CITY OF MERCED - Contract Summary & Routing Cover Sheet Report Date: 2/10/2022 Contract Name: SMARSH INC. 2022-10-02 Contract No.: 301877 Contract Obligation: $25,906.30 Project No.:
Vendor/Person Name: SMARSH, INC.
Contract Status: Information-Only Services PO #:
Responsible Dept.: (0403) Information Technology
City Dept. Contact: J.R. Wright x6959 Finance PO#:
Key Dates: Effective: 2/28/2022 Expires: 2/27/2023 Retain Until: 2/27/2044 Council Meeting: 3/7/2022 Recorded: Doc. No.:
Contract Categories: Information-Only Agreement
Key Elements:
Key Element Name Eff./Exp. Date Short Text § Value
$ Original Value $25,906.30
Description/Comments APN:
Text messaging and social media archiving.
"Information-Only" Agreement for 03/07/2022.
Routing Information 2nd Submittal
Received by Clerk: 2/7/2022
Signed by Attorney: 1/21/2022
Finance Contract No.: 301877 2nd Submittal
Submitted to Finance: 2/10/2022
2nd Submittal
Submitted to Insurance:
3/1 Risk Management Approval
Forwarded to City Mgr.:
Attested to by Clerk: 311
Approved by Council: 317 E-Mail Address: [email protected] Please sign and return to the Records Clerk, Ext. 6202, in the City Clerk's Office
City of Merced Contract/Agreement Transmittal Form
The City Clerk's Office will keep one original for the City's files, all other originals will be returned Date Submitted: 02/07/2022 Council Approval Needed? Yes Department: Information Technology Council Meeting Date:
Contact Name/Ext: J.R. Wright / 6959
Department Head Signature:
Contract Information (If expediting heeded, please provide a brief explanation below as to why.) SPECIAL HANDLING: CONFIDENTIAL RUSH OTHER DATE NEEDED BY:
Reason:
New Contract
Modification - Amendment #: 4 _Change Order #: Original Contract Date:
Purpose of Contract: Text Message and Social Media Archiving Contract Effective Date: 02/28/2022 02/27/2023
Contract Expiration Date:
Contractor/Vendor Information
Name: Emily Moyer Business License #:
E-Mail: [email protected] Misc. Receivable Acct. #: _ Budget Information
Funds Available in Budget? (Select one)
Yes - Account #: 672-0403-512.24-00
No - Attach a copy of Budget Transfer Form or the Administrative Report appropriating funds • Does not require funds
Amount of Contract: $25,906.30 Amount of Amendment: $
Insurance Information
Does the agreement require the other party to provide certificates of insurance? Yes Have the certificates of insurance with appropriate endorsements been provided? Yes No Types of Required Insurance:
General Liability Worker's Compensation Aviation Liability Automobile Liability _Professional Liability
other:
Required Attachments (as applicable)
Certificate of Insurance Labor & Material Bond Warranty Bond W-9 (or substitution) |Faithful Performance Bond Administrative Report asmarsh®
Order Form (#Q073633)(Service Account Number: 40967)
Client Information
Company Name City of Merced, CA
Address 678 WEST 18TH STREET City Merced
State California Zip 95340
Primary Contact Name Jamie Wright Title IT Manager
(Authorized User) Phone 209-385-6959 Email [email protected] Technical Contact Name Jamie Wright Title IT Manager
Phone 209-385-6959 Email [email protected]
Billing Contact Name Jamie Wright Title IT Manager
Phone 209-385-6959 Email [email protected]
Address 678 W 18th St City Merced
State California Zip 95340-4708
Quote Date 01/13/2022 12:21:32 Quote Expiration 02/28/2022 Smarsh Sales Executive Emily Moyer Term of Subscription 12 Months Activation Date Upon Grant of Access to Service Historical Import Billing In Arrears Setup Fee Billing Upon Contract Execution
Services and Fees
Rate per Minimum Minimum
Quantity Quantity
Pro Support - Basic - Annual $0.00 1 $0.00
Professional Archive - SMG 200 - Annual $700.00 1 $700.00 Professional Archive - SMG 200 Capture & Archive - Annual $82.81 230 $19046.30 Professional Archive - SMG 200 Premium Adj - Annual $28.00 220 $6160.00 Professional Archive-Extended Retention Fee (Per GB)-Annual $2.50 $0.00 Recurring Subtotal $25,906.30
One-Time Subtotal $ 0.00
If Client uses more Connections than it has licensed, Smarsh will bill for that use at $82.81 per connection plus $28.00 for each premium Notes
Connection.
US: +1 (866) 762-7741 UK: +44 (0) 800-048-8612 www.smarsh.com asmarsh
Terms & Conditions
On a date following the execution of this Order Form, Smarsh will provide Client with a license key for the Software or with login le Professional Archive Service Specific Terms available at https://www.smarsh.com/legal/SSTProfessionalCloud; the following Premium Channels Service Specific Terms, i plicable: Mobile Channels Service Specific Terms available at https://www.smarsh.com/legal/SSTMobileChannels, and Twitter Service Specific Terms available a https://www.smarsh.com/legal/SSTTwitter.
The Smarsh Service Agreement - General Terms, the Information Security Addendum, the Service Specific Terms, and this Order Form are, collectively, the "Agreement." The Initial Term of the Services shall begin on the date this Order Form is executed and continue for the Subscription Term specified above, unless Client is adding the above Services to an existing Service account, in which case, the above Services will sync to and co-terminate with Client's existing subscription Term. The Services will be subject to renewals as For AT&T Mobility subscribers, your signature below represents your acceptance of the AT&T Wireless Terms and Conditions available at www.smarsh.com/legal/ATT as they apply to AT&T messages that are archived by Smarsh. "Archive Fees" are the Fees charged for access to the Connected Archive (i.e., Professional Archive or Enterprise Archive). "Capture & Archive Fees" are the Fees that are charged for capture and archive of a bundle of Connections within the Professional Archive. "Capture Fees" are the per-Connection Fees that are charged for the capture of Connections by Connected Capture (i.e., Cloud Capture or Capture Server). "Premium Adj. Fees" are the additional Fees that are charged for capture of Connections from premium Channels. "Set-up Fees" are the one-time Fees that are charged to implement a Service. "Professional Services Fees" are the Fees charged for hourly, monthly, or flat rate professional services.
The Platform Fees, the Capture & Archive Fees, the Capture Fees, and the Premium Adj. Fees, as applicable, are invoiced on an annual, up-front basis or a monthly basis in arrears, as specified on page 1 of this Order Form. Client agrees that the Recurring Subtotal above is Client's minimum commitment during each year or month, as applicable, of the Term. Smarsh will invoice Client for any usage over the minimum quantities at the applicable rate indicated in this Order Form.
The Platform Fees, the Capture & Archive Fees, the Capture Fees, and the Premium Adj. Fees, as applicable, are invoiced upon execution of this Order Form. Client agrees that the Recurring Subtotal above is Client's minimum commitment during the Term.
Smarsh will invoice Client for any usage over the minimum quantities at the applicable rate indicated in this Order Form.
If not priced above, data import, conversion (if applicable), and storage Fees for Client's historical data and storage Fees for data from Connected Capture or other external capture mechanisms ingested into the Professional Archive are as follows:
Data Imports - One-time $10/GB
Import Data Conversion fees $3/GB
Data Storage - Annual $2.50/GB
Information about Smarsh data privacy compliance is available at www.smarsh.com/legal.O Client authorized signature
By —
Stephanie Dietz Saphanie NUt City Manager a 311220
Name:
APPROVED AS TO FORM:
1-2122
OHN B. GOULART Date
SeniorBepyty, City Attorney 300-048-8612 www.smarsh.com Page 2 of 2 Account Number: 672-0403-512-24-00
Amount: $25,906.30
VERIFIED
BY: Winch
Finance Officer
FINANCE ENTRY
Contract No: 301877
Vendor Number: 17974
P.O. Number: 144478
Project Number: n/a
Funds Available: Funds AvailableM 2/24/22
FL 2/25/22
0000000
ATTEST:
CITY CLERK
ipa CITY Of MERCE 1889
BY-
ssistant/Deputy City Cle
INCORPORATED ART
smarsh™
Capture. Reveal. Respond.
Information Security Addendum
Overview
Smarsh will implement and maintain a written information security program that maintains administrative, technical, and physical safeguards, designed to:
• ensure the security and confidentiality of all Client Confidential Information that is processed, stored, or controlled by Smarsh;
• protect against anticipated threats or hazards to the security or integrity of such Confidential Information;
• prevent unauthorized access to or loss, acquisition, disclosure, or use of such Confidential Information; and
• ensure the secure disposal of such Confidential Information in compliance with applicable National Institute of Standards and Technology (NIST) standards.
Smarsh will use reasonable efforts to ensure its written information security program and administrative, technical, and physical safeguards align with accepted industry practices [such as applicable security standards published by International Organization for Standardization (ISO) or NIST], and comply with applicable data protection and privacy laws, as well as the terms and conditions of the Agreement, including those contained in this Information Security Addendum. Detailed information about Smarsh's information security program is contained in the security documentation available by secure login at https://central.smarsh.com.
Smarsh will designate a security manager to oversee its information security program and ensure its compliance with this Information Security Addendum.
1. Personnel Security
1.1. Screening. Smarsh will perform criminal background checks on all Smarsh employees prior to commencement of employment. Smarsh shall not allow any employee to perform services for Client or to access Client Data if such background checks reveal such individual was convicted of a crime involving any type of theft, fraud, bribery, other dishonest acts or the violation of any securities law.
1.2. Training. Smarsh will provide annual security awareness training to all Smarsh employees and contractors and will require Subcontractors to provide such training for their employees. Smarsh will provide additional role-based security training for Smarsh employees and contractors with access to Client Data or the applications that process and store Client Data.
asmarsh
Capture. Reveal. Respond.
1.3. Revocation. Smarsh will revoke physical and logical access for each Smarsh employee within 24 hours of such employee's termination of employment.
2. Facilities & Systems Security
2.1. Facilities Access. Smarsh will employ physical security procedures to ensure that only authorized individuals and guests have access to corporate facilities. Such procedures will include the use of CCTV, cardkey access, processes to log and monitor visitors, and use of receptionists or security guards. Smarsh will maintain surveillance records for at least ninety (90) days.
2.2. Systems Access. Smarsh will follow the principle of "least privilege" when granting access to Smarsh systems. Smarsh will enforce complex password requirements across all Smarsh systems to minimize password-related access control risks.
Smarsh will utilize multi-factor authentication when feasible. Smarsh's information security policies will prohibit Smarsh employees from sharing, writing down, emailing, IM'ing or storing passwords unencrypted on any Smarsh system (including desktops).
3. Product Security
3.1. Smarsh will leverage a "security by design" approach and will utilize a software development life cycle that follows best practices defined by NIST and the OWASP Software Assurance Maturity Model (SAMM).
3.2. Smarsh will proactively ensure the security of its applications and environment by leveraging a "security by design" approach. Smarsh will, in accordance with industry accepted benchmarks such as those published by the Center for Internet Security (or equivalent), security-harden all network devices and servers that will host or process Client Data and code or web applications that are under Smarsh control.
Smarsh will perform both static and dynamic automated web application security code analysis on all code prior to deployment in a production environment and correct security flaws discovered by source code analyses prior to deployment.
Smarsh will, in accordance with generally accepted industry standards, monitor the Services and Smarsh networks, servers, and applications for potential security vulnerabilities. Smarsh will promptly respond to any identified vulnerabilities and assess criticality to resolve, or implement compensating controls for, such identified vulnerabilities within a reasonable amount of time, taking into account the risks posed by each such vulnerability.
3.3. Smarsh will employ then-current industry-standard measures to test the Services for (a) 'back door, 'time bomb,' 'Trojan Horse,' 'worm,' 'drop dead device,' 'virus',
asmarsh™
Capture. Reveal. Respond.
'spyware' or 'malware;' or (b) any computer code or software routine that disables, damages, erases, disrupts or impairs the normal operation of the Services or any component thereof.
3.4. Smarsh QA and test networks and environments will be physically or logically separated from production networks and environments and will not be globally accessible to anyone on the internet. Administrative passwords across QA and test environments will be different than those used in production environments.
3.5. Smarsh will enforce a formal change management process which will include tracking and approving all product changes. Any such changes will be internally reviewed and tested within a staging environment before such changes are finalized and deployed.
3.6. Smarsh will not use Client Data for testing purposes.
4. Data Center Security
4.1. Data Center Access. Smarsh will employ physical security procedures and controls to ensure that only authorized individuals have access to Smarsh data centers.
4.2. Physical Security. Smarsh will employ data center security measures that align with the AICPA trust principles for physical security and will, at a minimum, secure Smarsh data centers using: floor-to-ceiling walls, multi-factor authentication for data center access, 24/7 security monitoring, alarmed exits, and onsite security personnel.
4.3. Data Center Locations. Smarsh primary and disaster recovery data centers will be located in geographically diverse locations to enhance security, availability, and resiliency.
5. Secure Configuration
Smarsh will use the Center for Internet Security (CIS) benchmarks for its secure baseline configurations. Smarsh will use secure configuration management tools to alert of changes to baseline configurations.
6. Data Management
6.1. Segregation. Client Data will be logically segregated from the data of other Smarsh clients.
6.2. Encryption. Smarsh will encrypt Client Data in transit and at rest using encryption techniques that comply with security industry standards published by NIST.
• smarsh™
Capture. Reveal. Respond.
6.3. Back-ups. Smarsh leverages data replication across multiple geographically dispersed data centers as well as a local backup data center.
6.4. Media Destruction. Smarsh will ensure removal of all data from any media taken out of service and destroy or securely erase such media to make it unreadable, undecipherable, and unrecoverable by any means in compliance with applicable NIST standards.
6.5. Removable media. Smarsh will not allow its employees to store Client Data on any portable removable media (such as USB mass storage, external hard drives, and CD/DVDs); provided, however, that if storage on removable media is required to support the services (such as for client-requested data exports) provided under the Agreement, portable removable media must be encrypted as described above in Section 4.2.
7. Vulnerability Management
7.1. Smarsh will deploy vulnerability scanning mechanisms in its information systems and on hosted applications and will configure such mechanisms to conduct regular scans on Smarsh operating systems and infrastructure, web applications, and databases. Smarsh will analyze and assess all scan reports.
7.2. Smarsh will undergo annual penetration testing and will conduct quarterly security audits to identify potential vulnerabilities in the infrastructure used to provide the Services. Smarsh will implement a software/firmware patching program and will apply updates to all infrastructure components in a timely manner in accordance with the NIST 800-53 vulnerability remediation guidelines for critical or high-risk vulnerabilities.
8. Application Performance and Security
Smarsh will use industry-standard technology and tools to monitor the uptime status of its hosted applications and send alerts when any warning conditions need to be reviewed. Smarsh will use industry-standard firewalls, IDS/IPS technology, and malware detection on its networks and hosted applications and will harden its device configurations. Smarsh will require the use of VPN for access to its secure networks.
9. Business Resiliency and Incident Response
9.1. Incident Response. Smarsh's information security program will include written incident response policies and procedures to define roles and responsibilities in the event that there is any actual, or reasonably suspected, unauthorized access to Smarsh facilities or Smarsh systems ("Security Incident"). Such policies and procedures will include processes to ensure that (i) server logs are maintained; (ii) all
asmarsh™
Capture. Reveal. Respond
Security Incidents (defined below) are appropriately logged; (iii) all such server logs are retained for at least ninety (90) days; (iv) all such Security Incident logs are retained for at least three (3) years; and (v) all such logs are appropriately protected to ensure the integrity of such log. Smarsh will immediately implement such procedures immediately upon becoming aware of a Security Incident.
9.2. Client Data Incident. Upon becoming aware of any actual or reasonably suspected unauthorized third-party access to, or disclosure of, Client Data ("Client Data Incident"), Smarsh will: (i) immediately investigate, and take reasonable measures to remediate, the cause of such Client Data Incident, and (ii) promptly, but no later than forty-eight (48) hours after discovery, notify Client of such Client Data Incident.
The notification will include, to the extent known, details of the incident, including the time, date, and nature of the incident and contact information for a member of Smarsh's information security team who can answer additional questions.
9.3. Business Continuity/Disaster Recovery. Smarsh will maintain a Business Continuity and Disaster Recovery Plan ('BCP") for the Services and implement the Plan in the event of a disaster, as defined in the BCP. The BCP will include disaster avoidance procedures which are designed to safeguard Client Data and Smarsh's data processing capabilities in the event of a disaster as defined in the BCP. Smarsh will make an executive summary of the BCP available in its Security Packet. Smarsh will test the BCP on at least an annual basis.
10. Annual Security Reviews
10.1. Smarsh will undergo an annual independent third-party SSAE 16 SOC 2 Type I (or its equivalent or successor) assessment of its information security program and its administrative, technical, and physical safeguards for all facilities used to deliver the Services. Such assessment will include, at a minimum, a network-level vulnerability assessment based on recognized industry practices.
10.2. Smarsh will assess criticality and remediate, or implement compensating controls for, all issues identified in such assessment in a timely manner based on level of criticality and risk.
10.3. Smarsh will include an executive summary of the results of such assessment in the Security Packet available to Client via login at https://central.smarsh.com.
11. Vendor and Third-Party Security
11.1. Risk Assessments. Smarsh will conduct an initial risk review and verification before engaging third-party vendors or subcontracting any of the Services. Thereafter, Smarsh will conduct annual risk reviews of such third-party vendors and subcontractors.
asmarsh™
Capture. Reveal. Respond
11.2. Subcontractors. A list of Smarsh subcontractors is available at https://www.smarsh.com/legal/subprocessors. Smarsh will provide prior notice to Client and allow time for Client to object before Smarsh engages any new subcontractors who will have access to or process Client Data. If Smarsh uses subcontractors to perform any of the Services, Smarsh will (a) enter into a written agreement with each such subcontractor that imposes obligations on the subcontractor (i) that are at least as restrictive as those imposed on or required of Smarsh under the applicable provisions of the Agreement and (ii) that prohibit the subcontractor from accessing or using Client Data except to the extent necessary to perform the subcontracted services; (b) only disclose Client Data to such subcontractor to the extent necessary for the subcontractor to perform the subcontracted services, (c) not be relieved of any of its obligations under this Agreement; and (d) remain liable and responsible for the performance or non- performance of such subcontractor.
12. Client Security Assessments
12.1. Security Documentation. To facilitate Client's risk-based assessment of Smarsh's information security program and administrative, technical, and physical safeguards applicable to Client's Confidential Information, Smarsh will make its Security Packet available to Client via https://central.smarsh.com. The Security Packet includes, among other documentation, Smarsh's completed industry- standard information gathering questionnaire ('SIG") and Smarsh's annual independent SSAE 16 SOC 2 Type Il report. Smarsh will update the Security Packet on a regular basis. If Client requests that Smarsh complete Client's security or other questionnaire(s) in lieu of, or in addition to, the Security Packet, Client must execute an order form and pay a professional services fee based on the size and scope of such questionnaire(s).
12.2. On-site Assessments. Where sufficient to allow Client to complete its risk-based assessment of Smarsh's information security program and administrative, technical, and physical safeguards applicable to Client's Confidential Information, Client shall refer to Smarsh's Security Packet. If Client desires to complete an on- site assessment, Client may conduct no more than one on-site assessment in a 12- month period, all such requests must be received by Smarsh at least 30 days prior to the requested assessment date, all such on-site assessments must be conducted during Smarsh's normal business hours, and Client shall bear all costs associated with such on-site assessment. Smarsh will scope the work required to facilitate such assessment and provide Client with a quote for the professional services fees associated with such on-site assessment. If Client desires to proceed with such on-site assessment, Client must execute an order form or statement of work for such on-site assessment and provide Smarsh with its proposed list of
asmarsh™
Capture. Reveal. Respond.
attendees. Smarsh will invoice Client for such on-site assessment, and Client shall pay the associated fees within 30-days of the invoice date.
13. Export Controls
Smarsh will comply with the export laws and regulations of the United States and other applicable jurisdictions when providing the Services. Smarsh will neither conduct business with nor allow access to its information systems by (a) any person on a government promulgated export restriction list; (b) any U.S.-embargoed countries; or (c) any organization or company on the U.S. Commerce Department's "Denied Parties List."
asmarsh™
Capture. Reveal. Respond.
Service Specific Terms - Professional Archive
These Service Specific Terms - Professional Archive apply only to Client's purchase and use of the Connected Archive Professional Archive Service. Unless expressly stated otherwise, capitalized terms contained in these Service Specific Terms have the meaning given them in the Smarsh Service Agreement - General Terms.
1. Descriptions. The "Professional Archive" is a Service that captures data from the Client's Third Party Services and archives it as Client Data. The Professional Archive includes a supervision module for compliance review and a discovery module for managing collection and export of communications for litigation holds, eDiscovery, and regulatory audits. To enable the Professional Archive to receive Client Data, Client must purchase a bundle of Connections. A "Connection" means one of the following, as applicable to the specific Channel: (a) a user account such as an email mailbox; (b) an instant message account or screen name; (c) a social media page or profile; or (d) a mobile device phone number.
2. Data Retention. Smarsh will retain Client Data captured by the Professional Archive during the Term of the Agreement for a default retention period of up to 7 years at no additional charge. If Client requires Client Data captured by the Professional Archive to be retained for longer than 7 years, Client must purchase extended data retention. Client may implement retention policies within the Professional Archive. Client is solely responsible for ensuring that the default retention period or any other retention policies implemented by Client within the Professional Archive comply with any applicable legal, regulatory, or Client internal requirements. Data that Client sends on removable media to Smarsh for import into the Professional Archive as Client Data will be subject to import fees and additional storage fees, as specified in the applicable Order Form. Data that is sent from Connected Capture or any other external capture service to the Professional Archive as Client Data will be subject to additional storage fees, as specified in the applicable Order Form. Following termination or expiration of the Agreement, Smarsh will retain Client Data for a minimum of six (6) months to allow time for Client to make alternative arrangements for long-term data storage.
Thereafter, Smarsh may delete Client Data in its sole discretion.
3. Data Exports. During the Term, Client may complete self-service exports of Client Data at no additional charge by logging into the Professional Archive. Client may also engage Smarsh to perform exports of Client Data on Client's behalf by signing a separate Order Form and paying the associated Professional Services Fees. Following termination or expiration of the Agreement, Client may maintain access to the Professional Archive and the ability to complete self-service exports by executing a separate historical access agreement. In the alternative, Client may engage Smarsh to perform an export on Client's behalf of all or a portion of the Client Data remaining in the Professional Archive by signing a separate Order Form and paying the associated Professional Services Fees.
3. Client Obligations. Client is responsible for configuring applicable third-party platforms or systems to transmit Client Data to the Professional Archive. If Client wishes to ingest its historical data into the Professional Archive, Client must provide such data in a format acceptable to Smarsh. No later than the second business day of each month, Client shall submit to Smarsh usage reports for the prior month in a format specified by Smarsh.
4. Client-Side Software Terms. Certain Channels may require Client to install software ("Client- Side Software") to allow the Professional Archive to receive Client Data. If Client-Side Software is provided to Client by Smarsh, upon delivery of the Client-Side Software Smarsh grants Client a limited, non-exclusive, non-sublicensable license to download and install the applicable Client-Side Software onto Client's end user's computer, laptop, or mobile device (as applicable), for which Client has purchased a Connection, or on Client owned or controlled servers, plus one copy for backup or archival purposes. Smarsh, and its licensors retain all rights in and to the Client-Side Software that are not expressly granted to Client in this Section 4.
asmarsh™
Capture. Reveal. Respond.
5. Datacenters. The Professional Archive is hosted on Smarsh-managed infrastructure in the United States.
6. Service Level Agreement. The Service Level Agreement applicable to the Professional Archive is available at https://www.smarsh.com/legal/ConnectedArchiveSLA. asmarsh™
Capture. Reveal. Respond.
Service Specific Terms - Mobile Channels
These Service Specific Terms - Mobile Channels apply when Client uses the Professional Archive or a Connected Capture Service to capture or archive text messages from a mobile telecommunications provider or from the CellTrust SL2 app. Unless expressly stated otherwise, capitalized terms contained in these Service Specific Terms have the meaning given them in the Smarsh Service Agreement - General Terms.
Client is only permitted to actively capture and archive text messages for Client's current employees or contractors. Client is not permitted to actively capture or archive text messages for any individual who is not a Client employee or contractor. Client agrees to (i) notify Smarsh immediately when any employee's employment or contractor's service is terminated; and (b) provide each employee and contractor with clear and conspicuous notice of policies regarding the receipt, transmission, storage, and use of employee's or contractor's text messages. Client is responsible for ensuring that each employee and contractor has agreed to such policies and that each employee has been made aware that such employee has no reasonable expectation of privacy in such employee's text messages. Each telecommunications carrier may have a different implementation process. The implementation process Is dependent on actions to be completed by Client and the applicable telecommunications carrier.
Smarsh is not responsible for delays in implementation caused by a telecommunications carrier, CellTrust, Client, or Client employees or contractors.
Certain telecommunications carriers (e.g. AT&T, Verizon and Rogers) require Smarsh to pass through certain additional terms ("Additional Text Service Terms"). Such Additional Text Service Terms are subject to modification by the applicable carrier and such modifications shall be incorporated into the Agreement upon notice to Client. The current Additional Text Service Terms follow.
EACH OF I-III THAT FOLLOW ARE AGREEMENTS MADE BETWEEN CLIENT AND THE APPLICABLE TELECOMMUNICATION CARRIER DIRECTLY. SMARSH IS NOT A PARTY TO THESE TERMS.
[TERMS BEGIN ON THE NEXT PAGE]
asmarsh™
Capture. Reveal. Respond.
I. AT&T Mobile Archiving Terms. These Terms are made between Client and AT&T Mobility.
This agreement is between you as our subscriber ("You") and the affiliate of AT&T Mobility National Accounts, LLC providing wireless service to You ("AT&T"), and it sets forth the terms and conditions ("Terms and Conditions") under which You agree to use and AT&T agrees to provide access to Archived Messages through the Archived Messages Service (as such terms are defined below). By using the Archived Messages Service, You accept these Terms and Conditions, which AT&T may modify from time to time.
1. DEFINITIONS.
1.1. Archived Messages means a Participating Employee's Messages that AT&T has made available to SMARSH for retrieval through use of SMARSH's Archived Messages Service.
1.2. Archived Messages Service means SMARSH's service that provides You access to Archived Messages.
1.3. Customer Liable MDNs means a Mobile Directory Number (MDN) for AT&T wireless service that is established under Your corporate account and corporate name and for which You are financially responsible to AT&T for an AT&T service.
1.4. Employee Liable MDN means a MDN for AT&T wireless service that is established in the name of an individual employee of Your company or other authorized individual and for which such individual is financially responsible to AT&T for AT&T
1.5. Messages means messages sent or received by any Participating Employee via short message service (SMS), multimedia message service (MMS) and/or AT&T Business Messaging Service.
1.6. Participating Employee means Your employee or other authorized user of a mobile device with a Customer Liable MDN whose Customer Liable MDN(s) is subscribed to the Archived Messages Service.
2. ARCHIVED MESSAGES SERVICE.
2.1. You authorize AT&T to make the Messages available to Smarsh for use solely in connection with SMARSH's Archived Messages Services.
2.2. You will only access, use, copy, store or disclose Archived Messages in accordance with these Terms and Conditions. You will not access, use, copy, store or disclose Archived Messages for any other purpose.
2.3. SMARSH. You will enter into an agreement with SMARSH Inc. ("SMARSH") for the Archived Messages Service, and You will pay all of SMARSH's charges for such Archived Messages Service in accordance with that agreement and these Terms and Conditions.
asmarsh™
Capture. Reveal. Respond.
2.4. Customer Liable MDNs Only. You will enroll only Customer Liable MDNs in the Archived Messages Service. You may not enroll any Employee Liable MDNs in the Archived Messages Service.
2.5. Notice and Consent. Prior to enrolling any individual's device in the Archived Messages Service and accessing, using, storing, copying or disclosing any Participating Employee's Archived Messages, You will provide advance disclosure to each such individual containing clear and conspicuous notice of the terms and conditions of the Archived Messages Service, including how You and SMARSH will access, use, copy, retain, protect or disclose such individual's Archived Messages, as well as the duration and purpose of such access, use, copying or retention. You will also obtain all lawfully required consents for those uses of such individual's Messages. You agree to maintain the currency of such consent at all times.
2.6. Transferring a Mobile Device or Customer Liable MDN to Another Employee. Prior to transferring a mobile device or Customer Liable MDN that is enrolled in the Archived Messages Service to another person, you will disenroll or notify SMARSH to disenroll the then-current Participating Employee and the Customer Liable MDN on that mobile device from the Archived Messages Service.
2.7. Acknowledgement and Agreement. You acknowledge that AT&T will make the Archived Messages available to SMARSH for use in connection with the Archived Messages Service and that AT&T will have no further control for the Archived Messages after they are provided to SMARSH. You further agree that AT&T will have no responsibility or liability to You with respect to the Archived Messages after they are provided to SMARSH.
2.8. Limitations and Restrictions. You may access a Participating Employee's Archived Messages only with that Participating Employee's express knowledge and consent. You must maintain records of each Participating Employee's express, informed consent for You to collect and use his or her Archived Messages. If a Participating Employee revokes such consent at any time, then you must immediately cease initiating requests for that individual's Archived Messages.
2.9. Customer Business Records. You agree to maintain full, complete and accurate records related to Your performance under these Terms and Conditions, and You agree to preserve such records for five (5) years from the date of preparation; provided, however, that You agree to retain for at least five (5) years following Your latest access to Archived Messages Service records that are sufficient to demonstrate each Participating Employee's consent to Your access to and use of his or her Archived Messages. Such records shall be available for inspection and copying by AT&T during Your normal business hours, upon five (5) days' notice, but not more than once per quarter, unless otherwise required by applicable law, rule or regulation. If You fail to comply with the obligations set forth in this Section, or if AT&T's review of such records reveals that You are in violation of any of these Terms and Conditions, then, in addition to its other remedies under these Terms and Conditions, Your account agreement with AT&T or at law or in equity, AT&T may terminate your access to the Archived Messages.
2.10. Compliance with Laws, Policies and Practices. You agree to comply with all applicable laws, rules and regulations, including all applicable consumer protection, marketing, data security, export and privacy laws and Federal Trade Commission privacy initiatives. You are solely responsible for making any asmarsh™
Capture. Reveal. Respond.
disclosures required by law, rule, regulation, or otherwise regarding the nature, accuracy, effectiveness, or limitations of the Archived Messages Service.
2.11. Indemnification. You agree to indemnify and hold AT&T, its officers, directors, employees and agents harmless from and against any claim, damage or loss that is related to or arising out of Your failure to comply with any of these Terms and Conditions, including reasonable attorney's fees.
asmarsh™
Capture. Reveal. Respond.
Il. Verizon Mobile Archiving Terms.
This agreement is between you as our subscriber and Verizon Wireless ("VZW") and it sets forth the terms and conditions under which you agree to use, and we agree to provide access to, Archived Messages through the Archived Messages Service (as such terms are defined below). By using the Archived Messages Service, you accept these Terms and Conditions, which may be modified by us from time to time.
1. DEFINITIONS
1.1. Archived Messages means the Participating Employee's Messages available for retrieval by SMARSH from VZW.
1.2. Archived Messages Service means SMARSH's service that provides Archived Messages to you.
1.3. Customer Liable MDNs means a VZW Mobile Directory Number (MDN) that is established under your corporate account and corporate name for which you are financially responsible for the payment to VZW for VZW service.
1.4. Employee Liable MDN means a VZW MDN that is established in the name of an individual employee of your company and such individual employee is financially responsible for the payment to V ZW for VZW services.
1.5. Messages means messages sent or received by the Participating Employee via the short message service (SMS) or the multimedia message service (MMS).
1.6. Participating Employee means your employee who has opted into the Archived Messages Service via your Customer Liable MDN.
2. ARCHIVED MESSAGES SERVICE.
2.1. You will only access, use, copy, store or disclose Archived Messages in accordance with these Terms and Conditions. Customer will not access, use, copy, store or disclose Archived Messages for any other purpose.
2.2. SMARSH. You will enter into an agreement with SMARSH Inc. ("SMARSH") for the Archived Messages Service and you will pay all of SMARSH's charges for such Archived Messages Service in accordance with such agreement and these Terms and Conditions.
2.3. Customer Liable MDNs Only. You will enroll only Customer Liable MDNs in the Archived Messages Service. You will not enroll any Employee Liable MDNs in the Archived Messages Service.
2.4. Notice and Consent. Prior to enrolling any employee in the Archived Messages Service and accessing, using, storing, copying or disclosing any Participating Employee's Archived Messages, you will provide advance disclosure to each employee containing clear and conspicuous notice of the terms and conditions of the Archived Messages Service, including how you and SMARSH will access, use, copy, retain, protect or disclose such employee's Archived Messages, as well as the asmarsh™
Capture. Reveal. Respond.
duration and purpose of such access, use, copying or retention. Prior to enrolling any employee in the Archived Messages Service, VZW will send a free to end user text message, pre-approved by you, to each employee containing a notice to opt- in to the Archived Messages Service, and you will not access, use, store, copy or disclose any employee's Archived Messages until such consent has been obtained.
2.5. Revocation of Consent. You will ensure that each Participating Employee may immediately revoke consent through readily available mechanisms to the Participating Employee. You will immediately notify SMARSH of any such revocation of consent so that SMARSH can notify VZW of such revocation. If consent is revoked, then you will not access, retrieve, use, store, copy or disclose such employee's Archived Messages dated after the revocation date. You may access, use, store, copy or disclose such employee's Archived Messages retrieved by you prior to such revocation date.
2.6. Transferring Mobile Device or Customer Liable MDN to Another Employee. Prior Customer Liable MDN on that mobile device.
2.7. Periodic Reminders. VZW will provide periodic reminders to each Participating Employee of its enrollment in the Archived Messages Service, if Company enables such option in SMARSH's portal.
2.8. Acknowledgement. You acknowledge that VZW will make available to SMARSH the Archived Messages for use in connection with the Archived Messages Service and VZW will have no further control or responsibility for the Archived Messages once they are provided to SMARSH.
2.9. Limitations and Restrictions. You may access the Participating Employee's Archived Messages only with that Participating Employee's express knowledge and consent. You must maintain records of each employee's express, informed consent for you to collect such Participating Employee's Archived Messages. If a Participating Employee revokes such consent at any time, then you. must immediately cease initiating requests for that employee's Archived Messages.
3. CUSTOMER BUSINESS RECORDS. You will maintain full, complete and accurate records related to your performance under these Terms and Conditions and shall preserve such records for five (5) years from the date of preparation; provided, however, that you will retain, for at least five (5) years following the latest access to Archived Messages, records sufficient to demonstrate each employee's consent to access and use its Archived Messages. Such records shall be available for inspection and copying by VZW during your normal business hours, upon five (5) days' notice, but no more than once per quarter, unless otherwise required by applicable law, rule or regulation. If you refuse to comply with the obligations set forth in this Section or if VZW's review of such records reveals that you are in violation of any of these Terms and Conditions, then, in addition to its other remedies under these Terms and Conditions, your account agreement with VZW or at law or in equity, VZW may terminate your access to the Archived Messages. asmarsh™
Capture. Reveal. Respond.
4. COMPLIANCE WITH LAWS, POLICIES AND PRACTICES. You will comply with all applicable laws, rules and regulations, including all applicable consumer protection, marketing, data security, export and privacy laws and Federal Trade Commission privacy initiatives. You are solely responsible for making any disclosures required by law, rule, regulation, or otherwise regarding the nature, accuracy, effectiveness, or limitations of the Archived Messages Service.
Updated 11/24/15
asmarsh™
Capture. Reveal. Respond.
III. Rogers Mobile Archiving Terms.
Where Client purchases Rogers Archiving Service, Client will be required to sign this Data Release Direction and Consent directly with Rogers Communications Canada Inc. This serves as notice of the foregoing requirement.
DATA RELEASE DIRECTION & CONSENT
WHEREAS Rogers Communications Canada Inc. ('Rogers") provides telecommunications services (including SMS/MMS messaging services), to
('Customer');
AND WHEREAS the Customer has executed an agreement with Smarsh Inc. ('Smarsh) for the archiving of the Customer's SMS/MMS messages associated with the listed Customer CTNs, as provided by Smarsh;
AND WHEREAS the Customer has directed Rogers to send copies of the SMS/MMS messages associated with the listed Customer CTNs to Smarsh in order to facilitate the archiving of those messages;
NOW, for valuable consideration, the receipt and sufficiency of which are acknowledged, Customer agrees as follows:
Customer hereby directs Rogers to send copies of all of the Customer's incoming and outgoing SMS/MMS messages for those corporate lines that the Customer has indicated, as communicated through Smarsh, and consents to the transmission/disclosure of such Customer data and confidential information (including personal information) from Rogers to Smarsh. The Customer acknowledges that the Customer data will be sent outside of Canada as part of this direction and consent.
Customer (which term includes its parent, predecessor, subsidiary, affiliated and related companies and organizations, associated and related partnerships, and each of the present and former directors, officers, employees, agents, representatives, and employees of each of them and their successors, heirs, executors, administrators and assigns) thereby, for itself, its administrators and agents releases and forever discharges Rogers (along with its affiliates, present and former directors, officers, and employees) from any action or cause of action in relation to: (i) the Customer's data that is sent to Smarsh; and, (ii) Smarsh's services to the Customer. The Customer accepts and assumes all of the risks of directing Rogers to send the Customer's data to Smarsh to enable Smarsh to provision the archiving services contracted for by the Customer directly with Smarsh and further agrees not to make any claim, threaten to institute or take or continue any proceedings whatsoever against any person or corporation or entity with respect to the matters herein released, nor to make any claim, threaten to institute or take or continue any proceedings against any person or corporation or entity in respect of which any claim could arise against Rogers in relation thereof. In the event such proceedings are commenced, Customer agrees that this data release direction and consent may be raised as an estoppel and as a complete defence and reply to any such proceedings and may be submitted to the court as Customer's consent to an order dismissing such proceedings on a summary basis. • smarsh®
Service Specific Terms - Twitter
These Service Specific Terms - Twitter apply when Client uses a Connected Archive or a Connected Capture Service to capture or archive Twitter content. Unless expressly stated otherwise, capitalized terms contained in these Service Specific Terms have the meaning given them in the Smarsh Service Agreement - General Terms.
1. Twitter Content. Twitter is a Third Party Service as further described in Section 5 (Third Party Providers) of the Smarsh Service Agreement - General Terms. The Services capture the following information from Twitter as Client Data: tweets created by end users, end users' comments, end users' retweets where the retweet contains new end user content, end users' direct messages, end users' blocks, end users' favorites, and end users' follows ("Twitter Content"). Smarsh will capture only end user content as Twitter Content, it will not capture third-party content from Twitter. Client is permitted to actively capture Twitter Content only for end users who are Client's current employees or contractors. Client is prohibited from actively capturing Twitter Content for any individual who is not a Client employee or contractor. Furthermore, Client is permitted to capture Twitter Content from only those end user accounts that the employee or contractor uses solely within the scope of its employment or contract with Client. Client will provide each employee and contractor with clear and conspicuous notice of policies regarding the receipt, transmission, storage, and use of employee's or contractor's Twitter Content. Client is responsible for ensuring that each employee and contractor has agreed to such policies and that each employee has been made aware that such employee has no reasonable expectation of privacy in such employee's Twitter Content. Client will immediately disable Twitter Content capture within the applicable Services for an employee or contractor when such employee's employment or contractor's service with Client is terminated.
2. Acceptable Use of Twitter Content. Client may capture, archive, and use Twitter Content contained in Client Data for the following purposes: (a) to meet legal and regulatory obligations to store communications (e.g. SEC 17a4, MiFID 2); (b) to search and export communications in response to litigation or regulatory requests (electronic discovery); and (c) to detect and prevent misconduct by automatically flagging communications which match certain keyword policies (driven by legal and regulatory requirements, such as FINRA rule 3110)... If Client is a government entity: (i) Client's use of the Services to capture and archive Twitter Content must be in accordance with 48 C.F.R. 12.212 and 48 C.F.R. 227.7202-1 through 227.7202-4; and (ii) Client is prohibited from using Twitter Content to conduct surveillance or gather intelligence.
3. Twitter TOS. Twitter requires Smarsh to pass through certain additional terms ("Twitter TOS").
Smarsh is not a party to the Twitter TOS. The Twitter TOS are subject to modification by Twitter. The Twitter TOS are available at https://twitter.com/en/tos. Client shall at all times comply with the Twitter TOS when using the Services to capture or archive Twitter Content. Twitter may direct Smarsh to cease the capture and archive of Twitter Content if Client violates the Twitter TOS. Smarsh will have no liability for such termination of the Services pursuant to Client's or Client's end users' violation of the applicable Twitter TOS.
4. Twitter Content and Data Privacy. As used in these Service Specific Terms - Twitter: (i) 'personal data' and 'controller' have the meanings assigned in Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of Personal Data and on the free movement of such data and its implementing regulations promulgated by the EU, EEA, and their individual member states ("GDPR"); (ii) 'process' has the meaning assigned in the GDPR or the California Consumer Privacy Act of 2018, as amended (Cal. Civ. Code §§ 1798.100 to 1798.199) and its implementing regulations ('CCPA"), as applicable; and 'personal information' and 'service provider' have the meaning assigned in the CCPA.
4.1. Notwithstanding anything to the contrary in this Agreement or any other agreement to which Client and Smarsh are parties, with respect to personal data and personal information contained Service Specific Terms - Twitter | Page 1 of 2
asmarsh®
in Twitter Content that Smarsh captures and archives as Client Data, and any processing thereof by either Client or Smarsh, the parties acknowledge and agree that:
a) Twitter and Client are joint controllers;
b) Smarsh is a processor and service provider that processes such personal data and personal information on behalf of Client;
Client is solely responsible for all legal obligations of a controller or joint controller under applicable Data Protection Laws & Regulations (as defined in the data privacy agreement executed by the parties); and
d) in no event will Smarsh be obligated to fulfill the legal duties of a controller or a joint controller related to Client Data.
4.2. Client will use the Services to process Twitter Content in accordance with applicable laws, including but not limited to the GDPR, the CCPA, and all other applicable Data Protection Laws and Regulations.
4.3. As between the parties, Client is solely responsible for ensuring that its instructions to Smarsh to capture, archive, or otherwise process Twitter Content comply with applicable Data Protection Laws and Regulations.
Service Specific Terms - Twitter | Page 2 of 2
asmarsh®
Smarsh Services Agreement-General Terms
This Smarsh Services Agreement-General Terms (the "Agreement") constitutes a binding agreement between Smarsh Inc. ("Smarsh) and the company entering this Agreement ("Client") identified in an order document that references this Agreement ("Order Form"). Client represents that it has the authority to enter into this Agreement, and agrees that the terms of this Agreement will govern Client's use of the Services (as defined in Section 1).
This Agreement includes four parts: (I) the legal terms that are included in this "Smarsh Services Agreement - General Terms", (2) the terms that are specific to each service included in the "Service Specific Terms", (3) the description of what is included with each service in "Service Descriptions"; and (4) the Acceptable Use Policy available at www.smarsh.com/legal/AUP ("AUP").
1. Services. Smarsh will provide the services specified in each Order Form ("Services"), according to the Agreement, the Service Specific Terms (including the applicable Service Level Agreements)), and the Service Descriptions, which describe the features and functionality of each Service. The Service Specific Terms and Service Descriptions are located at www.smarsh.com/legal. Smarsh grants Client a revocable, non-exclusive, non-transferable, limited license to access and use the Services purchased by Client during the Term (as defined in Section 12).
2. Support & User Groups. Smarsh Central, located at https://central.smarsh.com is where Client may seek support resources for the Services as well as engage with other end users in online forums regarding the Services.
Smarsh Central. Support FAQ's and other support resources are available on Smarsh Central located at https://central.smarsh.com. Client may initiate support requests by submitting support tickets on Smarsh Central. Changes to Smarsh's support policies will be made available on Smarsh Central.
2.2. Groups. Smarsh Central also provides online forums and related features to Users of the Services (as defined in Section 4.6) for discussion, feedback, and general Q&A purposes (such forums and related features are collectively called "Groups"). Smarsh grants Client and its Users a revocable, non-exclusive, non-transferable license to access and use Groups within Smarsh Central in connection with Client's use of the Services. Client or Users may post comments or content to Groups ("Groups Content"). Client hereby grants Smarsh a worldwide, exclusive, royalty-free, irrevocable license to access, use, reproduce, make derivatives of, and incorporate Groups Content into Smarsh products or services for commercial use. Client acknowledges that Groups Content is not confidential and is subject to the AUP. Smarsh may delete Groups Content without prior notice. Client is responsible for all Groups Content posted by its Users. Smarsh disclaims all liability arising from Groups Content and use of Groups, including exposure to content that is potentially offensive, indecent, inaccurate, objectionable, or otherwise inappropriate. Smarsh may suspend or discontinue Groups at any time. Smarsh provide Groups without charge and Groups is not part of the Services.
3. Trial Services. If a trial period is indicated on an Order Form, Smarsh will provide Client with a temporary account to one or more Services ("Trial Account"). The Trial Account will be accessible for the trial period set forth in the Order Form, or if no trial period is stated, the Trial Account period will be thirty (30) days. DURING THE TRIAL PERIOD, THE TRIAL ACCOUNT AND ASSOCIATED SERVICES Smarsh Services Agreement - General Terms | Page 1 of 9 asmarsh®
ARE PROVIDED "AS IS" AND "AS AVAILABLE" AND WITHOUT REPRESENTATION OR WARRANTY OF ANY KIND.
4. Client Obligations.
4.1. As used in this Agreement, the term "Client Data" means: (a) the data that the Services capture or archive from Client's systems or from Client's Third Party Services (as defined in Section 5), or (b) Client's historical data provided by or on behalf of Client for ingestion by the Services. Client hereby grants Smarsh a limited, non-exclusive license to access, copy, transmit, download, display, and reproduce Client Data as necessary to provide, support, and improve the Services, as directed by Client, or as otherwise authorized hereunder. Data generated by the Services regarding Client's use of the Services is usage data and is not and does not contain Client Data.
4.2. Because Smarsh will not have access to Client's systems or Third Party Services, it is Client's sole responsibility to monitor the Services, Client's systems and Third Party Services to ensure that Client Data is being captured accurately. Client will notify Smarsh of any delivery failures or outages of Client's systems that could affect the transmission of Client Data..
4.3. It is Client's responsibility to encrypt (i) data sent to the Services from Client's systems and (ii) historical data sent to Smarsh for ingestion. Smarsh will have no responsibility or liability for any data that Client transmits to Smarsh in an unencrypted format. Smarsh is not responsible or liable for any update, upgrade, patch, maintenance or other change to Client's systems or Third Party Services that affects the transmission of Client Data to the Services. It is Client's responsibility to ensure that the Services are configured to capture Client Data from all relevant end-user accounts or devices or web domains, as applicable.
4.4. Client is solely responsible for the content of Client Data. Client represents and warrants that (a) Client Data will not (i) infringe any third party right, including third party rights in patent, trademark, copyright, or trade secret, or (ii) constitute a breach of any other right of a third party, including any right that may exist under contract or tort theories; (b) Client will comply with all applicable local, state, national, or foreign laws, rules, regulations, or treaties in connection with Client's use of the Services, including those related to data privacy, data protection, communications, SPAM, or the transmission, recording, or storage of technical data, personal data, or sensitive information; and (c) Client will comply with the AUP. Smarsh may update the AUP from time to time.
4.5. Client is responsible for creating an account within the Services and ensuring that (a) Client's account registration information is complete and accurate; and (b) Client's account credentials are confidential. Client will notify Smarsh immediately of any unauthorized use of Client's account or account credentials, or any other known or suspected breach of the security of Client's account. Client is responsible for the activity that occurs within Client's account and for the actions or omissions of Client's employees, contractors or agents, whether such person is or was acting within the scope of their employment, engagement, or agency relationship. Client will not permit Smarsh competitors to access the Services.
4.6. Client may provide Representatives with access to the Services, may purchase Services on behalf of Representatives, or where Client is required to review Representative communications, Client may use the Services to meet such requirement. A "Representative" means any entity (a) that Client controls or that is under common control with Client; or (b) on behalf of which Client has a regulatory requirement to archive or review communications data. Representatives' use of the Services is subject to the terms of this Agreement. Client is responsible for the actions or omissions of each Representative whether such person is or was acting within the scope of their employment, engagement, or agency relationship.
4.7. Client may designate user roles with different levels of access for use or support of the Services.
An "Authorized User" is the administrative user(s) with the highest level of access and is Smarsh Services Agreement - General Terms | Page 2 of 9 asmarsh®
responsible for managing the Services for Client. Only Authorized Users may appoint other Authorized Users, request or agree to changes to the Services, add or remove users, make billing inquiries, contact support, or take other, similar actions. A "User" is any individual who is granted login credentials to the Services. Users may not share account log in credentials.
5. Third Party Providers. The Services receive Client Data from third party sources and are dependent on the third party's services, software, applications, platforms (such as third party social media, business networking platforms systems, telecommunications carriers, or other messaging or communication services or APIs) ("Third Party Services"). Third Party Services are not offered, controlled, or provided by Smarsh. A Third-Party Service may make changes to its service, or components thereof, or suspend or discontinue a service without notice to Smarsh. In addition, the availability of the Third-Party Service may depend on Client's compliance with the Third-Party Service terms. The Third-Party Service will have access to Client's data and will provide Client's data to Smarsh. Smarsh does not control and is not responsible or liable for how the Third-Party Service transmits, accesses, processes, stores, uses, or provides data to Smarsh. Smarsh expressly disclaims all liability related to or arising from any Third-Party Service, including Client's use thereof, or liability related to or arising from any updates, modifications, outages, delivery failures, corruption of data, loss of data, discontinuance of services, or termination of Client's account by the Third-Party Service.
Client is solely responsible for ensuring Client complies with all Third-Party Service terms and conditions. Client acknowledges that certain Third-Party Services do not represent that they are suitable for sensitive communications and do not encrypt messages sent over such Third-Party Services networks, including social media providers, telecommunication carriers and certain messaging platforms. Client agrees that if Client transmits sensitive health or financial information via these unsecure Third Party Services networks, Client assumes all risk associated with such transmission and is responsible for any damages or losses incurred with respect to transmitting such sensitive data over such networks and to Smarsh. Such transmission may also be a breach of the
6. Term & Termination.
6.1. Term. The Agreement will begin on the Effective Date and will remain in effect for the term specified in the Order Form or, if no term is specified, 12 months ("Initial Term"). The Initial Term will renew automatically for additional, successive 12-month terms (each a "Renewal Term"), unless Smarsh or Client provides the other party with written notice of non-renewal at least 60 days prior to the end of the Initial Term or the applicable Renewal Term, or either party terminates in accordance with section 6.2 or 6.3 below. The Initial Term plus any Renewal Term are, collectively, the "Term." Any Order Form executed after the Effective Date will co-terminate with Client's then-current Term.
6.2. Termination for Breach. Either party may terminate this Agreement if the other party materially breaches its obligations under this Agreement and such breach remains uncured for a period of 30 days following the non-breaching party's written notice thereof. Smarsh may suspend Client's access to the Services in the event of a breach of this Agreement and will not be liable for any damages resulting from such suspension.
6.3. Termination for Bankruptcy. This Agreement will terminate immediately, upon written notice, where (a) either party is declared insolvent or adjudged bankrupt by a court of competent jurisdiction; or (b) a petition for bankruptcy or reorganization or an arrangement with creditors is filed by or against that party and is not dismissed within 60 days.
6.4. Effect of Termination. Upon any termination or expiration of the Agreement: (a) all rights and licenses to the Services granted to Client by Smarsh will immediately terminate; (b) Client will pay any Fees due and payable up to the date of termination, except in the case of Smarsh's termination for Client's breach, and in such case, Client will pay the Fees owing for the remainder of the then-current Term; and (c) upon request, each party will return to the other or delete the Confidential Information of the other party; provided that if Client requests Smarsh to return Smarsh Services Agreement - General Terms | Page 3 of 9 •smarsh®
Client Data from within Client's Professional Archive (defined in Professional Archive Service Specific Terms) instance, Client may (i) sign a separate Order Form for such Professional Services and will pay Smarsh's then-current data extraction and exportation fees plus any hardware costs as specified in such Order Form or (ii) sign a separate access-only agreement to maintain access to the Professional Archive with the ability to complete self-service exports.
7. Fees & Payment. Client will pay the fees for the Services as set forth in the Order Form ("Fees'). Upon execution of the Order Form, Smarsh will invoice Client for the Fees for the recurring Services.. One- time Fees and Fees for professional services will be invoiced per the terms of the Order Form, or the applicable statement of work. Fees for a Renewal Term will be invoiced upon renewal. Client will pay Fees within thirty (30) days of the date of the invoice. If Client disputes any Fees, Client must notify Smarsh within 120 days of the date of invoice. Invoices not disputed within 120 days from the date of invoice will be deemed accepted by Client. Smarsh may charge a late fee of 1.5% per month on any Fees not paid when due. Smarsh may suspend Client's access to the Services in the event Client fails to pay the Fees when due. Smarsh will increase Fees upon each Renewal Term, provided that any such increase will not exceed five percent (5%) of the then current Fees. Smarsh will provide ninety (90) days' prior written notice of any such increase in Fees.
8. Minimum Commitment & Invoice of Overages. Client agrees that the recurring Fees are Client's minimum purchase commitment during the Initial Term and, upon renewal, each Renewal Term.
The minimum commitment is the total sum of the recurring Fees set forth in the applicable Order Form. For Fees invoiced based on usage, (a) if Client's usage exceeds the minimum commitment specified in the Order Form, Smarsh will invoice, and Client will pay the additional Fees due for such usage at the rate specified in the Order Form; and (b) if Client's usage during a month is less than Client's minimum purchase commitment, Smarsh will invoice Client for the minimum purchase commitment. Client understands that even if Client terminates prior to the end of the Term or any Renewal Term, such minimum commitment shall be due to Smarsh.
9. Taxes. All Fees payable by Client under this Agreement are exclusive of taxes and similar assessments. Client is responsible for all sales, service, use and excise taxes, utility user's fees, VAT, 911 taxes, or universal service fund fees or taxes, taxes assessed on the use of software or any other similar taxes, duties and charges of any kind imposed by any federal, state or local governmental or regulatory authority on any amounts payable hereunder, other than any taxes imposed on Smarsh's income.
10. Confidentiality.
10.1. "Confidential Information" means (a) the non-public information of either party, including but not limited to information relating to either party's product plans, present or future developments, customers, designs, costs, prices, finances, marketing plans, business opportunities, software, software manuals, personnel, research, development or know-how; (b) any information designated by either party as "confidential" or "proprietary" or which, under the circumstances taken as a whole, would reasonably be deemed to be confidential; (c) the terms of this Agreement; or (d) Client Data. "Confidential Information" does not include information that: (i) is in, or enters, the public domain without breach of this Agreement; (ii) the receiving party lawfully receives from a third party without restriction on disclosure and without breach of a nondisclosure obligation; (iii) the receiving party knew prior to receiving such information from the disclosing party, as evidenced the receiving party's records; or (iv) the receiving party develops independently without reference to the Confidential Information.
10.2. Obligations with Respect to Confidential Information. Each party agrees: (a) that it will not disclose to any third party, or use for the benefit of any third party, any Confidential Information disclosed to it by the other party except as expressly permitted by this Agreement; and (b) that it will use at least reasonable measures to maintain the confidentiality of Confidential Information of the other party in its possession or control but no less than the measures it uses to protect its own confidential information. Either party may disclose Confidential Information Smarsh Services Agreement - General Terms |Page 4 of 9
•smarsh
of the other party: (i) pursuant to the order or requirement of a court, administrative or regulatory agency, or other governmental body, provided that the receiving party, if feasible and/or legally permitted to do so, gives reasonable notice to the disclosing party to allow the disclosing party to contest such order or requirement; or (i) to the parties' agents, representatives, subcontractors or service providers who have a need to know such information provided that such party shall be under obligations of confidentiality at least as restrictive as those contained in this Agreement. Each party will promptly notify the other party in writing upon becoming aware of any unauthorized use or disclosure of the other party's Confidential Information.
10.3. Remedies. Each party acknowledges and agrees that a breach of the obligations of this Section 10 by the other party may result in irreparable injury to the disclosing party for which there may be no adequate remedy at law, and the disclosing party will be entitled to seek equitable relief, including injunction and specific performance, in the event of any breach or threatened breach or intended breach by the recipient of Confidential Information.
11. Intellectual Property. As between Smarsh and Client, all right, title and interest in and to the Services, the information technology infrastructure including the software, hardware, databases, electronic systems, networks, and all applications, APIs or Client-Side Software (as defined in the Service Specific Terms) required to deliver the Services, or made available or accessible to Client by Smarsh, including all documentation regarding the use or operation of the Services (collectively "Intellectual Property") are the sole and exclusive property of Smarsh. Except as expressly stated herein, nothing in this Agreement will serve to transfer to Client any right in or to the Intellectual Property. Smarsh retains all right, title and interest in and to Intellectual Property. As between Smarsh and Client, Client Data is the sole and exclusive property of Client and other than the limited license to Client Data granted hereunder, nothing in this Agreement will serve to transfer to Smarsh any intellectual property rights in Client Data.
12. Smarsh Representations and Warranties; Warranty Disclaimer.
12.1. Performance Warranty. Smarsh represents and warrants that it will provide the Services in accordance with generally accepted industry standards.
12.2. Authority. Smarsh represents and warrants that it has the right and authority to enter into this Agreement and that the performance of its obligations under this Agreement will not breach, or conflict with, any other agreement to which Smarsh is a party.
12.3. Compliance with Laws. Smarsh represents and warrants that it will comply with the laws and regulations applicable to Smarsh in its performance of the Services.
12.4. Warranty Disclaimer; No Guarantee. EXCEPT AS SET FORTH ABOVE, SMARSH MAKES NO
REPRESENTATION OR WARRANTY OF ANY KIND IN CONNECTION WITH THE SERVICES,
PROFESSIONAL SERVICES OR SOFTWARE, INCLUDING, WITHOUT LIMITATION, ANY INFORMATION OR MATERIALS PROVIDED OR MADE AVAILABLE BY SMARSH. SMARSH
HEREBY DISCLAIMS ANY AND ALL OTHER REPRESENTATIONS AND WARRANTIES, WHETHER
EXPRESS OR IMPLIED, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT. SMARSH DOES NOT
REPRESENT OR WARRANT THAT THE SERVICES OR SOFTWARE WILL BE AVAILABLE OR ERROR-FREE. SMARSH WILL NOT BE LIABLE FOR DELAYS, INTERRUPTIONS, SERVICE
FAILURES OR OTHER PROBLEMS INHERENT IN THE USE OF THE INTERNET, ELECTRONIC COMMUNICATIONS, OR OTHER SYSTEMS OUTSIDE THE REASONABLE CONTROL OF SMARSH.
SMARSH DOES NOT GUARANTEE THAT USE OF THE SERVICES BY CLIENT OR THE ADVICE
CONSULTING OR PROFESSIONAL SERVICES PROVIDED TO CLIENT WILL ENSURE CLIENT'S
LEGAL COMPLIANCE WITH ANY FEDERAL, STATE, OR INTERNATIONAL STATUTE, LAW, RULE REGULATION, OR DIRECTIVE. THE SOFTWARE IS NOT DESIGNED OR INTENDED FOR USE IN
HAZARDOUS ENVIRONMENTS REQUIRING FAIL-SAFE PERFORMANCE, INCLUDING BUT NOT Smarsh Services Agreement - General Terms |Page 5 of 9
a smarsh®
LIMITED TO ANY APPLICATION IN WHICH THE FAILURE OF THE SOFTWARE COULD LEAD DIRECTLY TO DEATH, PERSONAL INJURY, OR SEVERE PHYSICAL OR PROPERTY DAMAGE.
13. Indemnification.
13.1. Client Indemnification. Client will defend, indemnify and hold harmless Smarsh, its officers, directors, employees and agents, from and against all claims, losses, damages, liabilities and expenses (including fines, penalties, and reasonable attorneys' fees), arising from or related to the content of Client Data and Client's breach of the Service Specific Terms or Sections 4.2, 4.3,
4.4, 4.5, or 15.1 of this Agreement. Smarsh will (a) provide Client with prompt written notice upon becoming aware of any such claim; except that Client will not be relieved of its obligation for indemnification if Smarsh fails to provide such notice unless Client is actually prejudiced in defending a claim due to Smarsh's failure to provide notice in accordance with this Section
13.1(a); (b) allow Client sole and exclusive control over the defense and settlement of any such claim; and (c) if requested by Client, and at Client's expense, reasonably cooperate with the defense of such claim.
13.2. Smarsh Indemnification. Smarsh will defend, indemnify and hold Client harmless from third- party claims arising from a claim that the Services infringe any United States patent, trademark or copyright; provided that, Client shall (a) provide Smarsh with prompt written notice upon becoming aware of any such claim; (b) allow Smarsh sole and exclusive control over the defense and settlement of any such claim; and (c) reasonably cooperate with Smarsh in the defense of such claim. Notwithstanding the foregoing, Smarsh will not be liable for any claim that relates to or arises from: (i) custom functionality provided to Client based on Client's specific requirements; (ii) any modification of the Services by Client or any third party; (iii) the combination of the Services with any technology or other services, software, or technology not provided by Smarsh; or (iv) Client's failure to use updated or modified versions of the Services made available by Smarsh. Except as expressly provided in Section 14.1.3, the indemnification obligation contained in this Section 13.2 is Client's sole remedy, and Smarsh's sole obligation, with respect to claims of infringement.
14. Remedies and Limitation of Liability.
14.1. Remedies.
14.1.1. In the event of a breach of any warranty under Section 12 Smarsh will use commercially reasonable efforts to provide Client with an error correction or work-around that corrects the reported non-conformity. The foregoing remedy is Client's sole and exclusive remedy for a breach of Section 12.
cent sate and eduse remedy or reach of the apricate son
14.1.3. If the Services are subject to a claim of infringement under Section 13.2, Smarsh may, in its sole discretion, either (a) procure for Client the right to continue to use the Services; (b) modify the Services such that they are non-infringing; or (c) if in the reasonable opinion of Smarsh, neither (a) nor (b) is commercially feasible, then Smarsh may, upon thirty (30) days' prior written notice to Client, terminate the applicable Service.
14.2. Limitation of Liability.
14.2.1. IN NO EVENT WILL EITHER PARTY BE LIABLE TO THE OTHER, OR TO ANY THIRD PARTY,
FOR ANY SPECIAL, INDIRECT, INCIDENTAL, PUNITIVE, EXEMPLARY OR CONSEQUENTIAL DAMAGES (INCLUDING LOSS OF: USE, DATA, BUSINESS, OR PROFITS), ARISING FROM OR
IN CONNECTION WITH THE SERVICES OR SOFTWARE (AS DEFINED IN THE SERVICE
SPECIFIC TERMS), WHETHER BASED ON BREACH OF CONTRACT, BREACH OF WARRANTY,
TORT (INCLUDING NEGLIGENCE), OR OTHERWISE, REGARDLESS OF WHETHER SUCH Smarsh Services Agreement - General Terms |Page 6 of 9
asmarsh®
DAMAGES WERE FORESEEABLE OR WHETHER THE PARTY HAD BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. SMARSH WILL NOT BE LIABLE FOR ANY DAMAGES,
WHETHER CONSEQUENTIAL OR OTHERWISE, ARISING FROM OR RELATED TO CLIENT'S
NON-COMPLIANCE WITH ANY FEDERAL, STATE, OR INTERNATIONAL STATUTE, LAW, RULE, REGULATION, OR DIRECTIVE.
14.2.2.EXCEPT WITH RESPECT TO SECTION 13.1 (CLIENT INDEMNIFICATION), EACH PARTY'S
AGGREGATE LIABILITY FOR ALL DAMAGES ARISING FROM OR RELATING TO THIS AGREEMENT, NOTWITHSTANDING THE FORM IN WHICH ANY ACTION IS BROUGHT (E.C.,
CONTRACT, TORT, OR OTHERWISE), WILL NOT EXCEED THE TOTAL FEES ACTUALLY
RECEIVED BY SMARSH FROM CLIENT FOR THE APPLICABLE SERVICES IN THE TWELVE (12) MONTH PERIOD IMMEDIATELY PRECEDING THE DATE OF THE INCIDENT FROM
14.2.3.THE LIMITATION OF LIABILITY SET FORTH ABOVE IS CUMULATIVE; ALL PAYMENTS MADE
FOR ALL CLAIMS AND DAMAGES WILL BE AGGREGATED TO DETERMINE IF THE LIMIT HAS BEEN REACHED.
15. General Terms.
Export Restrictions. The Services and Software (as defined in the Service Specific Terms), including any software, documentation and any related technical data included with, or contained in, the Services of Software, may be subject to United States export control laws and regulations. Smarsh Public IM policy manager is classified under Export Control Classification Number (ECCN) 5D002.c.1 and has been qualified for export under authority of license exception ENC, in accordance with sections 740.17(d) and 740.17(b)(3) of the U.S. Export Administration Regulations, 15 C.F.R. Part 730 et seq. (the "EAR"). It may not be downloaded or otherwise exported or re-exported into (or to a national or resident of Crimea- Region of Ukraine, Cuba, Iran, North Korea, Sudan, Syria or any other country to which the United States has embargoed goods; or any organization or company on the United States Commerce Department's "Denied Parties List." Client will comply with the export laws and regulations of the United States and other applicable jurisdictions when using the Services. Client will not transfer the Software, or any other software or documentation provided by Smarsh (a) to any person on a government promulgated export restriction list; or (b) to any U.S.-embargoed countries. Without limiting the foregoing: (a) Client represents that it and its Authorized Users and any other users of the Services are not named on any United States government list of persons or entities prohibited from receiving exports; (b) Client represents that Client will not use the Software or Services in a manner which is prohibited under United States Government export regulations; (c) Client will comply with all United States anti-boycott laws and regulations; (d) Client will not provide the Software or Service to any third party, or permit any user to access or use the Software or Service, in violation of any United States export embargo, prohibition or restriction; and (e) Client will not, and will not permit any user or third party to, directly or indirectly, export, re-export or release the Software or Services to any jurisdiction or country to which, or any party to whom, the export, re-export or release is prohibited by applicable law, regulation or rule.
15.2. Assignment. Neither party may assign this Agreement, in whole or in part, without the other party's prior written consent, except that either party may assign this Agreement without the other's consent in the case of a merger, reorganization, acquisition, consolidation, or sale of all, or substantially all, of its assets. Any attempt to assign this Agreement other than as permitted herein will be null and void. This Agreement will inure to the benefit of, and bind, the parties' respective successors and permitted assigns.
15.3. Force Majeure. A failure of party to perform, or an omission by a party in its performance of, any obligation of this Agreement will not be a breach of this Agreement, nor will it create any liability, if such failure or omission arises from any cause or causes beyond the reasonable control of the parties, including, but not limited to the following (each a "Force Majeure Event"): (a) acts of God; (b) acts or omissions of any governmental entity; (c) any rules, regulations or orders issued Smarsh Services Agreement - General Terms | Page 7 of 9 • smarsh®
by any governmental authority or any officer, department, agency or instrumentality thereof; (d) fire, storm, flood, earthquake, accident, war, rebellion, insurrection, riot, strikes and lockouts; or (e) utility or telecommunication failures; so long as such party uses reasonable efforts to resume performance after any such Force Majeure Event.
15.4. Governing Law. This Agreement will be governed by and construed in accordance with the laws of the State of Delaware, without regard to conflict/choice of law principles. Any legal action or proceeding arising under this Agreement will be brought exclusively in the federal or state courts located in Multnomah County, in the State of Oregon, and the parties hereby irrevocably consent to the personal jurisdiction and venue therein.
15.5. Relationship of the Parties. The parties are independent contractors as to each other, and neither party will have power or authority to assume or create any obligation or responsibility on behalf of the other. This Agreement will not be construed to create or imply any partnership, agency, or joint venture.
15.6. Notices. Any legal notice under this Agreement will be in writing and delivered by personal delivery, express courier, certified or registered mail, postage prepaid and return receipt requested, or by email. Notices will be deemed to be effective upon personal delivery, one (1) day after deposit with express courier, five (5) business days after deposit in the mail, or when receipt is acknowledged in the case of email to Smarsh. Notices will be sent to Client at the address set forth on the Order Form or such other address as Client may specify. Notices will be sent to Smarsh at the following address: Smarsh Inc., Attention: Legal, 851 SW 6th Ave, Suite 800, Portland, OR 97204, or in the case of email, to [email protected].
15.7. Publicity. Smarsh may disclose that Client is a customer of Smarsh.
15.8. Severability; Waiver. If for any reason a court of competent jurisdiction finds any provision or portion of this Agreement to be unenforceable, that provision of the Agreement will be enforced to the maximum extent permissible so as to effect the intent of the parties, and the remainder of this Agreement will continue in full force and effect. Failure of either party to insist on strict performance of any provision herein will not be deemed a waiver of any rights or remedies that either party will have and will not be deemed a waiver of any subsequent default of the terms and conditions thereof.
15.9. Entire Agreement; Electronic Signatures. This Agreement is the entire agreement between the parties with respect to its subject matter, and supersedes any prior or contemporaneous agreements, negotiations, and communications, whether written or oral, regarding such subject matter. Smarsh expressly rejects all terms contained in Client's purchase order documents, or in electronic communications between the parties, and such terms form no part of this Agreement. The parties agree that electronic signatures, whether digital or encrypted, or Client's click-through acceptance of this Agreement, give rise to a valid and enforceable agreement.
15.10. Amendments. Smarsh may amend this Agreement by posting a revised version to www.smarsh.com/legal. Client accepts the revised version of this Agreement by either (a) execution of an Order Form incorporating the revised version; or (b) continued use of the Services for 30 days following the earliest notice of such revised version provided to an Authorized User at the Services log-in prompt. For the avoidance of doubt, however, (a) such acceptance does not amend the "Effective Date" of the Agreement, which remains the date on which Client first executes an Order Form for the Services or Software, and (b) the Term of the Agreement will continue to renew on the anniversary of the Effective Date.
Smarsh Services Agreement - General Terms | Page 8 of 9 a smarsh®
16. IF CLIENT IS LOCATED IN EUROPE, THE FOLLOWING MODIFICATIONS TO THE ABOVE TERMS APPLY:
16.1. Sections 14.2.1 - 14.2.3 are replaced with the following Sections 14.2.1 - 14.2.3:
14.2.1 Limitation of Consequential Damages. Subject to 14.2.3, in no event shall either party be liable under or in relation to this Agreement or its subject matter (whether such liability arises due to negligence, breach of contract, misrepresentation or for any other reason) for any: (a) loss staff time; (g) losses or liabilities under or in relation to any other contract; or (h) indirect, special or consequential loss or damage.
14.2.2 Limitation on Direct Damages. Subject to Sections 14.2.1 and 14.2.3, Smarsh's aggregate liability arising from or in connection with this Agreement (and whether the liability arises because of breach of contract, negligence, misrepresentation or for any other reason) shall not exceed 1.25 times the amounts paid or payable (having been invoiced but not yet paid by Client for the license to use the Service.
14.2.3 Notwithstanding anything to the contrary in this Agreement, neither party excludes or limits its liability in respect of death or personal injury caused by the negligence of that party, its servants or agents, breach of any condition as to title or quiet enjoyment implied by Section 12 Sale of Goods Act 1979 or Section 2 Supply of Goods and Services Act 1982, or liability for fraudulent misrepresentation or such other liability which cannot under applicable law be excluded or limited by Agreement.
16.2. Section 15.4 is replaced with the following:
15.4 Governing Law and Jurisdiction. This Agreement and all matters arising out of or relating to this Agreement shall be governed by the laws of England and Wales and the parties agree to submit to the exclusive jurisdiction of the English courts. The parties agree that the United Nations Convention on Contracts for the International Sale of Goods is specifically excluded from application to this Agreement. Notwithstanding anything in this Agreement to the contrary, nothing in this Agreement prevents either party from seeking injunctive relief in the appropriate or applicable forum.
Smarsh Services Agreement - General Terms |Page 9 of 9
asmarsh®
Smarsh Support and Service Levels
1. Support
Smarsh offers a broad range of support services, and our Global Support team is committed to ensuring Client's successful use of the Smarsh Connected Suite.
1.1. Support Packages
The Smarsh Basic support package is included with all Smarsh services at no additional charge. Client may purchase a premium support package to extend hours of support coverage, receive support from named or assigned members of the Smarsh Global Support team, and access other support services beyond those included in the Basic support package. The table below provides an overview of the support services included with each support package. The Agreement provides more details about the premium support packages purchased by Client. Client may access online support resources and FAQ's at https://central.smarsh.com ("Smarsh Central").
Support Packages
Features Basic PRO Plus PRO Elite BCS BCS Elite
Access to Smarsh Central
Self-Service Support
Resources
Access to System Status
Page Updates and
Subscriptions
Products Updates, Fixes,
and Enhancements
(Standard Release Cycle)
Web-based Support
24/7 Phone Support for
Severity 1 Issues
Enhanced Support
Response Times
Named Technical Support
Engineer(s)
Assigned Technical
Account Manager(s)
Weekly Status Calls
Annual Account Reviews
Quarterly Account
Reviews
Regular Account Reports
Smarsh University
Subscription
Named Executive Sponsor
Dedicated Account Status
Page
US: +1 (866) 762-7741 UK: +44 (0) 800-048-8612 www.smarsh.com Page 1 of 5 asmarsh®
1.2. Service Incidents and Support Requests
Except with respect to Severity Level 1 issues, Smarsh recommends reporting issues regarding availability or performance of the Services by creating a case at Smarsh Central. All Severity Level 1 issues must be reported by calling 866-SMARSH-1. Support requests must include a detailed description of the error or request, including the operating conditions that gave rise to the error. The individual requesting support will receive notification via email to confirm receipt of a Support request, along with a case number for reference. Smarsh standard phone support is available Monday through Friday between the hours of 8 am and 8 pm Eastern (excluding United States Federal Holidays). If Client purchases a premium support package, standard phone support hours are expanded. Off-hours phone support is available 24 hours per day, 365 days per year for Severity Level 1 or 2 issues. Smarsh may limit the right to submit support requests to a maximum of 10 Users, unless specified otherwise in the Agreement.
Severity Description
Issue impacts multiple users: Service is down, or major functionality is unavailable or materially impacted by performance issues, and no workaround is available.
Issue impacts multiple users: important features are unavailable or degraded, or multiple users are degraded, and no workaround is available.
2 Or
The issue impacts a single user, major functionality is unavailable or materially impacted by performance issues, and no workaround is available.
Issue impacts multiple or single users: important features are unavailable, but a workaround is available,
3 Or
intermittent disruption of Services.
A minor feature is unavailable,
4 there is a minor performance impact
1.3. Initial Response
After Client creates a case, Smarsh will use commercially reasonable efforts to respond to Client within the target response time indicated below for the corresponding severity level and support package. For all packages, Smarsh will respond to routine service requests (e.g. requests for information, password resets, reports of potential defects, feature requests, and troubleshooting guidance) within one business day.
Target Initial Response Time
PRO Plus, PRO Elite,
Severity Basic
BCS, BCS Elite
60 minutes 30 minutes
2 hours 1 hour
4 hours 2 hours
1 business day 8 hours
US: +1 (866) 762-7741 UK: +44 (0) 800-048-8612 www.smarsh.com asmarsh®
1.4. Resolution Process
Smarsh will address and resolve issues with the Services reported by Client that are within the control of Smarsh based on the resolution process indicated below for the corresponding severity level. If Client support package, Smarsh will provide notification of a target resolution or workaround plan, updates, and escalation based on the process for the corresponding severity level specified below, unless specified otherwise in the Agreement.
Resolution Process
PRO Plus, PRO Elite, BCS, BCS Elite
All packages Notification of Resolution Escalation to
Severity Updates
Target Management
Smarsh will Within 4 hours after initial Every hour If the issue is not investigate the response resolved within 8
issue and will hours after initial
work response
continuously
1 until the error is
fixed or a
temporary
workaround is
implemented.
Smarsh will Within 48 hours after initial Every 4 hours If the issue is not investigate the response resolved within 3
issue and will business days
work after initial
continuously response
until the error is
fixed or a
temporary
workaround is
implemented
Smarsh will work Within 4 days after initial Every day If the issue is not during normal response resolved within 5
business hours business days
3 to investigate after initial
the issue and response
implement a fix
or workaround.
Smarsh will work Within 7 days after initial Every day As agreed by the to provide a fix in response parties.
4 the next
maintenance
release.
1.5. Escalation Process
Client may escalate an active support case if (i) Client is not satisfied with the resolution method implemented by Smarsh, (ii) there has been a significant change in the business impact to Client after the issue was reported, or (iii) Smarsh fails to respond in a timely manner during the resolution process.
Instructions for initiating the escalation process are available at Smarsh Central.
US: +1 (866) 762-7741 UK: +44 (0) 800-048-8612 www.smarsh.com smarsh®
2. Service Levels
This section 2 applies only to Connected Archive and Cloud Capture products. It does not apply to Capture Server products.
2.1. Definitions
"Availability" means that Client can access the platform and is measured using the formula in section 2.2 below.
"Downtime" means service interruptions that occur outside applicable maintenance windows specified in section 2.4 below, including Planned Maintenance, Emergency Maintenance, and Outages. "Emergency Maintenance" means maintenance required to: (i) maintain Availability on a go-forward basis, or (ii) execute a critical security change
"Outages" means unplanned service interruptions that temporarily prevent access to major functions of the applicable platform.
"Planned Maintenance" means: (i) maintenance that occurs during applicable maintenance windows specified in section 2.4 below, or (ii) maintenance that occurs outside applicable maintenance windows for which Smarsh has provided advance notice in accordance with section 2.4 below.
2.2. Uptime Commitment
The Availability for the production instance of a Connected Suite product during each calendar month (the "Uptime Commitment") is as specified below. The Uptime Commitments specified below do not apply to user acceptance testing environments or other non-production environments.
Product Uptime Commitment
Connected Archive
Professional Archive 99.9%
Enterprise Archive 99.9%
(multi-tenant instance)
Cloud Capture
MobileGuard 99.9%
Vantage 99.9%
Socialite 99.9%
Availability is measured using the following industry-standard formula:
Availability (less Planned Maintenance) = Total Minutes in a Month (30 days) - Total Downtime in the Month Total Minutes in a Month (30 days)
US: +1 (866) 762-7741 UK: +44 (0) 800-048-8612 www.smarsh.com asmarsh®
2.3. Service Credits
If Smarsh does not meet its Uptime Commitment in any calendar month, Smarsh will issue Client a credit for a portion of Client's platform Fees for the affected Service in accordance with the table below. Client must request credits within thirty (30) days from the end of the month in which Smarsh did not meet its Uptime Commitment. Smarsh will use its diagnostic monitoring tools to verify its failure to meet its Uptime Commitment before Smarsh issues a credit. Smarsh will apply applicable credits to Client's next invoice.
Uptime Service Credit
98.0% - 99.89% 5% of monthly platform Fee (or 0.5% of annual platform Fee)
95.0% - 97.9% 10% of monthly platform Fee (or 1% of annual platform Fee) Below 95.0% 20% of monthly platform Fee (or 1.75% of annual platform Fee)
2.4. Maintenance Windows
Smarsh provides maintenance notifications and reminders, and Client may subscribe to such notifications and reminders, through the Status Page at https://status.smarsh.com/
2.4.1. Professional Archive. To the extent reasonably possible, Smarsh will refrain from performing maintenance that causes interference with or disruption to Client's access to Professional Archive.
Smarsh will perform planned maintenance during the maintenance windows specified below. To the extent feasible, Smarsh will provide 48 hours' advance notice of any maintenance it will perform outside its maintenance windows and that may cause interference with or disruption to Client's access to Professional Archive
Professional Archive maintenance windows:
Mon-Thurs: 12:00 AM-5:00 AM and 9:00 PM-11:59 PM Eastern Fri: 12:00 AM-5:00 AM and 6:00 PM-11:59 PM Eastern
• Weekends: any time
2.4.2. Enterprise Archive and Cloud Capture products. To the extent reasonably possible, Smarsh will refrain from performing maintenance that causes interference with or disruption to Client's access to Enterprise Archive or Cloud Capture during normal business hours for the region in which Client's Enterprise Archive or Cloud Capture instance is deployed. Smarsh will perform planned maintenance during the maintenance windows specified below. To the extent feasible, Smarsh will provide at least three (3) days' advance notice of any maintenance it will perform outside its maintenance windows and that may cause interference with or disruption to Client's access to Enterprise Archive or Cloud Capture. Smarsh may perform Emergency Maintenance without providing advance notice to Client.
Enterprise Archive and Cloud Capture products maintenance windows:
Mon-Fri: 12 AM - 5AM and 8 PM - 11:59 PM
: Weekends:any time
The times specified above are local to the region in which Client's Enterprise Archive or Cloud Capture instance is deployed.
US: +1 (866) 762-7741 UK: +44 (0) 800-048-8612 www.smarsh.com Acceptable Use Policy
September 19, 2019
This Acceptable Use Policy ("AUP") describes the proper use of the Services and Groups available through Smarsh Central. This AUP is incorporated by reference into the Agreement.
Smarsh may suspend or terminate Client's use of the Services, any User's access to Groups on Smarsh Central, or the Agreement, if Client or any of Clients Users or Representatives violate this AUP. As between Client and Smarsh, Client is solely responsible for the data, content, messages, or other information that Client transmits, archives, distributes, displays, uploads or downloads through its use of the Services.
Prohibited Activities
Client shall not use the Services to:
(a) commit a crime, violate any rights of a person or entity (including intellectual property rights), or 1) omi had amate audient tons arisen 1)
letters, pyramid schemes);
(d) transmit harmful or potentially harmful code, including viruses, Trojan horses, worms, time bombs or any other computer programming routines that could damage, interfere with, surreptitiously intercept, or expropriate any system, program, data or personal information; (e) transmit bank, credit card or debit card numbers or other card numbers, or other financial account information such as cardholder name, expiration date, PIN or PIN blocks, service code, or track data from a magnetic strip or chip.
(f) create a false identity or forged email address or header, or phone number, or otherwise attempt to mislead others as to the identity of the sender or the origin of a message or phone call; (g) circumvent another service offered by Smarsh, such as subscribing to email archiving for the purpose of archiving email marketing;
(h) harvest data; or
(i) act in a way that will subject Smarsh to any third-party liability.
Client shall not (a) reverse engineer any Service; (b) attempt to bypass or break any security mechanism on any of the Services; or, (c) use the Services in a manner that poses a security or service risk to Smarsh or other users.
Interference with Services is Prohibited
Client shall not engage in, or attempt to engage in:
(a) unauthorized access to or use of the Services, data, or the networks or systems, including an attempt to probe, scan or overload a Smarsh system or the Services, or to breach security or authentication measures without express authorization;
(b) unauthorized monitoring of code, data, or traffic on a system without express authorization; (c) deliberate attempts to overload a system and broadcast attacks; (d) an action that imposes an unreasonable or disproportionately large load on Smarsh's infrastructure;
(e) performance of a program/script/command or sending messages of any kind that are designed to interfere with a user's terminal session, by any means, including locally or by the Internet; (f) the use of manual or electronic means to avoid any use limitations placed on the Services, such as timing out; or
(g) any other activity that could be reasonably interpreted as unauthorized access to or interference with the Services.
Laws Specific to Communications
Clients shall comply with all laws that apply to communications, including wiretapping Telephone Consumer Protection Act, the Do-Not-Call Implementation Act, CAN-SPAM Act of 2003 and any other laws or regulations applicable to communications, including any third party policies such as the applicable guidelines published by the Cellular Telecommunications Industry Association, the Mobile Marketing Association.
If Client uses the Services in connection with any bulk and commercial email practices Client shall, in accordance with applicable law:
(a) obtain the verifiable consent of e-mail recipients via affirmative means; (b) obtain necessary consents in accordance with applicable law; (c) retain evidence of consents in a form that may be produced on request; (d) allow a recipient to revoke consent;
(e) post an email address for complaints in a conspicuous place; (f) have a privacy policy posted for each domain associated with the mailing; (g) have the means to track anonymous complaints;
(h) not obscure the source of the Client e-mail in any manner; and, (i) not attempt to send any message to an email address after such number of rejections as is Updates
Smarsh may revise and update this AUP from time to time.
Current Version of AUP: Version 5, Effective September 19, 2019. asmarsh®
Service Descriptions
Last updated April 15, 2020
2 PROFESSIONAL ARCHIVE.
OVERVIEW. 2
PLANS AND FEATURES. 2
ADD-ON MODULES .. 8
PLAN FEATURES DESCRIPTIONS... ... 9
ADD-ON MODULES DESCRIPTIONS .. 11
PROFESSIONAL SERVICES DESCRIPTIONS ... 11
US: +1 (866) 762-7741 UK: +44 (0) 800-048-8612 www.smarsh.com Page 1 of 13 a smarsh®
Professional Archive
Overview
The Connected Archive - Professional Archive ("Professional Archive") archives supported electronic communications and other data from third party systems ("Channels"). Professional Archive includes the following capabilities: storage, search, discovery, administration, reporting, exports, and depending upon the plan, policies and supervision. Additional modules or professional services may be added to enhance the capabilities of Professional Archive. Available features and add-on modules are described in this document. Certain plans are not eligible for certain features or add-on modules. Smarsh will enable the features of Professional Archive that are associated with the plan Client purchases. Client must purchase Connection bundles to enable capture from supported Channels. A full list of supported Channels is available at https://www.smarsh.com/products/connected- capture/all-supported-channels/. Connections captured from a premium Channel will incur additional charges, as indicated on the applicable Order Form (defined in the General Terms available at https://www.smarsh.com/legal/).
Plans and Features
Client must purchase a plan to access Professional Archive. Client will have access to the features and other services that correspond to the purchased plan, as specified in the tables on pages 3-8 below.
Legend
Feature is included
Feature is available for an additional fee
Feature is not available
US: +1 (866) 762-7741 UK: +44 (0) 800-048-8612 www.smarsh.com Page 2 of 13 •smarsh®
Silver Gold Platinum
Professional Archive
# of Bundled Connections 5 | 10 | 20 50 | 100 | 200 500 | 1000 | 2000 | 5000 Professional Archive Access 3 Users 10 Users 100 Users
Standard Storage 7 years 7 years 7 years
Search
Universal Search
Proximity Search
Saved Search
Advanced Search
Policies
Active Lexicon Policies 10 50
Post Review Actions
Supervision
Review & Escalation Queues
Review Tools
Discovery
Cases Unlimited Unlimited Unlimited
Legal Hold
Discovery Users 20
Admin
Self-Service Exports 2 active per User 10 active per User 25 active per User Roles
Groups
Retention Policies
IP Whitelisting
Multi Factor Authentication
Identity & Access Management $
External Archiving
Reports
Administration
Policy Activity
Supervision
US: +1 (866) 762-7741 UK: +44 (0) 800-048-8612 www.smarsh.com Page 3 of 13 asmarsh®
Silver Gold Platinum
Client Services
Onboarding $ $ $
Legacy Data Import
Professional Services
Audit Assist $ $
Monthly Archive DVD
Policy Library $
Policy Tuning $
Assisted Review $
unu
Custom Feature/Application
Development
Training
Online User Guides and
Knowledge Base
Smarsh University: Web-based
and Instructor-led Training
Smarsh University: On-site
Training
Support
Basic
Premium
US: +1 (866) 762-7741 UK: +44 (0) 800-048-8612 www.smarsh.com Page 4 of 13 asmarsh®
SMG GOV
Professional Archive
Connections 10 | 20 | 50 | 100 | 200 500 | 1000 | 2000 | 5000 Professional Archive Access 3 Users 50 Users
Standard Storage 7 years 7 years
Search
Universal Search
Proximity Search
Saved Search
Advanced Search
Policies
Active Lexicon Policies 10
Post Review Actions
Discovery
Cases Unlimited Unlimited
Legal Hold
Discovery Users 3 15
Admin
Self-Service Exports 2 active per User 25 active per User Roles
Groups
Retention Policies r
IP Whitelisting
Multi Factor Authentication
Identity & Access Management
External Archiving
Reports
Administration
Policy Activity
US: +1 (866) 762-7741 UK: +44 (0) 800-048-8612 www.smarsh.com Page 5 of 13 a smarsh®
SMG GOV
Client Services
Onboarding $ $
Legacy Data Import
Professional Services
Audit Assist
Monthly Archive DVD
Custom Feature/Application Development
rainin
Online User Guides and Knowledge Base
Smarsh University: Web-based and Instructor-led Training $ $ Smarsh University: On-site Training
Support
Basic
Premium $ $
US: +1 (866) 762-7741 UK: +44 (0) 800-048-8612 www.smarsh.com Page 6 of 13 a smarsh®
E-Discovery
Professional Archive
Connections 500 | 1000 | 2000 | 5000
Professional Archive Access 10 Users
Standard Storage 3 years
Search
Universal Search
Proximity Search
Saved Search
Advanced Search
Discovery
Cases Unlimited
Legal Hold
Discovery Users 15
Admin
Self-Service Exports 10 active per user
Roles
Groups
Retention Policies
IP Whitelisting
Multi Factor Authentication
Identity & Access Management
Reports
Administration
US: +1 (866) 762-7741 UK: +44 (0) 800-048-8612 www.smarsh.com Page 7 of 13 • smarsh®
E-Discovery
Client Services
Onboarding $
Legacy Data Import
Professional Services
Audit Assist
Monthly Archive DVD
Custom Feature/Application Development
Training
Online User Guides and Knowledge Base
Smarsh University: Web-based and Instructor-led
Training
Smarsh University: On-site Training
Support
Basic
Premium
Add-on Modules
Personal Access
Employee access to the employee's archived messages $
Tablet & Mobile Interfaces
User Labels/Folders
Outlook® Plug-in
US: +1 (866) 762-7741 UK: +44 (0) 800-048-8612 www.smarsh.com Page 8 of 13 a smarsh®
Plan Features Descriptions
Connections
One Connection is:
• An end-user account such as email mailbox;
• An instant message account or screen name;
• A social media page or profile; or
• A mobile device phone number
A Channel is an electronic communications data source, such as email, a social media platform, a mobile carrier, or a collaboration platform. Connections from certain Channels are premium Connections and will incur additional capture and archive fees as indicated on the applicable Order Form.
Professional Archive Access
Each User of Professional Archive receives individual log-in credentials, which allows that User to access Professional Archive.
Standard Storage
The Capture & Archive Fees specified in the Order Form for Professional Archive include 3 years of storage of Client Data for the E-Discovery package and 7 years of storage of Client Data for all other packages. Client must purchase extended data retention if a longer storage period is required. Additional storage fees apply for legacy data sent to Smarsh for import into Professional Archive or data sent from Connected Capture products or other external capture services to Professional Archive.
Search
Users can perform e-discovery or compliance and supervision searches across archived Connections based on variables such as message data, User data review activities and advanced search features. Users can apply tags, retention policies, notes and other information to (i) individual messages or (ii) in bulk to a set of messages.
Professional Archive includes an audit trail that tracks and logs activity within Client's account including searches, messages reviewed, and notations made.
Policies
Policies allow Client to configure compliance rules for automated flagging and classification of messages based on Client-selected criteria within Professional Archive, up to the number of active lexicon policy rules specified in Client's plan. Messages can be automatically tagged, flagged, scored or assigned to a specific User.
Supervision
Supervision allows Reviewers to mark messages "Reviewed," "Escalate," or "Violation," as well as to design and implement review and escalation queues based off policies and escalated messages. These queues enable formalized, streamlined, workflows for small and large compliance teams.
US: +1 (866) 762-7741 UK: +44 (0) 800-048-8612 www.smarsh.com Page 9 of 13 • smarsh®
Discovery
Discovery allows Users to: (i) access cases as well as a facet and filtering panel that allows Users to filter the messages by Channel, participant, message tags, and other facets, (i) manage legal holds, (ii) share cases with other Users, and (iv) and export messages from a case via FTP.
Admin
Authorized Users have the ability to add, manage, and remove Users and Reviewers from within Professional Archive, set permissions for Users and Reviewers, and grant access to specific features.
Self-Service Exports
Client may export or download messages from Professional Archive by creating an Export. An Export is a collection of messages that can be exported out of the archive. The number of active Exports a User can have at any given time is specified in the Plans and Features table in this document.
Users, Reviewers, and Roles
Client can provide access to Professional Archive for as many Users as Client requires. Client must appoint at least one Authorized User as the administrative User associated with the account. Reviewers are Users who perform supervision. Roles allow Client to define permissions for specific pages and features. These roles can be assigned to a User.
Groups
Groups allows Client to create a hierarchy of groups using end-user identifiers and associated Connections. Client can set permissions for these groups to control data access for Professional Archive Users.
Retention Policies
Retention policies allow a User to create and apply policies to messages to be retained for a certain time period and then purged (deleted) from Professional Archive.
IP Whitelisting
IP whitelisting allows Client to determine the IP addresses that a User may use to access Professional Archive. IP whitelisting supports multi-factor authentication.
Multi-Factor Authentication
Multi-factor authentication allows Client to enforce a second layer of authentication before access to Professional Archive is permitted. To access Professional Archive, a User must provide their log-in credentials together with a code that is sent to the email address associated with the applicable Professional Archive account.
US: +1 (866) 762-7741 UK: +44 (0) 800-048-8612 www.smarsh.com Page 10 of 13 asmarsh®
Identity & Access Management
Available identity and access management features include:
• Active Directory Sync
Enables Client to integrate their Active Directory in Professional Archive. • LDIF
Enables Client to update Groups within Professional Archive using a LDAP Data Interchange Format ("LDIF") file process.
Single Sign-on
Enables Client to allow Users to authenticate into Professional Archive using a single set of log-in credentials.
Client must purchase an add-on onboarding service to enable identity and access management features.
External Archiving
Enables Client to send a copy of Client Data to a third party by email.
Reports
Client will have access to different levels of pre-built reports depending upon Client's specified plan. Available standard reports include Professional Archive administration, policy activity, and supervision. Administration reports include User activity, archive statistics, and content usage. Policy reports include policy activity, auditing, and actions. Supervision reports include reviewer, queue, and message activity.
Add-on Modules Descriptions
Personal Archive
Allows end-users of Connections to search their own archived messages through a web-based client or Outlook plugin.
Professional Services Descriptions
Onboarding
Smarsh offers several Professional Archive onboarding packages to provide options that align to each Client's specific implementation needs. With all onboarding packages, Smarsh will create Client's Professional Archive environment and provide detailed configuration instructions.
Data Import
Smarsh will import Client's messages from legacy systems into Professional Archive at an agreed-upon rate specified in an Order Form. Additional data conversion charges will apply if the data is not provided in a supported format.
US: +1 (866) 762-7741 UK: +44 (0) 800-048-8612 www.smarsh.com Page 11 of 13 a smarsh®
Audit Assist
Audit Assist allows Client up to five hours of data export service, once per year, in response to a regulatory audit.
Any hours in excess of five will be paid at the hourly rate specified in the applicable Order Form, or if not specified, $250 per hour. Alternatively, Client may purchase assistance with data requests for audit or litigation purposes at an hourly rate. Audit Assist includes structuring a data export and responding to a data request.
Monthly Archive DVD
The Smarsh Client Data team will create a copy of the data ingested by Professional Archive in the previous month. The data will be copied to one or more DVDs and then shipped to Client's authorized shipping address.
Assisted Review
Assisted Review is a service through which Smarsh certified reviewers augment Client's existing compliance program by completing first-pass compliance reviews on Client's behalf. The certified reviewers follow Client's supervision policies and guidelines to review flagged messages within Professional Archive and escalate the messages that meet Client's specified risk criteria for further review by Client's compliance team.
Policy Library
Policy Library is a library of pre-built Smarsh-designed lexicon policies that a Client can select for its use.
Policy Tuning
Policy Tuning is a service through which Smarsh experts work with Client to tune policies and modulate lexicons for Supervision within Professional Archive. Policy Tuning results in a standard set of diagnostic tools and processes that prioritize the most critical, high-risk messages for review in order to improve the effectiveness of Client's compliance program. Client must purchase Policy Library to be eligible to purchase Policy Tuning.
Training
Smarsh offers online documentation, training courses, and certification courses to help Client and its Users understand and leverage Professional Archive's features and functionality. Each Professional Archive package includes access to user guides, technical documentation, and knowledge articles on Smarsh Central. Client may purchase Smarsh University training and certification courses for an additional fee.
Support
Smarsh provides phone and web-based technical support as specified in the Smarsh Support and Service Levels document available at https://www.smarsh.com/legal. Web-based technical support articles are available at https://central.smarsh.com/s/. Each Professional Archive package includes the Basic support package. Client may purchase a premium support package to extend hours of availability, allocate designated support resources, and access other premium support services.
US: +1 (866) 762-7741 UK: +44 (0) 800-048-8612 www.smarsh.com Page 12 of 13 • smarsh®
Regulatory Letter
Upon completion of Professional Archive implementation, and at Client's request, Smarsh will provide Client a letter stating that Smarsh is providing third-party downloader service pursuant to certain rules and regulations.
Custom Feature/Application Development
Custom features/applications that are not currently available in Professional Archive may be requested and will be provided (if feasible, in Smarsh's sole discretion) at an agreed-upon rate.
Additional Professional Services / Support
The following additional professional and support services may be purchased by Client for a fee:
• Premium support
Custom documentation
Custom end-user communications
• Data export services
US: +1 (866) 762-7741 UK: +44 (0) 800-048-8612 www.smarsn.com Page 13 of 13