UWM Printing and Mail House RFP.docx

REQUEST FOR PROPOSAL

PROJECT TITLE: UWM Annual Philanthropy Printing and Mail House Ref # 689360

The University of Washington is soliciting proposals from potential vendors to provide the above referenced services. Vendors interested in providing the required services must submit proposals per the requirements detailed in this RFP.

This solicitation is open to those vendors that satisfy the minimum qualifications stated herein and that are available for work in Washington State.

Contents of this Solicitation

I. General Instructions

II. Requirements

III. Evaluation and Contract Award

VI. Attachments

Section I General Instructions

1.1 PURPOSE

The purpose of this Request for Proposal (RFP) is to invite printing and mail house vendors to execute the donor and non-donor solicitations for the FY25 fiscal year and beyond for the UW Medicine Annual Philanthropy department at the University of Washington.

1.2 RFP COORDINATOR

The RFP Coordinator is the sole point of contact in the University for this Procurement. All communication between the Contractor and the University upon release of this RFP shall be with the RFP Coordinator, in writing, as follows:

Silvia Andersen, Contract Manager Procurement Services silvif@uw.edu

1.3 Definition of Terms

“Supplier”, “Proposer”

“Request for Proposal”

-A written solicitation document which identifies the UW’s need, and consultants are invited to submit proposals which outline their solution to the need, their qualifications and experience to provide the services, and their costs or fees.

1.4 tIMETABLE

1.5 PROPOSAL SUBMISSION

Vendors shall submit a proposal in PDF OR Word format, via the University’s Workday Strategic Sourcing website. Proposals must be submitted on or before the time specified in 1.4 Timetable. Any proposal received after that date and time will not be considered. All proposals shall remain valid for a minimum of 180 days following the RFP closing date.

All proposals and any accompanying documentation become the property of the UW and will not be returned and shall be received on or before 5:00 PM PST on July 31, 2024. Any proposals received after the date shown above will not be considered.

Proposals shall be clearly marked and delivered in accordance with the instructions. It is the responsibility of the Vendor to see that their proposal is received on or before the due date for proposals.

Workday This solicitation is being conducted in Workday. Vendors can register for the sourcing event by visiting https://university-of-washington.public-portal.us.workdayspend.com/

Search using reference # 689360

Option 1 – Select Bid > Register

Option 2 – Select the title of the RFP and select Start Bid > Register

1.6 INQUIRIES

All questions must be submitted in writing via the Workday Strategic Sourcing website citing the particular RFP section and paragraph number, and utilizing the attached template/Attachment E. Depending upon the nature of the inquiry and the response, copies of the question and response may be distributed to all other potential vendors. The closing date for asking of questions is given in Paragraph 1.4. The University may exercise its option not to reply to Vendor inquiries; therefore, Vendors should be prepared to submit a proposal based on the information included in the RFP.

1.7 COMPLAINTS

A. Contractors may submit a complaint to the RFP Coordinator based on any of the following:

· The solicitation unnecessarily restricts competition;

· The solicitation evaluation or scoring process is unfair or flawed; or

· The solicitation requirements are inadequate or insufficient to prepare a response.

B. Contractors may submit complaints up to 5 business days prior to the proposal due date. Complaints must meet the following requirements:

· Must be in writing.

· Must be sent to the procurement coordinator, or designee.

· Should clearly articulate the basis for the complaint.

· Should include a proposed remedy.

The RFP coordinator or designee will respond to complaints in writing; the response to complaints including any changes to the solicitation will be posted as an amendment on WEBS, https://fortress.wa.gov/ga/webs/ and in Workday. The complaint may not be raised again during the protest period. The complaint process does not include an appeal process.

1.8 Interpretation of the RFP

Should any discrepancies be found in or omissions from the specifications, or doubt as to their meaning, the Contractor shall at once notify the Coordinator, in writing. The Coordinator will send written instructions or addenda as required to all interested parties. All addenda issued shall be incorporated into the contract. The Purchaser shall not be responsible for or bound by oral interpretations. Only questions answered by written addenda are binding. Questions received less than five (5) working days before the proposed due date for submission of proposals cannot be answered.

1.9 REVISIONS TO THE RFP

The University reserves the right to change the acquisition schedule or cancel the RFP at any time. The University reserves the right to make corrections or amendments due to errors identified in the RFP by the University or a Contractor. Any changes will be dated and attached to, and made a part of, the RFP. All changes must be coordinated in writing with, authorized by, and made by the RFP Coordinator.

All RFP corrections and amendments will be posted to https://fortress.wa.gov/ga/webs/ and also to the Workday sourcing module. Contractors are responsible for checking the website for this information.

1.10 Signature

Each proposal must be signed by the Contractor with the usual signature and dated. The name and title shall be typed or printed below each signature.

A. Proposals submitted by a proprietorship must be signed by the Owner.

B. Proposals submitted by a partnership must be signed with the partnership name by one of the partners, followed by the signature and designation of the partner signing.

C. Proposals by a corporation must be signed with the legal name of the corporation, followed by the name of an authorized officer.

1.11 Cost of Proposals

Costs incurred in preparing and presenting the proposals or incurred in any other manner by the Contractor in responding to this solicitation are not reimbursable and may not be charged to the University.

1.12 Withdrawal or Modifications of Proposals

Any Contractor may withdraw their proposal upon written request at any time prior to the scheduled due date for submission of proposals.

1.13 Public Disclosure

The University is subject to RCW 42.56 (Public Records Act). All Contractor Responses and any subsequent Contract will be “public records” as defined in RCW 42.56.010

The Contractor must clearly specify any specific information that it claims is confidential or proprietary. Marking of the entire Response or entire sections as proprietary will not be honored. The University may not accept Responses where pricing is marked as proprietary.

All Responses received will remain confidential until the Contract, if any, resulting from this RFP is signed by the University and the Apparent Successful Contractor; thereafter, the Responses will be deemed public records.

To the extent consistent with RCW 42.56, the University will maintain the confidentiality of all information marked confidential or proprietary. If a request is made to view the Contractor’s information, the University will notify the Contractor of the request and the date that such records will be released unless the Contractor obtains a court order enjoining that disclosure. The Contractor will have five (5) business days from receipt of notice to obtain the court order. If the Contractor fails to obtain the court order enjoining disclosure, the University will release the requested information on the date specified.

1.14 ACCEPTANCE PERIOD

Contractor’s proposal must provide 120 business days for acceptance by University from the due date for receipt of Proposals.

1.15 RESPONSIVENESS

All Proposals will be reviewed by the RFP Coordinator to determine compliance with administrative requirements and instructions specified in this RFP. The Contractor is specifically notified that failure to comply with any part of the RFP may result in rejection of the Proposal as non-responsive.

1.16 Selection of Proposals

In determining the “apparent successful Contractor”, in addition to cost, the Contractor’s compliance with the requirements of this solicitation, and the items listed below, shall be given consideration.

A. The ability, capacity, and skills of the Contractor to perform the contract or provide the service required.

B. The character, integrity, reputation, judgment, experience, and efficiency of the Contractor.

C. The quality of performance of previous contracts or service.

D. The previous and existing compliance by the Contractor with the laws relating to contract and services.

E. Such other information as may be secured having a bearing on the decision to award the contract.

1.17 No Obligation to Contract

This solicitation does not obligate the University of Washington to contract for the solicited services specified herein.

1.18 Contract in Best Interest

The University reserves the right to accept or reject proposals on each item separately or as a whole, to reject any or all proposals without penalty, to waive informalities or irregularities, and to contract in the best interests of the University.

1.19 PUBLICITY

Advertising, including use of the University marks and logos, press releases, or any other general public announcement by a Contractor, stating the availability of its products or services to University employees is strictly prohibited unless the Contractor has obtained prior written authorization from the UW Procurement Services Department.

1.20 NON-ENDORSEMENT

The successful Contractor agrees to make no reference to the University in any literature, promotional material, brochures, sales presentation or the like without express written consent of the University.

1.21 FUNDING

Any contract awarded as a result of this procurement is contingent upon the continued availability of state or federal agency funding.

1.22 Contract and Terms & Conditions

The Apparent Successful Vendor will be expected to enter into a contract which is substantially the same as the University of Washington General Terms and Conditions, which can be located at https://finance.uw.edu/ps/files/purchasing/terms-and-conditions and are also attached as Exhibit D. In no event is a Vendor to submit its own standard contract terms and conditions in response to this solicitation.

By submitting a proposal, Supplier certifies that they understand and accept the terms and conditions of this solicitation as well as the University’s General Terms and Conditions. Any exceptions must be submitted as an attachment to the bidder’s proposal. Suppliers must specifically cite each clause with which they have an issue and suggest an alternate language. The agency will review requested exceptions and accept or reject the same as its sole discretion.

1.23 Data-Security

If, during the course of the performance, administration, or maintenance of this contract, or any extension or renewal thereof, CONTRACTOR acquires, uses, or otherwise obtains access to ‘University Data’ as those terms are defined in the UW Data Processing Agreement, incorporated herein, then the UW and CONTRACTOR agree that all of the terms and conditions of the UW’s Data Processing Agreement and/or IT Data Security Addendum(s) shall apply.

1.24 IN-STATE RECIPROCITY

The Department of Enterprise Services has established a schedule of states (Schedule) which grant a preference to their own in-state businesses for goods and services. Detailed information regarding the various States’ reciprocity policies is contained in the following URL. Bids submitted by Consultants with addresses in any of the states as described in the Schedules shall be evaluated in accordance with the instructions stated in the Schedule.

https://www.naspo.org/research-and-innovation/state-preference-repository/

1.25 GRATUITIES

In accordance with RCW 42-52-150 and 160, Ethics in Public Service, no gifts, gratuities or any item of economic value may be accepted by University Employees. Contractors agree to offer no such items to any University employee.

1.26 Minority and Women Business Enterprise Participation

In accordance with chapter 39.19 RCW, the University of Washington encourages participation in all of its contracts by firms certified by the Office of Minority and Women’s Business Enterprises (OMWBE). Participation may be either on a direct basis in response to this solicitation or on a we think there might be subcontractors on the RFP basis. However, no preference will be included in the evaluation of proposals, no minimum level of MWBE participation shall be required as a condition for receiving an award and proposals will not be rejected or considered non-responsive on that basis. Any affirmative action requirements set forth in federal regulation or statutes included or referenced in the contract documents will apply.

The established annual procurement participation goals for this solicitation are MBE 6% and WBE 4%. For information on certified firms, Contractors may contact OMWBE at 360/753-9693or http://www.omwbe.wa.gov.

1.27 U.S. Small Business Participation

Participation in contracts for goods and services is encouraged by firms which qualify under definitions by the U.S. Small Business Administration as small business (SB), or small disadvantaged business (SDB), or small women owned business (WOB).

The percentage listed below is voluntary. No preference will be included in the evaluation of bids/proposals. Participation in University contracts may be either direct as the Contractor in response to this solicitation, or as a subcontractor to a Contractor.

Voluntary U.S. Small Business goals for this solicitation are 15% SB/SDB/WOB

1.28 Subcontractor Participation Monitoring and Reporting

Once a contract is awarded through the solicitation or proposal process, the awarded Service Provider is obligated to complete the vendor registration in Access Equity. Access Equity is a secure online vendor management system (B2GNow). Confidential information (Tax ID, etc.) will not be published. The Awarded Service Provider that have previously registered with B2Gnow for any public entity, must verify the system has updated information.

Service Providers can access the system at https://omwbe.diversitycompliance.com/or through a direct link on the Office of Minority and Women’s Business Enterprises (OMWBE) website at: https://omwbe.wa.gov/.

Each month during the contract, the Service Provider will report payments to all Subcontractors through the Access Equity system. This monthly reporting information includes total payment in dollars made to the Subcontractor, payment dates, and any additional information required to verify payment to Subcontractors. The Service Provider will enter this payment information into the Access Equity system, and the Subcontractors will verify this payment information in the system. Online training is available through the Access Equity/B2Gnow system. This requirement applies to both Service Providers and Subcontractors.

1.29 Federal Small, Small Disadvantaged or Small Woman Owned Business Certification:

In accordance with Public Law 95-507, Federal Contracts that contain Federal Acquisition Regulations (FAR) clause 52.219-8 (Utilization of Small Business Concerns and Small Disadvantaged Business Concerns) impose requirements regarding subcontracting with small businesses and small business subcontracting plans. Refer to FAR 19.001 for guideline definitions.

With regards to certification, the Small Business Administration (SBA) classifies small businesses on an industry-by-industry basis, utilizing a Standard Industrial Classification (SIC) code as described in the Code of Federal Regulations (CFR) Title 13, Part 121.The offeror certifies that the information is true and understands that whoever, for the purpose of securing a contract or subcontract is accountable under Public Law 99-661 and the CFR Title 13, Part 124 & 125.

If a firm misrepresents the status of any concern or person as a small business owned and controlled by a minority or woman owned business, they shall (1) be punished by imposition of a fine, imprisonment, or both; (2) be subject to administrative remedies including suspension and disbarment; and (3) be ineligible for participation in programs conducted under the authority of the Small Business Act.

If you need assistance in determining whether your business is considered to be small, contact the Seattle branch of the U.S. Small Business Administration at (206) 553-7310, or the University’s Representative at (206) 543.4156.

SECTION II

REQUIREMENTS

2.1 Period of Service

Unless otherwise stated, the initial term of the agreement shall be for the period of time during the performance of the work only. Extensions, if any, shall be agreed upon in writing between the parties.

2.2 Proposal Requirements and Instructions

Background and History: Describe the company, organization, officers or partners, number of employees and operating policies which would affect this Contract. State the number of years the organization has been continuously engaged in business.

Financial Stability: Describe the financial status of the company. Attach a copy of the most recent annual financial statement or another similar document.

Technical Approach and Methodology: Describe Bidder’s technical approach and methodology for accomplishing the described Scope of Work. The proposed approach and methodology should include a detailed work plan and schedule. All information to be provided by participating Hospital(s) as part of this plan must be specified including content, format, and frequency.

Project Team and Management Structure: Identify proposed project team and management structure for completing the Scope of Work. This should identify roles and responsibilities, including Bidder expectations of participating UW Medicine Hospital(s) staff resources. Provide resumes of key professional staff to be assigned to the project and their level of commitment to this engagement.

Proposed Fees: Provide a cost proposal to accomplish the Scope of Work or provide the requested product.

Firm Experience and Credentials: Provide evidence of Bidder’s experience in projects or providing products as described within this RFP.

References: List three (3) relevant references, including a description of the engagement, professional fees, duration, and date of completion, contact person, title, mailing address, telephone number and e-mail address.

Contract Management Information: Provide primary Contract Manager Contact name, title, mailing address, telephone number and email address.

2.3 SCOPE OF WORK

UW Medicine Annual Philanthropy is looking for a printing and mail house vendor to execute their donor and non-donor solicitations for the FY25 fiscal year. These direct mail solicitations are sent to a broad audience that includes patients, alumni and donors. The plan is to send over 200,000 mail pieces in this next fiscal year.

We have 5 distinct letterhead suites that we will print throughout the year (examples: UW Medicine Alumni, UW Medicine General, Patient, etc.)

Each piece we send includes a piece of standard letterhead 8.5 x 11, #9 a reply (non BRE) envelope, and a 1/3 sheet response device (front and back full color) enclosed in a standard #10 sized mail envelope (no window) with a live stamp sent from Seattle.

All projects folded, nested and inserted. With addresses and addressees matched

Here are the project titles, the timing and quantities needed:

Requirements

Printing options must include 4 color offset printing, 4 color digital printing and 1 and 2 color printing with variable information on all components (letter, envelope, and response device). High quality envelope addressing is also required.

Vendor should have capabilities for managing all portions of this contract or outsource to a trusted vendor (BAA required for specific segments) including, but not limited to design, pre-press data processing, lasering, and mailing. If any component is not available in-house, vendor must describe how these components will be managed, describe related quality control measures and confirm if they can meet a 15-day turnaround for direct mail projects.

Vendor must be able to handle multiple text and graphic variables within a personalized letter, card or brochure, giving history and matching gift forms, response device and outer and return envelope. Vendor must also be able to handle complex segmentation requests, including variable gift amounts, and variable paragraphs within the body of the letter, card or brochure. Vendor must be able to work with specialized colors.

Each solicitation contains variable information that is personalized to the recipient and requires accurate data manipulation. Solicitation projects involve numerous letters (up to 30), cards or brochures on varied stock (up to four versions) with variable data that may be either unique to a segment letter or cross all segments.

Because of the complex nature of the data selections, it is important that the vendor of choice provide comprehensive project management and quality control. A single, dedicated Project Manager to all University of Washington projects is preferred. The Project Manager should provide or be able to accommodate the following: project-related stock samples that reflect best practices in university advancement appeals, establishing milestone due dates for design creation, press-proofs, copy writing, editing, data submission, “live sample” proofing (both PDF and hard copies) and data purges. Project management should also be capable for design edits, data manipulation, reporting, proof-reading and provide regular progress updates on all projects.

Vendor should be able to demonstrate data security.

Vendor must have knowledge of HIPAA regulations and their impact on hospital/patient fundraising

Vendor should be able to demonstrate experience in both hospital and university fundraising and be current in advancement communication best practices

Vendor must have proven method of matching response devices, letters, and outer envelopes. Camera matching system is preferred. Vendor must be able to demonstrate the process used for correcting mismatched pieces.

Quality assurance is a mandatory requirement. Vendor must be able to demonstrate established internal and external quality control procedures. Vendor must take steps to avoid variable data offsetting onto a facing page.

Printing Specifications

Letterhead versions (with optional sidebar information) (bleeds and no bleeds, single-sided or double-sided + variable copy printed in black ink

#10 envelope versions (bleeds and no bleeds, single and double-sided, closed face + variable address block in black ink)

#9 return envelope versions (standard #9 closed face courtesy reply envelope) 1/0 black ink

Response devise versions (no bleeds, double sided; variable data printed on one side in black ink)

Optional printing capabilities desired

· 4/cp variable images and text printed on letterhead and #10 envelope

· Printing with bleeds for letterhead, #10 envelopes and response devices

· Coated and uncoated paper

· Real pen and custom printed signatures

· The ability to work with custom colors

Variable copy to include salutation, segment-specific language, address, fund selections, envelope tag lines, paragraphs, sentences, phrases, gift amounts, gift history, matching gift information, postscripts, scanline, appeal code, signature, etc.

Vendor should be prepared to suggest, print and produce other types of mail pieces, keeping current with university and medicine direct mail best practices.

Proofing

Testing of all printing methods to match all UW brand colors

UW Medicine must receive either or both digital and live hard copy samples for review prior to printing.

Proofing of each job to include color matching.

Press checks of each job upon request.

2.4 Functional, technical, and performance requirements

Vendor will receive files and segment data appropriately. The data will have been processed with NCOA updates and be CASS certified. A purge file approximately one week prior to mailing will be delivered and vendor will need to purge this file from the original data set. Each segment may have variable paragraphs that need to be dropped in to the letter along with variable gift funds and variable gift handles on the response device.

SECTION III

EVALUATION AND CONTRACT AWARD

1.

2.

3.

3.1 Evaluation of Proposals

The University reserves the right to make Vendor selections based solely on the proposal submitted. Responsive proposals will be evaluated strictly in accordance with the requirements stated in this solicitation and any addenda issued. The evaluation of proposals shall be accomplished by an evaluation team to be designated by the UW, which will determine the ranking of the proposals. The RFP Coordinator may contact the Vendor for clarification of any portion of a Vendor’s proposal.

3.2 Interview / Presentation

At its sole discretion, the University may require Vendors to participate in an interview or provide a presentation to the evaluation committee. If so, the score from the interview and/or the presentation may be combined with the score of the proposal to identify the apparent successful Vendor. The University will contact the Vendor directly to schedule the interview/presentation.

3.3 Evaluation Criteria & Scoring

The following weighting and points will be assigned to the proposal for evaluation purposes:

Client interaction

Higher Education Experience and knowledge of direct mail best practices

Academic Medical Center Experience

Local Representation

Total Possible Points

3.4 Notification to Proposers

Once the final evaluation phase has been completed, the solicitation Coordinator will issue a written announcement to all participants in Workday and WEBS, citing the name(s) of the apparent successful vendors.

3.5 Protest Procedure

The protest process occurs after the bids are submitted and evaluated. This allows bidders to focus on the evaluation process to ensure its integrity and fairness. Protests can raise issues related to the evaluation process as set out in the solicitation or how the process was executed. This allows for evaluation process errors and problems to be corrected before a contract is executed.

The protest process will meet the following requirements:

1) After the announcement of the apparent successful bidder (ASB), bidders will be offered a debriefing upon written request.

2) Bidders will be given 3 business days after the ASB is announced to request a debriefing.

3) Bidders are required to participate in a debriefing as a prerequisite for submitting a protest.

4) Bidders will be given 5 business days after their debriefing to file a written protest.

5) The protest process will allow bidders an opportunity to submit a protest based only on the following:

A matter of bias, discrimination, or conflict of interest on the part of an evaluator;

Errors in computing the scores; or Non-compliance with procedures described in the procurement document or UW protest process.

6) Protests are to be submitted to the UW’s Director of Procurement Services (Director) and the procurement coordinator.

7) The Director will issue a written response within 10 business days from receipt of the protest unless additional time is needed. The protesting bidder shall be notified if additional time is needed.

8) The Director’s protest decision is final. If a protesting bidder does not accept the protest response, the bidder may try to seek relief from superior court.

9) At the time that the protest response is issued, the Director of the Department Enterprise Services will be provided a copy of the original protest and the UW’s response.

Section IV Attachments

1. Attachment A. Data Processing Agreement

4. Attachment D. University of Washington General Terms and Conditions

5. Attachment E. Question Template

6. Attachment F. IT Accessibility Rider

7. Attachment G. IT Security Terms

8. Attachment H. Business Associate Agreement image1.emf

C-to-P-DPA.docx

UNIVERSITY OF WASHINGTON

CONTROLLER TO PROCESSOR

DATA PROCESSING AGREEMENT

Introduction, Parties, AND Effective Date

This Data Processing Agreement (the “DPA”) is hereby incorporated into and amends the [insert name of Underlying Agreement] (the “Agreement”) between the University of Washington, an agency of the State of Washington, with its main campus located in Seattle, Washington (the “University”) and [insert entity name], a [insert name of jurisdiction within which entity was formed (ex. Delaware)] [insert type of entity type (ex. corporation)], with a principal place of business at [insert entity’s address] as of the Effective Date below. With respect to Data Processing performed under the Agreement and this DPA, the University is the Controller and the [insert non-UW entity] is the Processor. The parties agree as follows:

Definitions

1. “Controller” refers to the person or entity that determines the purpose and means for Data Processing.

2. “Data Breach” means any technical or physical incident or set of circumstances that leads to the unauthorized, accidental or unlawful access to, or destruction, loss, alteration, or disclosure of, University Personal Data undergoing Data Processing by the Processor.

3. “Data Processing” means any operation(s) performed on University Personal Data, whether or not by automated means, such as collection, recording, organization, storage, adaptation, alteration, retrieval, consultation, access, use, disclosure by transmission, dissemination, combination, restriction or destruction.

4. "Data Request” means a request to exercise rights available under any applicable law with respect to University Personal Data.

5. “Processor” refers to the person or entity that performs Data Processing on behalf of the Controller.

6. “Sub-processor” means any person or entity appointed by or on behalf of the Processor to carry out any portion of the Work.

7. “University Personal Data” or “UPD” means any records or information relating to an identified or identifiable natural person, such as name, identification number, location data, online identifiers, or factor(s) specific to physical, physiological, genetic, mental, economic, cultural, or social identity or characteristics, or is identified as personally identifiable data (or a similar term) by any applicable law, that:

a. Is created, received, or maintained by the University and transmitted to, accessed by, or otherwise made available to the Processor in connection with the Processor’s performance of the Work;

b. Is created or compiled by the Processor in performing the Work; or

c. Is appended to, aggregated with, or associated with any University Personal Data originating from the University that was transmitted to or accessed by the Processor in connection with the Processor’s performance of the Work.

Notwithstanding the foregoing, UPD does not include personal data relating to the Processor’s or Sub- processor’s personnel or personal data that is acquired from non-UW sources and is processed by the Processor not in association with the Work.

8. “Processor” as used in this DPA includes both the Processor identified above, and any third party and/or entity that owns or controls, is owned or controlled by, or is under common ownership or control with the Processor, where control is defined as the possession, directly or indirectly, of the power to direct or cause the direction of the management and policies of an entity, whether through ownership of voting security, by contract, or otherwise.

9. “Work” refers to any and all activities carried out by the Processor or a Sub-processor in providing services, work product or deliverables under the Agreement, or in fulfilling any other obligations set forth in the Agreement.

standard of care

1. The Processor represents and warrants that any Data Processing shall be by personnel who (a) are obligated to maintain confidentiality under applicable law or job expectations, and (b) are sufficiently trained and experienced to use reasonable care commensurate with state-of-the-art professional practices to comply with the obligations in this DPA.

2. The Processor shall ensure that there are appropriate personnel-vetting processes, and appropriate policies and/or controls over activities as necessary to safeguard UPD per this DPA and applicable law.

3. Prior to the disclosure of UPD to, or the commencement of Data Processing by any Sub-processor, the Processor shall cause each Sub-processor to execute an agreement with the Processor that includes terms and conditions which establish at least the same level of protection for UPD as those set out in this DPA and applicable law. If a Sub-processor fails to fulfill its data protection obligations under this DPA or applicable law, the Processor shall remain fully liable to the University for the performance of that Sub-processor’s obligations.

purpose And LIMITS OF DATA PROCESSING

1. The Description of Data Processing Exhibit to this DPA sets forth certain information relating to the Data Processing by the Processor for the purpose of carrying out the Work. The Processor may only engage in Data Processing for the limited purpose described in the Description of Data Processing Exhibit (the “Purpose”). The Processor shall limit its Data Processing to include only the minimum UPD needed to fulfill the Purpose. The Processor’s Data Processing will not involve any secondary uses of UPD beyond the Purpose. Without limiting the generality of the foregoing, the Processor shall not use any UPD to market or sell goods or services to persons named or otherwise identified in UPD.

2. When the University reasonably deems necessary to meet its own requirements and/or applicable laws, the University may make reasonable changes to the Data Processing by amending the Description of Data Processing Exhibit or providing the Processor with an additional exhibit in the same form as the Description of Data Processing Exhibit. Any material change to the Description of Data Processing Exhibit that increases the cost of the Work shall be subject to the mutual agreement of the parties.

3. The University shall have sole control over determinations related to (a) the lawfulness of the Data Processing, and (b) the necessity of any privacy notice to and/or solicitation of consent from individuals whose personal data will undergo Data Processing in relation to the Work.

Non-Disclosure AND DATA REQUESTS

1. UPD shall not be disclosed by the Processor (or any Sub-processor) to a third party, unless the University grants permission in writing to the Processor to disclose, or unless such disclosure is required by applicable law.

2. If the Processor receives any subpoena, discovery request, court order, or other legal request or order that calls for disclosure of any UPD, then the Processor shall promptly notify the University unless specifically prohibited by law from doing so. The Processor’s notification shall give the University sufficient time to object to the disclosure, obtain a protective order, or otherwise protect UPD by limiting disclosure. The Processor shall provide the University with prompt and full assistance in the University’s efforts to protect UPD. Any disclosure pursuant to this section shall be limited to the minimum disclosure required by law.

3. The Processor shall assist the University by implementing technical and organizational measures, to the extent practicable, in order for the University to meet its obligations (as understood by the University) to respond to Data Requests relating to UPD held by the Processor. The Processor shall promptly notify the University if the Processor receives a Data Request, assist the University in the University’s response, and respond to the Data Request directly only on the documented instructions of the University or as required by applicable laws to which the Processor is subject, in which case the Processor shall, to the extent permitted by applicable laws, inform the University of the Processor’s legal obligations before any response to the Data Request.

Compliance and Data Transfers

1. The Processor shall conduct all Work and Data Processing in full compliance with any and all applicable statutes, regulations, rules, standards and orders of any official body with jurisdiction over the Processor or the University. Applicable statutes, regulations, rules, or orders may include, but are not necessarily limited to:

a. The Family Educational Rights and Privacy Act (“FERPA”), 20 U.S.C. §1232g; 34 CFR Part 99;

b. The Health Insurance Portability and Accountability Act (“HIPAA”), 42 U.S.C. § 300gg and 29 U.S.C § 1181 et seq. and 42 USC 1320d et seq.; and/or the Washington Health Care Information Act, Ch. 70.02 RCW; and

c. European Union General Protection Data Regulation (“GDPR”), Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016. The University’s obligations and rights with respect to GDPR are set forth in the Agreement and this DPA. The Agreement, this DPA, and any directions contained in notices from the University to the Processor pursuant to § J.4 together constitute the University’s documented instructions to the Processor for the purposes of GDPR. The subject matter of the Data Processing with respect to GDPR is the Work, as defined above, in the Agreement, and/or in the Description of Data Processing Exhibit to this DPA (including any change(s) pursuant to § D.1). Compliance with GDPR includes, without limitation, the following:

i. The Processor shall provide the University with assistance and information required by GDPR, to the extent applicable, as it relates to Data Processing. As contemplated by GDPR, the Processor’s provision of assistance may relate to data protection impact assessments, prior consultations, demonstration of compliance with Article 28 of GDPR, and audits. The Processor will also immediately notify the University if, in its opinion, a University instruction infringes GDPR.

ii. The Sub-processors that are identified and described by the Processor in the Description of Data Processing Exhibit of this DPA are the only Sub-processors permitted to perform Data Processing. Prior to engaging a new Sub-processor for Data Processing, the Processor shall: (1) notify the University in writing of the intended addition or replacement of the Sub-processor; and (2) give the University the opportunity to object to such change.

2. For Data Processing that involves transfers of UPD from the European Economic Area, Switzerland, or the United Kingdom to a country that does not ensure an adequate level of data protection (including, but not limited to, the United States) within the meaning of the applicable laws of the foregoing territories, the Standard Contractual Clauses (accessible at https://privacy.uw.edu/design/agreements/dpa/ shall govern such transfers.

SAFEGUARDING DATA

1. Taking into consideration the state of the art, costs of implementation and the nature, scope, context and purposes of the Data Processing, the likelihood and potential severity of risks to the rights and freedoms of natural persons, and the risk of Data Breach, the Processor represents and warrants that it shall implement technical, physical, and administrative security measures appropriate to such risks, which may include, but are not necessarily limited to:

a. The de-identification, anonymization, pseudonymization, and encryption of UPD;

b. The ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems, facilities, and services;

c. The ability to restore the availability of and access to UPD in a timely manner in the event of a physical or technical incident; and

d. A process for regularly testing, assessing, and evaluating the effectiveness of technical, physical, and administrative measures for ensuring the security of the Data Processing.

2. The Processor’s measures for protecting UPD shall (a) meet or exceed industry best practices for safeguarding personal data, and (b) be based on the concepts of privacy by design and by default.

DATA BREACH responsE

1. The Processor shall have sufficient capabilities for detecting, identifying, and responding to a Data Breach.

2. If the Processor has reason to believe that a Data Breach has occurred, then, without undue delay, the Processor shall notify the University of said Data Breach. Such notification to the University shall include sufficient information to enable the University to meet its obligations under applicable law.

3. In the event of a Data Breach, the Processor shall cooperate with the University and immediately:

a. Investigate and identify the nature of the Data Breach;

b. Preserve relevant evidence;

c. Contain, remediate, and mitigate the Data Breach; and

d. Notify the University of any additional or newly-emerged information beyond the initial Data Breach notification to the University described in § H.2.

4. In the event of a Data Breach caused in whole or part by the Processor:

a. The University may instruct the Processor, at the Processor’s expense, to provide:

i. Notice when required by applicable law, or when a Data Breach could result in harm to individuals and/or risk to the University; and/or

ii. Services such as credit monitoring or identity theft protection to individuals when the absence of such services could result in harm to individuals and/or individuals would have a reasonable expectation that such services be provided.

b. Alternatively, the University may elect to provide the aforementioned notice and services itself.

5. Notwithstanding the foregoing, unless the Processor is required by law to provide the aforementioned notice and/or services in a particular manner, the University shall control the time, place, content, and manner of such notice and services.

DISPOSITION OF UPD UPON Termination OR FULFILLMENT OF PURPOSE

4. The duration of Data Processing by the Processor shall be no longer than the expiration or termination of the Agreement or fulfillment of the Purpose with respect to UPD, whichever is earlier.

5. Upon expiration or termination of the Agreement, or fulfillment of the Purpose with respect to UPD, whichever is earlier, the Processor shall transfer to the University any and all UPD, unless otherwise instructed by the University in writing.

gENERAL TERMS

1. SURVIVAL AND ORDER OF PRECEDENCE. This DPA shall survive the expiration or earlier termination of the Agreement. In the event the provisions of this DPA conflict with any provision of the Agreement, or the Processor’s warranties, support agreement, or service level agreement, the provisions of this DPA shall prevail.

2. SEVERABILITY. If any provision of this DPA is found to be unenforceable, the remainder of the Agreement and this DPA shall remain in effect.

3. HEADINGS FOR CONVENIENCE ONLY. Any and all subject headings are not substantive and are for convenience only.

4. NOTICES. Any notices or communications required or permitted to be given by this DPA must be (a) given in writing, and (b) personally delivered; mailed by prepaid, certified mail, or overnight courier; or transmitted by electronic mail (including PDF) with receipt acknowledged, to the party to whom such notice or communication is directed, or to the mailing address or regularly monitored electronic email address of such party.

IN WITNESS WHEREOF, this DPA has been executed as of the date of the last party to sign below (“Effective Date”). If signed in counterparts, then each shall be considered an original thereof.

University:

Signature

Processor:

Name and Title

Date

DESCRIPTION OF DATA PROCESSING EXHIBIT

This Description of Data Processing Exhibit to the Data Processing Agreement (the “DPA”) sets forth certain information relating to the Data Processing, current as of the date of the last signature below (including in a countersigned version of this Description of Data Processing Exhibit), that the Parties anticipate will be carried out in connection with the Work as defined in the DPA. This version of this Description of Data Processing Exhibit may be superseded by subsequent versions issued in accordance with Section § D.2 of the DPA.

1. NATURE AND PURPOSE

[Describe the nature (such as the operations to be undertaken by the Processor, volume of personal data, etc.) and the purpose (such as the University’s mission and the University department or unit’s specific objectives that will be fulfilled through the Processor’s Data Processing)]

2. CATEGORIES OF DATA SUBJECTS

[List the categories of individuals about whom personal data relates (such as currently enrolled undergraduate students, prospective academic personnel, alumni who have donated to the University between 2008-2018, etc.)]

3. TYPES OF PERSONAL DATA

[List the personal data points that will undergo Data Processing including any special categories of personal data. NOTE: special categories of personal data include information relating to racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation.]

4. PROCESSOR CONTACT PERSON

[Insert name, title, mailing address, email address, and phone number]

5. UNIVERSITY DEPT/UNIT CONTACT PERSON

[Insert name, title, mailing address, email address, and phone number]

6. SUB-PROCESSORS

[The Processor must list all Sub-processors that will perform any GDPR-governed Data Processing (such as cloud storage providers, hosting providers, etc.), with an explanation of each Sub-processor’s Data Processing activities. If GDPR does not apply or the Processor does not use any Sub-processors for GDPR-governed Data Processing, insert “Not Applicable”.]

University:

Processor:

Controller to Processor Data Processing Agreement

Version September 2021 image1.gif image2.emf

Confidentiality Statement RFP.docx Attachment B

To be completed and returned with proposal

CONFIDENTIALITY STATEMENT

The provider of services shall keep all work and services carried out hereunder for the University of Washington entirely confidential and not use, publish or make known any information to any persons other than the personnel of the parties of the agreement. The confidentiality of such information will survive the conclusion of the provider’s work and the termination of the agreement.

AGREED TO:

Signature: ____________________________________________________

Printed Name: ________________________________________________

Date: ________________

RFQQ 11-0025 Attachment B image1.jpeg image3.emf

OMWBE RFP.doc

ATTACHMENT C

Complete and return with proposal

Minority and Women's Business Enterprise (MWBE) Response Form

This solicitation includes voluntary goals for MWBE participation. If the Vendor has been certified by the State of Washington Office of Minority and Women's Business Enterprises (OMWBE), please complete Part 1 below. If the Vendor is proposing to subcontract or joint venture with certified Minority Business Enterprises (MBE's) or Women's Business Enterprises (WBE's) please complete Part 2. If the Vendor proposes no MWBE participation in the bid, so indicate in Part 3.

1.

MWBE VENDOR:

Vendor is certified by the OMWBE as: (check as applicable)

MBE

FORMCHECKBOX

Both Minority and Woman Owned FORMCHECKBOX

WBE

FORMCHECKBOX

Combination 50% Minority / 50% Woman Owned FORMCHECKBOX

2.

MWBE SUBCONTRACT PARTICIPATION:

The voluntary goals for MWBE participation in this contract are established in the accompanying solicitation.