12.15. “Subscription Term” means the entire period during which Customer is entitled to use the Subscription Services, including the initial term and any applicable renewal terms.
12.16. “Support Services” means the type of Procore’s customer support for the Subscription Services described in Exhibit A, and as may be specified or purchased within an Order.
12.17. “Updates” means all updates, enhancements, and other modifications that Procore makes generally available, at no additional charge, to its customers of the Subscription Services identified in an Order.
12.18. “Usage Metrics” means the metrics used to determine the scope of Customer’s access and use of the Subscription Services and associated Fees, as set out in an Order.
// Signature Page Follows //
DocuSign Envelope ID: D4E4F8D4-84AE-4394-9B6D-BD966564D633 DocuSign Envelope ID: 864A4536-2679-4503-9CBA-B8F08B8B945E Dec. 6, 2022
Item #5 Page 89 of 103
DocuSign Envelope ID: 864A4536-2679-4503 -9CBA-B8F088889 45E
PROCORE SUBSCRIPTION AND SERVICES AGREEMENT
Procore
By:
4bV4t;l
(sign here)
Signature Page
By:
RLSBAD , a municipal
of the State of California
Alice Bisgrove, VP, Assistant General Counse l
(print name/title)
Associate General counsel
(sign here)
Benjamin sing er
(print name/title)
CLO & corporat e secretary
APPROVED AS TO FORM:
Cindie McMahon , City Attorney
BY: (;LJ.ir., ~- ~
City Attorney
Procore_SSA_Rov 2022.01.10
ATTEST:
~FAVIOLA MEDINA
City Clerk Services Manager
Dec. 6,2022 Item #5 Page 90 of 103
Procore_SSA_Rev 2022.01.10
PROCORE SUBSCRIPTION AND SERVICES AGREEMENT
Exhibit A – Support Services and SLA Agreement
1. OVERVIEW
This Support Services and SLA Agreement (“ SLA”) is entered into by Procore and Customer and covers the Procore Subscription Services defined in the Procore Subscription and Services Agreement (“Agreement ”) to which this SLA is attached. Except as otherwise modified or defined herein, all capitalized terms in this SLA have the meanings set forth in the Agreement.
2. DEFINITIONS
For purposes of this SLA, the following definitions apply:
2.1 “Scheduled Downtime” means the window during which scheduled maintenance of the Subscription Services is performe d.
Procore shall use commercially reasonable efforts to not provide more than 6 hours of Scheduled Downtime per calendar month. Scheduled maintenance is communicated to users through “in app” notifications, with a minimum target of a 24-hour notice.
2.2 “Service Credit” means a calculation dividing the number of days of Subscription Service credited by 365, then multiplied by the annual Subscription Fee. In the event the annual Subscription Fee was $100,000 and the customer was due 3 days of service credit, then 3 divided by 365 times $100,000 would result in a Service Credit to the customer for $821.92.
3. SERVICE AVAILABILITY
Procore’s service- level objective for the Subscription Services is 99.9% of the time, 7 days a week, and 24 hours per day as calculated over a calendar month excluding Scheduled Downtime. This does not include Force Majeure Events or other factors outside of Procore’s reasonable control.
3.1 Service Availability. The Subscription Service will be available 99.9% of the time, 7 days a week, and 24 hours per day as calculated over a calendar month excluding Scheduled Downtime (“ Service Availability”). If Procore does not meet the Service Availability in any individual calendar month, Customer may notify Procore support via a support ticket within 5 business days of a failure by Procore to achieve the Service Availability, including any other relevant details concerning the incident (“SLA Claim ”). Procore will promptly investigate and make a good faith, reasonable determination, based on the information available, as to the validity of the SLA Claim. Failure to timely notify Procore will forfeit Customer’s right to receive a Service Credit.
3.2 Service Credits. Upon Procore’s validation of the SLA Claim, Procore will apply a Service Credit on Customer’s next invoice, calculated in accordance with the chart below. If the Subscription Service (or any portion thereof) is discontinued for any reason, the Service Credit will be in the form of a pro rata rebate at the end of the applicable subscription period. The aggregate maximum number of Service Credits to be issued to Customer for any and all SLA Claims that occur in a calendar month will not exceed fifteen (15) days of Service Credit.
Uptime Availability Days of Service Credit
< 99.9% - ≥ 99.0% 3
< 99.0% - ≥ 95.0% 7
< 95.0% 15
3.3 Exclusions. Customer will not have any remedies under this SLA to the extent any SLA Claim is due to: (a) Customer’s use of the Subscription Services outside the permitted scope described in the Agreement ; (b) any period of unavailability lasting less than ten (10) minutes; (c) Force Majeure Events or other factors outside of Procore’s reasonable control; (d) malfunction of equipment, systems, software, network connections, or other infrastructure not owned or operated by Procore; or (e) Scheduled Downtime.
3.4 Exclusive Remedy. Except for gross negligence or willful misconduct by Procore, the remedies set forth herein represent Customer’s sole and exclusive remedy for breach of the SLA described herein.
4. SUPPORT
DocuSign Envelope ID: D4E4F8D4-84AE-4394-9B6D-BD966564D633 DocuSign Envelope ID: 864A4536-2679-4503-9CBA-B8F08B8B945E Dec. 6, 2022
Item #5 Page 91 of 103
Procore_SSA_Rev 2022.01.10
4.1 Access to Support. Customer and Authorized Users have access to technical support via telephone, online chat, email, or self- paced online tutorials. Support hours can be found at support.procore.com/references/contact-support.
Support does not include training sessions on the features and functionality of the Subscription Services (e.g., implementation) or training in relevant computer skills considered prerequisite to an individual’s ability to use personal computers, the Internet/World Wide Web, and online software in accordance with the requirements of the Agreement.
Furthermore, only qualified, trained Customer support personnel or Authorized Users familiar with Subscription Services are authorized to contact Procore to obtain support.
4.2 Reporting. Before requesting support from Procore, Customer shall use reasonable efforts to comply with any applicable operating and troubleshooting procedures as set forth in the Documentation or as otherwise provided by Procore. If such efforts are unsuccessful, Customer should promptly notify Procore support via Procore’s Ticket Tracking System (“System”) of the issue including any supporting information Customer believes may assist Procore in both its diagnostic determination as well as the Severity/Priority classification. Upon Procore’s receipt of a support request via the System, Procore shall use co mmercially reasonable efforts to answer questions and provide standard error corrections to known problems. In the event of any problems or errors involving the Subscription Services that Procore cannot immediately resolve, Procore shall begin working on a resolution to the problem and shall work diligently and in a commercially reasonable manner on the problem until it is resolved.
4.3 Status Updates. Response time commitment for a first support contact between Procore and Customer after Customer contacts Procore for support is based on the Severity/Priority of the issue as entered into the System by the Customer.
The Severity/Priority levels reported by Customer will be determined by Procore in its reasonable discretion, taking into consideration Customer’s report of the impact and functionality of the issue and impact to Customer. Once Procore receives an error ticket as reported from Customer, Procore shall provide Customer with timely status updates as reasonably determined by Procore until a workaround or other resolution is established by Procore.
DocuSign Envelope ID: D4E4F8D4-84AE-4394-9B6D-BD966564D633 DocuSign Envelope ID: 864A4536-2679-4503-9CBA-B8F08B8B945E Dec. 6, 2022
Item #5 Page 92 of 103
Procore_SSA_Rev 2022.01.10
Procore Customer Data Processing Addendum
This Data Processing Addendum (this "DPA") supplements and forms part of the Subscription Services Agreement or other agreement between Customer and Procore about the provision of Services by Procore to Customer ("Agreement") when Data Protection Law applies to Customer’s access and use of the Services to process Customer Personal Data (defined below).
Customer enters into this DPA on behalf of itself and, to the extent required under applicable law, in the name of and on behalf of its Data Controller Affiliates (defined below) ("Customer"). For the purposes of this DPA only, and except as otherwise indicated, the term "Customer" shall include Customer and Data Controller Affiliates.
Data Processing
a. Scope and Roles . This DPA applies when Customer Personal Data is processed by Procore under applicable Data Protection Law. In this context, where the law provides for the roles of "controller" and "processor," Customer is the Controller of the Customer Personal Data covered by this DPA, and Procore shall be a Processor Processing Customer Personal Data on behalf of Customer and this DPA shall apply accordingly. b. Details of Data Processing.
a. Subject matter. The subject matter of the data Processing under this DPA is Customer Personal Data. b. Duration. The duration of the Processing under this DPA is determined by the Agreement. Regardless of whether the Agreement has terminated or expired, this DPA will remain in effect until, and automatically expire when Procore deletes or anonymizes all Customer Personal Data as described in the Agreement. c. Purpose. The purpose of the processing under the DPA is the provision of the Services by Procore to Customer as specified in the Agreement.
d. Nature of the Processing. Customer Personal data is processed by Procore in connection with the Services under the Agreement and/or any applicable Order.
e. Categories of Data Subjects . The Data Subjects of Customer which may include Customers’ Aut horized Users, employees, contractors, suppliers, or other third parties whose Personal Data is uploaded by Customer for use in connection with the Services.
f. Categories of data. Identifiers (contact detail including name, email, phone number and addresses); Employment Data (professional data, contact details, hours worked, site access) IT Data (IP addresses, browser type, language preferences, cookies data);and other Personal Data that Customer or its Authorized Users elect to submit to the Services.
g. Special categories of data (if appropriate). Procore and/or its Subprocessors do not intentionally collect or process any special categories of data in connection with the provision of the Services under the Agreements. However, Customer or its Affiliates may choose to include this type of data within content that the Customer instructs Procore to process on its behalf.
c. Compliance with the laws. Each party will comply with all laws, rules and regulations applicable to it and binding on it in the performance of this DPA.
d. Jurisdiction Specific Terms. Certain jurisdictions require other specific terms. Where required under applicable Data Protection Law, this DPA fully incorporates the applicable Jurisdiction Specific Terms available at http://procore.com/legal/jurisdiction-specific-terms and updated from time to time, and including the California Consumer Privacy Act of 2018, Cal. Civ. Code § 1798.100 et seq., and its implementing regulations:
Procore’s obligations to Customer under the DPA are only those express obligations imposed by the CCPA that require that a "Business" and a "Service Provider" to have in place. Each party is responsible for fulfilling its respective obligations set out in the CCPA.
Procore will not collect, sel l, retain, disclose or use the Personal Information of the Consumer for any purpose other than to perform the Subscription Services specified in the Agreement, or as otherwise permitted by CCPA.
Procore certifies that it understands and will comply with the restrictions set forth herein.
The terms used in the applicable provisions of the DPA shall be replaced as follows: "Personal Data" shall mean "Personal Information"; "Controller" shall mean "Business"; "Processor" shall mean "Service Provider"; and "Data Subject" shall mean "Consumer" (collectively, the "replaced terms"). Further, the replaced terms shall have the definitions ascribed to in the CCPA.
Documented Instructions.
a. Customer Instructions . Customer shall, in its use of the Services, at all times provide documented instructions to Procore for the Processing of Customer Personal Data, in compliance with applicable Data Protection Law. The Parties agree that this DPA and the Agreement constitute Customer’s documented instructions regarding Procore’s Processing of Customer Personal Data ("Documented Instructions"). Procore will Process Customer Personal Data in accordance with Customer’s Documented Instructions. Additional instructions outside the scope of the Documented Instructions DocuSign Envelope ID: D4E4F8D4-84AE-4394-9B6D-BD966564D633 DocuSign Envelope ID: 864A4536-2679-4503-9CBA-B8F08B8B945E Dec. 6, 2022
Item #5 Page 93 of 103
Procore_SSA_Rev 2022.01.10
(if any) require prior written agreement between Procore and Customer, including agreement on any additional fees payable by Customer to Procore for carrying out such instructions. b. Obligations and Indemnity . Customer shall ensure that its Documented Instructions comply with all laws, rules and regulations applicable to the Customer Personal Data, and that the Processing of Customer Personal Data per Customer's Documented Instructions will not cause Procore to be in breach of applicable Data Protection Law.
Customer is solely responsible for the accuracy, quality, and legality of (a) the Customer Personal Data provided to Procore by or on behalf of Customer; (b) how Customer acquired any such Customer Personal Data; and (c) the Documented Instructions it provides to Procore re garding the Processing of such Personal Data. Customer shall not provide or make available to Procore any Personal Data in violation of the Agreement, this DPA, or otherwise inappropriate for the nature of the Services and shall indemnify Procore from all claims and losses in connection therewith.
Confidentiality of Customer Personal Data. Procore will not access or use, or disclose to any third party, any Customer Personal Data, except, in each case, as necessary to maintain or provide the Services, or as necessary to comply with the law, a Public Authority Request and/or a valid and binding order of a governmental body (such as a subpoena or court order). If a governmental body sends Procore a demand for Customer Personal Data, Procore will attempt to redirect the governmental body to request that data directly from Customer. As part of this effort, Procore may provide Customer’s basic contact information to the governmental body. If compelled to disclose Customer Personal Data to a governmental body, then Procore will give Customer reasonable notice of the demand to allow Customer to seek a protective order or other appropriate remedy unless Procore is legally prohibited from doing so.
Authorized persons. Procore shall ensure that all persons authorized to Process Customer Personal Data on behalf of Procore are made aware of the confidential nature of the Customer Personal Data, and have committed themselves to confidentiality (e.g., by confidentiality agreements) or are under an appropriate statutory obligation of confidentiality.
Authorized Subprocessors . Customer hereby generally authorizes Procore to engage Subprocessors in accordance with this Section 5. Customer approves the Subprocessors currently listed below as Appendix A. If Customer transfers Customer Personal Data to Procore under the SCCs, the above authorization will constitute Customer's prior written consent to the subcontracting by Procore of the Processing of Customer Personal Data if such consent is required under the SCCs. Procore may remove, replace or appoint suitable and reliable further Subprocessors, provided that Procore shall notify Customer, update the list of Subprocessors and provide Customer with an opportunity to object where required under applicable Data Protection Law.
a. Objections. If the Customer reasonably objects to the engagement of a new Subprocessor, Procore shall have the right to cure the objection through one of the following options (to be selected at Procore’s sole discretion): (a) Procore cancels its plans to use the Subprocessor with regard to Customer Personal Data; (b) Procore will take the corrective steps requested by Customer in its objection (which removes Customer's objection) and proceed to use the Subprocessor with regard to Customer Personal Data; (c) Procore may cease to provide or Customer may agree not to use (temporarily or permanently) the particular aspect of the Service that would involve the use of such Subprocessor with regard to Customer Personal Data; and (d) Procore provides Customer with a written description of commercially reasonable alternative(s), if any, to such engagement, including without limitation modification to the Services. If Procore, in its sole discretion, cannot provide any such alternative(s), or if Customer does not agree to any such alternative(s) if provided, Procore and Customer may terminate this DPA with prior written notice, or suspend the affected Services. Termination shall not relieve Customer of any fees or charges owed to Procore for Services provided up to the effective date of the termination under the Agreement. In the event that Procore elects to suspend Customer’s access to and use of affected Services, such suspension shall relieve Customer of any fees or charges owed to Procore for such Services after the effective date of the suspension. If Customer does not object to a new Subprocessor's engagement within ten (10) days of notice by Procore, that new Subprocessor shall be deemed accepted. b. Subprocessor Obligations. Where Procore authorizes a Subprocessor as described in Section 5.1:
a. Procore will restrict the Subprocessor’s access to Customer Personal Data only to what is necessary to provide or maintain the Services in accordance with the Documentation, and Procore will prohibit the Subprocessor from accessing Customer Personal Data for any other purpose; b. Procore will enter into a written agreement with the Subprocessor and, to the extent that the Subprocessor performs the same data processing services provided by Procore under this DPA, Procore will impose on the Subprocessor the same contractual obligations that Procore has under this DPA; and c. Procore will remain responsible for its compliance with the obligations of this DPA and for any acts or omissions of the Subprocessor that cause Procore to breach any of Procore obligations under this DPA.
Security; Audits; Personal Data Breach; Impact Assessments. a. Security. Procore’s provision of the Services will be consistent with the measures described in Appendix B.
DocuSign Envelope ID: D4E4F8D4-84AE-4394-9B6D-BD966564D633 DocuSign Envelope ID: 864A4536-2679-4503-9CBA-B8F08B8B945E Dec. 6, 2022
Item #5 Page 94 of 103
Procore_SSA_Rev 2022.01.10
a. Updates to Procore Security Controls . Customer is responsible for reviewing the information made available by Procore relating to data security and making an independent determination as to whether the Security Controls set forth in Section 6.1, above, meet Customer’s requirements and legal obligations under applicable law.
Customer acknowledges that the Security Controls are subject to technical progress and development and that Procore may update or modify the Security Controls from time to time provided that such updates and modifications do not materially degrade the overall security of the Services during the Subscription Term b. Confidential Security Reports and Audits . Procore does and will maintain compliance with SSAE 18 (SOC 1 & 2), or appropriate and comparable equivalents of those audit standards, for the duration of its processing of Customer Personal Data. Upon request, Procore shall, no more than once per calendar year make available for Customer’s review, a summary copy of an audit report(s) ("Report") that reflects such compliance, a request may be made by emailing [email protected]. Customer acknowledges and agrees that such Reports are Procore’s Confidential Information. Procore shall also provide a requesting Customer with a Report and/or confirmation of Procore's own audits and/or a report of third party auditors' audits of its Subprocessors that have been provided by those Subprocessors to Procore, to the extent such reports or evidence may be shared with Customer (“Third- party Subprocessor Audit Reports”). Customer acknowledges that (a) Reports and Third -party Subprocessor Audit Reports shall be considered Confidential Information as well as confidential information of the third-party Subprocessor and (b) certain third-party Subprocessors to Procore may require Customer to execute a non-disclosure agreement with them in order to view a Third-party Subprocessor Audit Report. c. Personal Data Breach. In the event of a Personal Data Breach, Procore shall notify Customer without undue delay and otherwise respond as described in 6.3.1 below. In addition, Procore shall, taking into account the nature of the Processing and the information available to Procore assist Customer in ensuring compliance with its obligations under applicable Data Protection Law to conduct a data protection impact assessment and, with prior notice, to assist with consultations with the Competent Supervisory Authority (defined below), where required. a. Practices. Procore does and will (a) maintain and follow a documented incident response plan and associated procedures consistent with industry standards for Personal Data Breach handling; (b ) investigate Personal Data Breach of which Procore becomes aware, and, within the scope of the Services, and take such steps as Procore in its sole discretion deems necessary and reasonable to remediate such Personal Data Breach; and (c) notify Customer without undue delay upon confirmation of a Personal Data Breach that is known or reasonably suspected by Procore to affect Customer Personal Data, and provide Customer with reasonably requested information about such Personal Data Breach and the status of the remediation and restoration activities. The obligations herein shall not apply to a Personal Data Breach caused by Customer, Customer’s Authorized Users or misuse of Customer’s Access Credentials. Procore’s obligation to report or respond to a Personal Data Breach under this Section 6 is not and will not be construed as an acknowledgement by Procore of any fault or liability of Procore with respect to the Personal Data Breach.
Procore Assistance with Data Subject Requests . Procore will inform Customer of requests from Data Subjects exercising their Data Subject rights under applicable Data Protection Law (e.g., including but not limited to rectification, deletion and blocking of data) addressed directly to Procore regarding Customer Personal Data. Custome r shall be responsible for handling such requests of Data Subjects. Upon a written request for assistance by Customer, Procore will reasonably assist Customer with handling such Data Subject request. Procore may charge Customer no more than a reasonable ch arge to perform such assistance, and such charges will be set forth in a quote and agreed in writing by the Parties, or as set forth in the Agreement. If Customer does not agree to the quote, the Parties agree to reasonably cooperate to find a feasible solution.
International Transfers of Personal Data
a. U.S. Based Processing . Notification of Changes. Customer acknowledges and agrees that Procore may transfer and process Customer Personal Data to and in the United States and anywhere else in the world where Procore, its Affiliates, or its Subprocessors maintain data processing operations. Procore shall ensure that such transfers are made in compliance with applicable Data Protection Law and this DPA. b. Application of SCCs. The applicable SCC Controller -to-Processor Clauses, currently available through Procore’s Jurisdiction Specif ic Terms located at http://procore.com/legal/jurisdiction -specific-terms, will apply to Customer Personal Data that is transferred via the Services from Europe (defined below) and/or the United Kingdom, either directly or via onward transfer, to any country not recognized by the European Commission, the Swiss Federal Data Protection and Information Commissioner and/or a competent United Kingdom regulatory authority or governmental body as providing an adequate level of protection for Customer Personal Data. This DPA fully incorporates the applicable SCCs by reference. If Customer submits Customer Personal Data to the Services for Processing by Procore, Customer and Procore will be deemed to have entered into the SCCs, where applicable, and the submission of such Customer Personal Data to the Services will constitute Customer’s prior written consent to the transfer and Processing by Procore if such consent is required under the SCCs. The SCCs, will not apply where the Customer Personal Data is DocuSign Envelope ID: D4E4F8D4-84AE-4394-9B6D-BD966564D633 DocuSign Envelope ID: 864A4536-2679-4503-9CBA-B8F08B8B945E Dec. 6, 2022
Item #5 Page 95 of 103
Procore_SSA_Rev 2022.01.10
transferred in a ccordance with an Alternative Transfer Mechanism (defined below), such as when necessary for the performance of Services pursuant to the Agreement or on Customer’s Documented Instructions. c. Explicit Consent and Notice . Customer shall bear sole responsibility for obtaining its Authorized User’s and/or Data Subjects’ informed and explicit consent prior to the transfer of any Customer Personal Data to Procore in a manner consistent with the applicable Data Protection Law. If, at any time, an Authorized User and/or Data Subject withdraws any consent given pursuant to this Subsection, Customer shall immediately inform Procore in writing at [email protected] and cease use and collection of Customer Personal Data related to such objecting Authorized User and/or Data Subject. Customer shall keep an electronic record of all consents given, and any consents withdrawn, by Authorized Users and/or Data Subjects and shall make such records available to Procore upon request.
Return or Deletion of Customer Data.
a. Upon termination or expiration of the Agreement, Procore shall (at Customer's written request) anonymize all Customer Personal Data in its possession or control. This requirement shall not apply to the extent Procore is required by applicable law to retain some or all of the Customer Personal Data. b. Customer acknowledges that the Services are used as a system of record and that data uploaded to the Services is required to be retained under applicable laws for the establishment, exercise or defense of legal claims. As an equivalent to deletion, Procore shall permanently and securely anonymize Customer Personal Data to the extent no individual could be identified.
Indemnification by Customer. To the maximum extent permitted by applicable law and in addition to any other remedy that is available, including the indemnities provided in the Agreement, Customer agrees to defend, indemnify and hold harmless Procore, its Affiliates and Procore’s Subprocessors, including their respective officers, directors, employees, agents, successors, representatives, agents, resellers and assigns (each, a "Procore Indemnitee") from and against any and all Losses resulting Customer’s violation of this DPA and/or the infringement or violation by Customer, its Authorized Users or any other user of Customer’s Access Credentials, of any privacy or other right of any person under applicable Data Protection Law.
Limitation of Liability
a. Exclusion of Damages. UNDER NO CIRCUMSTANCES AND REGARDLESS OF THE NATURE OF ANY ACTION SHALL THE
PROCORE INDEMNITEES BE LIABLE, DIRECTLY OR INDIRECTLY, IN WHOLE OR IN PART, TO CUSTOMER OR TO ANY
OTHER PERSON OR ENTITY FOR ANY LOSSES OR LOSS, DAMAGE, CORRUPTION OR RECOVERY OF CUSTOMER PERSONAL DATA ARISING FROM OR RELATING TO CUSTOMER’S BREACH OF ITS OBLIGATIONS IN THIS DPA. b. Limitation of Liability. Each Party’s and all of its Affiliates’ liability, taken together in the aggregate, arising out of or related to this DPA, and all DPAs between Customer and its Data Controller Affiliates and Procore, whether in contract, tort or under any other theory of liability, is subject to the "Limitation of Liability" section of the Agreement and the applicable cap (maximum) for the relevant party set forth in the Agreement. Any reference in such section to the liability of a party means the aggregate liability of that party and all of its Affiliates under the Agreement and all DPAs together. For the avoidance of doubt, the Procore Indemnitees’ total liability for all Actions by Customer and all of Customers Affiliates (including Data Controller Affiliates) arising out of or related to the Agreement and all DPAs shall apply in the aggregate for all claims under both the Agreement and all DPAs established under the Agreement, and, in particular, shall not be understood to apply individually and severally to Customer and/or to any Customer Affiliate that is a contractual party to any such DPA. To the extent required by applicable law, (a) this section is not intended to modify or limit the Parties’ liability for Data Subject claims made against a Party where there is joint and several liability under Data Protection Law, or (b) limit either Party’s responsibility to pay penalties imposed on such Party by a regulatory authority.
Termination of the DPA . This DPA will continue in force until the termination of the Agreement (the "Termination Date"), provided that the data protection obligations of this DPA and the SCCs shall continue to apply for so long as Procore processes Customer Personal Data.
Severance. Should any provision of this DPA be invalid or unenforceable, then the remainder of this DPA shall remain valid and in force. The invalid or unenforceable provision shall be either (a) amended as necessary to ensure its validity and enforceability, while preserving the parties’ intentions as closely as possible or, if this is not possible, (b) construed in a manner as if the invalid or unenforceable part had never been contained therein.
Entire Agreement; Order of Precedence. Except as supplemented by this DPA, the Agreement will remain in full force and effect.
Any conflict between the terms of the Agreement and this DPA related to the processing of Customer Personal Data are resolved in the following order of priority: (1) the Standard Contractual Clauses, where applicable; (2) the DPA; and (3) the Agreement.
Definitions. Unless otherwise defined in the Agreement, all capitalized terms used in this DPA will have the meanings given to them below:
DocuSign Envelope ID: D4E4F8D4-84AE-4394-9B6D-BD966564D633 DocuSign Envelope ID: 864A4536-2679-4503-9CBA-B8F08B8B945E Dec. 6, 2022
Item #5 Page 96 of 103
Procore_SSA_Rev 2022.01.10
a. "Access Credentials" means any user name, identification number, password, license or se curity key, security token, PIN, or other security code, method, technology, or device used, alone or in combination, to verify an individual's identity and auuthorization to access and use the Services. b. "Action" means any claim, action, cause of action, demand, lawsuit, arbitration, inquiry, audit, notice of violation, proceeding, litigation, citation, summons, subpoena, or investigation of any nature, civil, criminal, administrative, regulatory, or other, whether at law, in equity, or otherwise. c. "Affiliates", "Customer Data", "Procore", and "Services" shall each have the meaning ascribed to it in the Agreement. d. "Alternative Transfer Mechanism" means a mechanism, other than SCCs that enables the lawful transfer of Personal Data from Europe or the U.K. to a third country in accordance with applicable Data Protection Law. e. "Competent Supervisory Authority" means, in accordance with Clause 13 of the EU SCCs, (i) the supervisory authority applicable to the data exporter in its EEA country of establishment or, (ii) where the data exporter is not established in the EEA, the supervisory authority applicable in the EEA country where the data exporter's EU representative has been appointed pursuant to Article 27(1) of the GDPR, or (iii) where the data exporter is not obliged to appoint a representative, the supervisory authority applicable to the EEA country where the data subjects relevant to the transfer are located. With respect to Personal Data to which the UK GDPR applies, the competent supervisory authority is the Information Commissioners Office (the "ICO"). With respect to Personal Data to which the Swiss DPA applies, the competent supervisory authority is the Swiss Federal Data Protection and Information Commissioner. f. "Controller" means the entity that determines as a legal person alone or jointly with others the purposes and means of the Processing of Personal Data. Unless otherwise specified, Controller or "data exporter" refers to Customer. g. "Customer", as used on this DPA, shall include Customer (as defined in the Agreement) and its Data Controller Affiliates. h. "Customer Personal Data" means Customer Data submitted to Procore for Processing in connection with the Services pursuant to the Agreement, which contains Personal Data. i. "Data Controller Affiliates" means any of Customer's Affiliates that have not signed or otherwise accepted their own Order with Procore and therefore would not be a "customer" as defined under the Agreement but is an entity which is:
(i) subject to Data Protection Law; and (ii) permitted t o use the Procore Services pursuant to the Agreement between Customer and Procore. For the avoidance of doubt, no third-party beneficiaries are intended. j. "Data Protection Law" means any data protection and privacy laws and regulations that are applicable to the processing of Customer Personal Data by Procore, including, where applicable, the laws listed in Procore’s Jurisdiction Specific Terms available at http://procore.com/l egal/jurisdiction-specific-terms, as may be amended, superseded or replaced from time to time.
k. "Data Subject" means the identified or identifiable person to whom Customer Personal Data relates. l. "Documented Instructions" has the meaning ascribed in Subsection 2.1 of this DPA. m. "Europe" means the European Economic Area and Switzerland. n. "GDPR" means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of Personal Data and on the free movement of such data and repealing of Directive 95/46/EC (General Data Protection Regulation) o. "including" and its derivatives mean "including but not limited to." p. "Losses" means any and all losses, damages, deficiencies, claims, actions, judgments, settlements, interest, awards, penalties, fines, costs, or expenses of whatever kind, including reasonable attorneys’ fees, expert witness fees, settlement amounts, and the costs of enforcing any right to indemnification hereunder and the cost of pursuing any insurance providers.
q. "Personal Data" means any data that relates to an identified or identifiable natural person, to the extent that such information is protected under applicable Data Protection Law. r. "Personal Data Breach " means a breach of security which results in the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data Processed by Procore or Procore’s Subprocessors.
s. "Procore Indemnitee" shall have the meaning ascribed to it in Section 11, above. t. "Processing" (unless defined differently under applicable Data Protection Law) means any operation or set of operations which is performed upon Personal Data, manually or automatically, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction. u. "Processor" means an entity which Processes Personal Data on behalf of the Controller pursuant to the Agreement.
Processor or "data importer" in this DPA refers to Procore. v. "Public Authority Request" means a government agency or law enforcement authority, including a judicial authority request for information.
w. "Services" means Procore’s Services as set forth in the Agreement. x. "Standard Contractual Clauses" or "SCCs" means : (i) where the GDPR applies the contractual clauses annexed to the European Commission's Implementing Decision 2021/914 of 4 June 2021 on standard contractual clauses for the DocuSign Envelope ID: D4E4F8D4-84AE-4394-9B6D-BD966564D633 DocuSign Envelope ID: 864A4536-2679-4503-9CBA-B8F08B8B945E Dec. 6, 2022
Item #5 Page 97 of 103
Procore_SSA_Rev 2022.01.10
transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council (the "EU SCCs"); (ii) where the UK GDPR applies, the applicable standard data protection clauses adopted pursuant to Article 46(2)(c) or (d) of the UK GDPR (the "UK SCCs"); and (iii) where the Swiss DPA applies, the applicable standard data protection clauses issued, approved or otherwise recognized by the Swiss Federal Data Protection and Information Commissioner ("FDPIC")(the "Swiss SCCs").
y. "Subprocessor" means any Processor engaged by Procore to assist in processing Customer Personal Data in connection with the Services per Customer’s Documented Instructions under the terms of the Agreement and this DPA.
Subprocessors may include Procore’s Affiliates, but shall exclude Procore employees, contractors, and consultants. z. "UK GDPR " means the UK General Data Protection Regulation, as retained in UK law by the European Union (Withdrawal) Act 2018 and renamed by the Data Protection, Privacy and Electronic Communications (Amendments etc.) (EU Exit) Regulations 2020 and the UK's Data Protection Act 2018.
Appendix A – List of Procore Subprocessors
Subprocessor
Name
Nature/Description of
Processing
Subject of
Processing/Customer
Personal Data
Country of
Storage/Processing
Amazon Web
Services
Infrastructure
Cloud Hosting
i.e.: Authorized User
Identifiers, Employment
Data, IT Data
United States
S3 Buckets for storage are
based on region of
Customer and include the
following regions as
applicable:
United States (default)
Australia & New Zealand
Brazil
Canada
France
Germany
Hong Kong
Ireland
Italy
Korea
Singapore
South Africa
Sweden
United Arab Emirates (UAE)
United Kingdom
Amplitude
Inc
Product Analytics i.e.: Authorized User
Identifiers, Employment
Data, IT Data
United States
Ecrion
Software
PDF Template
Processing
i.e.: Authorized User
Identifiers
United States
Fullstory Digital experience
intelligence (DXI)
platform
i.e.: Authorized User
Identifiers and video content
upon consent.
United States
Google
Analytics
Product Analytics i.e.: Authorized User
Identifiers, Employment
Data, IT Data
Global
LaunchDarkly Procore Feature
Management
i.e.: Authorized User
Identifiers, Employment
Data, IT Data
United States
DocuSign Envelope ID: D4E4F8D4-84AE-4394-9B6D-BD966564D633 DocuSign Envelope ID: 864A4536-2679-4503-9CBA-B8F08B8B945E Dec. 6, 2022
Item #5 Page 98 of 103
Procore_SSA_Rev 2022.01.10
Looker Data Analytics i.e.: Authorized User
Identifiers such as email or
user ID, IT Data for requests
management
United States
New Relic Application, Database,
and Machine
monitoring
i.e.: Authorized User Email
Identifiers
United States
Pendo Usage Data Collection
Communication
i.e.: Authorized User
Identifiers, Employment
Data, IT Data
United States
SalesForce Customer Account
Management
Customer Identifiers and
Account Information
United States
Sendgrid Transactional and
Marketing Email
i.e.: Authorized Users Email
Identifiers
United States
Snowflake Data Warehouse i.e.: Authorized User
Identifiers, IT Data,
Employment Data
United States
Sumo Logic Application and System
log aggregation
i.e.: Authorized User
Identifiers
United States
Tableau Data Visualization
Reporting, SQL
i.e.: Authorized User
Identifiers, IT Data,
Employment Data
United States
BugSnag Error Message Logging i.e.: Authorized User IT Data and Identifiers based on error
United States
Additional Subprocessors for Procore Estimating Services ("Estimating") Application
Name
Nature/Description of
Processing
Subject of Processing/Customer
Personal Data
Country of Storage/Processing
Microsoft
Azure
Infrastructure / Cloud
Hosting
i.e.: Authorized User Identifiers,
Employment Data, IT Data
United States
Stripe Payment processor i.e.: Authorized User Identifiers, IT Data, credit card processing as
processed by Stripe
United States
Baremetrics Reporting for stripe i.e.: Authorized User Identifiers, IT Data, proof of payment
United States
Hubspot CRM i.e.: Authorized User Identifiers,
Employment Data, IT Data
United States
Fullstory Application playback for
support
i.e.: Authorized User Identifiers, IT
Data and Screen capture
United States
DocuSign Envelope ID: D4E4F8D4-84AE-4394-9B6D-BD966564D633 DocuSign Envelope ID: 864A4536-2679-4503-9CBA-B8F08B8B945E Dec. 6, 2022
Item #5 Page 99 of 103
Procore_SSA_Rev 2022.01.10
Appendix B - Technical and Organizational Security Measures At all times while Procore Processes Customer Personal Data, Procore will: (a) maintain and follow a written information security program (including the adoption and enforcement of internal policies and procedures) designed to (a) help Customer secure Customer Personal Data against accidental or unlawful loss, access or disclosure, (b) identify reasonably foreseeable and internal risks to Customer Personal Data and unauthorized access to the Services, and (c) minimize Customer Personal Data risks, including through risk assessment and regular testing. Procore will designate one or more employees to coordinate and be accountable for the information security program. The information security program will include the following Security Measures (as updated from time to time):
Physical Access Controls: Procore takes measures, such as security personnel and secured buildings, designed to (i) prevent unauthorized persons from gaining access to Customer Data, (ii) manage, monitor and log movement of persons into and out of Procore facilities, and (iii) guard against environmental hazards such as heat, fire, and water damage.
System Access Controls: Procore takes measures designed to prevent unauthorized use of Customer Data. These controls may vary based on the nature of the Processing undertaken and may include, among other controls, authentication via passwords and two-factor authentication, documented authorization processes, documented change management processes, logging of access on several levels, system audit or event logging, and related monitoring procedures to proactively record user access and system activity for routine review.
Data Access Controls: Procore takes measures designed to ensure that Customer Data is accessible and manageable only by properly authorized staff, direct database query access is restricted, and application access rights are established and enforced to ensure that persons entitled to use a data processing system only have access to the Personal Data to which they have privilege of access, and that Customer Data cannot be read, copied, modified, or removed without authorization in the course of Processing.
Access Policy: In addition to the access control rules set forth in Subsections 1.1–1.3 above, Procore implements an access policy under which access to its system environment, to Personal Data, and to other Customer Data is restricted to authorized personnel only.
Input Controls: Procore takes measures to ensure that: (i) the Customer Data source is under the control of Customer; and (ii) Personal Data integrated into Procore’s systems is managed by secured file transfer from Customer and the Authorized User subject.
Data Backup: Procore ensures that backups are made on a regular basis, are secured, and are encrypted when storing data to protect against accidental destruction or loss when hosted by Procore.
Organizational Management: Procore maintains a dedicated staff responsible for the development, implementation, and maintenance of Procore’s data privacy and information security programs.
Audit: Procore maintains audit and risk assessment procedures for the purposes of periodic review and assessment of risks to the organization, monitoring and maintaining compliance, and reporting the condition of its information security and compliance to senior internal management.
Policies: Procore maintains data protection and information security policies and makes sure that policies and measures are regularly reviewed and where necessary, improve them.
Integration: Procore communicates with Customer applications utilizing cryptographic protocols such as TLS 1.2 or above to protect information in transit over public networks. At the network edge, stateful firewalls, web application firewalls, and DDoS protection are used to filter attacks. Within the internal network, applications follow a multi- tiered model which provides the ability to apply security controls between each layer.
Operations: Procore maintains operational procedures and controls to provide for configuration, monitoring, and maintenance of technology and information systems according to prescribed internal and adopted industry standards, including secure disposal of systems and media to render all information or data contained therein as undecipherable or unrecoverable prior to final disposal. or release from Controller possession.
Incident Response: Procore maintains incident procedures designed to investigate, respond to, mitigate and notify of events related to Customer’s data. or information assets. A dedicated network operations and security operations staff performs rapid monitoring and response capabilities to address alerts.
Network Security: Procore engages in network security controls such as providing for the use of enterprise firewalls and layered DMZ architectures, and intrusion detection systems and other traffic and event correlation procedures designed to protect systems from intrusion and limit the scope of any successful attack.
DocuSign Envelope ID: D4E4F8D4-84AE-4394-9B6D-BD966564D633 DocuSign Envelope ID: 864A4536-2679-4503-9CBA-B8F08B8B945E Dec. 6, 2022
Item #5 Page 100 of 103
Procore_SSA_Rev 2022.01.10
Risk Management: Procore utilizes vulnerability assessment, patch management, and threat protection technologies and scheduled monitoring procedures designed to identify, assess, mitigate and protect against identified security threats, viruses and other malicious code.
Business Continuity: Procore maintains business resiliency/continuity and disaster recovery procedures, as appropriate, designed to maintain service and/or recovery from foreseeable emergency situations or disasters.
Testing is performed to evaluate the plans and recovery capabilities.
Additional information: For additional information on Procore’s security measures and compliance please refer to the information made available and updated periodically at the following link: https://www.procore.com/trust-and- security/security.
DocuSign Envelope ID: D4E4F8D4-84AE-4394-9B6D-BD966564D633 DocuSign Envelope ID: 864A4536-2679-4503-9CBA-B8F08B8B945E Dec. 6, 2022
Item #5 Page 101 of 103
Exhibit 3
Information Technology Department
1635 Faraday Ave ï Carlsbad, CA 92008 ï 760-602-2450 t
Memorandum
Octobe
r 26, 2022
To: Roxanne Muhlmeister, Assistant Finance Director/Purchasing Officer From: Doug Kappel, IT Applications Manager
Via: Maria Callander, IT Director
Re: Approve the cooperative use of the California Multiple Award Schedules (CMAS) agreement with EC America, Inc
The IT Departm
ent would like to cooperatively use the California Multiple Award Schedules (CMAS) agreement CMAS No. 3-118-70-1448C contract with EC America, Inc to provide for the implementation, licensing and subscription service of the Procore Project Managemen t Pro solution. This solution provides for standardization of how construction projects are managed across the organization and implements tools that allow for visibility and transparency into project status and progression.
Staff engaged an outside consultant that worked with city departments to identify and document the city’s project management needs and requirements. At the end of this engagement, the consultant’s recommendation was to implement Procore Project Management Pro for managing construction projects. EC America prov ides for the procurement of professional services, licenses and subscription services for the Procore Project Management Pro solution.
As per Carlsbad Municipal Code Section 3.28.100 – Cooperative purchasing, “The purchasing officer shall have the authority to join with other public or quasi-public agencies in cooperative purchasing plans or programs for the purchase of goods and/or services by contract, arrangement or agreement as allowed by law and as determined by the purchasing officer to be in the city’s best interest. The purchasing officer may buy directly from a vendor at a price established by another public agency when the other agency has made their purchase in a competitive manner.”
Approval for Exemption
_______________________ ______________
Roxanne Muhlmeister, Date
Assistant Finance Director/Purchasing Officer
11/14/2022
Dec. 6, 2022
Item #5 Page 102 of 103
( City of
Carlsbad
Muhlmeister
October 26, 2022
Pag
e 2
CC: Maria Callander, IT Department Director
Cindie McMahon, City Attorney
Brent Gerber, Senior Management Analyst
Shea Sainz, Senior Contract Administrator
Joy Lile, Contract Administrator
Dec. 6, 2022
Item #5 Page 103 of 103