Page 1 of 5 June 2024

PURCHASE ORDER TERMS AND CONDITIONS

GENERAL TERMS

1. General. The following terms and conditions (“Terms and Conditions”), together with such terms as are set forth on the face of the Purchase Order Form (the “Form”) and such other plans, specifications, attachments, or other documents identified on the Form shall constitute the entire agreement (the “Purchase Order”) between the University of Massachusetts (the “University”, which definition shall include each of the University campuses and the President’s Office) and the Contractor, as defined on the Form (individually a “Party” and collectively, the “Parties”) for the University’s purchase of the equipment, goods, or other devices (collectively, “Products”) or services (“Services”) noted on the Form. This Purchase Order is composed of the following documents, listed in the order of precedence: (1) this Purchase Order Terms and Conditions; (2) any Purchase Order Amendments or additional or revised terms as noted on the Form; and (3) any attached quotes or Statements of Work.

The Purchase Order Terms and Conditions, and any agreed upon changes thereto noted on the Form or included in any Purchase Order Amendments, shall take precedence over any additional or conflicting terms and conditions as may be included in any other document attached to this Purchase Order. The University shall not be bound by any additional, different, or conflicting terms, whether printed or otherwise, in any other communications between the parties (including, but not limited to, on Contractor’s quotes, proposals, forms, invoices, emails or letters). The terms of any quotes or proposal referred to in this Purchase Order or any Statement of Work are included and made a part of the Purchase Order only to the extent they specify the Products or Services ordered, the price therefor, and the delivery thereof, and then only to the extent that such terms are consistent with the terms and conditions of this Purchase Order.

2. Acceptance by Contractor. This Purchase Order shall be deemed accepted by the Contractor upon receipt by the University of any writing, including a writing transmitted by facsimile, email, or other electronic transmission, indicating Contractor’s acceptance, or upon the following: (i) Contractor’s shipment of the Products ordered or any portion thereof; or (ii) the performance of any Services by Contractor, in whole or in part, hereunder.

3. Payment. Unless otherwise specified on the Form, the University’s payment terms are net forty-five (45) days from the later of: (i) delivery and University’s acceptance of Contractor’s Products or Services; or

(ii) University’s receipt of Contractor’s invoice. Any discounts and early payment incentives provided by Contractor shall be stated on the Form.

The University shall not be responsible for any shipping, handling, fuel surcharges, insurance, or other fees unless expressly noted on the Form. Late penalty interest is assessable at rates established by the Commonwealth after 45 days in accordance with Mass. Gen. Laws c.

29 § 29C and with 815 C.M.R. 4.00. Contractor’s invoices must be submitted to the BILL TO ADDRESS referenced on the Form and must include the University’s Purchase Order number and the name of the University department listed in the shipping address.

4. Termination.

a. The University may terminate this Purchase Order in whole or in part for convenience upon thirty (30) days prior notice. Upon notice of such termination, Contractor shall immediately stop all work including shipment of the Products, and cause its suppliers and/or subcontractors to cease their work related to this Purchase Order. Contractor shall be paid for Products or Services satisfactorily provided or performed. In no event shall Contractor be paid for costs incurred or Services performed after receipt of a notice of termination, or for costs incurred by Contractors or subcontractors which reasonably could have been avoided.

b. The University may terminate this Purchase Order in whole or in part for cause upon seven (7) days prior written notice if Contractor breaches any term or condition of this Purchase Order. The University may also terminate this Purchase Order without liability to University in the event Contractor becomes insolvent or makes an assignment for the benefit of creditors, or a petition is filed to declare Contractor bankrupt. If University terminates the Purchase Order for cause, University shall have no payment obligations to Contractor. If a court of competent jurisdiction makes a determination that the University improperly terminated the Purchase Order for cause, then the termination shall be deemed to have been for the University’s convenience under Section 4(a) and Contractor shall have all rights under that Section, but no other rights or claims for damages.

5. Indemnification. The Contractor shall defend, indemnify, and hold harmless the Commonwealth, the University, its Trustees, Officers, servants, and employees from and against any and all third party claims, liability, losses, damages, costs, or expenses (including reasonable attorneys’ and experts’ fees) arising out of or resulting from the Contractor’s performance under this Purchase Order, including Products delivered or Services performed by the Contractor, its agents, servants, employees, or subcontractors under this Purchase Order which arise out of or in connection with the Contractor’s performance of this Purchase Order, including but not limited to the negligence, reckless or intentional conduct of the Contractor, its agents, officers, employees or subcontractors, and including any and all claims and all claims, liabilities, and costs, in connection with a security or data breach, or unauthorized disclosure of data (each, an “Event”). The foregoing express obligation of indemnification shall not be construed to negate or abridge any other obligation of indemnification running to the Commonwealth and/or the University that would otherwise exist.

The University shall give the Contractor prompt and timely notice of any claims, threatened or made, or any lawsuit instituted against it which could result in a claim for indemnification hereunder. The extent of this Contract of indemnification shall not be limited by any obligation or any term or condition of any insurance policy. The obligations set forth above shall survive the expiration or termination of this Purchase Order.

6. Insurance. Unless otherwise noted on the Form, the Contractor shall purchase and maintain at its sole cost and expense throughout the term of the Purchase Order adequate insurance coverage necessary for the delivery of Products and performance of Services under the Purchase Order. Such insurance must include but not be limited to the types and amounts of coverage, as indicated on the Form and as further detailed on the Insurance Addendum found at PO Insurance Requirements and incorporated herein by reference.

Contractor shall provide evidence of such insurance prior to the delivery of any Products or the provision of any Services to the University.

7. Assignment. The Contractor shall not assign or in any way transfer any interest in this Purchase Order without the prior written consent of the University, nor shall the Contractor subcontract any Service without the prior written approval of the University. Any purported assignment of rights or delegation of performance in violation of this Section is VOID. This Purchase Order shall be binding on Contractor’s successors and permitted assigns.

8. Severability. If any provision of this Purchase Order is declared or found to found to be illegal, unenforceable, or void, then both parties shall be relieved of all obligations under that provision. The remainder of the Purchase Order shall be enforced to the fullest extent permitted by law.

https://www.dropbox.com/s/wbvn6wpmamjtgym/Revised%20PO%20Insurance%20RequirementsPDF.pdf?dl=0

Page 2 of 5 June 2024

9. Waiver/Amendment. All conditions, covenants, duties and obligations contained in this Purchase Order can be waived only by written agreement. Forbearance or indulgence in any form or manner by a party shall not be construed as a waiver, or in any way limit the legal or equitable remedies available to that party. This Purchase Order may be amended only by written agreement of the parties, executed by the parties’ authorized representatives and in compliance with all other regulations and requirements of law.

10. Entire Agreement. The Parties understand and agree that this Purchase Order and its attachments or amendments (if any) constitute the entire understanding between the parties and supersede all other verbal and written agreements and negotiations by the parties relating to the University’s purchase of the Products or Services set forth herein.

11. Choice of Law/Forum. This Purchase Order is entered into in the Commonwealth of Massachusetts, and the laws of the Commonwealth, without giving effect to its conflicts of law principles, govern all matters arising out of or relating to this Purchase Order and all of the transactions it contemplates, including, without limitation, its validity, interpretation, construction, performance and enforcement.

The Parties agree to bring any action arising out of or relating to this Purchase Order or the relationship between the Parties in the state courts of the Commonwealth of Massachusetts which shall have exclusive jurisdiction thereof. The Contractor expressly consents and agrees to the jurisdiction of the state courts of the Commonwealth of Massachusetts as the sole forum for any action arising out of or relating to this Purchase Order or the relationship between the parties, waiving any claim or defense that such forum is not convenient or proper.

12. Force Majeure. Neither Party shall be liable to the other or be deemed to be in breach of this Purchase Order for any failure or delay in rendering performance arising out of causes beyond its reasonable control and without its fault or negligence. Such causes may include, but are not limited to: acts of nature or of a public enemy, fire, war, terrorism, flood, earthquake, civil disturbance, strikes, epidemics, quarantine restrictions, governmental orders, freight embargos, or unusually severe weather.

13. Taxes. The University is exempt from federal excise, state, and local taxes; therefore, sales to the University are exempt from Massachusetts sales and use taxes. If the University should become subject to any such taxes during the term of this Purchase Order, the University shall reimburse the Contractor for any such taxes paid by the Contractor. Any other taxes imposed on the Contractor on account of this Purchase Order shall be borne solely by the Contractor.

14. Delivery/Risk of Loss. Contractor shall make all deliveries of Products in accordance with the quantities and schedule set forth on the Form. Contractor shall address all deliveries to the DELIVERY ADDRESS noted on the Form and shall include the Attention to, Room/Floor/Suite, and University’s Purchase Order number on all packages and correspondence. All deliveries shall include a packing slip. Contractor shall pack, mark and ship all Products in accordance with the shipping instructions contained on the Form and any requirements of common freight carriers. Unless the Form expressly states otherwise, all Products shall be shipped DAP destination to the DELIVERY ADDRESS designated on the Form. Contractor assumes all risk of loss of or damage to all Products ordered and all work in progress, materials, and other items related to the Purchase Order until the same have been received and accepted by the University at the destination specified on the Form.

15. Product Documentation. All Products delivered by Contractor will include all documentation, such as operator/user manuals, training materials, guides, and other materials relating to their use and operation, whether in writing, electronic means or otherwise (collectively “Documentation”). University may keep, modify, copy, and internally distribute the Documentation for University’s internal business purposes.

16. Inspection. The University shall have a reasonable time (in no event less than 30 days) after receipt to inspect the Products delivered or Services rendered by Contractor. The University at its option may reject or revoke acceptance of all or any portion of such Products or Services which in the University’s opinion do not conform to the terms of this Purchase Order. Any rejected Products will be returned to Contractor at Contractor’s expense. Any rejected Services shall be re-performed by the Contractor or, if the University so elects, in its sole discretion, by a third party selected by the University; and in either event, the cost of re-procuring any rejected Services shall be borne solely by Contractor. The University’s failure to inspect any Products or Services shall not relieve Contractor of any of its obligations hereunder.

17. Dates of Performance. Delivery and completion dates shall be stated on the Form. If such dates are not stated, Contractor shall deliver the Products or provide Services as if time is of the essence.

Contractor shall inform the University immediately of any anticipated delay in the delivery or completion date; however, such notice shall not constitute a change to the delivery or completion terms of the Purchase Order unless expressly agreed to by University in writing. If any Products are not delivered or if any element of the Services is not completed by Contractor by the date specified and to the satisfaction of the University, the University may, in its option, either approve a revised date for performance or the University may cancel this Purchase Order and obtain such Products or Services elsewhere; and in either event Contractor shall be liable for any resulting loss or expense incurred by the University. Contractor’s sole remedy for a delay caused by the University shall be an extension of the time for Contractor’s performance equal to the duration of University’s delay.

18. Warranty.

a. Contractor warrants that all material, work product, and Products delivered under the Purchase Order (a) shall strictly conform to all specifications, drawings, samples, or other descriptions furnished to and approved by University, (b) shall be fit and serviceable for the purpose intended, as agreed to by the University and Contractor, (c) shall be of good quality and free from defects in materials and workmanship, (d) shall be new and not refurbished or reconditioned, unless expressly agreed in writing by the University, and (e) shall not infringe any patent, copyright, mark work, trademark, trade secret or other intellectual property, proprietary or contractual right of any third party. In addition, Contractor warrants that the University shall have good and marketable title to all Products (including all components thereof) purchased by the University pursuant to the Purchase Order, free of all liens and encumbrances and that no licenses are required for the University to use such Products. For all Services rendered pursuant to the Purchase Order, Contractor warrants that all Services shall be provided in a professional and workmanlike manner, with a degree of skill and care consistent with current, good and sound professional procedures. Neither receipt of material, work product, deliverables, or Products, nor payment therefore by University shall constitute a waiver of this provision. If a breach of this warranty occurs, the University may, in its sole discretion, and without waiving any other rights, return for credit or refund, or require prompt correction or replacement of the nonconforming Products or the re-performance of the Services.

b. Intellectual Property Indemnity. Contractor shall indemnify, defend and hold the University harmless against all claims, liabilities, losses, damages, costs and expenses (including legal fees) resulting from or arising in connection with any actual or claimed infringement of any patent, copyright, mask work, trademark, trade secret or other intellectual property, proprietary or contractual right of any third party, with respect to the Products or Services provided under the Purchase Order.

c. Price. Contractor warrants that the prices and terms for Products or Services furnished hereunder are not less favorable than

Page 3 of 5 June 2024 those prices and terms currently extended to any other customer for the same or similar Products or Services. If Contractor reduces its prices and/or improves its terms to others for such Products or Services during the terms of this Purchase Order, Contractor shall reduce the prices and/or improve the terms herein accordingly.

d. Accessibility Compliance. Contractor warrants and represents that its Products and Services provided under this Purchase Order are currently in compliance with, and during the Term of this Purchase Order shall remain in compliance with, all applicable Massachusetts and Federal laws and regulations, including, but not limited to 28 CFR Part 35 and Web Content Accessibility Guidelines

2.1 (WCAG), conformance levels A and AA. Contractor agrees to promptly respond to, resolve, and remediate any request by the University regarding the noncompliance of its Products or Services in a timely manner at no cost to the University. Contractor further agrees to indemnify, defend, and hold harmless the University from and against any and all claims arising out of its failure to comply with the requirements of this section. Failure to comply with the requirements of this Section constitutes a material breach of this Contract and may be grounds for Termination for Cause, as set forth herein.

19. Compliance with Laws. Contractor represents and warrants that, in the production and sale of Products to be delivered pursuant hereto, and in the provision of Services hereunder, Contractor has complied with all applicable federal, state, and municipal laws and regulations, including, without limitation: (a) all such laws and regulations pertaining to health, safety and environmental standards,

(b) all such laws and regulations pertaining to design, manufacture, testing, labeling, and transportation of such Products, and (c) all such laws and regulations pertaining to affirmative action, nondiscrimination, and equal opportunity. Contractor acknowledges that it may be subject to the Massachusetts Conflict of Interest statute, Mass. Gen. Laws c.

268A, and to that extent, Contractor agrees to comply with all requirements of the statute in the performance of this Contract.

20. Material Safety Data Sheets. Contractor shall submit a Material Safety Data Sheet (MSDS) for each toxic or hazardous substance or mixture containing such substance (pursuant to Mass.

Gen. Laws c. 111F s. 8, 9, and 10 and the regulations contained in 441 CMR s. 21.06) that is shipped against this Purchase Order.

21. Use of the University of Massachusetts Name. The Contractor shall not use nor permit its subcontractors to use the name of “University of Massachusetts,” or any variation, adaptation, or abbreviation thereof, or the name of any of its trustees, officers, faculty, students, employees, or agents, or any trademark owned by the University without the prior written consent of University. The Contractor shall not, without the prior written consent of the University list the University as a client in any written materials or disclose the name of the University as a client reference to prospective customers or for any other reason. Contractor shall not speak publicly on behalf of the University, make any written, oral or electronic communications or issue any press releases referring to this Purchase Order or any aspect of its relationship with the University unless specifically permitted in writing by the University to do so on each occasion.

22. Independent Contractor. The Contractor is an independent contractor and not an employee or agent of the University. No act or direction of the University shall be deemed to create an employer/employee or joint employer relationship. The University shall not be obligated under any contract, subcontract, or other commitment made by the Contractor.

23. Certification. Contractor certifies under the pains and penalties of perjury that Contractor has filed all state tax returns, paid all taxes and complied with all applicable laws relating to taxes; and has complied with all applicable laws relating to contributions and payment in lieu of contributions to the Employment Security System, and any applicable laws relating to workers compensation and payment of wages. Pursuant to federal law, Contractor shall verify the immigration status of all workers assigned to the Contract without engaging in unlawful discrimination; and Contractor shall not knowingly or recklessly alter, falsify, or accept altered or falsified documents from any such worker.

24. Data Protection Controls. The Contractor shall protect data and information provided by the University to Contractor (“University Data”) to commercially acceptable standards and no less rigorously than it protects its own confidential information. The Contractor shall develop, implement, maintain, and use appropriate administrative, technical, and physical security measures to preserve the confidentiality, integrity, and availability of University Data. The Contractor will not provide any University Data to any sub-contractor or agent without the prior express written permission of the University or as otherwise provided under the Purchase Order. Contractor shall return to the University all University Data, and shall not retain a copy, upon termination, cancellation, expiration, or other conclusion of the Purchase Order. Unless the University requests that the University Data be destroyed, the Contractor shall retain any University Data only as long as needed for the specified purpose and shall securely dispose of any University Data when there is no longer a business need to retain the data. The Contractor agrees to: (i) notify the University immediately if any breach of security, confidentiality, or integrity of the University Data occurs; and (ii) assist the University in any subsequent investigation and notification processes.

25. Confidentiality

a. Confidential Information. During the course of this Purchase Agreement, each Party may disclose to the other certain non-public information or materials relating to a Party’s products, intellectual property, business, marketing programs and efforts, and other confidential information and trade secrets (“Confidential Information”).

Notwithstanding the foregoing, Confidential Information does not include information that: (a) is or becomes publicly available through no breach by the receiving Party of this Agreement; (b) was previously known to the receiving Party prior to the date of disclosure, as evidenced by contemporaneous written records; (c) was acquired from a third party without any breach of any obligation of confidentiality; (d) was independently developed by a Party hereto without reference to Confidential Information of the other Party; or (e) is required to be disclosed pursuant to statute or regulation, a subpoena or other similar order of any court or government agency, provided, however, that Party receiving such subpoena or order shall promptly inform the other Party in writing and provide a copy thereof, and shall only disclose such Confidential Information necessary to comply with such subpoena or order.

b. Protection of Confidential Information. Except as expressly provided herein, and subject to the requirements of the Massachusetts Public Records Law (M.G.L. c. 66, as applicable), the receiving Party will not use or disclose any Confidential Information of the disclosing Party without the disclosing Party’s prior written consent, except disclosure to and subsequent uses by the receiving Party’s employees, agents, and contractors on a need-to-know basis, provided that such employees, agents, and contractors have executed written agreements restricting use or disclosure of such Confidential Information that are at least as restrictive as the receiving Party’s obligations under this Section. Subject to the foregoing nondisclosure and non-use obligations, the receiving Party agrees to use at least the same care to avoid disclosure or use of this Confidential Information as the receiving party employs with respect to its own Confidential Information of a like importance, which shall not be less than the standard of care imposed by applicable laws and regulations relating to the protection of such information and, in the absence of any legally imposed standard of care, the standard shall be that of a reasonable person under the circumstances.

Page 4 of 5 June 2024

26. Payment Card Industry- Data Security Standards. If, in the course of its engagement by University, Contractor has access to or will collect, access, use, store, process, dispose of or disclose credit, debit or other payment cardholder information, Contractor shall at all times remain in compliance with the Payment Card Industry Data Security Standard (“PCI DSS”) and if applicable, Payment Application Data Security Standard (PA DSS) requirements, including remaining aware at all times of changes to these standards and promptly implementing all procedures and practices as may be necessary to remain in compliance with these standards, including promptly notifying the University of its non-compliance, in each case, at Contractor’s sole cost and expense. Both parties are responsible for the security of the cardholder data that is in such party’s control or possession, as mandated by PCI Security Standards Council (PCI SSC) in the performance of their individual and mutual responsibilities under this Agreement.

27. Government Contracts. If noted on the Form that this Purchase Order is made with funds obtained by the University directly or indirectly under a United States Government grant or contract, Contractor shall comply with all applicable provisions of the Federal Terms Addendum found at Federally Funded Projects Addendum which shall be incorporated by reference herein.

ADDITIONAL PURCHASE ORDER TERMS APPLICABLE TO

SOFTWARE PURCHASES

28. Software Terms. These Additional Purchase Order Terms Applicable to Software (collectively “Software Terms”) shall apply if the Products and/or Services noted on the Form include software or other computer programs or applications (“Software”) including, but not limited to those that require acceptance of any terms included or linked to on Contractor’s web site, order form, third party terms, quotation or other ordering document, or contained in any manufacturer “shrinkwrap” or “clickwrap” agreement, end user license, or other similar agreement (collectively “Contractor Terms”). Any such Contractor Terms will have no force or effect, even if Contractor Terms contain a merger clause or similar precedence of terms clause. Any Contractor Terms, amendments, or attachments to any Purchase Order which contain conflicting language or have the effect of deleting, replacing or modifying any printed language of these Software Terms, or any printed language of the Purchase Order Terms and Conditions and/or Form shall be interpreted as superseded by the Purchase Order Terms and Conditions and these Software Terms. Further, if Contractor or a Software manufacturer requires any individual University users to accept an end user agreement or agreement with similar purpose or effect in order to access or use the software, the terms of such end user agreement shall be of no force or effect to the extent the terms add to, conflict with, or are inconsistent, with the terms of this Purchase Order.

29. Grant of License. In accordance with the terms of this Purchase Order, Contractor grants to University, and University accepts from Contractor, a non-exclusive, non-transferable license (the “License”) to use the Software identified on the Form. For the avoidance of doubt, University and Contractor specifically agree that: nothing contained herein shall grant the other party any right, title, or interest in and to any intellectual property developed by a party (i) prior to the Effective Date or (ii) outside the scope of this Purchase Order. Software

30. Warranty. Contractor warrants that: (i) the Software will perform substantially in accordance with the applicable Documentation (as defined herein) or as represented or warranted by the Contractor; and

(ii) Contractor will use reasonable commercial efforts consistent with industry standards to scan for and remove any software viruses before providing the Software to the University. The Contractor warrants that it has the right to sell, license, or sublicense the software to University for the purposes and subject to the terms and conditions set forth herein.

As used in this warranty statement, “Documentation” means the Contractor user manuals, on-line help functions, technical specifications and user instructions regarding the operation, installation and use of the Software as made available by Contractor to University.

31. Additional Warranties. In addition to any other warranties provided in the Purchase Agreement, Contractor further represents and warrants as follows: (i) it has the full power, capacity and authority to enter into and perform this Purchase Agreement and to make the grant of rights contained herein, including without limitation, the right to license any ancillary or third party programs licensed to the University under this Purchase Order; (ii) there is no pending or threatened litigation that would have a material adverse impact on its performance under this Agreement; (iii) to the best of its knowledge, the University’s licensed use of the Software will not infringe the intellectual property rights of any third party; (iv) the Software does not contain any virus or similar code that may destroy, modify, alter, or cause the destruction, modification or alteration, in whole or in part, of any of the University’s equipment, devices, software, or data; (v) Contractor shall not deliver any third party software or other intellectual property to the University in connection with or embedded in the Software for which the University would be required to be bound by any third party terms and conditions unless the University agrees to such third party terms and conditions in writing; all such third party software and intellectual property shall be deemed part of and included in the definition of “Software”; or (vi) the Software will materially conform to Contractor’s generally available documentation for six (6) months (or such greater period of time as may be provided in the Purchase Order) from the date of delivery to the University.

32. Infringement.

a. Contractor represents that it has full right to sell, license, or sublicense to University the Software, including any products for the use thereof set forth in the Form, and that all such Software and/or products are delivered free of any liens, encumbrances or claims for any infringement of any United States copyright, patent, trade secret or trademark. The Contractor further warrants that the Software or product will not infringe any patent, copyright, trade secret or trademark. The Contractor agrees to indemnify and hold University harmless from any and all third-party claims of infringement relating to the University’s use of the Software or products sold or licensed hereunder, including but not limited to paying all defense costs and attorney’s fees, and any judgments.

b. If the use of any element of the Software is enjoined as a result of any claim arising out of an infringement claim, the Contractor will, at its option and expense, either secure for University the right to continue to use the allegedly infringing Software, or to replace or modify the Software so that it is no longer infringing, provided the Software continues to materially perform the same function(s) as necessary to fulfill the Contractor's obligations under this Purchase Order and otherwise conforms to the warranty hereunder. In the event Contractor fails to do either of the foregoing, the Contractor shall refund to University the full purchase price of all Software and products purchased or licensed hereunder.

33. General Data Security.

a. Contractor shall develop, implement, maintain and use appropriate administrative, technical and physical security measures to preserve the confidentiality, integrity and availability of all electronically maintained or transmitted data received from, or on behalf of, the University or its staff, faculty, agents, and/or students (collectively “University Data”).Contractor agrees that it will protect University Data according to commercially acceptable standards and no less rigorously than it protects its own confidential information, but in no case less than reasonable care.

b. Contractor also agrees that any and all University Data will be stored, processed, and maintained solely on designated target servers and that no University Data at any time will be processed on or transferred to any portable or laptop computing device or any portable storage medium, unless that storage medium is in use as part of the Contractor's designated backup and recovery processes.

https://www.dropbox.com/s/i7u1dhmye7erenp/Revised%20PO%20Federally-funded-projects-addendum-022421PDF.pdf?dl=0

Page 5 of 5 June 2024

c. No University Data may be outsourced or housed outside the United States of America without the University’s prior written authorization.

34. Use of University Data. All University Data is the exclusive property of University. Contractor will not use the University Data for any purpose other than that of rendering services to University, nor will Contractor sell, distribute, assign, lease, dispose of or otherwise exploit the University Data. Except as otherwise specifically provided for in this Purchase Order, the Contractor agrees that University Data will not be shared, sold, or licensed with any third-party, with the exception of approved sub-contractors, without the express, prior, written approval of the University in each instance. Contractor will be solely responsible for any unauthorized use, reuse, distribution, transmission, manipulation, copying, modification, access, or disclosure of University Data and any non-compliance with the data privacy and security requirements by Contractor or Contractor’s users, agents or sub-contractors.

35. University Data after Expiration. Upon termination, cancellation, expiration or other conclusion of the Purchase Order, Contractor shall return all University Data to University unless University requests that such data be destroyed. This provision shall also apply to all University Data that is in the possession of subcontractors or agents of Contractor. Contractor shall complete such return or destruction not less than thirty (30) days after the conclusion of this Purchase Order. Within such thirty (30) day period, Contractor shall certify in writing to University that such return or destruction has been completed.

36. Data Breach.

a. Contractor shall report, both orally and in writing, to the University any use or disclosure of University Data not authorized by this Purchase Order, or otherwise authorized in writing by University, including any reasonable belief that an unauthorized individual has accessed University Data. Contractor shall make the report to University immediately upon discovery of the unauthorized disclosure, but in no event more than two (2) business days after Contractor reasonably becomes aware or should have become aware there has been such unauthorized use or disclosure. Contractor's report shall identify: (i) the nature of the unauthorized use or disclosure [including a root cause analysis, containing as much specific detail as possible (e.g., cause, contributing factors, chronology of events)]; (ii) the University Data used or disclosed (together with samples of any forms or documents that were involved to illustrate the type of University Data involved (with personal identifiers removed or redacted); (iii) date of the event or estimated date (if date unknown); (iv) date of discovery; (v) a summary of the nature and scope of the Contractor's investigation; (vi) who made the unauthorized use or received the unauthorized disclosure; (vii) what Contractor has done or shall do to mitigate any deleterious effect of the unauthorized use or disclosure; and (viii) what corrective action Contractor has taken or shall take to prevent future similar unauthorized use or disclosure. Contractor shall provide such other information, including a written report, as reasonably requested by University.

b. Contractor agrees to comply with all applicable laws that require the notification of individuals in the event of unauthorized release of personally identifiable information (PII) or other event requiring notification. In the event of a breach of any of Contractor's security obligations or other event requiring notification under applicable law (a "Notification Event"), Contractor agrees to assume responsibility for informing all such individuals in accordance with applicable law and to reimburse and indemnify, hold harmless and defend the University and its trustees, officers, and employees from and against any claims, damages, costs incurred or sustained by the University in responding to, and mitigating damages caused by, any Event (as defined herein), or third party claims or causes of action brought or asserted against the University. Contractor shall provide the University with written notice and a draft copy of notifications prior to Contractor disseminating same to impacted individuals, but all costs associated with such notifications shall be borne solely by Contractor.

c. In the event that any unauthorized access to or improper disclosure of University Data including PII is caused by the Contractor’s breach of its security and/or privacy obligations under this Purchase Order, the Contractor shall be responsible for the performance and costs of: (i) a forensic investigation to determine the cause of the breach, if reasonably necessary, after which it shall provide the University with a description of the breach, what information was affected, and what steps have been taken to mitigate the effects of the breach; (ii) providing notification of the security breach as required by applicable law, including any required notification to government and relevant industry self-regulatory agencies; (iii) providing credit file or identity monitoring (as required by state law according to the PII that was accessed or disclosed); and (iv) operating an identity theft call center to respond to questions from individuals whose PII may have been accessed or disclosed for a period of one year after the date on which such individuals were notified of the unauthorized access or disclosure.

d. For the purposes of this Purchase Order, “Event” shall mean the following, either individually or collectively: 1) any use or disclosure of University Data not permitted under this Purchase Order; 2) any data security incident; or 3) any other event that would trigger notification obligations under applicable law requiring notice to consumers and/or oversight agencies in connection with an impermissible use or disclosure or breach of personally identified information.

e. The Contractor’s liability for any Event shall not exceed the greater of: (i) $250,000; (ii) the amount mandated by applicable State or Federal law; (iii) five times the total value of the Contract (or in the case of subscription-based Contracts, five times the total value of the Contract during the committed subscription term); or (iv) the total coverage provided by Contractor’s insurance provider(s) for such Event.

37. Compliance. Contractor agrees to abide by all applicable federal, state, and local laws, ordinances, and regulations and all University regulations and policies, specifically including without limitation those pertaining to the privacy and use of student records, health information, and other University Data, including, but not limited to, the Family Educational Rights and Privacy Act (FERPA), the Health Insurance Portability and Accountability Act (HIPAA), the Gramm- Leach Bliley Act, and the Federal Trade Commission’s Red Flags Rule (which implements Section 114 of the Fair and Accurate Credit Transactions Act of 2003). Contractor shall protect all personally identifiable information and shall obtain, in advance, all necessary permissions and consents required related to its collection and/or receipt of any such information. In the event University shares with or provides access to Contractor of any protected health information (“PHI”), University and Contractor shall, to the extent required by HIPAA, enter into a separate business associate agreement which will govern the use of the PHI. Contractor agrees to include all such terms and conditions contained in any subcontractor or agency contracts.

Contractor certifies its compliance with § 889 of the McCain National Defense Authorization Act (prohibition against use of covered telecommunications equipment), and § 448.095, F.S. (Contractor’s use of the E-Verify system). To the extent applicable, Contractor acknowledges and warrants that the software shall conform to the latest version of WCAG Web Content Accessibility Guidelines, version

2.1 (“WCAG 2.1”) at conformance Level A and AA. If the Software does not fully conform to WCAG 2.1 A and AA, Contractor shall advise University in writing of the nonconformance and shall provide University with a plan to achieve conformance to WCAG 2.1 A and AA, including but not limited to, an intended timeline for conformance.

Contractor shall indemnify, hold harmless and defend the University and its trustees, officers, and employees from and against any claims, damages, or other liability arising out of Contractor’s failure to comply with the provisions of this section.

IN WITNESS WHEREOF, the Contractor accepts these University Terms and Conditions and warrants that it shall comply with these University Terms and Conditions for any applicable Purchase Order with the University, which acceptance may be evidenced by Contractor’s performance under any applicable University Purchase Order Form.

GENERAL TERMS