ND+GovDeals+PA+-+Signed.pdf

NASPO ValuePoint

PARTICIPATING ADDENDUM

ON-LINE AUCTION SERVICES

Led by the State of New Mexico

Master Agreement #: 20-00000-21-00051AB Contractor: Liquidity Services Operations LLC dba GovDeals Participating Entity: STATE OF NORTH DAKOTA

This Participating Addendum is entered into by Contractor and Participating Entity (collectively, the “Parties”).

Scope and Participation:

Scope: This Participating Addendum includes the entire scope of the products and services available through the Master Agreement referenced above.

Tier 1: Online Auction System Any scope exclusions specified herein apply only to this Participating Addendum and shall not amend or affect other participating addendums or the Master Agreement itself.

Participation: This Participating Addendum covers participation of Participating Entity in the above-referenced Master Agreement between the State of New Mexico and Contractor for On-Line Auction Services. This Participating Addendum may be used by all state agencies, institutions of higher education, cities, counties, districts, and other political subdivisions of the state, and nonprofit organizations within the state if authorized herein and by law. Issues of interpretation and eligibility for participation are solely within the authority of the State Chief Procurement Official.

Term: This Participating Addendum shall become effective as of the date of the last signature below and shall terminate upon the expiration or termination of the Master Agreement, as amended, unless the Participating Addendum is terminated sooner in accordance with the terms set forth herein.

Primary Contacts: The following (or their named successors) are the primary contact individuals for this Participating Addendum:

CONTRACTOR:

Name: Rebecca Murphy, Director of Business Development, State Gov’t & Higher Ed

Address: 100 Capitol Commerce Blvd., Ste. 110, Montgomery, AL 36117

Telephone: 980-254-8908

Fax: 334-387-0519

Email: rmurphy@govdeals.com

ON-LINE AUCTION SERVICES

Led by the State of New Mexico

PARTICIPATING ENTITY:

Name: Abigail Dschaak

Address:

4th Floor Capitol Tower 600 E. Boulevard Ave. Dept. 012 Bismarck, ND 58505

Telephone: 701-328-4912

Email: aadschaak@nd.gov

Participating Entity Modifications and Additions to the Master Agreement This Participating Addendum and Exhibit A incorporates all terms and conditions of the Master Agreement as applied to the Participating Entity and Contractor, subject to the following limitations, modifications, and additions:

Any limitations, modifications, or additions specified herein apply only to the agreement and relationship between Participating Entity and Contractor and shall not amend or affect other participating addendums or the Master Agreement itself.

1. Cooperative Purchase: This Participating Addendum is a cooperative purchasing Contract established pursuant to North Dakota Century Code (N.D.C.C.) sections 54- 44.4-13. This Participating Addendum is made available to state entities, institutions under the jurisdiction of the State Board of Higher Education, other government entities (including counties, cities, townships, public primary and secondary educational entities, governmental boards and commissions), nonprofit entities established on behalf of public entities, tribal agencies, transportation providers under N.D.C.C. ch. 39-04.2, and the International Peace Garden. Participation in this open-ended Participating Addendum is not mandated; therefore, the estimated volume of this Participating Addendum is not known.

2. Definitions:

a) Control Environment - is the set of standards, processes, and structures that provide the basis for carrying out internal control across the organization.

b) Data - means any information provided to, or collected, generated, stored, or processed by the system. Data includes user identification information and metadata which may contain Data or from which the Participating Entity’s Data may be ascertainable.

c) Data Breach - means any access, destruction, loss, theft, use, modification or disclosure of Data by an unauthorized party or that is in violation of Participating Addendum terms and/or applicable state or federal law.

d) Data Classification - means the process of defining data into relevant categories so the information has the appropriate controls in place to protect confidentiality, integrity, and availability based on the type of information.

ON-LINE AUCTION SERVICES

Led by the State of New Mexico

e) Personally Identifiable Information (PII) - information about an individual maintained by an agency, including that 1) can be used to distinguish or trace an individual‘s identity, such as name, social security number, date and place of birth, mother‘s maiden name, or biometric records; or (2) is linked or linkable to an individual, such as medical, educational, financial, and employment information.

f) Recovery Point Objective (RPO) - means the point in time to which Data can be recovered and/or systems restored when service is restored after an interruption. The Recovery Point Objective is expressed as a length of time between the interruption and the most proximate backup of Data immediately preceding the interruption. The RPO is detailed in the SLA.

g) Recovery Time Objective (RTO) - means the period of time within which information technology services, systems, applications and functions must be recovered following an unplanned interruption. The RTO is detailed in the SLA.

h) Software as a Service (SaaS). The capability provided to the consumer is to use the provider’s applications running on a provider’s infrastructure. The applications are accessible from various client devices through interfaces such as a web browser (e.g., web-based email), or a program interface. The consumer does not manage or control the underlying infrastructure including network, servers, operating systems, storage, or even individual application capabilities, with the possible exception of limited user-specific application configuration settings. This definition is based on and consistent with National Institute of Standards and Technology (NIST) Special Publication 800-145.

i) Users – means contractors, subcontractors, outsourcing vendors, consultants and others who have a need to use the software for the benefit of Participating Entity.

3. Term: This Participating Addendum shall become effective as of the date of the last signature below and shall terminate upon the expiration or termination of the Master Agreement, as amended, unless the Participating Addendum is terminated sooner in accordance with the terms set forth herein.

This Participating Addendum shall be coterminous with the Master Agreement.

4. Prepayment: Participating Entity will not make any advance payments before performance by Contractor under this Participating Addendum.

5. Payment of Taxes by Participating Entity: Participating Entity is not responsible for and will not pay local, state, or federal taxes. Participating Entity sales tax exemption number is E 2001. Participating Entity will furnish certificates of exemption upon request by Contractor.

6. Termination (supplements Master Agreement):

a. Termination by Mutual Agreement: This Participating Addendum may be terminated by mutual consent of both Parties executed in writing.

b. Early Termination in the Public Interest: Participating Entity is entering this Participating Addendum for the purpose of carrying out the public policy of the State of North Dakota, as determined by its Governor, Legislative Assembly, Agencies and

ON-LINE AUCTION SERVICES

Led by the State of New Mexico

Courts. If this Participating Addendum ceases to further the public policy of the State of North Dakota, Participating Entity, in its sole discretion, by written notice to Contractor, may terminate this Participating Addendum in whole or in part.

c. Termination for Lack of Funding or Authority: Participating Entity by written notice to Contractor, may terminate the whole or any part of this Participating Addendum under any of the following conditions:

1. If funding from federal, state, or other sources is not obtained or continued at levels sufficient to allow for purchase of the services or goods in the indicated quantities or term.

2. If federal or state laws or rules are modified or interpreted in a way that the services or goods are no longer allowable or appropriate for purchase under this Participating Addendum or are no longer eligible for the funding proposed for payments authorized by this Participating Addendum.

3. If any license, permit, or certificate required by law or rule, or by the terms of this Participating Addendum, is for any reason denied, revoked, suspended, or not renewed.

Termination of this Participating Addendum under this subsection is without prejudice to any obligations or liabilities of either Party already accrued prior to termination.

d. Termination for Cause: Participating Entity may terminate this Participating Addendum effective upon delivery of written notice to Contractor, or any later date stated in the notice:

1. If Contractor fails to provide services or goods required by this Participating Addendum within the time specified or any extension agreed to in writing by Participating Entity; or

2. If Contractor fails to perform any of the other provisions of this Participating Addendum within, or so fails to pursue the work as to endanger performance of this Participating Addendum within in accordance with its terms.

The rights and remedies of Participating Entity provided in this subsection are not exclusive and are in addition to any other rights and remedies provided by law or under this Participating Addendum.

7. Suspension for Convenience: Participating Entity shall have the right at any time to order the services of contractor fully or partially staffed for participating state’s own convenience. Participating Entity shall provide contractor written notice of the reason for and duration of the suspension. The schedule shall be delayed on a day-four-day basis to the extent Participating Entity has issued a stop work order to Contractor and such stop work order is causing delays in completing services in accordance with the

ON-LINE AUCTION SERVICES

Led by the State of New Mexico schedule. Contractor shall have the right to submit claims in accordance with the terms of this Participating Addendum as a result of stop work orders issued under this section.

8. Injunctive Relief (supplements Section 13.2.3 of the Master Agreement): Contractor shall immediately report to Participating Entity any and all unauthorized disclosures or uses of Participating Entity’s Confidential Information or Proprietary Information of which Contractor or its staff is aware or has knowledge. Contractor acknowledges that any unauthorized publication or disclosure of Participating Entity’s Confidential Information or Proprietary Information to others may cause immediate and irreparable harm to Participating Entity. If Contractors should publish or disclose such Confidential Information or Proprietary Information without authorization, Participating Entity shall immediately be entitled to injunctive relief or any other remedies to which it is entitled under law or equity without requiring a cure period. Contractor shall indemnify, defend, and hold harmless Participating Entity from all damages costs liabilities and expenses (including without limitation reasonable attorneys’ fees) causing by or arising from Contractor’s unauthorized notification or disclosure of Participating Entity’s Confidential Information or Proprietary Information. As a condition to these indemnity obligations, Participating Entity will provide Contractor with prompt notice of any claim of which Participating Entity is aware and for which indemnification shall be sought under this Participating Addendum and shall cooperate in all reasonable respects with Contractor in connection with any such claim.

9. Right of Setoff Damages: Amounts due Participating Entity by Contractor, including liquidated or other damages, or claims for damages, may be deducted or set-off by Participating Entity from any money payable to Contractor pursuant to this Participating Addendum.

10. Right to Withhold Amounts Otherwise Due if the Contractor is in Breach (supplements Section 13.8.3.6 of Master Agreement): If Contractor fails to deliver Deliverables or to provide Service which satisfy Contractor’s obligations under this Participating Addendum, Participating Entity shall have the right to withhold any and all payments due under this Participating Addendum. Participating Entity may withhold any and all payments under this Participating Addendum to Contractor without penalty or work stoppage by Contractor until failure to perform is cured.

11. Rights to Remedies and Cumulation of Rights (supplements Section 13.8.4 of Master Agreement): No remedy conferred by any of the specific provisions of the Participating Addendum is intended to be exclusion of any other remedy and each and every remedy shall be cumulative and shall be in addition to every other remedy given under this Participating Addendum, now or in the future existing at law or in equity or by statute or otherwise.

ON-LINE AUCTION SERVICES

Led by the State of New Mexico

12. Non-Waiver: Either party’s failure to exercise any of its rights under this Participating Addendum, its delay in enforcing any right, or its waiver of its rights on any occasion, shall not constitute a waiver of such rights on any other occasion. No course of dealing by either party in exercising any of its rights shall constitute a waiver thereof. No waiver of any provision of this Participating Addendum shall be effective unless it is in writing and signed by the party against whom the waiver is sought to be enforced.

13. Indemnification (supplements Section XI of Master Agreement): Contractor agrees to defend, indemnify, and hold harmless the state of North Dakota, its agencies, officers and employees (Participating Entity), from and against claims based on the vicarious liability of the Participating Entity or its agents, but not against claims based on the Participating Entity’s contributory negligence, comparative and/or contributory negligence or fault, sole negligence, or intentional misconduct. This obligation to defend, indemnify, and hold harmless does not extend to professional liability claims arising from professional errors and omissions. The legal defense provided by Contractor to the Participating Entity under this provision must be free of any conflicts of interest, even if retention of separate legal counsel for the Participating Entity is necessary. Any attorney appointed to represent the Participating Entity must first qualify as and be appointed by the North Dakota Attorney General as a Special Assistant Attorney General as required under N.D.C.C. § 54-12-08. Contractor also agrees to reimburse the Participating Entity for all costs, expenses and attorneys' fees incurred if the Participating Entity prevails in an action against Contractor in establishing and litigating the indemnification coverage provided herein. This obligation shall continue after the termination of this agreement.

14. Intellectual Property Infringement Indemnification (supplements the Master Agreement):

a. Contractor, at its own expense, shall defend and indemnify Participating Entity against claims that products furnished under this Participating Addendum infringe a United States patent or copyright or misappropriate trade secrets protected under United States law.

Contractor’s obligation shall not extend to a claim based on any alleged infringement arising from any: (a) additions, changes, or modifications to the services by or on behalf of Participating Entity; (b) incorporation of the services or any component thereof into any other product or process; or (c) use of the services other than as permitted by this Participating Addendum.

b. As to any product which is subject to a claim of infringement or misappropriation, Contractor may (a) obtain the right of continued use of the product for Participating Entity or (b) replace or modify the product to avoid the claim. If neither alternative is available on commercially reasonable terms then, at the request of Contractor, any applicable Software license and its charges will end, Participating Entity will stop using the product, and will return the product to Contractor. Upon return of the product, Contractor will give Participating Entity a credit for the price paid to Contractor, less a reasonable offset for use and obsolescence.

ON-LINE AUCTION SERVICES

Led by the State of New Mexico

15. Insurance (supplements Section XII of Master Agreement): Contractor shall secure and keep in force during the term of this agreement and Contractor shall require all subcontractors, prior to commencement of an agreement between Contractor and the subcontractor, to secure and keep in force during the term of this agreement, from insurance companies, government self-insurance pools or government self-retention funds, authorized to do business in North Dakota, the following insurance coverages:

1. Commercial general liability, including premises or operations, contractual, and products or completed operations coverages (if applicable), with minimum liability limits of $2,000,000 per occurrence.

2. Workers compensation coverage meeting all statutory requirements. The policy shall provide coverage for all states of operation that apply to the performance of this Participating Addendum.

3. Employer’s liability or “stop gap” insurance of not less than $2,000,000 as an endorsement on the workers compensation or commercial general liability insurance.

The insurance coverages listed above must meet the following additional requirements:

1. Any deductible or self-insured retention amount or other similar obligation under the policies shall be the sole responsibility of the Contractor.

2. This insurance may be in policy or policies of insurance, primary and excess, including the so-called umbrella or catastrophe form and must be placed with insurers rated “A-” or better by A.M. Best Company, Inc., provided any excess policy follows form for coverage. Less than an “A-” rating must be approved by the Participating Entity. The policies shall be in form and terms approved by the Participating Entity.

3. The duty to defend, indemnify, and hold harmless the Participating Entity under this agreement shall not be limited by the insurance required in this agreement.

4. The state of North Dakota and its agencies, officers, and employees (Participating Entity) shall be endorsed on the commercial general liability policy on a primary and noncontributory basis, including any excess policies (to the extent applicable), as additional insured. The Participating Entity shall have all the benefits, rights and coverages of an additional insured under these policies that shall not be limited to the minimum limits of insurance required by this agreement or by the contractual indemnity obligations of the Contractor.

5. A “Waiver of Subrogation” waiving any right to recovery the insurance company may have against the Participating Entity.

6. The Contractor shall furnish a certificate of insurance to the undersigned Participating Entity representative prior to commencement of this agreement. All endorsements shall be provided as soon as practicable.

7. Failure to provide insurance as required in this agreement is a material breach of contract entitling the Participating Entity to terminate this agreement immediately.

8. Contractor shall provide at least 30-day notice of any cancellation or material change to the policies or endorsements. Contractor shall provide on an ongoing basis, current certificates of insurance during the term of the Participating

ON-LINE AUCTION SERVICES

Led by the State of New Mexico

Addendum. A renewal certificate will be provided 10 days prior to coverage expiration.

16. Cyber Liability and Security Insurance (supplements the Master Agreement): In the event Contractor will host data, or provide for the hosting of data through a third-party entity, Contractor shall secure and maintain Cyber Liability and Security Insurance or equivalent insurance product(s), with minimum liability limits of not less than $2,000,000 and first party limits of not less than $1,000,000, that will provide, without cost to the Contractor or Participating Entity, an immediate response in the event of a data breach, including meeting all notification obligations of Contractor and Participating Entity and in the event the data breach involves personal information as defined by N.D.C.C. § 51-30- 1(4), the insurance policy shall also make available free credit monitoring for any affected individual for a minimum period of one year. Contractor shall defend, indemnify, save and hold harmless, the Participating Entity, its officers, agents and employees from liability of any nature or kind, including costs and expenses, on account of a data breach arising from Contractor hosting, transmission, or control of data, any and all suits, claims, or damages of any character whatsoever, resulting from injuries or damages sustained by any person or persons or property by virtue of performance of this Participating Addendum.

17. Representations and Warranties: Contractor represents and warrants to participating entity that neither Contractor, in connection was performing the services in performance of this Participating Addendum, nor the completed product delivered by Contractor will infringe any patent, copyright, trademark, trade secret or other proprietary right of any person. Contractor further represents and warrants to Participating Entity that it will not use any trade secrets or confidential or proprietary information owned by any third party in performing the services related to this Participating Addendum or in delivery of the completed product unless Contractor has the authority to license, use or provide those trade secrets or confidential or proprietary information to Participating Entity. Contractor further represents and warrants to Participating Entity that neither Contractor nor any other company or individual performing services pursuant to this Participating Addendum is under any obligation to assign or give any work done under this Participating Addendum to any third party.

18. Works for Hire: Contractor acknowledges that all work(s) under this Participating Addendum is "work(s) for hire" within the meaning of the United States Copyright Act (Title 17 United States Code) and hereby assigns to Participating Entity all rights and interests Contractor may have in the work(s) it prepares under this Participating Addendum, including any right to derivative use of the work(s). All software and related materials developed by Contractor in performance of this Participating Addendum for Participating Entity shall be the sole property of Participating Entity, and Contractor hereby assigns and transfers all its right, title, and interest therein to Participating Entity.

Contractor shall execute all necessary documents to enable Participating Entity to protect Participating Entity’s intellectual property rights under this section.

ON-LINE AUCTION SERVICES

Led by the State of New Mexico

19. Confidentiality(supplements Section 13.2.1 of the Master Agreement): Contractor shall not use or disclose any information it receives from Participating Entity under this Participating Addendum that Participating Entity has previously identified as confidential or exempt from mandatory public disclosure except as necessary to carry out the purposes of this Participating Addendum or as authorized in advance by Participating Entity. Participating Entity shall not disclose any information it receives from Contractor that Contractor has previously identified as confidential and that Participating Entity determines in its sole discretion is protected from mandatory public disclosure under a specific exception to the North Dakota public records law, N.D.C.C. CH. 4404. The duty of Participating Entity and Contractor to maintain confidentiality of information under this section continues beyond the Term of this Participating Addendum.

20. Compliance with Public Records Laws: Contractor understands that except for disclosures prohibited in this Participating Addendum, Participating Entity must disclose to the public upon request any records it receives from Contractor. Contractor further understands that any records obtained or generated by Contractor under this Participating Addendum, except for records that are confidential under this Participating Addendum, may, under certain circumstances, be open to the public upon request under the North Dakota public records law. Contractor agrees to contact Participating Entity immediately upon receiving a request for information under the public records law and to comply with Participating Entity’s instructions on how to respond to the request.

21. Spoliation – Preservation of Evidence: Contractor shall promptly notify Participating Entity of all potential claims that arise or result from this Participating Addendum.

Contractor shall also take all reasonable steps to preserve all physical evidence and information that may be relevant to the circumstances surrounding a potential claim, while maintaining public safety, and grants to Participating Entity the opportunity to review and inspect such evidence, including the scene of an accident.

22. Severability: If any term of this Participating Addendum is declared to be illegal or unenforceable by a court having competent jurisdiction, the validity of the remaining terms is unaffected and, if possible, the rights and obligations of the Parties are to be construed and enforced as if this Participating Addendum did not contain that term.

23. Applicable Law and Venue(supplements Section 13.12 of Master Agreement): This Participating Addendum is governed by and construed in accordance with the laws of the State of North Dakota. Any action to enforce this Participating Addendum must be adjudicated exclusively in the state District Court of Burleigh County, North Dakota. Each Party consents to the exclusive jurisdiction of such court and waives any claim of lack of jurisdiction or forum non conveniens.

ON-LINE AUCTION SERVICES

Led by the State of New Mexico

24. Alternative Dispute Resolution – Jury Trial: By entering this Participating Addendum, Participating Entity does not agree to binding arbitration, mediation, or any other form of mandatory Alternative Dispute Resolution. The Parties may enforce the rights and remedies in judicial proceedings. Participating Entity does not waive any right to a jury trial.

25. Attorney Fees and Costs: In the event a lawsuit is instituted by Participating Entity to obtain performance due under this Participating Addendum, and Participating Entity is the prevailing Party, Contractor shall, except when prohibited by N.D.C.C. § 28 26 04, pay Participating Entity’s reasonable attorney fees and costs in connection with the lawsuit.

26. Nondiscrimination and Compliance with Laws: Contractor agrees to comply with all applicable federal and state laws, rules, and policies, including those relating to nondiscrimination, accessibility and civil rights. (See N.D.C.C. Title 34 – Labor and Employment, specifically N.D.C.C. ch. 34-06.1 Equal Pay for Men and Women.)

Contractor agrees to timely file all required reports, make required payroll deductions, and timely pay all taxes and premiums owed, including sales and use taxes, unemployment compensation and workers' compensation premiums.

Contractor shall have and keep current all licenses and permits required by law during the Term of this Participating Addendum all licenses and permits required by law.

Contractor’s failure to comply with this section may be deemed a material breach by Contractor entitling Participating Entity to terminate in accordance with the Termination for Cause section of this Participating Addendum.

27. Work Product: All work product, equipment or materials created for Participating Entity or purchased by Participating Entity under this Participating Addendum belong to Participating Entity and must be immediately delivered to Participating Entity at Participating Entity's request upon termination of this Participating Addendum.

28. Technology Standards: Contractor shall comply with applicable Participating Entity enterprise architecture technology standards. These standards can be found on Participating Entity’s website at https://www.ndit.nd.gov/standards. If Contractor is unable to comply with any applicable standard, Contractor shall request a waiver from that requirement by submitting a Request for Exemption from Information Technology Standards or Statutory Policies (SFN 51687) form in coordination with Participating Entity’s procurement officer for the Participating Entity’s review and approval or disapproval.

29. Personnel: Contractor agrees upon request by Participating Entity, Contractor shall replace any Contractor personnel that Participating Entity determines, in its sole discretion, to be unable to perform the responsibilities of this Participating Addendum

ON-LINE AUCTION SERVICES

Led by the State of New Mexico acceptably, e.g., inappropriate or unprofessional personal conduct, professional inabilities, etc

30. Software License: All ownership rights to Contractor’s software provided to Participating Entity under this Participating Addendum (intellectual property owned by Contractor prior to performance of this Participating Addendum) shall remain with Contractor. If Contractor’s incorporates any of Contractor’s Software in any work product provided to Participating Entity, Contractor agrees to provide written notice to Participating Entity of its incorporation in the work product and to convey to Participating Entity a non-exclusive, perpetual, cost-free license, and patent and copyright indemnity, for Participating Entity to use that software for its intended purpose.

31. License Grant and Scope of Use: Contractor grants to Participating Entity a nonexclusive, perpetual, royalty-free, irrevocable, unlimited license to publish, translate, reproduce, modify, deliver, perform, display, and dispose of the Intellectual Property, and its derivatives, used or delivered under this Participating Addendum, but not created under it ("Pre-existing Intellectual Property"). The license shall be subject to any third-party rights in the Pre-existing Intellectual Property. Contractor shall obtain, at its own expense, on behalf of the Participating Entity, written consent of the owner for the licensed Pre-existing Intellectual Property.

32. SaaS and Data Security: Remote access to Data from outside the continental United States, including remote access to Data by authorized SaaS support staff in identified support centers, is prohibited unless approved in advance by Chief Information Officer of the State of North Dakota.

33. Data Processing and Location:

a) Contractor shall transmit, process, and store Participating Entity Data within the continental United States.

b) Contractor shall notify Participating Entity at least 90 days prior to any relocation of Participating Entity’s Data to a different hosting facility. Participating Entity reserves the right to terminate the Participating Addendum without penalty if Participating Entity does not approve of the new hosting facility.

34. Independent Entity: Contractor is an independent entity under this Participating Addendum and is not a Participating Entity employee for any purpose, including the application of the Social Security Act, the Fair Labor Standards Act, the Federal Insurance Contribution Act, the North Dakota Unemployment Compensation Law and the North Dakota Workforce Safety and Insurance Act. Contractor retains sole and absolute discretion in the manner and means of carrying out Contractor activities and responsibilities under this Participating Addendum, except to the extent specified in this Participating Addendum.

35. Unanticipated Amendments: If additional work is required within the scope of this Participating Addendum due to a legitimate unforeseen circumstance, Participating

ON-LINE AUCTION SERVICES

Led by the State of New Mexico

Entity shall provide Contractor a written description of the additional work and request Contractor to submit a proposal for accomplishing the scope of work. Contractor will not commence additional work until all Parties agree in writing.

36. State Audit: Pursuant to N.D.C.C. § 54-10-19, all records, regardless of physical form, and the accounting practices and procedures of Contractor relevant to this Participating Addendum are subject to examination by the North Dakota State Auditor, the Auditor’s designee, or Federal auditors, if required. Contractor shall maintain these records for at least three (3) years following completion of this Participating Addendum and be able to provide them upon reasonable notice. Participating Entity, State Auditor, or Auditor’s designee shall provide reasonable notice to Contractor prior to conducting examination.

Orders: Any order placed by Participating Entity or a Purchasing Entity for a product or service offered through this Participating Addendum shall be deemed to be a sale under, and subject to the pricing and other terms and conditions of, the Master Agreement unless the parties to the order agree in writing that another contract or agreement applies to the order.

IN WITNESS WHEREOF, the Parties have executed this Participating Addendum.

PARTICIPATING ENTITY CONTRACTOR

Signature: Signature:

Name: Name: Michael Price

Title: Title: Vice President, Revenue

Date: Date: 1/4/2023

For questions regarding NASPO ValuePoint Participating Addendums, please contact the Cooperative Contract Coordinator team at info@naspovaluepoint.org.

Fully executed NASPO ValuePoint Participating Addendums must be submitted via email in PDF format to pa@naspovaluepoint.org.

Abigail Dschaak

Procurement Officer

1/5/2023

ON-LINE AUCTION SERVICES

Led by the State of New Mexico

EXHIBIT A – Software as a Service (SaaS) Service Level Agreement (SLA)

Contractor represents and warrants that the services will be performed in a professional manner consistent with industry standards reasonably applicable to such services.

1. SAAS AVAILABILITY:

The SaaS shall be available twenty-four (24) hours per day, 365 days per year (excluding agreed-upon scheduled maintenance downtime, maintaining an uptime of at least 99.5%.

2. SUPPORT AND ERROR RESOLUTION:

Contractor will respond to Participating Entity requests for support services regarding the licensed software in accordance with the procedures identified below. In each case, Participating Entity may describe and submit the problem by telephone, email or online helpdesk/service desk tool.

Incident Severity Response

Time Resolution

Time Escalation Procedure

High Impact – System unusable

1 hour

Final Resolution within:

4 hours

Contact: LSI IT Service Desk Function 877-287-2587 IT.support@liquidityservices.com

Severity Level 1 This is an incident that has a critical business impact on production with no known workaround to keep the business operational. This includes complete loss of critical applications or systems to multiple internal users across several business locations or customer service delivery to numerous buyers, sellers and partners. It is recommended that the Participating Entity also notify its GovDeals Account Manager of the issue.

Medium Impact – System useable with severely restricted functionality or performance

4 hours

Final Resolution within:

8 hours (1 business day)

Contact: LSI IT Service Desk Function 877-287-2587 IT.support@liquidityservices.com

Severity Level 2 This is an incident that affects a vital component of the business application or system. Application or system is available and usable but limited or degraded. The operation can continue but in a restricted manner. A workaround may be possible but very inconvenient. This also includes loss of critical business application or system at a crucial business location. It is recommended that the Participating Entity also

ON-LINE AUCTION SERVICES

Led by the State of New Mexico notify its GovDeals Account Manager of the issue.

Low Impact – system useable with minor impact on functionality or performance

8 hours

Final Resolution within:

40 hours (1 business week)

Contact: LSI IT Service Desk Function 877-287-2587 IT.support@liquidityservices.com

Severity Level 3 This is an incident with a minor non-critical loss of application or system functionality/performance.

Impaired operation with a known workaround.

This included issues that can wait for an after-hour fix to prevent production downtime. If it is determined that it may escalate to a Sev2, an ECR or scheduled code release process will be deployed to resolve the issue. It is recommended that the Participating Entity also notify its GovDeals Account Manager of the issue.

3. RESPONSE TIME SERVICE LEVEL:

Contractor represents and warrants that ninety-five percent (95%) of all transactions shall process at a mutually agreed upon time threshold. Participating Entity retains right to use a Third-Party service to validate the performance of Contractor’s response times.

4. SCHEDULED MAINTENANCE AND NOTIFICATIONS

1) Standard Maintenance Windows

All maintenance activities are scheduled to occur during low traffic periods (outside of core US trading hours), typically on the weekends.

2) Notification of Scheduled Maintenance Downtime Contractor shall provide 48 hours advance notice to the Participating Entity of any scheduled maintenance downtime which will cause the total scheduled maintenance downtime to occur outside of the Standard Maintenance Windows outlined above. In cases of emergency, Contractor shall use its best efforts to notify Participating Entity of a planned downtime as soon as practicable.

5. RPO AND RTO

Contractor commits to a RPO of four (4) hours and RTO of twelve (12) hours. In other words, when unscheduled downtime occurs, Contractor will resume service with data matching what the system contained at some point within the four hours preceding the unscheduled downtime. Additionally, the system cannot be down for longer than twelve (12) hours during unscheduled downtime.

ON-LINE AUCTION SERVICES

Led by the State of New Mexico

6. SAAS AND DATA SECURITY:

a) Contractor shall:

1) Certify the sufficiency of its security standards, tools, technologies and procedures in providing SaaS under this Participating Addendum;

2) Compliance with the following:

i. Undergo an annual Statement on Standards for Attestation Engagements

(SSAE) Service Organization Control (SOC) 2 Type II audit or equivalent such as ISO 27001 for the Contractor R’s application and database hosting provider.

Audit results and Contractor’s plan to correct any negative findings shall be provided to the Participating Entity within seven (7) calendar days upon Contractor’s receipt of such;

ii. Provide Participating Entity with a detailed description of the audited Control Environment. If Participating Entity determines the Control Environment is not satisfactory, the Participating Entity may request Contractor to correct any deficiencies;

3) Compliance with applicable industry standards, law, regulations and guidelines.

If Contractor cannot comply with the above. Contractor shall participate in the Participating Entity Third-Party Risk Management (TPRM) assessment. Upon completion of the TPRM assessment Contractor will be given the opportunity to remediate the identified risks. If Contractor will not or cannot remediate the identified risk(s) the Participating Entity may terminate the Participating Addendum.

b) Contractor shall implement and maintain all appropriate administrative, physical, technical and procedural safeguards in accordance with section a) above at all times during the term of this Participating Addendum to secure such Data from Data Breach, protect the Data and the SaaS from hacks, introduction of viruses, disabling devices, malware and other forms of malicious or inadvertent acts that can disrupt the Participating Entity’s access to its Data.

c) Contractor shall allow the Participating Entity reasonable access to SaaS security logs, latency statistics, and other related SaaS security data that affect this Participating Addendum and the Participating Entity’s Data, at no cost to the Participating Entity.

d) Contractor assumes responsibility for the security and confidentiality of the Data under its control.

e) No Data shall be copied, modified, destroyed or deleted by Contractor other than for normal operation or maintenance of SaaS during the Participating Addendum period without prior written notice to and written approval by the Participating Entity.

7. SAAS AND ARCHITECURE:

When requested by the Participating Entity and provided a mutually agreed period of time allowed for delivery, Contractor shall provide Participating Entity with detailed architectural diagrams on an annual basis. The architectural diagrams are to include but not limited to servers, hardware, software solution (operating system, application servers, databases, identity repository), network architecture (dataflow diagram, firewalls, proxies, IDS/IPS).

Contractor shall allow the Participating Entity reasonable access to review the architecture.

ON-LINE AUCTION SERVICES

Led by the State of New Mexico

8. ENCRYPTION:

Information designated as sensitive, including PII, shall be encrypted end-to-end while it is in transit and at rest. Data must be encrypted using the most current Federal Information Processing Standard (FIPS) 140-2 validated cryptographic modules and the current Advanced Encryption Standard algorithm.

9. RIGHTS TO DATA:

The Parties agree that as between them, all rights, including all intellectual property rights, in and to Data shall remain the exclusive property of the Participating Entity, and Contractor has a limited, non-exclusive license to access and use the Data as provided to Contractor solely for performing its obligations under the Participating Addendum. Nothing herein shall be construed to confer any license or right to the Data, including user tracking and exception Data within the system, by implication, estoppel or otherwise, under copyright or other intellectual property rights, to any third party. Unauthorized use of Data by Contractor or third parties is prohibited. For the purposes of this requirement, the phrase “unauthorized use” means the data mining or processing of data, stored or transmitted by the service, for unrelated commercial purposes, advertising or advertising-related purposes, or for any other purpose other than security or service delivery analysis that is not explicitly authorized.

Participating Entity shall have the ability to export data in partial or in entirety at its discretion without interference from the Contractor. This includes the ability for the Participating Entity to export data to other service providers.

10. DATA BACKUP:

a) Contractor shall provide geographical disparate storage on a daily basis of all backup disks, data, or materials of any type whatsoever produced in whole or in part in connection with or related to the performance by Contractor of its obligations under this Participating Addendum (including without limitations discs, tapes, other storage media, work papers and partial drafts of documentation code).

b) Contractor shall use appropriate and reliable storage media. Contractor shall regularly backup Participating Entity Data and retain such backup copies for a minimum of twelve

(12) months or timeframe required by applicable laws and regulations.

11. DATA RETENTION AND DISPOSAL:

a) Contractor shall retain Participating Entity’s Data until the Participating Entity deletes the

Participating Entity’s Data or for the time period mutually agreed to by the Parties in this Participating Addendum.

b) At the Participating Entity’s election, Contractor will either securely destroy or transmit to Participating Entity repository any backup copies of Participating Entity Data.

c) Contractor shall supply Participating Entity a certificate indicating the records disposed of, the date disposed of, and the method of disposition used.

d) Contractor shall retain logs associated with Participating Entity activity for a minimum of twelve (12) months or timeframe required by applicable laws and regulations.

ON-LINE AUCTION SERVICES

Led by the State of New Mexico

12. TRANSITION ASSISTANCE:

a) For ninety (90) days prior to the expiration date of this Participating Addendum, or upon notice of termination of this Participating Addendum, Contractor shall assist the Participating Entity in extracting and/or transitioning all Data securely in the format determined by the Participating Entity (“Transition Period”). Contractor agrees that there shall be no additional fees to execute the transition of Data during Transition Period.

b) Contractor and Participating Entity shall develop a Transition Plan (“Transition Plan”) detailing each party’s respective tasks in connection with the orderly transition and migration of the licensed software, Data, any generated contextual data such as reference tables, metadata, structured and unstructured data not necessarily provided by Participating Entity, and hosting services.

c) During the Transition Period, SaaS and Data access shall continue to be made available to the Participating Entity without alteration.

d) Contractor shall permanently destroy or render inaccessible any portion of the Data in Contractor and/or subcontractor’s possession or control following the expiration of all obligations in this section. Within thirty (30) days, Contractor shall issue a written statement to the Participating Entity confirming the destruction or inaccessibility of the Participating Entity’s Data.

13. DATA BREACH:

Upon discovery or reasonable belief of any Data Breach, Contractor shall provide notice and remedy in compliance with Contractor’s Incident Response Plan (IRP), a copy of which will be provided to the Participating Entity.

14. DISASTER RECOVERY/BUSINESS CONTINUITY:

a) In the event of disaster or catastrophic failure that results in significant Data loss or extended loss of access to Data, Contractor shall provide notice, by phone and through electronic mail, to the individuals identified in the SAAS NOTICE section of this exhibit.

Contractor shall provide such notification within twenty-four (24) hours after Contractor reasonably believes there has been such a disaster or catastrophic failure. In the notification, Contractor shall inform the Participating Entity of:

1) The scale and quantity of the Data loss;

2) What Contractor has done or will do to recover the Data and mitigate any deleterious effect of the Data loss; and

3) What corrective action Contractor has taken or will take to prevent future Data loss.

4) If Contractor fails to respond immediately and remedy the failure, the

Participating Entity may exercise its options for assessing damages or other remedies under this Participating Addendum.

b) Contractor shall restore continuity of SaaS, restore Data in accordance with the RPO and RTO as set forth in the SLA, restore accessibility of Data, and repair SaaS as needed to meet the performance requirements stated in the SLA. Failure to do so may result in the Participating Entity exercising its options for assessing damages or other remedies under this Participating Addendum.

ON-LINE AUCTION SERVICES

Led by the State of New Mexico

c) Contractor shall conduct an investigation of the disaster or catastrophic failure and shall share the report of the investigation with the Participating Entity. The Participating Entity and/or its authorized agents shall have the right to lead (if required by law) or participate in the investigation. Contractor shall cooperate fully with the Participating Entity, its agents and law enforcement.

15. AUDIT AND EXAMINATION:

a) Upon advance written request, Contractor agrees that the Participating Entity or its designated representative shall have access to Contractor SaaS operational documentation, records and databases, including online inspections, that relate to the SaaS purchased by the Participating Entity.

b) The online inspection shall allow the Participating Entity, its authorized agents, or a mutually acceptable third party to test that controls are in place and working as intended.

Tests may include, but not be limited to, the following:

1) Operating system/network vulnerability scans,

2) Web application vulnerability scans,

3) Database application vulnerability scans, and

4) Any other scans to be performed by the Participating Entity or representatives on behalf of the Participating Entity.

c) After any significant Data loss or Data Breach or as a result of any disaster or catastrophic failure, Contractor will at its expense have an independent, industry-recognized, Participating Entity -approved third party perform an information security audit. The audit results shall be shared with the Participating Entity within seven (7) days of Contractor’s receipt of such results. Upon Contractor receiving the results of the audit, Contractor will provide the Participating Entity with written evidence of planned remediation within thirty (30) days and promptly modify its security measures in order to meet its obligations under this Participating Addendum.

16. DISCOVERY:

If Contractor receives a request which may reasonably be interpreted as requiring access to the Data of the Participating Entity or the Participating Entity’s use of the SaaS, Contractor shall provide notice, by phone and through electronic mail, to the individuals identified in the SAAS NOTICE section of this Exhibit, unless prohibited by law from providing such notification. Contractor shall provide such notification within forty-eight (48) hours after Contractor receives the request.