Agreement

C23-1034

MASTER SERVICES AGREEMENT.

This Master Services Agreement (the “Master Agreement” or the “Agreement”) is made as of this 28" day
of September, 2023 by and between City of Glendale(“Client”) and Access Information Management
Corporation and its_affiliates, (“Company”). Client and Company are each a “Party” and collectively the
“Parties” to the Agreement. The effective date of this Agreement is the date of the last signature date below (the
“Effective Date”).

In consideration of the mutual covenants contained herein, and other good and valuable consideration,
the receipt and spGisiene of which are hereby acknowledged, the Parties hereby agree as follows:

1.1. Unless otherwise specified in this Master Agreement, all terms used and not defined herein
have the meanings assigned to them in Exhibit A.
2. Term.
2.1. Term of the Master Agreement. The Agreement will commence on the Effective Date and

shall continue for an initial term of three years. Each Statement of Work (as defined below) where applicable, will
remain in full force and effect in accordance with its terms, unless terminated earlier in accordance with the
provisions of Section 7. In the event that any Statement of Work is in effect as of the termination or expiration of
the Agreement, then, notwithstanding anything to the contrary in Section 7, the Agreement will continue in effect
solely for the term of,.and for purposes of, such Statement of Work.

2.2. Extension. The Term may be extended for one (1) one-year period by mutual agreement of
the parties in a signed writing. In the event that Company continues to hold Records after the expiration or
termination of this Agreement, the terms of this Agreement shall continue to apply until all Records have been
removed from Company’s facilities.

3. Services.

3.1. Company, acting through its affiliates, agrees to provide, and Client wishes to purchase,
the services set forth in this Section 3.1 (as may be applicable, the “Services”) subject to the provisions in this
Agreement. By tendering records to Company for storage or destruction, or utilizing other related services of
Company, Client accepts the terms and conditions of this Agreement. Each Service shall be provided in accordance
with Company’s standard operating procedures applicable thereto at the time the parties entered into this
Agreement, and as modified in Company’s sole discretion from time to time.

3.1.1. Storage and Related Services. Client hereby engages Company to store and provide
services in connection with (collectively, “Storage Services”) Client’s documents, media, open shelf storage,
electronic or digital images and records and other deposit items (collectively, the “Records”) subject to the
terms and conditions of this Agreement. By providing any Records to Company or receiving Services from
Company, Client accepts the terms of this Agreement.

3.1.2. Destruction Services.

(A) Destruction of Records in Storage. Company may provide services for the secure
destruction of Records (“Destruction Services”) held in storage by Company if requested
by Client. If Client requests, Company will furnish a Certificate of Destruction to Client.

(B) Other Destruction Services. If Client requests, as part of Destruction Services
Company may: (i) provide shredding consoles and other equipment (“Consoles”) in
Client’s facilities for the collection of papers to be destroyed; (ii) service the Consoles
on an agreed schedule or as needed; (iii) provide mobile on-site shredding on an agreed
schedule or as needed; and/or (iv) securely destroy other materials as requested by Client

1

in writing. Consoles remain the property of Company at all times and Client will not file
any lien, nor allow any lien to be filed against the Consoles. Client shall place only office
paper in Consoles. Client shall reimburse Company for loss or damage to any Consoles
and for any damage to Company’s shredders caused by non-paper products.

3.1.3. Conversion and Software Services

(A) Conversion Services. If requested by Client, Company may provide scanning,
imaging, and/or indexing services (collectively the “Conversion Services”, and
together with any other services under this Agreement, the “Services”) in connection
with Client’s Records. As a result of the Conversion Services, Company shall deliver an
electronic copy of the serviced Records, or other embodiment of its efforts
(“Deliverables”) as set forth in one or more work orders mutually agreed upon by the
Parties and made part of this Agreement. Criteria for acceptance of Conversion
Services or Deliverables are set forth within each applicable work order.
Notwithstanding anything to the contrary herein or in any work order, satisfactory
completion and acceptance of any Conversion Services and/or Deliverables shall be
deemed to have been delivered and accepted by Client if Client does not object in
writing to such Conversion Services or Deliverables within thirty (30) days of receipt
by Client. Client hereby acknowledges and agrees that it shall not control the manner,
means or methods by which Company performs any Conversion Services contained
herein.

(B) Software Services. If Client requests that Company provide software services or any
other services, the Parties shall execute the applicable addendum and attachments
thereto.

3.2, Other terms for Record Storage. Access and Delivery.

3.2.1. Client shall not at any time store with Company any materials that it knows would
attract insects or vermin, are highly flammable, explosive, toxic, radioactive, dangerous or illegal to possess
or store, or that are otherwise deemed by Company, in its sole discretion, to represent a hazard (“Prohibited
Materials”). Company reserves the right, but is not obligated, to inspect any Records and may refuse to accept
and/or remove and redeliver to Client any Prohibited Materials. Client shall also not provide or store with
Company any memorabilia or collectibles, materials having historical value (such as fossils or historical
manuscripts, journals or photographs), artwork, negotiable instruments, jewelry, currency or other items that
have intrinsic market value.

3.2.2. Client shall encrypt all electronic Records that include any personally identifiable
information, nonpublic personal information, sensitive financial information, protected health information,
or any other information where such other information is required by any Applicable Laws to be encrypted
either in transit or at rest or is otherwise subject to regulation governing its disclosure to third parties, before
transmitting or otherwise delivering those Records to Company. Client shall use reasonable encryption methods
for the type of records being provided, but in no event less than required by Applicable Law or otherwise
reasonable under prevailing National Institute of Standards and Technologies standards. All encrypted data
must be in a format that is acceptable to Company and is unusable, unreadable or indecipherable to
unauthorized individuals. Company will not verify whether such electronic Records are properly encrypted.

3.3. Additional Services: Statements of Work.

3.3.1. In the event the Parties agree to that Company should perform new services in
addition to those services contained in the SOW attached to this Master Agreement (“Additional Services”),

2

such new services shall be the subject of a new or amended Statement of Work (each, a “Statement of
Work” or “SOW7”) and incorporated into this Agreement by a written, signed amendment hereto. . Each
such SOW will contain a description of the Additional Services, as well as any applicable reports, technical
requirements, specifications or additional information required to utilize the Services.

3.3.2. Each SOW must be executed by an authorized representative of each Party. The
SOW properly executed in accordance with the terms of the Agreement are hereby incorporated into and
made part of the Agreement and are subject to and governed by the terms of the Agreement.

3.3.3. Unless otherwise agreed upon in a Statement of Work, a breach of a Statement of
Work is a breach of the Agreement, and such breach grants a Party with all rights contemplated by the
Agreement and under Applicable Laws.

3.4, Company’s Responsibilities and Obligations.

3.4.1. Company will perform the Services and any Additional Service described in a
SOW in a professional and workmanlike manner and carry out any necessary supervisory, administrative, health
and safety, clerical and other duties to implement the Services;

3.5. On-Premise Services or Access to Client Systems or Networks. To the extent any Services
are performed on facilities or premises owned, leased or occupied by Client or require access to Client computer
systems or networks:

3.5.1, Company will: (i) comply with Client policies, procedures and rules (excluding
financial penalties) regarding the access or use of such Client facilities, premises and/or Client computer systems;
ii) not tamper with, disable or damage any security mechanism, data, systems, software, hardware or equipment
on Client networks; (iii) perform only the Services authorized by Client in areas of Client’s facilities, premises
and/or Client computer systems specified by Client; and.(v) use Client computer systems for the sole purpose of
performing under the Agreement and any applicable SOW;,.

3.6. Order of Precedence. In the event of any inconsistency among the Agreement, a Statement
of Work or any exhibit, schedule, work order, attachment, addendum or amendment to the Agreement or a Statement
of Work, the order of priority (from highest to lowest) will be: (i) this Agreement, as amended; (ii) any exhibit,
schedule, work order, attachment or addendum to this Agreement; and (iii) a Statement of Work.

3.7. Personnel.

3.7.1, Company will: (i) be solely responsible for the employment of a sufficient number
of suitable and appropriately qualified staff to perform the Services in accordance with the Agreement and the
applicable SOW; and (ii) take all necessary steps to ensure that all employees involved in the provision of the
Services comply with the standards and requirements of the Agreement.

3.7.2. Company will be solely responsible for and will promptly pay all salaries and other
monies owed to its employees, agents and independent contractors. Company and Company’s employees, agents
and independent contractors are not eligible to participate in any benefit plan for Client employees. In addition,
Company will be solely and exclusively responsible for the payment of all required federal, state and local taxes
and contributions arising out of the employment of its personnel.

3.7.3. Client will have no direction or control over Company or any Company employee
or the manner and method utilized by Company to perform the Services in conformance with the terms, conditions
and obligations of the Agreement. Upon the reasonable request of Client, Company shall remove an identified
Company employee from the performance of the Services and as promptly as practicable thereafter, replace the
removed employee with a replacement employee at no cost to Client.

3.7.4. Company will conduct a background screening of personnel assigned to perform
Company’s obligations under the SOWs on behalf of Client at Company’s expense, as permitted by Applicable
Laws. Subject to Applicable Laws, Company will not assign any person who: (i) is not qualified to perform the
essential job functions; (ii) poses a known risk to the health, safety or welfare of others; (iii) has been convicted of
a criminal offense in the past seven years in a matter where the nature and gravity of the offense are substantially
related to the Services to be performed and render the person unfit to perform the Services; or (iv) is known to be
engaged in illegal drug use.

3.8. Subcontracting. Company will not subcontract all or any part of its obligations or rights
pursuant to the Agreement without the prior written approval of Client. In the event Client consents to the use of a
subcontractor, Company: (i) will be responsible for any acts and/or omissions of a subcontractor to the same extent
as if the acts and/or omissions had been performed directly by Company; (ii) must actively and diligently supervise
the activities of all subcontractors and (iii) must ensure the subcontractors’ compliance with the terms of the
Agreement. Client consents to the use of a transportation subcontractor utilized by Company from time to time,
provided such contractor is licensed and maintains adequate insurance coverage. Company’s use of temporary
employees that are at all times under the supervision, direction and control of Company shall not be deemed the use
of a subcontractor. The delegation of Company obligations to affiliates under common ownership and control is not
a subcontract and is permitted hereunder.

3.9. Equipment. Client shall not be responsible for supplying any tools, equipment or other
materials to Company for the provision of the Services, unless agreed to in writing by the Parties under the
applicable SOW.

4. Taxes and Expenses.
4.1. Taxes.

4.1.1. Company will be responsible for remitting to the appropriate taxing authority or agency
any taxes collectible by it from Client. Company will reimburse Client for any penalties and/or interest charged by
taxing authorities due to Company’s failure to collect and remit taxes where required.

4.1.2. Each Party will provide to the other Party, at its sole cost, all reasonably required
documentation for tax purposes and other exemption information reasonably requested by and required of the other
Party.

4.2, Reimbursable Expenses.

4.2.1. Client will have no obligation to reimburse Company for third-party expenses or other
costs incurred by Company to provide the Services, unless a Statement of Work expressly contemplates the
reimbursement of such expenses and costs.

4.2.2. All invoices that include costs to be paid by Client must be accompanied by
documentation of the costs if requested by Client.

5. Payments.

5.1. Payment Terms. Payment is due thirty (30) days from the date of Company’s invoice.
Client may, without triggering a default hereunder and without incurring interest, withhold disputed amounts from
any invoice submitted by Company provided that Client, by the due date of the invoice, both pays the undisputed
portion of any invoice and informs Company in writing of the disputed amount and the basis for such assertion.
Company agrees to reconcile such discrepancies and refund any overpayments, and/or disputed amounts within
thirty (30) working days after having received such written notice from Client. Upon verification of overpayment
and/or dispute, Company shall issue a credit within fifteen (15) working days and/or Client shall pay any amounts
owed within fifteen (15) working days of resolution. Software subscription/license fees are billed pursuant to the
payment terms specified in the applicable SOW in advance. Service charges are billed in arrears.

5.2, Charges. Client agrees to pay to Company charges for Services as attached hereto or as set
forth in the applicable Price Schedule(s) for the subject SOW(s). Except as expressly provided otherwise ina SOW
for Additional Services, rates are fixed for the first twelve months and shall thereafter increase as hereinafter set
forth over the then current rates every twelve months (even after termination or expiration of this Agreement and/or
any SOW, for so long as Company has any Records in its care, custody and control). Notice under this Section 5.2
may be sent by email, fax or first-class mail to an employee or representative of Client. Rates shall increase by the
greater of: (a) five (5%) or (b) the increase in the CPI-U. CPI-U shall mean the Consumer Price Index as published
by the U.S. Department of Labor, Bureau of Labor Statistics for all Urban Consumers, “all items” (1982-84=100).
CPI-U shall be measured by the twelve-month period commencing with the first day of the month that is at least 60
days prior to the month in which the Effective Date occurs.

5.3. Late Payments. Late Payments shall accrue interest at the rate of 18% per annum. Payments
received may be applied to the oldest invoices due.

5.4. Records Retention. During the Term and for a period of seven years thereafter, Company
will maintain complete and accurate books and records to substantiate Company’s charges to Client hereunder and
compliance with the Agreement (the “Books and Records”), unless otherwise required by Applicable Law.

5.5. Hard Copy and Media Storage Payment Clauses.

5.4.1 Unless stated otherwise in an SOW, storage rates are based upon cubic footage, taking
into consideration displacement of space in the storage shelving, and do not reflect an exact measurement of all
stored items, but rather an agreed measurement between Company and Client for billing purposes.

5.4.2 Records stored for a partial calendar month will be billed and payable on the basis of
a full month. Storage charges are billed monthly in advance. Service charges are billed in arrears.

5.4.3 For storage charges each month during the Term, Client shall pay the greater of (a)
the storage charges in the price schedule of the applicable SOW or (B) 80% of the highest monthly storage charge
for the preceding twelve (12) months.

6. Audit and Inspection Rights.

Upon not less than thirty (30) days’ advance written notification by the Client and no more
frequently than once per year, at any time during normal business hours until two (2) years after payment, Client or
its authorized representative shall have the right to inspect and audit Company’s billing records relating to this
Agreement. Company shall provide Client with proper access and facilities to undertake such inspection and audit,
if necessary. In the event an audit discloses overpayment by Client to Company, Company shall provide
reimbursement to Client for such over payment and correct future billing within sixty (60) calendar days.
Notwithstanding the above, if Client’s request for audit occurs during Company’s quarter or year end, or such other
time during which Company cannot reasonably accommodate such request, the parties shall mutually agree on an
extension to the thirty days’ advance written notification. Nothing contained herein will allow Client to review data
pertaining to Company’s other clients or proprietary information related to Company’s security programs.

7. Termination.

7.1. Termination for Cause by Client. Client may terminate the Agreement and/or any
Statement of Work if:

7.1.1. Company commits a material breach of the Agreement and fails to cure such
breach with reasonable period of time, not to exceed thirty (30) calendar days, unless a longer cure period is
permitted by Client in writing;

7.1.2. Company becomes insolvent in that its liabilities exceed its assets or by reason of
Company’s inability to pay its debts or its admission of its inability to pay its debts; Company makes an assignment
for the benefit of creditors or takes similar measures; Company files a voluntary petition in bankruptcy or a similar
proceeding, files any pleading seeking any reorganization, liquidation or dissolution under any law, admits or fails

to contest the material allegations of any such pleading filed against it, or is adjudicated bankrupt or insolvent;
Company has a receiver, trustee, liquidator or other person acting in a comparable capacity appointed for a
substantial part of its assets; or the dissolution of Company for any cause whatsoever.

7.2, Termination for Cause by Company. Company may terminate the Agreement or a
Statement of Work if:

7.2.1. Client fails to comply with any of its material obligations under the Agreement and
such failure is not cured by Client within thirty (30) calendar days after written notice of such failure to comply is
delivered to Client. provided, however, Client shall not have the right to cure more than two (2) payment defaults
in any rolling twelve (12) month period; or

7.2.2. Client makes an assignment for the benefit of creditors; Client files a voluntary
bankruptcy, judicial liquidation or reorganization petition; Client fails to vacate an involuntary bankruptcy or
reorganization petition filed against Client within ninety (90) calendar days from the date of such filing; or Client
fails to vacate, set aside or have dismissed any insolvency proceeding involving Client under any Applicable Law
within ninety (90) calendar days from the date of the commencement of any such proceeding.

In addition to its right to Terminate for Cause, if Client fails to comply with any of its material obligations under
the Agreement and such failure is not cured by Client within thirty (30) calendar days after the second of two (2)
written notices of such failure to comply is delivered to Client (the second notice being at least thirty (30) calendar
days after the first notice) Company may: (a) either (i) redeliver Client’s Records to Client at its address herein (for
which permanent removal, delivery, preparation of inventory reports, data extraction and other charges will apply)
or (ii) refuse Client access to Records until all outstanding invoice(s) are paid in full. If Services are suspended,
Client will remain responsible for payment of all charges accruing during such suspension; and/or (b) exercise such
other rights and remedies as may be allowed at law or in equity as if specific remedies were not herein provided.

7.3. Post-Termination Obligations.

7.3.1. Each Party’s accrued rights and liabilities and the rights and obligations of each
Party that are expressly or by implication intended to be effective upon or remain in effect following the termination
or expiration of the Agreement, including, without limitation, the right to recover damages, will survive any
termination or expiration of the Agreement.

7.3.2. Upon the expiration or other termination of this Agreement or any Statement of
Work, for any reason, Records will be delivered to Client or made available for pick-up by Client, as Client may
request, and, if applicable, all Company’s consoles located at Client’s facilities shall be removed by Company.
Storage charges and charges for services unrelated to the account closure shall continue to apply until all Records
are removed from Company.

7.3.3. Company agrees to provide services and assistance to wind-down or transition the
Services. Company shall deliver Client’s Records at Client’s request or permit Client to retrieve Client's Records
provided Client pays: (a) Company’s charges for account closing services in full in advance (including
decommissioning services if applicable); and (b) stays current on monthly payments for storage and services
unrelated to account closing services and (c) any accrued and unpaid amounts due to Company. Provided Client
remains current on outstanding amounts owed for storage and services fees and other amounts, Records shall be
made available for pick up by Client in their original format. Client agrees that Company shall not be obligated to
make available for permanent withdrawal more than two hundred fifty cubic feet of hard copy Records per week
per Company service market. Company may suspend the release of Records should Client be late on any open
invoices not timely paid, time being of the essence. Client will be required to pay the final month's invoice forty-
five (45) calendar days in advance before Company will be required to retrieve the remaining Records. Company
will present the final month's invoice to Client when Company anticipates that it will complete the permanent
withdrawal process for all of Client's records in the following month.

7.3.4. Inthe event Client fails to pay Company’s invoices for five or more months, then
Client will be deemed to have abandoned all Records and Company is hereby authorized to securely destroy same.
Destruction of Client’s Records is not a waiver of any Company rights.

8. Confidentiality.

8.1. | Company’s Confidentiality Obligations. Company shall comply with the confidentiality
and other obligations set forth in Exhibit B.

8.2. No Right to Use Trademarks or Publicize. Company will not use any trademark, patent,
service mark, trade name, logo or other indicia of Client without Client’s express written consent. Company will
not publish any information about Client’s use of Company’s Services or products, nor will Company use Client’s
name in any advertisement or promotion or in connection with any other solicitation for business (including, without
limitation, in the form of news releases or blog or social media postings) without Client’s prior written approval.

8.2.1. Client acknowledges that it may have access to proprietary and confidential
information of Company (“Confidential Company Information”), consisting of Company’s pricing, contract terms
and conditions (including this Agreement), audit reports or attestations, or SOPs. Except as required by the Arizona
Public Records Law or an order issued by a court of competent jurisdiction, Client shall restrict access to
Confidential Company Information to those employees on a strict “need to know” basis and subject to appropriate
confidentiality obligations commensurate with those herein. Client shall not use or disclose Confidential Company
Information for any purposes other than for the administration, analysis, and enjoyment of this Agreement. For
clarity, any confidential or proprietary information of Company learned by Client during any audit, review or
inspection of Company, including but not limited to audit findings, whether written, visual or oral, is Company
Confidential Information.

8.3. Survival. The obligations in this Confidentiality Section will survive this Agreement until
the confidential information of the Parties is no longer deemed to be Confidential Information.

9. Intellectual Property.

9.1. Ownership of Client and its Affiliates’ Intellectual Property. Company will not use any
Intellectual Property rights or other indicia of Client without Client’s written consent other than to perform the
Services.

9.2. Ownership of Company’s Intellectual Property. Company will retain ownership of all
Intellectual Property created or developed by Company: (i) prior to the Effective Date; and (ii) during the Term
unless Client specifically contracts with Company in an SOW to create or develop a product that the Parties intend
to be the Intellectual Property of Client. For clarity, all software used by the Company in providing services to
Client is Company’s Intellectual Property Information, whether or not modified in any respect during the Term
hereof.

10. Representations, Warranties and Covenants.
10.1. Client hereby represents, warrants and covenants that:

10.1.1. it is the owner or legal custodian of all Records and has full authority to digitize,
store, destroy and otherwise request Services for said Records without any restrictions, in
accordance with the terms of this Agreement;

10.1.2. it has the right to authorize the destruction of the Records for which Client requests
such destruction.

10.1.3. all instructions it issues to Company with respect to the processing of Client
Records will comply with all Applicable Laws; and

10.1.4. it has the authority and power to enter into and perform, and to make all
representations, warranties and grants, under the Agreement.

7

10.2. Company hereby warrants, represents and covenants that:

10.2.1.the Services will be performed by qualified personnel in a professional and
workmanlike manner and in accordance with the highest industry standard;

10.2.2.the Services will comply with the Specifications and standards set forth in the
applicable Statement of Work;

10.2.3. performance of the Services will comply with all Applicable Laws; and

10.2.4.the Services will not in any way misappropriate or infringe upon the rights
(including, without limitation, Intellectual Property rights) of any third party.

10.2.5.the entry into the Agreement and the performance of the Services will not cause
Company to be in violation of Applicable Laws or in breach of any agreement with third parties;
and

10.2.6.it has the authority and power to enter into and perform, and to make all
representations, warranties and grants, under the Agreement.

11. Indemnification.

11.1, Company Indemnification. Company will indemnify, defend and hold harmless Client and
its directors, managers, partners, officers, employees, successors and assigns (collectively, the “Client
Indemnitees”) from and against all Claims, that arise out of or are related to:

11.1.1. any actual or alleged infringement, violation or misappropriation of the
Intellectual Property rights of any third party;

11.1.2. any Claim of unfair competition;

11.1.3. property damage (other than to Records) to the extent caused by
Company’s negligent act or omissions;

11.1.4. disputes between Company and its contractors or subcontractors;

11.1.5. Company’s performance of Services on or at Client’s facilities, premises

and equipment.

11.2. Client Indemnification. Client will indemnify, defend and hold harmless Company and its
directors, managers, partners, officers, employees, successors and assigns (collectively, the “Company
Indemnitees”) from and against all Claims that arise out of or are related to:

11.2.1. any liability, damages or costs, including reasonable legal fees, (collectively,
“Costs”) arising from or relating to the performance of Services requested by Client, including without
limitation requested destruction of Records.

11.2.2. from any Costs arising from or relating to the destruction of any materials placed
in Consoles or tendered for destruction.

11.2.3. any Costs arising from or related to Client’s breach of Section 3.2.
11.2.4. any Claims arising from or related to Client’s breach of Section 10.1.

11.3. Indemnification Procedure.

11.3.1. The indemnified party (“Protected Party”) will notify the indemnifying party
(“Indemnifying Party”) of any Claim within a reasonable time after Protected Party has received written
notice of the Claim. If Indemnifying Party is materially prejudiced by Protected Party’s failure to give

8

notice of a Claim within a reasonable time after Protected Party has received written notice of such Claim,
then Indemnifying Party shall no longer be obligated to indemnify Protected Party. Indemnifying Party
shall have the right to assume direction and control of the defense of the Claim. The Parties will cooperate
in the settlement or defense and give each other full access to all relevant information.

11.3.2. Indemnifying Party will not enter into any settlement without Protected Party’s
prior written consent, unless: (i) there is no finding or admission of liability or culpability by Protected
Party, (ii) there is no effect on any other claim that may be asserted by Protected Party, (iii) the sole relief
is monetary damages that are paid by Indemnifying Party, and (iv) the settlement contains an unconditional
requirement by the claimant to release Protected Party from all liability in respect of such Claim.

12. Insurance.

12.1. Minimum Coverage. Company will maintain Commercial General Liability (CGL)
(including property damage and contractual liability); Automobile Liability; Workers Compensation (according to
statutory requirement), Employers Liability; Professional Liability/Errors and Omissions insurance in the following
minimum amounts covering the acts or omissions of Company, its agents, employees, contractors, or
subcontractors, and from claims under applicable worker’s compensation laws or regulations, related to the
Services under any Statement of Work (i) five million ($5,000,000) dollars General Liability per occurrence (ii)
five million ($5,000,000) dollars Automobile Liability per occurrence (iii) one million ($1,000,000) dollars
Employers Liability and (iv) five million ($5,000,000) dollars million Professional/Errors and Omissions Liability.
The minimums set forth herein may be met by a combination of primary and umbrella policies. The foregoing
requirement as to the types and limits of insurance coverage is not intended to and will not in any way or manner
limit or qualify the liabilities and obligations of Company pursuant to the Agreement. Company’s policy types are:
commercial general liability and umbrella liability are “occurrence” type policies; Professional/Errors and
Omissions is “per claim” type policy; Automobile Liability is “combined single limit” type policy; Company’s
Workers Compensation and Employer’s Liability is “per statute” and “each accident” or “each disease” type policy.
All policies shall be primary and non-contributory to insurance maintained by Client. Company must provide Client
written notice within 30 days of any cancellation of an insurance policy.

12.2. Additional Insured. Client will be named as additional insured on Company’s Commercial
General Liability policy.

12.3. Certificates. Company will, upon request, furnish certificates of insurance, including a
copy of the additional insured endorsement evidencing that Company is in compliance with the insurance
requirements of the Agreement.

13. Business Continuity.

13.1. Company represents and warrants that it has a comprehensive business continuity plan
(“Continuity Plan”) addressing the possibility of a potential disruption of service, disaster, failure, or interruption
of its ordinary business processes. The Continuity Plan will be available for Client to inspect at any reasonable time
in a secure setting, however it cannot be copied. Company will update and revise the Continuity Plan as needed
throughout the Term. Company will implement and execute the Continuity Plan as required in response to any
material disruption in the Services.

14. Business Ethics and Compliance.

14.1. Company will not, directly or indirectly: (i) give any type of payment or anything of value
to anyone where the intent is to improperly influence the person to obtain or retain business or some other
commercial advantage for or on behalf of Client; or (ii) accept any type of payment or anything of value from
anyone where the intent of the giver is to influence Company to act improperly with respect to Client.

14.2. Throughout the Term, Company will maintain and enforce policies and procedures to
ensure compliance with all Applicable Laws. Company will promptly report to Client any request or demand for

financial or other advantage of any kind received by Company in connection with the performance of the
Agreement.

14.3. Company represents that it has an anti-corruption and anti- bribery policy which is enforced
with respect to all employees and is available for Client’s inspection upon request. Company employees who violate
this policy are subject to disciplinary action, up to and including termination of employment.

14.4. Company is committed to maintaining a workplace that is free of unlawful harassment.
Harassment is offensive, unwelcome, physical or verbal behavior due to race, color, religion, sex, pregnancy,
national origin, ancestry, citizenship, age, marital status, disability, protected medical condition, uniform service
member status, veteran status, sexual orientation, gender identity or expression, genetic information or any other
basis protected by law. Company prohibits any conduct which contributes to an intimidating or offensive work
environment and/or interferes with a person's ability to perform his or her job. Employees who violate this policy
are subject to disciplinary action, up to and including termination of employment.

15. Force Majeure.

If either Party is delayed or prevented in the performance of any of its obligations under the
Agreement or a Statement of Work by a Force Majeure Event, that Party will give immediate written notice to the
other Party describing the Force Majeure Event. The affected Party will not be liable for such delay or non-
performance, and the time for performance of the affected obligation will be extended by such period as is
reasonable to enable that Party, using all reasonable efforts, to perform that obligation. Delays caused by Company’s
contractors or subcontractors do not constitute a Force Majeure Event unless their delay is caused by a Force
Majeure Event. A Party’s performance under this Section will be suspended only for so long as the Force Majeure
Event exists. Payment obligations are not subject to Force Majeure.

16. Assignment.

Neither Party may assign, transfer, mortgage, charge, subcontract, sub-license or otherwise dispose
of the whole or any part of the Agreement, whether by operation of law, contract or otherwise (collectively, to
“Assign” or an “Assignment”), without the other Party’s prior written consent, not to be unreasonably withheld.
Provided, however, that either Party may assign the Agreement as of right in the event of a sale, merger or change
of control of a Party.

17. Discrimination Regulations.

Client and Company shal] abide by the requirements of 41 CFR §§ 60-1.4(a), 60-300.5(a) and 60-
741.5(a). These regulations prohibit discrimination against qualified individuals based on their status as protected
veterans or individuals with disabilities and prohibit discrimination against all individuals based on their race, color,
religion, sex, sexual orientation, gender identity or national origin. Moreover, these regulations require that covered
prime contractors and subcontractors take affirmative action 1o employ and advance in employment individuals
without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, disability or veteran
status.

18. Governing Law; Venue.

The Agreement will be governed by and interpreted in accordance with the laws of the state of
Arizona without regard to its conflicts of law provisions. Any litigation or enforcement of an award must be brought
in the appropriate court in the State of Arizona. Each Party consents to personal and subject matter jurisdiction and
venue in such courts and waives the right to change venue. The Parties acknowledge that all directions issued by
the forum court, including injunctions and other decrees, will be binding and enforceable in all jurisdictions and
countries. In the event of dispute under this Agreement, the prevailing party as determined by final, binding
judgment, shall be entitled to seek recovery of reasonable attorney’s fees and costs.

10

19, Miscellaneous.

19.1. Complete Agreement. The Agreement, including the schedules, exhibits and any other
documents referred to herein, constitutes the complete terms agreed by the Parties in relation to its subject matter
and supersedes any and all prior agreements, understandings or arrangements between them, whether oral or in
writing, in relation to such matters. No course of dealing, usage of trade or course of performance will be construed
to supplement, amend or construe any term, condition or instruction of the Agreement.

19.2. Purchase Orders. Any terms and conditions contained in Client’s purchase orders are not
binding upon Company and are expressly rejected.

19.3. Amendments. No variation of or amendment to the Agreement will be effective unless
made in writing and signed by authorized signatories of the Parties.

19.4. Survival. The Sections in the Agreement that expressly or impliedly have effect after
termination, including indemnities, limitations of liability, guarantees, warranties and any undischarged obligations
arising prior to the expiration or termination of the Agreement, will survive expiration or termination and continue
to be enforceable.

19.5. Notices.
19.5.1, Company shall provide written notice to Client:

19.5.1.1. promptly upon Company’s discovery of a Force Majeure Event (notice may
be by email); and

19.5.1.2. promptly if Company has been issued a written citation from any
governmental authority for violations of any Applicable Laws which affects Client.

19.5.2. Any notice subject to this Section will include reasonable detail as necessary to
adequately inform Client. Company will keep Client apprised at all times of the status and development of all
matters relating to any notice.

19.5.3. Any formal notice required to be given under the Agreement must be in writing
and must be delivered personally, or sent by certified or registered mail or by commercial overnight courier, to each
Party required to receive the notice as set out below or as otherwise specified by the relevant Party by notice in
writing to each other Party. Any notice will be deemed to have been duly received: (i) if delivered personally, upon
delivery at the location and to the contact referred to in this Section; (ii) if sent by certified or registered mail, at
9:00 a.m. local time of the recipient on the second Business Day after mailing; or (iii) if delivered by commercial
courier, on the date and at the time that the courier’s delivery receipt is signed. Either Party may change its
representatives by written notice to the other Party.

Notices to Company:

Attn: Market Leader General Counsel
3919 West Washington Street 500 Unicorn Park Drive,
Phoenix, AZ 85009 Suite 503

Woburn, MA 01801

11

Notices to Client:

Attn: City Clerk
Street Address: 5850 W. Glendale Avenue
City, State, Zip: Glendale, AZ 85301

With a copy of al! legal notices to:

Attn: City Attorney
Street Address: 5850 W. Glendale Avenue
City, State, Zip: Glendale, AZ 85301

19.6. Waiver. The failure or delay of either Party to enforce or to exercise, at any time or for any
period of time, any term of or any right or remedy arising pursuant to the Agreement does not constitute and will
not be construed as a waiver of the term, right or remedy, and will not affect the Party’s right to later enforce or
exercise the right or remedy, nor will any single or partial exercise of any right or remedy preclude any further
exercise of the same or any other right or remedy.

19.7. Independent Parties. Nothing in the Agreement is intended to create a relationship, express
or implied, of employer-employee, principal-agent or partnership between Client and Company. Company will not
have and will not represent itself as having any authority to make contracts in the name of or on behalf of Client in
any way.

19.8. No Third-Party Beneficiaries. There are no intended third-party beneficiaries to the

Agreement.

19.9. Counterparts. The Agreement may be executed in multiple counterparts, each of which will
be considered an original, but all of which will constitute one and the same agreement. The signature of any Party
to the counterpart will be deemed a signature to the Agreement and may be appended to any other counterpart.
Electronic or facsimile transmission of an executed signature page will be sufficient to bind the executing Party.
The Agreement may be signed electronically.

20. Limitations of Liability.

20.1 _ Declaration of Valuation of Physical Records or Media. Client declares the value of
all Records to be (A) $1.00 per box, carton, linear foot of open shelf files or other hard copy storage unit (or
gigabyte of digital records) or (B) the actual replacement cost for the physical media with respect to tapes,
cartridges, cassettes or other non-paper media, unless agreed to otherwise in a signed attachment to this

Agreement.

20.2 Stored Records and Electronic Media. Company shall not be liable for any loss or damage
to Records, however caused, unless such loss or damage results from a failure by Company to exercise that care
that a reasonably careful person would exercise under like circumstances, in which case Company’s liability, if any,
for such loss or damage to Records shall not exceed the valuation in Section 20.1 above, but any related loss or
damage caused by the willful misconduct or intentionally malicious acts or omissions of Company’s employees,
agents, contractors, subcontractors or similar representative may be subject to Indemnification as provided in
Section 11 above. Without limiting the generality of the foregoing, Company is not liable or responsible for: (i)
loss or damage arising from Force Majeure or gradual deterioration of Records or media; or (ii) the repair,
replacement or restoration of lost or damaged images, data or other property. Client acknowledges that paper and
electronic storage media such as tapes and CDs deteriorate over time. Records are not insured by Company against
loss, damage or destruction, however caused. Client may, and is recommended by Company to, insure all Records
at its own expense. Client shall cause such insurers of Records to waive any right of subrogation or any other method
of recovery against Company.

12

20.3. Other Claims. Company’ maximum liability with respect to the breach of Exhibits C or D,
and/or a Data Security Breach as defined in Exhibit C and/or the unauthorized use or disclosure of Client’s
confidential information shall not exceed an amount equal to the total payments made by Client to Company for the
twelve (12) months immediately preceding the month during which the Claim arose, multiplied by ten. The
Company’s maximum liability with respect to any storage or destruction Services rendered hereunder is twelve (12)
months of charges paid by Client for such Services immediately preceding the service from which the claim arose.

20.4 Certain Damages. EXCEPT FOR INDEMNITY CLAIMS UNDER SECTION 11
ABOVE, COMPANY WILL NOT IN ANY EVENT BE LIABLE TO CLIENT OR ANY THIRD PARTY FOR
ANY INDIRECT, SPECIAL, INCIDENTAL, EXEMPLARY, CONSEQUENTIAL OR PUNITIVE DAMAGES
(INCLUDING, WITHOUT LIMITATION, LOST PROFITS) RELATED TO THIS AGREEMENT OR ARISING
FROM THE SERVICES, UNDER ANY CAUSE OF ACTION WHATSOEVER, INCLUDING BREACH OF
CONTRACT, BREACH OF WARRANTY, STRICT LIABILITY, OR NEGLIGENCE, EVEN IF COMPANY
HAS BEEN NOTIFIED OF THE POSSIBILITY OF SUCH DAMAGES.

20.5 Other.

20.5.1 Company shall not be liable for any loss or damage caused by completing any
requests, orders or instructions received from any authorized Client employee or representative.

20.5.2 Company is not and shall not be deemed a contract or common carrier for any
purpose. The pricing, valuation and liability provisions of the Agreement reflect that status and shall apply to
transportation services provided by Company.

20.5.3 In the event of any conflict between this Section 20 and any other term or provision,
whether herein contained or in any other agreement between the Parties (regardless of whether such other agreement
is executed before or after this Agreement), this Section 20 will control.

21, Arbitration

Any controversy or claim arising out of or relating to this contract, or the breach thereof, shall be settled by
arbitration administered according to the American Arbitration Association’s Commercial Arbitration Rules, and
judgment on the award rendered by the arbitrator may be entered in any court having jurisdiction thereof.

22. Conflicts. Company acknowledges this Agreement is subject to A.R.S. § 38-511, which allows for
cancellation of this Agreement in the event any person who is significantly involved in initiating, negotiating,
securing, drafting, or creating the Agreement on Client's behalf is also an employee, agent, or consultant of any
other party to this Agreement.

23. Lack of Appropriations. Nothing in this Agreement guarantees that some or all of the funds
necessary to comply with all of the Client’s obligations under this Agreement will be appropriated or otherwise be
available. The Client agrees to seek such appropriations in good faith from the Glendale City Council and that the
lack of appropriation does not permit the Client a right to termination for convenience. If sufficient funds are not
appropriated or otherwise available, the Client may unilaterally terminate this Agreement after providing ninety
(90) days written notice. In the event the Client provides such notice, the Client will not be entitled to a refund or
offset of any amounts previously paid, and the Client will pay any amounts due for post-termination obligations as
provided in Section 7.3.

24. E-verify, Records and Audits. To the extent applicable under A.R.S. § 41-4401, the Company
warrants its compliance and that of any applicable Subcontractor, as defined therein, with all federal immigration
laws and regulations that relate to their employees and compliance with the E-verify requirements under A.R.S. §
23-214(A). The Company or subcontractor’s breach of this warranty shall be deemed a material breach of the
Agreement and may result in the termination of the Agreement by the Client under the terms of this Agreement.
The Client retains the legal right to randomly verify the employment records of the Company to ensure that the

13

Company and its subcontractors are complying with the above-mentioned warranty. Client recognizes that
Company operates secure facilities and that employment records may be maintained at an off-site location or
maintained electronically.

25. Attestation of PC] Compliance. Upon Client’s reasonable request the Company will provide the
Client with a Payment Card Industry Data Security Standard (PCI DSS) attestation of compliance certificate signed
by an officer of Company with oversight responsibility.

26. No Boycott of Israel. To the extent A.R.S § 35-393 through § 35-393.03 are applicable, the parties
hereby certify that they are not currently engaged in, and agree for the duration of the Agreement to not engage in,
a boycott of goods or services from Israel, as that term is defined in A.R.S § 35-393.

27. Uyghur Forced Labor Prevention Act (UFLPA). Company certifies that it does not currently,

and during the term of this Agreement, will not use:

(a) the forced labor of ethnic Uyghurs in the People’s Republic of China;

(b) any goods or services produced by the forced labor of ethnic Uyghurs in the People’s Republic of
China; and

(3) any contractors, subcontractors or suppliers that use the forced labor or any goods or services
produced by the forced labor of ethnic Uyghurs in the People’s Republic of China.

[Signatures are on the following page]

14

IN WITNESS WHEREOF, the Parties have executed this Agreement as of the Effective Date.

ATTES
D by Julie K. Bower
9-29 09:25:02 MST
Julie K. Bower (SEAL)
City Clerk
APPRO S TO FORM:
E by Michael D. Bailey

9-29 09:19:25 MST

Michael D. Bailey
City Attorney

1S

City of Glendale,
an Arizon icipal corporation
ED by Vicki Rios

3-09-29 09:21:34 MST

By: Kevin R. Phelps
Its: City Manager

Access Information Management Corporation
A Massachusetts corporation,

by Andrea Bollefer
9-29 08:43:24 MST

Its:

EXHIBIT A
Definitions

“Affiliates” means any other person or entity that directly or indirectly Controls, is Controlled by or is under
common Control with a Party.

“Applicable Law” means any U.S., state, or local law, statute, code, ordinance, order, rule or regulation that
governs the Services.

“Claims” means all suits, claims, actions, demands, settlements, judgments, awards, damages, costs, fines,
penalties, losses, liabilities and related expenses (including interest, court costs, reasonable fees and expenses of
attorneys, accountants and other experts and professionals, costs of investigations and other proceedings such as
document production and providing testimony).

“Control” means the direct or indirect possession of the power to direct or cause the direction of the
management or policies of a person or entity, whether through ownership of securities, by contract or otherwise.

6

Force Majeure Event” means acts of God, fire, explosion, terrorism, serious civil disorder, war, hostilities
and embargos, pandemics and epidemics, utility outages, governmental orders and other matters entirely beyond
the reasonable control of the Parties. A Force Majeure Event does not include economic hardship, changes in market
conditions, insufficiency of funds, unavailability of equipment or supplies or strikes, work-to-rule actions, go-slows
or similar labor difficulties involving Company.

“Intellectual Property” means any and all: (i) copyrights, trademarks, trade names, domain names, goodwill
associated with trademarks and trade names, designs and patents; (ii) rights relating to innovations, know-how,
trade secrets and Confidential Information (technical and non-technical); (iii) moral rights, mask work rights,
author’s rights and rights of publicity; and (iv) other industrial, proprietary and intellectual property-related rights
anywhere in the world that exist as of the Effective Date or hereafter come into existence, and all renewals and
extensions of the foregoing, regardless of whether or not such rights have been registered with the appropriate
authorities in such jurisdictions in accordance with Applicable Law.

“Personal Data” means any information that specifically identifies any current, former or prospective
employee of Client or its Affiliates or customers or any of their respective employees, and with respect to all such
parties, their spouses and dependents, and includes names, addresses, telephone numbers and any other personally
identifiable information or information that is deemed to be “sensitive personal data” under Applicable Law.

“Records” means Client’s physical or digital documents, media, open shelf storage, digital images, data,
records and other deposit items stored or tendered for storage or digitization or destruction with Company, including
items in transit.

EXHIBIT B

DATA PRIVACY EXHIBIT

Definitions. Terms defined in this Section or elsewhere in this Exhibit B (“Data Privacy Exhibit”), shall have
the meanings set forth herein. Terms defined elsewhere in the Agreement shall have the meanings set forth
elsewhere in the Agreement, except that if a term is defined both in this Data Privacy Exhibit and elsewhere in
the Agreement, then, for purposes of this Data Privacy Exhibit, the definition in this Data Privacy Exhibit will
control.

a. “Applicable Privacy and Data Security Laws” means all applicable data protection, privacy, data
security, and breach notification laws and regulations currently in effect and that may come into effect
during the term of the Agreement.

b. “Cardholder Data” means credit and/or debit card account numbers and any associated information,
including cardholder names, expiration dates, and service codes.

c. “Data Security Breach” means any event involving the actual or reasonably suspected compromise of
the security, confidentiality, integrity, or availability of Client Personal Data, including, but not limited
to, any actual or reasonably suspected unauthorized collection, transmission, destruction, loss,
alteration, corruption, disclosure, use, or acquisition of, or access to, Client Personal Data.

d. “Data Subject” means a natural person to whom Client Personal Data relates.

e. “Process” (or “Processed” or “Processing”) means any operation or set of operations performed on
Client Personal Data, whether or not by automated means, such as collection, recording, sale,
organization, structuring, storage, retention, adaptation or alteration, retrieval, consultation, use,
disclosure by transmission, dissemination or otherwise making available, alignment or combination,
restriction, erasure or destruction.

f. “Services” means the services and deliverables provided by Company pursuant to the Agreement
(including any applicable statements of work).

g. “Subprocessor” means any third party engaged by Company, or by any other downstream Subprocessor
of Company, that will process Client Personal Data in connection with the provision of the Services by
Company.

h. “Client Personal Data” means any information relating to an identified or identifiable natural person
that is Processed by Company and/or its Subprocessors in connection with providing the Services.
Client Personal Data includes Cardholder Data that is Processed by Company and/or its Subprocessors
in connection with providing the Services.

i. Client Confidential Information- means non- public information, whether written, oral, recorded on
disc or in any other media or format that Client designates confidential or that, by its nature or under
the circumstances surrounding disclosure, ought to be treated as confidential. Client’s Confidential
Information includes, without limitation, all Records. All Client Personal Data is Client Confidential
Information. Client Confidential Information does not include information that: (i) entered the public
domain without the Company’s breach of any obligation owed to Client and without wrongdoing by
Company; (ii) was lawfully disclosed without a confidentiality obligation to Company from a source
other than Client; (iii) is or was rightfully in the Company’s possession prior to disclosure by Client;

or (iv) is independently developed by or for Company without use of the Client’s Confidential
Information.

Company shall comply with all Applicable Privacy and Data Security Laws when providing the Services, and
not, by act or omission, place Client or its Affiliates in violation of any Applicable Privacy and Data Security
Laws. Provided, however, all instructions issued by Client to Company with respect to the Services shall comply
with all Applicable Privacy and Data Security Laws. Client acknowledges that Company shall have no liability
when following Client’s instructions in the performance of Services.

Client Confidential Information shall at all times remain the sole and exclusive property of Client, and nothing
in the Agreement will be interpreted or construed as granting Company any license or other right under any
patent, copyright, trademark, trade secret, or other proprietary right to Client Confidential Information.

Company shall Process Client Confidential Information, including the creation and further use or disclosure of
data and analysis derived therefrom, solely for the purpose of, and only to the extent necessary for, the provision
of the Services.

Company will not: (i) sell Client Confidential Information; (ii) retain, use, or disclose Client Confidential
Information for any purpose other than for the specific purpose of performing the Services, including retaining,
using, or disclosing Client Confidential Information for a commercial purpose other than providing the
Services; or (iii) retain, use, or disclose Client Confidential Information outside of the direct business
relationship between Company and Client.

Company shall implement and maintain appropriate technical and organizational security measures in relation
to its Processing of Client Confidential Information in order to protect Client Confidential Information from
accidental or unauthorized destruction, loss, alteration, corruption, disclosure, use, acquisition, or access.
Furthermore, Company agrees to maintain a comprehensive written information security program overseen by
one or more designated employees that (a) contains reasonable and appropriate administrative, technical, and
physical safeguards, (b) includes written security policies that govern access, retention, and transport of Client
Confidential Information, and (c) provides for disciplinary action in the event of a violation of the program
tules.

Except as expressly authorized by Client in writing, Company shall not disclose or otherwise make available
Client Confidential Information to any third party (other than Company’s subsidiaries and affiliates that are
providing Services), unless: (i) the third party is a Subprocessor; (ii) the disclosure is necessary for the provision
of the Services; and (iii) Company has entered into a written contract with the Subprocessor requiring the
Subprocessor to abide by terms of the Agreement or has equivalent standards with respect to the confidentiality
of Client Confidential Information. Company shall be fully responsible, and remain fully liable to Client, for
any Processing of Client Confidential Information by a Subprocessor to the same extent as if the Processing
were performed directly by Company.

Company shall notify Client in writing as soon as reasonably possible and in no event later than forty-eight (48)
hours after confirmation by Company (including its personnel and agents), of a Data Security Breach, and, to
the extent reasonably feasible, shall promptly provide all information regarding the Data Security Breach that
is reasonably requested by Client. Upon discovery of a Data Security Breach, Company shall also immediately:

(i) investigate the reasons for and circumstances surrounding the Data Security Breach; (ii) take all
necessary actions to contain the Data Security Breach; and (iii) to the extent possible, prevent, mitigate, and
remediate any harm resulting from the Data Security Breach. Company’s obligations in this Section 8(iii)
are subject to and limited by Section 20 of the Master Services Agreement.

9

10

12

13

Company agrees to promptly cooperate with and assist Client in relation to the investigation of, and response
to, a Data Security Breach, including, without limitation providing notice, to Data Subjects impacted by a Data
Security Breach under the direction of Client. Unless otherwise required by law, Company agrees that it shall
not inform any third party of any Data Security Breach other than Company’s insurers, outside counsel and
security consultants, including impacted Data Subjects, without first obtaining Client’s prior written consent,
other than to inform a complainant that the matter has been forwarded to Client’s legal counsel. Further,
Company agrees that Client shall have the sole right to determine, unless otherwise required by Applicable
Privacy and Data Security Laws: (x) whether notice of the Data Security Breach is to be provided to any Data
Subjects, regulators, law enforcement agencies, consumer reporting agencies, or others; and (y) the contents of
such notice; Notwithstanding the foregoing, Client acknowledges that Company is required by its insurance
policies to notify its insurers of Data Security Breaches and that its insurers are entitled to direct Company’s
response. Client agrees to cooperate in good faith with Company’s insurers.

If Company will store, transmit, or otherwise Process Cardholder Data then Company represents that it is
presently in compliance with and that it will maintain continuous compliance with the Sections 9 and 12 of the
Payment Card Industry Data Security Standard (“PCI DSS”), which is developed and published by the Payment
Card Industry Security Council.

11 To the extent allowed by law, Company shall notify Client in writing as soon as reasonably possible after
receipt by Company of any complaint, inquiry, subpoena, court order, notice, or other request from a
government regulator or law enforcement personnel, or other person regarding the Processing of Client
Personal Data (each a “Request”). Company shall also notify Client within 10 business days in the event of
a Request from a Data Subject (or their representative) to exercise any of their rights under Applicable
Privacy and Data Security Laws with respect to Client Personal Data relating to them, such as the rights to
access, modify, delete, correct, or transfer such Client Personal Data (each a “Data Subject Request”).
Provided, however, a Data Subject Request must provide sufficient information to identify Client in order
for Company to be able to respond. Company shall not respond to any Request without Client’s prior written
approval, unless otherwise compelled by law. It shall be Client’s sole responsibility to respond to Data
Subject Requests. Company shall cooperate with Client at Client’s expense in seeking any protection from
disclosure of Client Personal Data that Client deems appropriate.

No more often than once annually, unless there is a Data Security Breach, Company shall allow for and
contribute to audits and/or on-site inspections of Company’s compliance with the obligations regarding the
Processing and protection of Client Confidential Information set forth in the Agreement (including this Data
Privacy Exhibit) conducted by Client or another auditor mandated by Client. Any third party designated by
Client shall be subject to the confidentiality provisions in the Agreement and Client shall be jointly and severally
liable for the breach thereof by its auditors. Client agrees to provide Company with at least thirty days’ notice
prior to performing an on-site inspection and to do so only during normal business hours. Audits must be
scheduled by mutual agreement. If Client’s request for audit occurs during Company’s quarter or year end, or
such other time during which Company cannot reasonably accommodate such request, the parties shall mutually
agree on an extension to the thirty days’ advance written notification. Company agrees to reasonably cooperate
with Client regarding such audits or on-site inspections. Any audit or inspection conducted pursuant to this
Section or Exhibit shall be subject to the Company’s reasonable security protocols, none of which will defeat
the essential purpose of the audit.

The Company’s liability for any breach of any of its obligations in this Exhibit B are subject to and limited by
Section 20 of the Agreement.

14

15

16

Notwithstanding anything to the contrary in the Agreement, all notices that Company is required to provide to
Client pursuant to this Data Privacy Exhibit shall be provided in writing to the officials identified in Section
19.5 of the Agreement.

The parties agree that to the extent an Affiliate of Client receives the benefit of the Services, it shall be permitted
to enforce the provisions of this Data Privacy Exhibit against Company without prejudice to Client’s rights or
remedies.

The provisions of this Data Privacy Exhibit shall survive termination or expiration of the Agreement and/or any
applicable statement of work for whatever reason.