DocuSign Envelope ID: 387DE0A6-E450-4D58-t 773BF83010CA DocuSign Envelope ID: B2679106-09D1-4F3B-858C-A5D62F3C5463
CITY OF RICHMOND
STANDARD CONTRACT
Department: City Attorney's Office Project Manager: Ivania Navarrete Project Manager E-mail: Project Manager Phone No:
[email protected] (510) 620-6509
PR No: Vendor No: P.O./Contract No:
Description of Services:
Cloud email and document management services
The parties to this STANDARD CONTRACT do mutually agree and promise as follows:
Parties. The parties to this Contract are the City of Richmond (herein referred to as the "City") and the following named Contractor
Manage LLO
Company Name:
Street Address: 71 S. Wacker, Suite 400
City, State, Zip Code: Chicago, IL 60606
Contact Person: Trevor Mathias
Telephone: (312) 420-5870 Email: [email protected] Business License No: N/A / Expiration Date:
A California V corporation, limited liability corporation general partnership, _ limited partnership, L individual, non-profit corporation, ] individual dba as [specify:]_
other [specify:
Term. The effective date of this Contract is July 1, 2023 and it terminates June 30, 2025 unless terminated as provided herein.
Payment Limit._City's total payments to Contractor under this Contract shall not exceed $72,000 • City shall not pay for services that exceed the Contract Payment Limit unless a contract amendment has been approved by the City Council or City Manager.
Contractor's Obligations. Contractor shall provide those services and carry out that work described in the Service Plan (Exhibit A) which is attached hereto and is incorporated herein by reference, subject to all the terms and conditions contained or incorporated herein.
City's Obligations. City shall make to the Contractor those payments described DocuSign Envelope ID: 387DE0A6-E450-4D58-84( 3BF83010CA DocuSign Envelope ID: 387DE0A6-E450-4D58-2 773BF83010CA DocuSign Envelope ID: B2679106-09D1-4F3B-858C-A5D62F3C5463 in the Payment Provisions (Exhibit B) which are attached hereto and are incorporated herein by reference, subject to all the terms and conditions contained or incorporated herein.
DocuSign Envelope ID: 387DE0A6-E450-4D58-84C 3BF83010CA DocuSign Envelope ID: 387DE0A6-E450-4D58-84C4-773BF83010CA DocuSIgn Envelope ID: B2679106-09D1-4F3B-868C-A6D62F3C6463
6. Authorized Representatives and Notices. This Contract is subject to the Authorized Representatives and Notices Provisions (Exhibit C) which are attached hereto and are incorporated herein by reference.
General Conditions. This Contract is subject to the General Conditions (Exhibit D) which are attached hereto and are incorporated herein by reference, subject to all the terms and conditions contained or incorporated herein.
8. Special Conditions. This Contract is subject to the Special Conditions (Exhibit E) (if any) which are attached hereto and are incorporated herein by reference, subject to all the terms and conditions contained or incorporated herein. (Note:
other than Public Works contracts, the City will agree to Special Conditions only in unusual circumstances.)
Insurance Provisions. This Contract is subject to the Insurance Provisions (Exhibit F) which are attached hereto and are incorporated herein by reference.
10. Signatures. These signatures attest the parties' Contract hereto:
CITY OF RICHMOND CONTRACTOR:
municipal corporatio iManage LLC
ocusigned |
By: Eduardo Martines
-085C427628CC78.. (* The Corporation Chairperson of the Board, President or Vice President should sign below)
-Docusignedby:
Title: Mayor By: Clinton M Crosier
- 46213021975.
I hereby certify that this Contract Title: General Counsel, VP, Secretary has been approved by City Council.
— DocuSigned by: Date Signed: 6/27/2023
Pamela Christian
By:
(* The Corporation Chief Financial Officer,
Secretary or Assistant Secretary should sign below)
Approved as to form: -Derolland by:
By: Clinton M Crosier
-Docusigned by: -ACI418213D2F476..
By: Shannon Moore Title:- General counsel, VP, secretary City Antoney Chief Assistant City Attorney Date signed: 6/27/2023 (NOTE: Pursuant to California Corporations
Code Section 313, if Contractor is a corporation
or nonprofit organization, this Contract (1) must
e signed by (a) the Chairperson of the Boar
resident or Vice-President and (b) th
Secrefary any Assistant Secretary, the Chief
Financlal Officer or any Assistant Treasurer.
LIST OF ATTACHMENTS:
Servica Plan Exhlbit A
Payment Provisions Exhibit B
Authorized Representatives and Notices
General Conditions
Special Conditions Exhibit E
Insurance Provisions Exhibit F
DocuSign Envelope ID: 387DE0A6-E450-4D58-8 173BF83010CA DocuSign Envelope ID: B2679106-09D1-4F3B-858C-A5D62F3C5463 For the Contract between the City of
Richmond and
iManage LLC
EXHIBIT A
SERVICE PLAN
City Attorney
Contractor shall, to the satisfaction of the _ perform the following services and be compensated as outlined below:
See Exhibit A-1 Manage Cloud Service Order Form: Licensing includes the following Manage Work user functionality in a single instance of Manage Work within a specified geographic region with backup of data to a secondary location within region for disaster recovery for up to 25 users:
- Manage Work 10 browser interface
- Manage Work 10 Desktop for Microsoft Windows or MAC OS - Email management with Microsoft Outlook or Gmail
- Mobility (web mobile access, iOSapplication, Blackberry application) - 625GB of document storage
- iManage Control Center
- External and Internal Collaboration using Manage Share (IMC-SHR-ADDON) - iManage Work RestAPI software development ToolKit (IMC-WRK-SDK) - Optical Character Recognition Service for Manage Work (IMC-WRK-OCR-USER) - Off-line or connected access using Manage Drive (IMC-WRK-DRV-USER) - iManage Threat Manager (IMC-TM-USER
DocuSign Envelope ID: 387DE0A6-E450-4D58-84‹ 3BF83010CA DocuSign Envelope ID: B2679106-09D1-4F3B-858C-A5D62F3C5463 Exhibit A-1 to Agreement with City of Richmond 'm
iManage Cloud Order Form
Customer Organization Name City of Richmond
("Customer")
Expiration Date of Order Form June 30,2023
iManage Contact Name Trevor Mathias
OFFER
This Order Form is effective as of the date signed by Customer or the date Customer issues a purchase order, whichever first occurs (the "Effective Date").
Subscription Start Date
October 01, 2023 (the "Subscription Start Date").
Initial Term 36 months from Subscription Start Date (the "Initial Renewal This Order Form will automatically renew for additional successive 12 months terms unless earlier terminated
pursuant to the Agreement's express provisions or either party gives the other party written notice of non-renewal at least 30 days prior to the expiration of the then-
current term (each, a 'Renewal Term' and together with
the Initial Term, the 'Term").
Billing Period Annual
Payment Terms Net 30 days from invoice date
Currency USD
Customer Data Storage Region Customer Data shall be stored in:
Work Threat Manager: United States (the 'Region')
• iManage Share: United States (the 'Region' for iManage Share)
DocuSign Envelope ID: 387DE0A6-E450-4D58-€ 773BF83010CA DocuSign Envelope ID: B2679106-09D1-4F3B-858C-A5D62F3C5463 Manage Cloud - Scope and Fees
The Manage Cloud scope and fees schedule below details the Cloud Services provided by Manage and purchased underthis Order Form.
Product SKU Product Description Quantity AnnualFees
IMC-CRP-PRO-XPR25 Manage Cloud - Corporate Professional Starter $24,000.01 Package for Manage Work with iManage Share
for 25 Users or less
Minimum Commitment
IMC-000-MAC iManage Cloud - Minimum Commitment- $24,000.01 Annual
Storage
Storage included for Manage Cloud (GB) 625
Options and Overages
Product SKU | Product Description Quantity Price
IMC-WRK-USRX Manage Cloud - User T $92.00
Overage, Monthly
IMC-CLD-GBX Manage Cloud - Storage $0.54
Overage, per GB, Monthly
Subscription
DocuSign Envelope ID: 387DE0A6-E450-4D58-84L 3BF83010CA DocuSign Envelope ID: B2679106-09D1-4F3B-858C-A5D62F3C5463 Manage Cloud-Product Descriptions
Manage Cloud - Corporate Professional Starter Package for Manage Work for 25 users or less Enables the following Manage Work user functionality in a single instance of Manage Work within a specified geographic region with backup of data to a secondary location within region for disaster recovery for up to 25 users:
- iManage Work 10 browser interface
- iManage Work I0 Desktop for Microsoft Windows or MAC OS - Email management with Microsoft Outlook or Gmail
- Mobllity (web mobile access, iOSapplication, Blackberry application) - 625GB of document storage
- iManage Control Center
- External and Internal Collaboration using Manage Share (IMC-SHR-ADDON) - iManage WorkRestAPl software development ToolKit (IMC-WRK-SDK) - Optical Character Recognition Service for Manage Work (IMC-WRK-OCR-USER) - Off-line or connected access using iManage Drive (IMC-WRK-DRY-USER) - iManage Threat Manager (IMC-TM-USER)
iManage Cloud - User Overage
The total number of active users is measured each month, between the 2Ist and the 25th of the month. If the measured number of users exceeds the number of users included in the subscription, this rate will be charged for each additional user.
Manage Cloud - Storage Overage
The total volume for document storage is measured each month, between the 2Ist and the 25th of the month. If the measured volume exceeds the document storage included in the subscription, this rate will be charged for each additional GB of storage.
HOW TO ACCEPT THIS ORDER FORM
Customer may accept this Order Form by: (i) signature below or, (ii) unless otherwise set forth below, Customer's issuance of a valid purchase order referencing the Order Form Date above. Customer agrees by accepting this Order Form, including the Agreement terms referenced above, no other terms and conditions apply to the Customer's access to, or use of, the Cloud Services, including those on a purchase order or other document issued by the Customer, and all such other terms and conditions are hereby rejected by iManage.
CUSTOMER: Please tick the relevant box for this order: ** stomer needs to issue a signed purchase order to secure payment and you are able to supp e document with the signed Order Customer does not require the issuance of a purchase order (whether in hard copy or through an electronic system such as Ariba) as a condition for payment.
Customer requires a signed purchase order to secure payment and you are able to supply the document within five (5) business days of the signed Order. You represent that you have full financial and business authority to commit Customer funds and agree that all Orders are non- cancellable and non-refundable.*
If Customer believes this Order is not taxable, Customer must submit to Manage for filing a proper exemption certificate prior to placing such non-taxable Order. *lf Customer needs a signed purchase order, Manage requires the Customer to issue a signed purchase order to cover the fees above for at least the first year of Cloud Service.
DocuSign Envelope ID: 387DE0A6-E450-4D58-8• .73BF83010CA DocuSign Envelope ID: B2679106-09D1-4F3B-858C-A5D62F3C5463 **Unless otherwise selected above, by executing this Order Form, Customer agrees that Customer's own purchase order is not required for this transaction.
INVOICING
The fees to be invoiced to Customer in the Initial Term will be as described in the scope and fees table above. No increase in Fees for any annual term of an Order Renewal Term shall exceed 7%.
ANNUAL BILLING
The annual Subscription Fees will be involced to Customer annually. The first invoice will be sent on the Subscription Start Date. Subsequent annual invoices will be sent on the anniversary of the Subscription Start Date. User and storage overage fees, if any, shall be invoiced monthly in arrears. Customer may order additional services and the fees will be pro-rated to the Term.
AMENDMENTS
Customer Delivery Detalls
Company Name:
City of Richmond
Address:
450 Civic Center Plaza
Richmond, CA 94804
Customer IT Contact:
Zena Battle
Email:
[email protected]
Telephone:
5106205501
SignaturetoOrder Form
Customer: Cry ofRichmond B
Individual Signing:
Signature:
Title:
Date:
DocuSign Envelope ID: 387DE0A6-E450-4D58-84. : 3BF83010CA DocuSign Envelope ID: B2679106-09D1-4F3B-858C-A5D62F3C5463 •
1 January 2023 m
Manage Cloud Services Agreement
CERTIFIED
& TermScout Certified Contract
CUSTOMER
FAVORABLE
Cloud Services Agreement
TERMS De Monoge
inis contract hos been carefully reviewed and cartified Customer ERM SEE TERMSCOUT REVIEW >
COU Favorable by TermScout, an independent contract rating company *This Manage Cloud Services Agreement was certified to be more customer-favorable than 89% of 1,000+ similar agreements reviewed by TermScout, as of 1 January 2023.
This Manage Cloud Services Agreement (this "Agreement"), is by and between the Manage entity described in Section
12.13 below (iManage"), and the customer identified in the applicable Order (Customer"). iManage and Customer are sometimes referred to herein individually as a "Party" and together as the "Parties." WHEREAS, Customer wishes to subscribe to the Services (as defined in Section 2.1), and Manage wishes to provide such Services to Customer, each on the terms and conditions set forth in this Agreement.
NOW, THEREFORE, in consideration of the mutual covenants, terms and conditions set forth herein, and for other good and valuable consideration, the receipt and sufficiency of which are hereby acknowledged, the Parties agree as follows:
1. Definitions.
"Action" means any claim, suit, action or proceeding.
"Affiliate" of a Party means any other entity that directly or indirectly, through one or more intermediaries, controls, is controlled by, or is under common control with, such Party. "Authorized User" means each of the individuals authorized by Customer to access and use the Services. "Cloud Services" means the cloud-based software-as-a-service applications, including the application programming interfaces, provided by Manage, and subscribed to under an Order. "Customer Data" means data submitted to, and stored within, the Cloud Services by Customer and its Authorized Users in connection with Customer's use of such Cloud Services (and includes any such data held in Manage's backups). "Data Protection Agreement" or "DPA" means the agreement set forth in Exhibit C. "Documentation" means any manuals, instructions or other documents or materials that iManage provides or makes available to Customer within embedded help files or on the Manage support website found at https://help.imanage.com_or https://help.closingfolders.com/hc/en-us, as applicable, and which describe the functionality, components, features or requirements of the Services, including any aspect of their installation, configuration, integration, operation, use, or support. "Fees" means the fees set out in the applicable Order.
"Harmful Code" means any software, hardware or other technology, device or means, including any virus, worm, malware or other malicious computer code, the purpose or effect of which is to (a) permit unauthorized access to, or to destroy, disrupt, disable, distort, or otherwise harm or impede in any manner (i) the function of any computer, software, firmware, hardware, system or network or (ii) the security, integrity, confidentiality or use of any data, or (b) prevent Customer or any Authorized User from accessing or using the Cloud Services as intended by this Agreement. 1 Previous versions of this Agreement were published on 1 October 2022, 23 May 2022, 16 September 2021, 16 April 2021, 15 May 2020, 11 October 2018, 28 August 2018, 6 March 2017, and 29 August 2016
DocuSign Envelope ID: 387DE0A6-E450-4D58-84 73BF83010CA DocuSign Envelope ID: B2679106-09D1-4F3B-858C-A5D62F3C5463 "Manage Personnel" means individuals involved in the performance of Services as employees or independent contractors of iManage.
"iManage Software" means software that allows an Authorized User to use certain features of the Cloud Services and is provided by Manage either for installation on Customer's or an Authorized User's device, or that is otherwise accessed by Authorized Users from or through Customer's or an Authorized User's software, hardware, or other devices. "Intellectual Property Rights" means existing and future registered and unregistered rights granted, applied for or otherwise in existence under or related to any patent, copyright, trademark, trade secret, database protection or other intellectual property Laws, and all similar or equivalent rights or forms of protection, in any part of the world. "Law" means any applicable statute, law, ordinance, regulation, rule, order, constitution, treaty, common law, judgment, decree, or other requirement having the force of law, of any federal, state, provincial, local, or foreign government or political subdivision thereof, or any arbitrator, court, or tribunal of competent jurisdiction, whether in existence as of the effective date of this Agreement or promulgated thereafter, as amended, or superseded. "Losses" means any and all losses, damages, liabilities, deficiencies, claims, actions, judgments, settlements, interest, awards, penalties, fines, costs, or expenses of whatever kind, including reasonable attorneys' fees. "Order" means the separate ordering documents) under which Customer subscribes to the Cloud Services pursuant to this Agreement, whether (a) placed by Customer directly with Manage, or (b) placed by a Partner (on behalf of Customer) with Manage, referencing this Agreement, with respect to Customer's subscription to the Cloud Services. "Order Effective Date" means the effective date specified in the applicable Order. "Order Term" means an Order Initial Term (as defined in Section 7.2) together with each applicable Order Renewal Term (as defined in Section 7.3).
"Partner" means an entity that has entered into an agreement ("Partner Agreement") with Manage that, among other things, authorizes the entity to resell the Services.
"Permitted Use" means any use of the Services and Manage Software, by an Authorized User, for the benefit of Customer solely in or for Customer's internal business operations. "Professional Services" means certain non-recurring professional, educational, operational, or technical services that Customer, at its option, may request from Manage and that Manage agrees to provide pursuant to an agreed upor statement of work ("SOW"). Professional Services do not include services undertaken by a Partner. "Professional Services Data" means all data provided to Manage by or on behalf of Customer (or that Customer authorizes Manage to obtain from the Cloud Services), through an engagement with Manage to obtain Professional Services. "Regulator" means any public body, government agency, or regulator with competent jurisdiction over a Party or one of its Affiliates.
"Representatives" means, with respect to a Party, that Party's and its Affiliates' employees, officers, directors, consultants, agents, independent contractors, service providers, subcontractors, and legal advisors. "Support Data" means all data provided to Manage by or on behalf of Customer (or that Customer authorizes Manage to obtain from the Cloud Services), during Manage's provision of Support Services (as defined in Section 13).
2. Services.
2.1 Services. Manage shall, during the applicable Order Term, provide to Customer, exercisable by and through Authorized Users, the following services (the "Services"), as applicable: (a) the Cloud Services; (b) the Support Services; (c) the Professional Services as set forth in a SOW; and (d) any incidental services not expressly set out in an Order or SOW if they are reasonably and necessarily required for the proper performance of the Services that are expressly set out in the applicable Order or SOW. 2 DocuSign Envelope ID: 387DE0A6-E450-4D58-84 73BF83010CA DocuSign Envelope ID: B2679106-09D1-4F3B-858C-A5D62F3C5463
2.2 Services Changes. Manage may make commercially reasonable changes to the Cloud Services, Support Services, and iManage Software from time to time; provided that, such change does not materially degrade the performance of the Cloud Services, Support Services, or Manage Software.
Non-Manage Applications and Services. Customer's use of any third-party applications, services, or products, which are licensed by their provider to Customer and/or Authorized Users), for use in connection with the Services ("Third-Party Products"), and any exchange or other transfer of any information between Customer and any third-party provider ("Third-Party Data Transfer") is solely between Customer and the applicable third- party provider. Manage makes no warranties of any kind and assumes no liability whatsoever for Customer's or Authorized Users' use of such Third-Party Products or acts or omissions in connection with any such Third-Party Data Transfer.
2.4 SLA. Exhibit A to this Agreement sets forth the service level agreement applicable to the Cloud Services.
3. Authorization and Customer Restrictions.
3.1 Authorization, iManage hereby authorizes Customer to access and use, during the applicable Order Term, the Cloud Services, the iManage Software, and such Documentation as Manage may supply or make available to Customer solely for the Permitted Use by and through Authorized Users in accordance with the Documentation.
This authorization is non-exclusive and, except as may be expressly set forth in Section 12.9, non-transferable.
3.2 Acceptable Use, Limitations and Restrictions.
(a) Neither Customer nor its Authorized Users may use the Services or the Manage Software: (i) in a way prohibited by Law; (i) to violate the rights of others; (iii) to try to gain unauthorized access to or disrupt the Services, the Manage Software, or any other service, device, data, account, or network; (iv) to spam or distribute Harmful Code; or (v) in a way that could harm or otherwise impair the Services, the Manage Software, or anyone else's use of it.
(b) Neither Customer nor its Authorized Users may: (i) resell or redistribute the Services or the Manage Software, (il) allow multiple users to directly or indirectly access any Services or Manage Software feature that is made available on a per-user basis, (il) access the Services or the iManage Software in order to build a competitive Without limiting any of Manage's other rights under this Agreement, an Authorized User's actual or suspected violation of the terms in this Section 3.2 may result in suspension of such Authorized User's use of the Services or the iManage Software. iManage will suspend such Authorized User's use of the Services and the iManage Software only to the extent, and for the time period, reasonably necessary to address said violation.
Unless Manage believes an immediate suspension is required, iManage will provide reasonable notice before suspending the Authorized User's use of the Services or the iManage Software, Manage may seek all reasonable legal remedies available to it if a violation of this Section 3.2 occurs. For the avoidance of doubt, the suspension rights in this Section only apply to fhose Authorized Users whom Manage knows or reasonably suspects are in violation of Section 3.2 (and not to Customer generally).
Use by Affiliates. Customer is entitled to make the Services, the Manage Software, and Documentation available to Authorized Users of its Affiliates provided that: (a) Customer will be responsible for the Fees and all acts and omissions of its Affiliates (and their Authorized Users); (b) Customer is liable for ensuring that its Affiliates (and their Authorized Users) comply with the terms of this Agreement; and (c) Customer shall ensure that any rights or remedies arising in connection with this Agreement will be actionable against Manage solely by Customer and not by any Affiliate except that Customer will be entitled to treat Losses of its Affiliates as if they are Losses of
3.4 iManage Software. Customer may need to install certain Manage Software in order to use the Cloud Services. If so, during the applicable Order Term, Customer may install and use the Manage Software only for use with the Cloud Services. Customer must uninstall the Manage Software when Customer's right to use the Cloud Services ends.
4. Fees; Payment Terms. In the event that a Partner places an Order with Manage on Customer's behalf, only Section
4.8 of this Section 4 shall apply to Customer.
4.1 Fees. Customer shall pay iManage the Fees in accordance with this Section 4. Fees shall be paid in the currency as detailed in the applicable Order.
4.2 Non-refundable and No Cancellation. Except as specifically set forth in this Agreement, all Orders, including all payment obligations thereunder, are non-cancelable and all payments made are non-refundable. 3 DocuSign Envelope ID: 387DE0A6-E450-4D58-8 773BF83010CA DocuSign Envelope ID: B2679106-09D1-4F3B-858C-A5D62F3C5463
4.3 Taxes. Orders pursuant to this Agreement do not include any transaction taxes, which may include local, state, provincial, federal, or foreign taxes, levies, duties, or similar governmental assessments of any nature, including value-added taxes, excise, use, goods and services taxes, consumption taxes or similar taxes (collectively defined as "General Taxes"). All Fees invoiced pursuant to this Agreement are payable in full and without reduction for General Taxes and/or foreign withholding taxes (collectively defined as "Taxes"). Customer is responsible for paying all Taxes associated with Fees due pursuant to this Agreement and all Orders, excluding income taxes imposed on iManage ("Manage Income Tax"). If Manage has a legal obligation to pay or collect Taxes (expressly excluding Manage Income Tax) for which Customer is responsible under this Agreement, the appropriate amount shall be computed based on Customer's address listed in the applicable Order and invoiced to and paid by Customer. Customer hereby confirms that Manage can rely on the sold-to name and address set forth in the Order(s) that Customer places with Manage as being the place of supply for purposes of any General Tax. If Customer is legally entitled to an exemption from the payment of any Taxes, Customer will promptly provide Manage with legally sufficient tax exemption certificates for each taxing jurisdiction for which it claims exemption.
Disputed Fees. If Customer disputes any portion of Fees set forth on any invoice, Customer shall within thirty (30) days of the date of the applicable invoice (a) pay the undisputed portion of Fees on said invoice and (b) notify Manage, in writing, of its basis for contesting the disputed Fees. The Parties agree to discuss any dispute within ten (10) days of Manage's receipt of such notification. If necessary, Manage shall provide an amended invoice to Customer after the discussion and Customer will pay such invoice within the time period set forth in the applicable Order.
Late Payment. If Customer falls to make any undisputed payment when due then, in addition to all other remedies that may be available, if such failure continues for thirty (30) days following written notice of such failure (Including notice that the Cloud Services may be suspended), Manage may suspend performance of the Cloud Services until all past due amounts have been paid, without incurring any obligation or liability to Customer by reason of such suspension. At Manage's discretion, past due amounts may accrue a late fee equal to the lesser of 1.5% per month or the maximum amount allowed by applicable Law.
4.6 No Deductions or Setoffs. All amounts payable to Manage under this Agreement shall be paid by Customer to Manage in full without any setoff, deduction or withholding for any reason (other than any deduction or withholding of tax as may be required by applicable Law).
Purchase Orders. If Customer requires the use of a purchase order or purchase order number, Customer (a) must provide the purchase order number at the time of purchase and (b) agrees that any terms and conditions on any such purchase order are null and void and will not apply to Customer's procurement of the Services or any other subject matter of this Agreement.
4.8 Purchases Through Partners. Customer may authorize a Partner to place an Order with Manage on Customer's behalf. Partners are not agents of Manage and are not authorized to enter into any agreement with Customer on behalf of Manage. Manage Partners are not authorized to make any promises or commitments on Manage's behalf, and Manage shall have no obligation to Customer other than those obligations specifically set forth and agreed to by Manage and Customer in this Agreement. If Customer orders from a Partner, the Partner will set Customer's pricing and payment terms for that Order, and Customer will pay the amounts due to the Partner.
Customer consents to iManage and its Affiliates providing the Partner with Administrator Data (as defined below) for purposes of provisioning, administering, and supporting (if applicable) the Services. The Partner may use such data according to the terms of the Partner's agreement with Customer. "Administrator Data" means the information provided to Manage or its Affiliates during sign-up, purchase, or administration of the Services. Under the terms and conditions of the applicable Partner Agreement, iManage is entitled to suspend or terminate Customer's subscription to the Cloud Services, Customer's rights to access and use the Cloud Service, and remove and discard any Customer Data (pursuant to the terms herein), if Manage is notified by Partner of Customer's failure to pay amounts due to Partner with respect to Customer's subscription to the Cloud Services; provided that, if Customer properly pays Partner, failure by such Partner to make any requisite payments to iManage shall not affect the validity or enforceability of Manage's obligations hereunder, nor shall it affect the validity of any access and use right which is subject to this Agreement. Customer consents to this suspension and termination right and acknowledges and agrees that Manage shall have no liability to Customer of any kind with respect to any such suspension or termination. Customer's sole recourse with respect to any such suspension or termination shall be against Partner.
5. Intellectual Property Rights.
5.1 Services and Documentation. All right, title, and interest in and to the Services, the Manage Software, and Documentation, including all Intellectual Property Rights therein, are and will remain with Manage. Customer has no right, license, or authorization with respect to any of the Services or Documentation except as expressly set 4 DocuSign Envelope ID: 387DE0A6-E450-4D58-84L 3BF83010CA DocuSign Envelope ID: B2679106-09D1-4F3B-858C-A5D62F3C5463 forth in Section 3.1, in each case subject to Section 3.2. All other rights in and to the Services, the Manage Software, and Documentation are expressly reserved by iManage.
Customer Data. As between Customer and Manage, Customer is and will remain the sole and exclusive owner of all right, title, and interest in and to all Customer Data, including all Intellectual Property Rights relating thereto.
6. Confidentiality and Security.
6.1 Confidential Information. In connection with this Agreement, each Party or one of its Affiliates (as the "Disclosing Party") may disclose or make available Confidential Information to the other Party or one of its Affiliates (as the "Receiving Party") (including Confidential Information that might be disclosed through, or to, a Partner). Subject to Section 6.2, "Confidential Information" means information in any form or medium (whether oral, written, electronic or other) disclosed, or made available, by a Party, or on behalf of a Party, to the other Party that is identified as confidential at time of disclosure or is disclosed, or made available, under circumstances that would reasonably indicate confidential treatment, including information consisting of or relating to the Disclosing Party's technology, trade secrets, know-how, business operations, plans, strategies, customers, pricing, and information with respect to which the Disclosing Party has contractual or other confidentiality obligations, in each case whether or not marked, designated or otherwise identified as "confidential". Without limiting the foregoing, (a) all Customer Data, Professional Services Data and Support Data is and will remain the Confidential Information of Customer, (b) the Services, Manage Software and Documentation are and will remain the Confidential Information of Manage and (c) the terms and existence of this Agreement are Confidential Information of each Party with respect to the other.
Exclusions. Confidential Information does not include information that the Receiving Party can demonstrate by written or other documentary records: (a) was rightfully known to the Receiving Party without restriction on use or disclosure prior to such information's being disclosed or made available to the Receiving Party in connection with this Agreement; (b) was or becomes generally known by the public other than by the Receiving Party's or any of its Representatives' noncompliance with this Agreement; (c) was or is received by the Receiving Party on a non-confidential basis from a third party that, to the Receiving Party's knowledge, was not or is not, at the time of such receipt, under any obligation to maintain its confidentiality; or (d) was or is independently developed by the Receiving Party without reference to or use of any Confidential Information.
Protection of Confidential Information. As a condition to being provided with any disclosure of or access to Confidential Information, the Receiving Party shall:
(a) not access or use Confidential Information other than as necessary to exercise its rights or perform its obligations under and in accordance with this Agreement; (b) except as may be permitted by and subject to its compliance with Section 6.4, not disclose or permit access to Confldential Information other than to its Representatives who: (i) need to know such Confidential Information for purposes of the Receiving Party's exercise of its rights or performance of its obligations under and in accordance with this Agreement; (i) have been informed of the confidential nature of the Confidential Information and the Receiving Party's obligations under this Section 6.3; and (iii) are bound by confidentiality and restricted use obligations at least as protective of the Confidential Information as the terms set forth in this Section 6.3;
safeguard the Confidential Information from unauthorized use, access or disclosure using at least the degree of care it uses to protect its sensitive information and in no event less than a reasonable degree of care: (i) with respect to trade secrets, for so long as such trade secrets qualify as trade secrets under applicable Law, (ii) with respect to Customer Data, in perpetuity, and (iii) with respect to all other Confidential Information, for five (5) years from the date of receipt or for such period as the information remains confidential, whichever is longer; and
(d) ensure its Representatives' compliance with and be responsible and liable for any of its Representatives' non-compliance with, the terms of this Section 6
Compelled Disclosures. If the Receiving Party or any of its Representatives is compelled by applicable Law or a Regulator to disclose any Confidential Information then, to the extent permitted by applicable Law or such Regulator, the Receiving Party shall: (a) promptly, and prior to such disclosure, notify the Disclosing Party in writing of such requirement so that the Disclosing Party can oppose such disclosure, seek a protective order or other limitation on disclosure, or waive its rights under Section 6.3; and (b) provide reasonable assistance to the Disclosing Party, at the Disclosing Party's sole cost and expense, in opposing such disclosure or seeking a protective order or other limitations on disclosure. If the Disclosing Party waives compliance or the Receiving Party, after providing the notice and assistance required under this Section 6.4, remains required by Law or such Regulator to disclose any Confidential Information, the Receiving Party shall disclose only that portion of the 5 DocuSign Envelope ID: 387DE0A6-E450-4D58-8 173BF83010CA DocuSign Envelope ID: B2679106-09D1-4F3B-858C-A5D62F3C5463 Confidential Information that the Receiving Party is legally required to disclose and, on the Disclosing Party's request, shall use commercially reasonable efforts to obtain assurances from the applicable court or other presiding authority that such Confidential Information will be afforded confidential treatment.
6.5 Additional Manage Obligations Regarding Law Enforcement. Manage will not disclose or provide access to any Confidential Information to law enforcement unless required by Law. If law enforcement contacts Manage with a demand for Confidential Information, Manage will attempt to redirect the law enforcement agency to request that data directly from Customer. If compelled to disclose or provide access to any Confidential Information to law enforcement, Manage will, to the extent permitted by applicable Law or the applicable law enforcement agency, (a) promptly notify Customer and provide a copy of the demand; (b) assess the legitimacy of any request, including the identity of the sender; (c) submit any clarifications necessary to understand the scope of the disclosure request; and (d) oppose any blanket disclosure requests. Manage will not provide any law enforcement agency with: (1) blanket or unfettered access to Confidential Information; (2) platform encryption keys used to secure Customer Data or the ability to break such encryption; or (3) access to Confidential Information if Manage is aware that the data is to be used for purposes other than those stated in the third party's request. In support of the above, Manage may provide Customer's basic contact information to the law enforcement agency.
Security. During the Agreement Term (as defined in Section 7.1), Manage will maintain commercially reasonable technical and organizational measures, including disaster recovery and business continuity procedures, designed to: (a) ensure the security and integrity of Customer Data, and (b) protect against accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Data. Such security safeguards and measures applicable to Customer Data are further described in Exhibit B. Customer is solely responsible for making an independent determination as to whether the technical and organizational measures meet Customer's requirements.
7. Term and Termination.
7.1 Agreement Term. This Agreement shall commence on the first Order Effective Date and, unless terminated earlier pursuant to any of this Agreement's express provisions, will continue for as long as there is an Order in effect the "Agreement Term").
7.2 Order Initial Term. The initial term of an Order commences upon the applicable subscription start date and, unless terminated earlier pursuant to any of this Agreement's express provisions, will continue for the initial term as set forth in the Order (the "Order Initial Term").
Order Renewal Term. Unless otherwise expressly agreed in the applicable Order, each Order will automatically renew for additional successive one-year terms unless earlier terminated pursuant to this Agreement's express provisions or either Party gives the other Party written notice of non-renewal at least thirty (30) days prior to the expiration of the then-current term (each, an "Order Renewal Term").
Termination. In addition to any other express termination right set forth elsewhere in this Agreement, either Party may terminate this Agreement or an Order, effective on written notice to the other Party, if the other Party materially breaches this Agreement or that Order, and such breach: (a) is incapable of cure; or (b) being capable of cure, remains uncured thirty (30) days after the non-breaching Party provides the breaching Party with written notice of such breach with specific reference to the non-breaching Party's right of termination under this Section
7.4. Termination of an Order shall not result in the automatic termination of any other Orders in existence.
Effect of Expiration or Termination. Upon any expiration or termination of this Agreement or an Order, as applicable, except as expressly otherwise provided in this Agreement:
(a) all rights, licenses, consents, and authorizations granted by either Party to the other hereunder will immediately terminate;
permanently erase all Manage Software, Documentation and Manage Confidential Information from all notwithstanding anything to the contrary in this Agreement, with respect to information and materials then in its possession or control: (i) the Receiving Party may retain the Disclosing Party's Confidential Information, in its then current state and solely to the extent and for so long as required by applicable Law; (ii) the Receiving Party also may retain the Disclosing Party's Confidential Information in its backups and disaster recovery systems until such Confidential Information is deleted or otherwise remediated in the ordinary course of 6 DocuSign Envelope ID: 387DE0A6-E450-4D58-841 3BF83010CA DocuSign Envelope ID: B2679106-09D1-4F3B-858C-A5D62F3C5463 business (not to exceed 180 days); and (iii) all information and materials described in this Section 7.5(c) will remain subject to all confidentiality, security and other applicable requirements of this Agreement; (d) if Customer properly terminates this Agreement or an Order, Customer will be relieved of any obligation to pay any applicable Fees attributable to the period after the effective date of such termination and Manage will: (i) refund to Customer all Fees paid in advance for Services that Manage has not performed as of the effective date of termination and (i) pay to Customer any unpaid Service Credit (as defined in Exhibit A) to which Customer is entitled (for the avoidance of doubt, the termination of an Order shall not affect the Customer's obligation to pay Fees in respect of any other Orders which continue in existence); and if Manage properly terminates this Agreement or an Order, all Fees that would have become payable had this Agreement remained in effect until expiration of the applicable Order Term will become immediately due and payable, and Customer shall pay such Fees, together with previously accrued but not yet paid Fees, on receipt of Manage's invoice therefor.
7.6 Surviving Terms. Each provision of this Agreement that, by its nature, should survive termination or expiration of this Agreement, will survive any termination or expiration of this Agreement.
8. Representations and Warranties.
8.1 Mutual Representations and Warranties. Each Party represents and warrants to the other Party that:
(a) it is duly organized, validly existing and in good standing as a corporation or other entity under the Laws of the jurisdiction of its incorporation or other organization; (b) it has the full right, power, and authority to enter into and perform its obligations and grant the rights, licenses, consents, and authorizations it grants or is required to grant under this Agreement; the execution of this Agreement by its representative has been duly authorized by all necessary corporate or organizational action of such Party; and
(d) this Agreement will constitute the legal, valid, and binding obligation of such Party, enforceable against such Party in accordance with its terms.
8.2 Compliance with Laws.
(a) iManage. Manage will comply with all Laws applicable to its obligations hereunder in providing the Services.
However, iManage is not responsible for compliance with any Laws or regulations applicable to Customer or Customer's industry that are not generally applicable to information technology service providers. Manage does not determine whether Customer Data Includes information subject to any specific Law or regulation. (b) Customer. Customer must comply with all Laws applicable to its use of the Services. Customer is responsible for maintaining privacy protections and security measures for components that Customer provides or controls, and for using the Services in a manner consistent with Customer's legal and regulatory obligations. Customer is responsible for responding to any request from a third party regarding Customer's use of the Services.
Additional Manage Representations, Warranties and Covenants, Manage represents, warrants and covenants to Customer, during the Agreement Term, that (a) Manage will perform the Services using personnel of required skill, experience and qualifications and in a professional and workmanlike manner in accordance with generally recognized industry standards for similar services and will devote adequate resources to meet its obligations under this Agreement, (b) the Cloud Services are and will remain free of Harmful Code, and (c) the Cloud Services will perform substantially in accordance with the functions specified in the Documentation when under use by Authorized Users in a manner that conforms to the terms and conditions of this Agreement and the Documentation. The warranties set forth herein are made to and for the benefit of Customer only.
8.4 Additional Customer Representations, Warranties and Covenants. Customer represents, warrants and covenants to Manage, during the Agreement Term, that (a) Customer is responsible for use of the Services by Authorized Users, and for ensuring that Authorized Users comply with the terms of this Agreement, (b) Customer owns or otherwise has and will have the necessary rights and consents in and relating to Customer Data as necessary in order to grant the rights to Manage contemplated by this Agreement, and (c) Manage's Processing (as defined below) of Customer Data in accordance with the terms hereof does not, and will not, cause Manage to suffer any liability for violation of a third party's rights, or violation of any applicable Law.
DISCLAIMER OF WARRANTIES. EXCEPT FOR THE EXPRESS WARRANTIES SET FORTH IN THIS AGREEMENT, ALL SERVICES, IMANAGE SOFTWARE, AND DOCUMENTATION ARE PROVIDED "AS IS"
AND IMANAGE HEREBY DISCLAIMS ALL WARRANTIES, WHETHER EXPRESS, IMPLIED, STATUTORY OR
OTHER, AND IMANAGE SPECIFICALLY DISCLAIMS ALL IMPLIED WARRANTIES OF MERCHANTABILITY, 7 DocuSign Envelope ID: 387DE0A6-E450-4D58-8 773BF83010CA DocuSign Envelope ID: B2679106-09D1-4F3B-85BC-A5D62F3C5463
FITNESS FOR A PARTICULAR PURPOSE, TITLE AND NON-INFRINGEMENT, AND ALL WARRANTIES ARISING FROM COURSE OF DEALING, USAGE OR TRADE PRACTICE. WITHOUT LIMITING THE
FOREGOING, IMANAGE MAKES NO WARRANTY OF ANY KIND THAT THE SERVICES, IMANAGE
SOFTWARE OR DOCUMENTATION, OR ANY PRODUCTS OR RESULTS OF THE USE THEREOF, WILL
OPERATE WITHOUT INTERRUPTION, BE COMPATIBLE OR WORK WITH ANY SOFTWARE, SYSTEM OR
OTHER SERVICES EXCEPT IF AND TO THE EXTENT EXPRESSLY SET FORTH IN THE DOCUMENTATION, OR BE ERROR FREE.
9. Indemnification.
Manage Indemnification. iManage shall indemnify, defend, and hold harmless Customer from and against Losses incurred by Customer arising out of or relating to any Action by a third party (other than an Affiliate of Customer) to the extent that such Losses arise from use of the Services, the Manage Software and Documentation (excluding Customer Data) in compliance with this Agreement that infringes an Intellectual Property Right of such third party. The foregoing obligation does not apply to any Action or Losses arising out of or relating to any:
(a) access to or use of the Services, the Manage Software, or Documentation in combination with any hardware, system, software, network or other materials or service not provided or authorized in the Documentation or otherwise in writing by Manage;
modification of the Services, the Manage Software, or Documentation other than: (i) by or on behalf of Manage; or (ii) with Manage's written approval in accordance with Manage's written specification; or (c) failure to timely implement any modifications, upgrades, replacements, or enhancements that require Customer action to implement, and are made available to Customer by or on behalf of Manage.
9.2 Customer Indemnification, Customer shall indemnify, defend and hold harmless iManage and its Affiliates, and each of its and their respective officers, directors, employees, agents, successors and assigns (each, an "iManage Indemnitee") from and against Losses incurred by such Manage Indemnitee in connection with any Action by a third party (other than an Affiliate of an iManage Indemnitee) that arises out of or relates to: (a) Customer Data infringing the Intellectual Property Right of such third party; or (b) Customer's use of the Services in violation of this Agreement or the Documentation.
Indemnification Procedure. Each Party shall promptly notify the other Party in writing of any Action for which such Party belleves it is entitled to be indemnified pursuant to Section 9.1 or Section 9.2. The Party seeking indemnification (the "Indemnitee") shall cooperate with the other Party (the "Indemnitor") at the Indemnitor's sole cost and expense. The Indemnitor shall immediately take control of the defense and investigation of such Action and shall employ counsel of its choice to handle and defend the same, at the Indemnitor's sole cost and expense. The Indemnitee's failure to perform any obligations under this Section 9.3 will not relieve the Indemnitor of its obligations under this Section 9 except to the extent that the Indemnitor can demonstrate that it has been prejudiced as a result of such failure. The Indemnitee may participate in and observe the proceedings at its own cost and expense with counsel of its own choosing.
Mitigation. At its option and sole cost and expense, Manage is entitled to mitigate the risk or Losses of any actual or threatened infringement of any third party's Intellectual Property Right by:
(a) obtaining the right for Customer to continue to use the Services, the Manage Software, and Documentation materially as contemplated by this Agreement;
modifying or replacing the Services, the iManage Software, and Documentation, in whole or in part, to make the Services, the Manage Software, and Documentation (as so modified or replaced) non-infringing, while providing materially equivalent features and functionality, in which case such modifications or replacements will constitute Services, Manage Software, and Documentation, as applicable, under this Agreement; or (c) if options (a) or (b) are not commercially reasonable, by written notice to Customer, terminating this Agreement with respect to all or part of the Services, the Manage Software, and Documentation, requiring Customer immediately to cease any use of the Services, Manage Software, and Documentation or any specified part or feature thereof, adjusting Fees going forward, and issuing Customer a refund equal to the balance of any prepaid amount.
THIS SECTION 9 SETS FORTH CUSTOMER'S SOLE REMEDIES AND IMANAGE'S SOLE LIABILITY AND
OBLIGATION FOR ANY ACTUAL, THREATENED OR ALLEGED CLAIMS THAT THIS AGREEMENT OR ANY
SUBJECT MATTER HEREOF (INCLUDING THE SERVICES, THE IMANAGE SOFTWARE, AND
DOCUMENTATION) INFRINGES, MISAPPROPRIATES OR OTHERWISE VIOLATES ANY THIRD-PARTY INTELLECTUAL PROPERTY RIGHT.
DocuSign Envelope ID: 387DE0A6-E450-4D58-84L 3BF83010CA DocuSign Envelope ID: B2679106-09D1-4F3B-858C-A5D62F3C5463
10. Limitations of Liability.
10.1 EXCLUSION OF DAMAGES. EXCEPT AS OTHERWISE PROVIDED IN SECTION 10.3, IN NO EVENT WILL
EITHER PARTY BE LIABLE FOR ANY CONSEQUENTIAL, INDIRECT, INCIDENTAL, SPECIAL, PUNITIVE LOSS OF PROFITS, BUSINESS, BUSINESS OPPORTUNITIES, REPUTATION, TURNOVER OR REVENUE
LOSS OF ANTICIPATED SAVINGS OR WASTED EXPENDITURE (INCLUDING MANAGEMENT TIME), LOSS,
OR LIABILITY UNDER OR IN RELATION TO ANY OTHER CONTRACT, OR LOSS OF GOODWILL, IN EACH
CASE, HOWEVER CAUSED, UNDER ANY THEORY OF LIABILITY, INCLUDING, WITHOUT LIMITATION,
CONTRACT, TORT, WARRANTY, NEGLIGENCE OR OTHERWISE, EVEN IF SUCH PARTY HAS BEEN ADVISED AS TO THE POSSIBILITY OF SUCH DAMAGES. SOME JURISDICTIONS DO NOT ALLOW THE LIMITATION OF INCIDENTAL, CONSEQUENTIAL, OR OTHER DAMAGES. IN SUCH AN EVENT, THIS LIMITATION WILL NOT APPLY TO THE EXTENT PROHIBITED BY LAW.
10.2 CAP ON MONETARY LIABILITY. EXCEPT AS OTHERWISE PROVIDED IN SECTION 10.3, IN NO EVENT WILL
THE AGGREGATE LIABILITY OF EITHER PARTY UNDER OR IN CONNECTION WITH THIS AGREEMENT
OR ITS SUBJECT MATTER, INCLUDING ANY ORDERS, UNDER ANY LEGAL OR EQUITABLE THEORY,
INCLUDING BREACH OF CONTRACT, TORT (INCLUDING NEGLIGENCE), STRICT LIABILITY AND
OTHERWISE, EXCEED THE GREATER OF (A) THE VALUE OF ALL AMOUNTS PAID BY CUSTOMER UNDER THIS AGREEMENT DURING THE 12 MONTHS PRECEDING THE ACT OR OMISSION ALLEGED TO GIVE RISE TO SUCH LIABILITY, OR (B) $50,000 USD. THE FOREGOING LIMITATION APPLIES NOTWITHSTANDING THE FAILURE OF ANY AGREED OR OTHER REMEDY OF ITS ESSENTIAL PURPOSE.
THE LIMITATIONS OF LIABILITY PROVIDED FOR HEREIN WILL APPLY IN AGGREGATE TO EITHER PARTY AND THEIR RESPECTIVE AFFILIATES AND SHALL NOT BE CUMULATIVE. THE EXCLUSIONS AND
LIMITATIONS IN THIS SECTION SHALL NOT LIMIT OR OTHERWISE RELIEVE CUSTOMER OF ITS PAYMENT OBLIGATIONS UNDER THIS AGREEMENT OR AN APPLICABLE ORDER.
Exceptions. The exclusions and limitations in Section 10.1 and Section 10.2 do not apply to: (a) fraud or fraudulent misrepresentation of either Party, (b) the liability of either Party for the indemnities set out in Section 9 (Indemnification), (c) negligence of either Party causing death or personal injury, or (d) liability for willful misconduct.
11. Force Majeure
11.1 No Breach or Default. In no event will either Party be liable or responsible to the other Party, or be deemed to have defaulted under or breached this Agreement, for any failure or delay in fulfilling or performing this Agreement, except for any payment obligation, when and to the extent such failure or delay is caused by any circumstances beyond such Party's reasonable control (a "Force Majeure Event"), including acts of God, flood, fire, earthquake, explosion, other catastrophes, such as epidemics, war, terrorism, invasion, riot or other civil unrest, embargoes or blockades in effect on or after the date of this Agreement, national or regional emergency, strikes, labor stoppages or slowdowns or other industrial disturbances (other than within Manage), passage of Law or any action taken by a governmental or public authority, including imposing an embargo, export or import restriction, quota or other restriction or prohibition or any complete or partial government shutdown, or national or regional shortage of adequate power or telecommunications or transportation. Either Party may terminate this Agreement if a Force Majeure Event continues substantially uninterrupted for a period of thirty (30) days or more.
11.2 Affected Party Obligations. In the event of any failure or delay caused by a Force Majeure Event, the affected Party shall give prompt written notice to the other Party stating the period of time the occurrence is expected to continue and use commercially reasonable efforts to end the failure or delay and minimize the effects of such Force Majeure Event.
12. Miscellaneous.
12.1 Export Compliance. The Services and other technology Manage makes available, and derivatives thereof, may be subject to export Laws and regulations of the United States and other jurisdictions. Each Party represents that it is not named on any U.S. government denied-party list. Customer shall not permit Authorized Users to access or use any Service in a U.S. embargoed country or in violation of any U.S. export law or regulation.
12.2 Further Assurances, Upon a Party's reasonable request, the other Party shall, at the requesting Party's sole cost and expense, execute and deliver all such documents and instruments, and take all such further actions, necessary to give full effect to this Agreement.
12.3 Contractual Relationship. The Parties are entering into this Agreement as independent contracting parties. Neither Party will have, or hold itself out as having, any right or authority to incur any obligation on behalf of the other Party. This Agreement will not be construed to create an association, joint venture, or partnership between the Parties or to impose any partnership liability upon either Party. 9 DocuSign Envelope ID: 387DE0A6-E450-4D58-8+ 73BF83010CA DocuSign Envelope ID: B2679106-09D1-4F3B-858C-A5D62F3C5463
12.4 Marketing. Customer agrees that Manage may include Customer's name and logo on Manage's website and in Manage's list of customers, press releases and other promotional materials.
12.5 Notices. Any notice or other communication under this Agreement given by a Party to the other Party will be in writing and will be effective upon delivery as follows: (i) if to Customer, (1) when delivered via registered mail, return receipt requested, to the address specified in an Order; or (2) when sent via email to the email address specified in an Order or otherwise on record for Customer; and (ii) if to iManage, when sent via email to [email protected], with a duplicate copy sent via registered mail, return receipt requested, to: Attn: Legal Department, Manage LLC, 71 South Wacker Drive, Suite 400, Chicago, IL, 60606, (or such subsequent address found on https://imanage.com/contact-us/). Any such notice, in either case, must specifically reference that it is a notice given under this Agreement. Manage may provide Customer with information and notices about the Cloud Services electronically, including via email, through the portal for the Cloud Services, or through a web site that Manage identifies, which has a mechanism allowing Customer to subscribe to receive such notifications via email. Notice is given as of the date it is made available by iManage. It is Customer's sole responsibility to ensure that Customer's administrators maintain accurate contact information on the Manage support website found at https://help.imanage.com.
12.6 Interpretation. For purposes of this Agreement: (a) the words "include," "includes" and "including" are deemed to be followed by the words "without limitation"; (b) the word "or" is not exclusive; (c) the words "herein," "hereof," "hereby," "hereto" and "hereunder" refer to this Agreement as a whole; (d) words denoting the singular have a comparable meaning when used in the plural, and vice-versa; and (e) words denoting any gender include all genders. Unless the context otherwise requires, references in this Agreement: (x) to sections, exhibits, schedules, attachments and appendices mean the sections of, and exhibits, schedules, attachments and appendices attached to, this Agreement; (y) to an agreement, instrument or other document means such agreement, instrument or other document as amended, supplemented and modified from time to time to the extent permitted by the provisions thereof; and (z) to a statute means such statute as amended from time to time and includes any successor legislation thereto and any regulations promulgated thereunder. The Parties intend this Agreement to be construed without regard to any presumption or rule requiring construction or interpretation against the Party drafting an instrument or causing any instrument to be drafted. The exhibits, schedules, and appendices referred to herein are an integral part of this Agreement to the same extent as if they were set forth herein.
12.7 Headings. The headings herein are for reference only and do not affect the interpretation of this Agreement.
12.8 Entire Agreement. This Agreement, together with any other documents incorporated herein by reference, constitutes the sole and entire agreement of the Parties with respect to the subject matter of this Agreement and supersedes all prior and contemporaneous understandings, agreements, representations, and warranties, both written and oral, with respect to such subject matter. In the event of any inconsistency between the statements made in the body of this Agreement, the related exhibits, schedules, attachments, and appendices (other than an Agreement; and (c) third, any other documents incorporated herein by reference.
Assignment. Neither Party may assign any of its rights or obligations hereunder, whether by operation of law or otherwise, without the other Party's prior written consent (not to be unreasonably withheld); provided, however, either Party may assign this Agreement in its entirety (together with all Orders), without the other Party's consent to an Affiliate or in connection with a merger, acquisition, corporate reorganization, or sale of all or substantially all of its assets. Notwithstanding the foregoing, if a Party is acquired by, sells substantially all of its assets to, or undergoes a change of control in favor of, a direct competitor of the other Party, then such other Party may terminate this Agreement upon written notice. In the event of such a termination, Manage will refund to Customer the balance of any prepaid amount. Any purported assignment, delegation, or transfer in violation of this Section
12.9 is void. This Agreement is binding upon and inures to the benefit of the Parties and their respective permitted successors and permitted assigns.
12.10 No Third-party Beneficiaries. Subject to Section 9, this Agreement is for the sole benefit of the Parties and their respective permitted successors and permitted assigns and nothing herein, express, or implied, is intended to or shall confer upon any other entity or natural person any legal or equitable right, benefit, or remedy of any nature whatsoever under or by reason of this Agreement.
12.11 Modification, Amendment and Waiver, Except as otherwise provided herein, no modification, amendment, or waiver of any provision of this Agreement will be effective unless in writing and signed by the Party against whom the modification, amendment or waiver is to be asserted.
12.12 Severability. If any provision of this Agreement is invalid, illegal, or unenforceable in any jurisdiction, such invalidity, illegality, or unenforceability shall not affect any other term or provision of this Agreement or invalidate 10 DocuSign Envelope ID: 387DE0A6-E450-4D58-84 /3BF83010CA DocuSign Envelope ID: B2679106-09D1-4F3B-858C-A5D62F3C5463 or render unenforceable such term or provision in any other jurisdiction. Upon such determination that any term or other provision is invalid, illegal, or unenforceable, the Parties shall negotiate in good faith to modify this Agreement so as to affect the original intent of the Parties as closely as possible in a mutually acceptable manner in order that the transactions contemplated hereby may be consummated as originally contemplated to the greatest extent possible.
12.13 Manage Entity, Applicable Law, and Venue.
(a) The iManage entity entering into this Agreement depends on the billing address of Customer set forth in the applicable Order. If the billing address is located in Europe, the Middle East or Africa, the Manage entity entering into this Agreement is Manage EMEA Limited, a private limited company registered in England and Wales. If the billing address is located in any other region, the Manage entity entering into this Agreement is Manage LLC, a Delaware limited liability company.
(b) This Agreement shall be governed by and construed in accordance with the Laws as set forth in the table below, without giving effect to conflict of law or choice of law principles. Any and all actions, suits or judicial proceedings upon any claim arising from or relating to this Agreement shall be instituted and maintained in Intellectual Property Rights.
If Customer is domiciled in: The governing Law is: Venue lies exclusively in courts sitting in:
Illinois and controlling Chicago, illinois, USA
United States federal law
A country in Europe, the Middle England London, England East, or Africa
United Kingdom England London, England
Canada Ontario and controlling
Toronto, Ontario, Canada
Canadian federal law
Japan Japan Tokyo, Japan
A country in Asia or the Pacific Singapore (as described in Singapore (as described in Section than Japan, Section 12.13(c)) 12.13(c))
Australia, or New Zealand
Australia or New Zealand New South Wales, Australia
• New South Wales, Australia
and controlling Australian
federal law
(c) If Customer's principal place of business is in a country in Asia or the Pacific region, other than Japan, question regarding its existence, validity or termination, shall be referred to and finally resolved by arbitration Australia or New Zealand, any dispute arising out of or in connection with this Agreement, including any in Singapore in accordance with the Arbitration Rules of the Singapore International Arbitration Centre, which rules are deemed to be incorporated by reference into this subsection. The Tribunal shall consist of one arbitrator. The language of the arbitration shall be English. The decision of the arbitrator shall be final, binding, and incontestable and may be used as a basis for judgment thereon in the above-named countries or elsewhere. To the maximum extent permitted by applicable Law, the Parties waive their right to any form of appeal or other similar recourse to a court of law.
12.14 Waiver of Jury Trial. Each Party irrevocably and unconditionally waives any right it may have to a trial by jury in respect of any legal action arising out of or relating to this Agreement or the transactions contemplated hereby.
12.15 Equitable Relief. Each Party acknowledges and agrees that a breach or threatened breach by such Party of any of Its obligations under Section 6 or, in the case of Customer only, Section 3.1 or Section 3.2, may cause the 11 DocuSign Envelope ID: 387DE0A6-E450-4D58-c 773BF83010CA DocuSign Envelope ID: B2679106-09D1-4F3B-858C-A5D62F3C5463 other Party irreparable harm for which monetary damages may not be an adequate remedy and agrees that, in the event of such breach or threatened breach, the other Party will be entitled to seek equitable relief, including a restraining order, an injunction, specific performance and any other relief that may be available from any court, without any requirement to post a bond or other security, or to prove actual damages or that monetary damages are not an adequate remedy. Such remedies are not exclusive and are in addition to all other remedies that may be available at Law, in equity or otherwise.
12.16 Anti-Corruption. Each Party agrees that it has not received or been offered any illegal or improper bribe, kickback, payment, gift, or thing of value from any of the other Party's employees, agents, or subcontractors in connection with this Agreement. Each Party will use reasonable efforts promptly to notify the other Party should such Party learn of any violation of this restriction.
12.17 Government Users. If Customer is a U.S. government entity or if this Agreement otherwise becomes subject to the Federal Acquisition Regulations (FAR), Customer acknowledges that elements of the Cloud Services constitute software and documentation and are provided as "Commercial Items" as defined at 48 C.F.R. § 2.101 and are being licensed to U.S. government user as commercial computer software subject to the restricted rights described in 48 C.F.R. §§ 2.101 and 12.212.
12.18 Feedback. Manage welcomes suggestions, comments, and other feedback on the Services ("Feedback") from all of its customers, as it helps Manage to improve its products and services. If Customer provides Manage with Feedback, Customer agrees that: (a) iManage is not subject to any confidentiality obligations in respect to the Feedback; (b) the Feedback is not confidential or proprietary information belonging to Customer or any third party and Customer has all of the necessary rights to disclose the Feedback to Manage; (c) Manage may freely use Feedback without any restrictions; and (d) Customer is not entitled to receive any compensation or reimbursement of any kind for Feedback.
13. Support Services.
13.1 Support Services. The Services include the Support Services as defined as Cloud Services Care and described in the Support Services Terms then in effect, available at:
https://support.imanage.com/worksite/iManage Maintenance Terms.pdf (the "Support Services Terms").
Manage may amend the Support Services Terms from time to time in its sole discretion; provided that, no such modification will materially degrade the level of service or other benefits provided to Customer under the version of the Support Services Terms in place as of the date of this Agreement, unless such modification has been agreed upon in writing by Customer. In the event the Support Services Terms contain an equivalent term as that in this Agreement, or there is a conflict between a term in the Support Services Terms and this Agreement, the terms in this Agreement shall prevail.
If the Cloud Services are subscribed to through a Partner that is authorized to provide Support Services, the Partner will provide details on the Support Services. In such a situation, the Support Services may be performed by the Partner or its designee, which, in some cases, may be iManage.
Notwithstanding the foregoing, with regard to the Cloud Service known as Closing Folders, Manage will provide Customer with general technical support services to help Customer troubleshoot any technical questions or issues Customer encounters with Closing Folders. Manage will also provide Customer with access to the knowledge base and other technical resources at https://help.closingfolders.com/hc/en-us_or such other website as notified to Customer from time to time.
13.2 Support Data; Ownership. Support Data will be used only to provide Support Services, Manage will not use Support Data or derive information from it for any advertising or similar commercial purposes. Manage will delete or return all copies of Support Data after the business purposes for which the Support Data was collected or transferred have been fulfilled or earlier upon Customer's request unless applicable Law requires storage of the Support Data. As between the Parties, Customer retains all right, title, and interest in and to Support Data. iManage acquires no rights in Support Data, other than the rights Customer grants to iManage to provide the Support Services. Customer agrees not to provide any Support Data to Manage to which regulations under FERPA (as defined below) or HIPAA (as defined below) would apply.
14. Professional Services.
14.1 Professional Services. Manage shall provide the Professional Services to Customer as described in an accompanying SOW. In the event of any inconsistencies between this Agreement and a SOW issued under this Agreement, the terms of this Agreement shall take precedence (other than an exception expressly set forth as such in the SOW. To the extent payment terms are not specified in the SOW, the payment terms in this Agreement shall apply.
12 DocuSign Envelope ID: 387DE0A6-E450-4D58-84C 3BF83010CA DocuSign Envelope ID: B2679106-09D1-4F3B-858C-A5D62F3C5463
14.2 License for Deliverables. Upon Customer's payment of fees due under an applicable SOW, Manage grants Customer a worldwide, perpetual, non-exclusive, non-transferable, royalty-free license to copy, maintain, use and run (as applicable), solely for Customer's internal business purposes associated with Customer's use of the Cloud Services and the Manage Software, all documents, work product and other materials (excluding without limitation computer code, algorithms and machine learning models) that are prepared by Manage for Customer pursuant to an applicable SOW ("Deliverables"). iManage retains all ownership rights in the Deliverables.
14.3 Representation and Warranty. iManage shall perform the Professional Services pursuant to Section 8.3 Customer acknowledges that Manage's ability to successfully perform the Professional Services is dependent upon Customer's provision of timely information, access to resources, and participation. If through no fault or delay of Customer, the Professional Services do not conform to the foregoing warranty, and Customer notifies Manage within sixty (60) days of Manage's delivery of the Professional Services, Manage will either re-perform the non-conforming portions of the Professional Services at no cost to Customer or waive or return, as applicable, any Fees owed or paid for the non-conforming portions of the Professional Services as Customer's sole remedy for breach of this Professional Services warranty.
14.4 THE REMEDIES SET FORTH IN SECTION 14.3 SHALL BE CUSTOMER'S SOLE AND EXCLUSIVE REMEDY
AND IMANAGE'S ENTIRE LIABILITY FOR ANY BREACH OF THE LIMITED WARRANTY SET FORTH IN SECTION 14.3.
14.5 Professional Services Data; Ownership. Professional Services Data will be used only to provide Professional earlier upon Customer's request unless applicable Law requires storage of the Professional Services Data. As between the Parties, Customer retains all right, title, and interest in and to Professional Services Data. iManage Professional Services to Customer. Customer agrees not to provide any Professional Services Data to Manage acquires no rights in Professional Services Data, other than the rights Customer grants to Manage to provide the to which regulations under FERPA or HIPAA would apply.
13 DocuSign Envelope ID: 387DE0A6-E450-4D58-¿ 773BF83010CA DocuSign Envelope ID: B2679106-09D1-4F3B-858C-A5D62F3C5463 Exhibit A
Service Level Agreement
1) Service Levels. iManage will make the Cloud Services available for access and use by Customer and its Authorized Users in each Region (as defined below) ("Available" and "Unavailable" will be interpreted accordingly) at least 99.9% of the time as measured over the course of each calendar month during the applicable Order Term, excluding unavailability of the Cloud Services due to Scheduled Downtime (as defined in paragraph (6) below) or any of the Exceptions (as defined below).
"Exceptions" mean performance or availability issues: (a) due to a Force Majeure Event; (b) that result from the use of services, hardware, or software not provided by iManage, including issues resulting from inadequate bandwidth or related to third-party software or services; (c) caused by software that is not being run by iManage itself as part of the Cloud Services; (d) during or with respect to beta or trial versions of the Cloud Services, features or sofware; (e) that result from Customer's unauthorized action or lack of action when required, or from Customer's employees, agents, contractors, or vendors, or anyone gaining access to Manage's network by means of Customer passwords or equipment, or otherwise resulting from Customer's failure to follow appropriate security practices; or (f that result from Customer's failure to adhere to any required configurations, use supported platforms, or follow any policies for acceptable use, or from Customer's use of the Cloud Services in a manner inconsistent with the features and functionality of the Cloud Services (for example, attempts to perform operations that are not supported) or inconsistent with the Documentation.
"Region" means the applicable regions) accommodating the data centers) from which the Cloud Services are provisioned, as detailed in the relevant Order.
Availability of the Cloud Services shall be calculated on a per Region basis, as follows:
Where: 8986600
) × 100]
total means the total number of minutes in the calendar month in the applicable Region; : nonexcluded means the total number of minutes in the calendar month where the Cloud Services is Unavailable in the applicable Region, excluding Unavailability of the Cloud Services due to Scheduled Downtime or any of the Exceptions; and
• excluded means the total number of minutes in the calendar month where the Cloud Services is Unavailable in the applicable Region due to Scheduled Downtime or any of the Exceptions.
The service levels and Service Credits set forth in this Exhibit A do not apply to on-premises software licensed as part of Customer's subscription.
2) Claims.
a) In order for Manage to consider a claim for Service Credit, Customer must submit the claim to Manage customer support includina all information necessary for iManage to validate the claim, including: (i) the affected Region; (ii) a detailed description of the incident; (iii) information regarding the time and duration of the downtime; (iv) the number and locations) of affected Authorized Users (if applicable); and (v) descriptions of attempts to resolve the incident at the time of occurrence.
b) Manage must receive the claim by the end of the calendar month following the month in which the incident occurred. For example, if the incident occurred on February 15th, Manage must receive the claim and all required information by March 31st.
c) Manage will evaluate all information reasonably available to Manage and make a good faith determination of whether a Service Credit is owed. Manage will use commercially reasonable efforts to process claims during the subsequent month and within thirty (30) days of receipt. Customer must be in compliance with this Agreement in order to be eligible for a Service Credit.
3) Service Credits.
a) If Manage determines that a Service Credit is owed to Customer pursuant to paragraph (2) above, Manage shall apply the Service Credit to Customer as set forth in the table below (each, a "Service Credit"). Service Credits are awarded on a per Region basis. Where fees for the Cloud Services are not allocated on a per Region basis in the relevant Order, the Service Credit shall be calculated by dividing the total monthly fee (or 1/12th of the total annual subscription fee, as applicable) by the number of Regions. For the avoidance of doubt, DocuSign Envelope ID: 387DE0A6-E450-4D58-84C 3BF83010CA DocuSign Envelope ID: B2679106-09D1-4F3B-858C-A5D62F3C5463 Unavailability of the Cloud Services in one Region will not result in Service Credits being awarded in respect of any other Region where the Cloud Services are Available.
Service Level Service Credit (% of 1/12lh of the
annual subscription fee, for the
affected Region)
Less than 99.9% but 10%
not less than 99.0%
Less than 99.0% but 25%
not less than 98.0%
Less than 98.0% but 50%
not less than 95.0%
_ess than 95.0% 100%
b) Subject to paragraph (4) below, Service Credits are Customer's sole and exclusive remedy for any availability issues under this Agreement. Customer may not unilaterally offset for any performance or availability issues.
C) Service Credits apply only to Fees paid for the particular Cloud Service for which the service level has not been met. The Service Credits awarded with respect to any billing month, for the affected Region, will not, under any circumstance, exceed the Fees for the particular Cloud Service in such billing month for that Region. 4) Termination. Customer may terminate this Agreement, effective on written notice to Manage, in the event the Cloud Services are Available less than 99.0% in any three months, in the same Region, during any consecutive six (6) month period. In such an event, Manage will issue Customer a refund equal to the balance of any prepaid amount.
Service Monitoring, Management and Reporting. Manage shall continuously monitor and manage the Cloud Services.
Customer may subscribe to Cloud Services notifications and, during the applicable Order Term, Manage will provide such notifications when an issue begins, while the issue is ongoing and when the issue has been resolved. Additionally, Manage publishes Availability reports on the Manage Data Center Alerts page of the Manage support website found at https://help.imanage.comand Customer may subscribe to receive a notification when such reports are published. 6) Scheduled Downtime. Manage reserves the right to schedule downtime for routine maintenance of the Cloud Services in each Region ("Scheduled Downtime"). Manage shall use commercially reasonable efforts to provide prior notice to Customer at least seven (7) calendar days before any Scheduled Downtime. 7) Emergency Maintenance. Manage reserves the right to perform emergency maintenance services at any time and without prior notice to Customer; provided that, Manage will use commercially reasonable efforts to provide prior notice to Customer. For the sake of clarity, emergency maintenance shall not be considered an Exception. 8) Pre-Production, Development, Testing and Similar Environments. The service levels and Service Credits set forth in this Exhibit A do not apply to Customer's pre-production, development, testing, or similar environments. 9) Previews, Proof-of-Concepts and Trials. Previews, proof-of-concepts, and trials ARE PROVIDED "AS-IS, "WITH ALL FAULTS," AND "AS AVAILABLE," as described herein. The service levels and Service Credits set forth in this Exhibit A do not apply to previews, proof-of-concepts, or trials. Manage may change or discontinue previews at any time without notice. Manage may also choose not to make a preview generally commercially available. 15 DocuSign Envelope ID: 387DE0A6-E450-4D58-8 773BF83010CA Docusign Envelope ID: B2679106-09D1-4F3B-858C-A5D62F3C5463 Exhibit B
General Security Exhibit
1) Purpose. This Exhibit B summarizes the technical and organizational measures that Manage has implemented to protect Customer Data from accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access, which are Manage's only responsibility with respect to the security of Customer Data. Manage may adapt such measures from time to time, for example, as a result of the development of regulations, technology, and other industry considerations.
2) Information Security Management. Manage has appointed one or more security officers responsible for coordinating and monitoring security rules and procedures. Manage maintains an information security program designed to protect Customer Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. The information security program may be updated from time to time based on changes in applicable legal and regulatory requirements, best practices and industry standards related to privacy and data security. 3) Standards. Manage uses commercially reasonable and appropriate methods and safeguards to protect the confidentiality, availability, and integrity of Customer Data. Manage adheres, and at all times will adhere, to information security practices at least as protective of Customer Data as identified in ISO 27001 and ISO 27017 (or substantially equivalent or replacement standards) or other generally accepted authoritative standards (e.g., SSAE 16, SOC2).
Manage Personnel. Manage maintains written policies and procedures that address the roles and responsibilities of Manage Personnel, including both technical and non-technical personnel, who have access to Customer Data in connection with providing the Cloud Services. All Manage Personnel with access to Customer Data receive annual training. Manage ensures that access rights are revoked for all Manage Personnel immediately upon the termination of their employment, contractual or other relationships with Manage. 5) Information Security Infrastructure.
a) Asset Inventory. Manage maintains inventories of all media on which Customer Data is stored. Access to such inventories is restricted to authorized Manage Personnel. b) Access Controls for Manage Personnel.
i) Access Policy. Manage enforces an access control policy (physical, technical, and administrative) based on least privileges principles.
il) Access Authorization.
(1) Manage maintains an authorization management system designed to ensure that only authorized Manage Personnel (technical and non-technical) are granted access to systems containing Customer Data. (2) All Manage Personnel accessing systems containing Customer Data have a separate, unique username.
Deactivated and expired usernames are not recycled or otherwise granted to other individuals. (3) Manage restricts access to Customer Data solely to Manage Personnel who have a need to access Customer Data in connection with the Cloud Services or as otherwise required by applicable Law. ili) Authentication.
(1) Manage uses industry standard practices, including strong authentication, to identify and authenticate all Manage Personnel who attempt to access Manage network or information systems. (2) Where authentication credentials of Manage Personnel are based on passwords, iManage requires that such passwords meet minimum requirements for length and complexity. Manage maintains practices designed to ensure the confidentiality and integrity of passwords when assigned, distributed, and stored. (3) Accounts of Manage Personnel are locked out in case of repeated attempts to gain access to the information system using an invalid password.
Encryption, iManage encrypts Customer Data at rest within the Cloud Services using ciphers at least as strong as 256-bit AES. Customer Data in transit to and from the Cloud Services is transferred to/from the Cloud Services across encrypted network connections and/or protocols (i.e., HTTPS and/or VPN). Backups of Customer Data are encrypted and stored in a secondary data center.
d) Encryption with Customer Key. Customer assumes all risks of data deletion, inaccessibility, and service outages that result from any unavailability of an encryption key created or maintained solely by Customer (such as the private key in a public-private pair), or where unavailability of any encryption key is caused by an act or omission of Customer or any Authorized User.
16 DocuSign Envelope ID: 387DE0A6-E450-4D58-84C 3BF83010CA DocuSign Envelope ID: B2679106-09D1-4F3B-858C-A5D62F3C5463 e) Network and Host Security.
Network Security. Manage utilizes an enterprise-class security information and event management (SIEM) system and maintains firewalls and other control measures (e.g, security appliances, network segmentation) to provide reasonable assurance that access from and to its networks is appropriately controlled ii) Security Updates. Manage uses commercially reasonable efforts to ensure that the Cloud Services operating systems and applications that are associated with Customer Data are patched and otherwise secured to mitigate the likelihood and impact of security vulnerabilities in accordance with Manage's patch management processes and within a reasonable time after Manage has actual or constructive knowledge of any critical or high-risk security vulnerabilities. Manage conducts vulnerability testing on a monthly basis. ill) Malicious Software. Manage maintains anti-malware controls to help prevent malicious software from causing accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Data. f) Physical Security.
Manage maintains physical security safeguards at any facilities where Manage hosts Customer Data. Physica access to such facilitles is only granted following a formal authorization procedure and access rights are reviewed periodically.
Such facilities are rated as Tier 3 data centers or greater, and access to such facilities must be limited to identified and authorized individuals. Such facilities use a variety of industry standard systems to protect against loss of data due to power supply failure, fire, and other natural hazards. g) Backups. iManage provides 24/7 managed backup services that include Customer Data stored in the primary site backed up on at least a daily basis to a secondary site, Manage provides backup services for all components of the solution included in the Cloud Services. Backups are maintained for a period of ninety (90) days in the primary data center, and ninety (90) days in the secondary data center. Notwithstanding the foregoing, the Cloud Service known as Closing Folders only maintains backups for thirty (30) days. h) Data Management. Manage maintains commercially reasonable controls for information governance and data management in connection with the Cloud Services. Manage destroys, deletes, or otherwise makes irrecoverable Customer Data upon the disposal or removal of storage media. Customer Data for each Customer is logically separated from data of other Manage customers.
Independent Assessments. On an annual basis, iManage has an independent third-party organization conduct an independent assessment of the standards set forth in paragraph (3) of this Exhibit B. Additionally, iManage undergoes penetration testing, conducted by an independent third-party organization, on an annual basis. Upon Customer's request (not more than one time per calendar year), and subject to the confidentiality and non-disclosure obligations set forth in this Agreement, Manage shall make available to Customer information regarding Manage's compliance with the obligations set forth in this Agreement in the form of Manage's ISO 27001 certification and/or SOC 2 or SOC 3 reports.
7) Business Continuity and Disaster Recovery. Manage maintains a business continuity plan that is compliant with ISO 22301. Manage also maintains disaster recovery capabilities designed to minimize disruption to the Cloud Services.
Included within these plans is disaster recovery incident management, procedures for the recovery of access to Customer Data in the secondary data center, as well as the periodic testing/exercising of the disaster recovery plan.
Customer's Responsibility. Notwithstanding anything contained in this Exhibit B, Customer understands and acknowledges that Customer is solely responsible for implementing and maintaining appropriate security measures for all systems within Customer's control. Failure to maintain appropriate security measures by Customer may relieve Manage for any Security Incident (as defined in Exhibit C), if such Security Incident was a result of Customer's failure. 17 DocuSign Envelope ID: 387DE0A6-E450-4D58-8 773BF83010CA DocuSign Envelope ID: B2679106-09D1-4F3B-858C-A5D62F3C5463 Exhibit C
Data Protection Agreement
The Parties agree that this DPA sets forth their obligations with respect to the Processing of Customer Data and Personal
1. Definitions.
"CCPA" means the California Consumer Privacy Act, Cal. Civ. Code § 1798.100 et seq., and its implementing regulations and any amendments thereto.
"Controller" means the natural or legal person, public authority, agency, or other body which, alone or jointly wit thers, determines the purposes and means of the Processing of Personal Data; where the purposes and means of such Processing are determined by Law, the Controller or the specific criteria for its nomination may be provided for by such Law.
"Data Importer" and "Data Exporter" have the meanings set forth in the Standard Contractual Clauses, in each case irrespective of whether such Standard Contractual Clauses, European Data Protection Legislation or Non-European Data Protection Legislation applies.
"Data Protection Legislation" means, as applicable, (a) European Data Protection Legislation, and (b) Non- European Data Protection Legislation, which applies to the Processing of Personal Data. "Data Subject" means an identified or identifiable natural person; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person. "European Data Protection Legislation" means, as applicable, data protection and privacy legislation in force inside the European Economic Area, including the General Data Protection Regulation and any national Laws implementing such legislation.
"General Data Protection Regulation" or "GDPR" means Regulation (EU) 2016/679 on the protection of natural persons with regard to the Processing of Personal Data and on the free movement of such data. "Non-European Data Protection Legislation" means data protection or privacy legislation in force outside the European Economic Area, including without limitation such legislation as is in force in the United States (including the CCPA and other federal and state Laws, as applicable), UK (including the UK GDPR and national implementing legislation), Brazil, Canada, Australia, Switzerland, and Singapore. "Personal Data" means any information Processed by iManage that relates to a Data Subject and is obtained as either Customer Data, Professional Services Data, or Support Data. "Processing" means any operation or set of operations which is performed on Personal Data or on sets of Personal Data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction. "Process" and "Processed have correlative meanings.
"Processor" means a natural or legal person, public authority, agency, or other body that Processes Personal Data on behalf of a Controller.
"Pseudonymization" means the Processing of Personal Data in such a manner that the Personal Data can no longer be attributed to a specific Data Subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organizational measures to ensure that the Personal Data are not attributed to an identified or identifiable natural person. 18 DocuSign Envelope ID: 387DE0A6-E450-4D58-84C 3BF83010CA DocuSign Envelope ID: B2679106-09D1-4F3B-858C-A5D62F3C5463 "Standard Contractual Clauses" means as applicable (a) the standard contractual clauses available at https://eur- lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32021D0914&from=EN pursuant Commission Implementing Decision (EU) 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of Personal Data to third countries pursuant to the GDPR ("EU SCs"); and (b) the International Data Transfer Addendum to the EU SCs issued by the Information Commissioner's Office under S119A(1) of the Data Protection https://ico.org.uk/media/for-organisations/documents/4019539/international-data-transfer- addendum.pdf ("UK Addendum").
"Sub-Processor" means other Processors used by Manage to Process Customer Data and Personal Data. "Supervisory Authority" means an independent public authority that has been established by a governmental body and is responsible for monitoring the application of applicable Data Protection Legislation, in order to protect the fundamental rights and freedoms of natural persons in relation to Processing and to facilitate the free flow of Personal Data.
"UK GDPR" means the GDPR as it forms part of the law of England and Wales, Scotland, and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018.
2. Roles and Scope.
2.1 This DPA only applies to the Processing of Customer Data and Personal Data by Manage on behalf of Customer pursuant to the Agreement.
2.2 Customer and Manage agree that with respect to Personal Data, Customer is the Controller of such Personal Data and iManage is a Processor of such Personal Data, except when Customer acts as a Processor or Sub- Processor of such Personal Data, in which case Manage is a Sub-Processor of such Personal Data. Nothing in the preceding sentence alters the obligations of either Manage or Customer under this DPA, as Manage acts as a Processor with respect to Customer in all events. In any instance where the Customer is a Processor or Sub- Processor, Customer warrants to Manage that Customer's instructions, including appointment of Manage as a Processor or sub-Processor, have been authorized by the relevant Controller.
This DPA does not limit or reduce any data protection commitments Manage makes to Customer in the Agreement.
2.4 Customer acknowledges and agrees that (taking into account the state of the art, the costs of implementation, and the nature, scope, context and purposes of the Processing of its Customer Data and Personal Data as well as the risks to individuals) the security practices and policies implemented and maintained by iManage provide a level of security appropriate to the risk with respect to its Customer Data and Personal Data.
Details of the Processing.
Data Subjects. The categories of Data Subjects whose Personal Data may be Processed in connection with the Services are determined and controlled by Customer in its sole discretion and may include but are not limited to:
Customer's representatives and end users, such as employees, contractors, collaborators, clients, prospects, and customers; and employees or contractors of Customer's clients, prospects, and customers.
Categories of Personal Data. The categories of Personal Data to be Processed in connection with the Services are determined by Customer in its sole discretion and may include but are not limited to: first and last name, employer, role, professional title, and contact information (e.g., email, phone numbers, and physical address).
Special Categories of Personal Data. Special categories of Personal Data, if any, to be Processed in connection with the Services are determined by Customer in its sole discretion and may include, but are not limited to, information revealing racial or ethnic origin; political, religious, or philosophical beliefs; trade union membership; or health data.
Processing Operations. iManage will Process Customer Data and Personal Data only as described and subject to the limitations herein (a) to provide Customer the Services in accordance with the Documented Instructions (as defined below), and (b) for business operations incidental to providing the Services to Customer, which may include (i) delivering functional capabilities as licensed, configured, and used by Customer and its Authorized Users, (i) preventing, detecting, and repairing problems, including Security Incidents (as defined below), and (i) providing technical support, professional planning, advice, guidance, data migration, deployment, and solution/software development services.
4. Obligations of Manage.
19 DocuSign Envelope ID: 387DE0A6-E450-4D58-E 773BF83010CA DocuSign Envelope ID: B2679106-09D1-4F3B-858C-A5D62F3C5463
4.1 Processing by Manage shall be governed by the Agreement and this DPA. In particular, Manage shall:
(a) Process Customer Data and Personal Data only on Documented Instructions (as defined below) from Customer, including with regard to transfers of Personal Data to a third country or an international organization, unless required to do so by applicable Data Protection Legislation; in such a case, iManage shall notify Customer of said legal requirement before Processing, unless said Data Protection Legislation prohibits such notification on important grounds of public interest; (b) inform Customer if, in its opinion, an instruction given by Customer with regard to Processing of Personal Data infringes any applicable Data Protection Legislation; in such a case, Manage may suspend the relevant Processing without penalty or liability until Customer gives iManage relevant written instructions that in ¡Manage's opinion do not infringe Data Protection Legislation; (c) ensure that persons authorized to Process Customer Data or Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality; d) provide periodic and mandatory data privacy and security training and awareness to iManage Personnel with access to Customer Data or Personal Data in accordance with applicable Data Protection Legislation; (e) taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of Processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, implement appropriate technical and organizational measures designed to ensure a level of security appropriate to the risk, including, those detailed in Exhibit B to the Agreement related to Customer Data and, inter alia, as appropriate:
(1) the Pseudonymization and encryption of Personal Data; (2) the ability to ensure the ongoing confidentiality, integrity, availability, and resilience of Processing systems and services;
(3) the ability to restore the availability and access to Personal Data in a timely manner in the event of a physical or technical incident; and
regularly testing, assessing, and evaluating the effectiveness of technical and organizational measures for ensuring the security of the Processing. in assessing the appropriate level of security for purposes of subparagraph 4.1(e)(4), take account in particular of the risks that are presented by Processing, in particular from accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Data or Personal Data transmitted, stored or otherwise Processed;
take steps to ensure that any natural person acting under the authority of Manage who has access to Customer Data or Personal Data does not Process such Personal Data except on instructions from Customer, unless he or she is required to do so by applicable Data Protection Legislation; and (h) adhere to the conditions set forth in paragraph 6 below for engaging or changing a Sub-Processor.
4.2 The Parties agree that this DPA and the Agreement (including the provision of instructions via configuration fools made available by iManage for the Cloud Services) constitute Customer's documented instructions regarding Manage's Processing of Customer Data and Personal Data ("Documented Instructions"). Manage will Process Customer Data and Personal Data only in accordance with Documented Instructions, and for business operations Incidental to providing the Services. Customer hereby grants all such rights and permissions in or relating to Customer Data and Personal Data to Manage and its Sub-Processors, as are necessary to perform the Services.
Manage will not retain, use, disclose or otherwise Process Customer Data or Personal Data other than for the purposes set out in this DPA and the Agreement. iManage will not derive information from Customer Data or Personal Data for any advertising or similar commercial purposes. In no event will Manage sell Personal Data.
Additional instructions outside the scope of the Documented Instructions (if any) require prior written agreement between iManage and Customer, including agreement on any additional fees payable by Customer to Manage for carrying out such instructions.
5. Security Incident Management.
(a) Notice. iManage will notify Customer of any breach of security that results in the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Data or Personal Data while Processed by Manage (a "Security Incident") without undue delay after becoming aware of the Security Incident and, in any event, within 48 hours of becoming aware of such Security Incident. Notification of a Security Incident will be delivered to one or more of Customer's administrators by any means iManage selects, including via email. It is Customer's sole responsibility to ensure Customer's administrators maintain 20 DocuSign Envelope ID: 387DE0A6-E450-4D58-84C 3BF83010CA DocuSign Envelope ID: B2679106-09D1-4F3B-858C-A5D62F3C5463 accurate contact information on the Manage support website found at https://help.imanage.com. Customer is solely responsible for complying with its obligations under incident notification Laws applicable to Customer and fulfilling any third-party notification obligations related to any Security Incident. Manage's obligation to report or respond to a Security Incident is not an acknowledgement by Manage of any fault or liability with respect to the Security Incident. Similarly, Customer's failure to comply with notification provisions hereunder or otherwise and any liabilities arising therefrom will not be attributed to Manage. (b) In the event of a Security Incident, Manage will (i) investigate the Security Incident; (i) provide Customer with information about the Security Incident (including, where possible, the nature of the Security Incident, the contact from whom more information can be obtained, and the likely consequences of the Security Incident), which information may be provided in phases as it becomes available; and (iii) take reasonable steps to mitigate the effects of, and to help minimize any damage resulting from, the Security Incident. In the event that a Security Incident was not due to the fault of Manage, Manage will cooperate with Customer with (c) iManage shall make reasonable efforts to assist Customer in fulfilling Customer's obligation under GDPR Article 33 or other applicable Data Protection Legislation to notify the relevant Supervisory Authority and Data Subjects about such Security Incident.
(d) Customer must notify iManage promptly about any possible misuse of its accounts or authentication credentials or any potential security incident related to a Cloud Service.
6. Sub-Processors.
6.1 iManage may engage subcontractors and Sub-Processors to provide services on its behalf.
6.2 In addition to Manage's Affiliates, Customer consents to Manage engaging the Sub-Processors listed at https://support.imanage.com/resources/Subprocessors.htm for the Processing of Customer Data and/or Personal Data in accordance with this DPA. The preceding authorizations will constitute Customer's prior written consent to the subcontracting by iManage of the Processing of Customer Data and Personal Data if such consent is required.
6.3 Where iManage engages a Sub-Processor for carrying out specific Processing activities on behalf of Customer, the same data protection obligations as set out in this DPA shall be imposed on such Sub-Processor by way of contract or other legal act to the extent required by applicable Data Protection Legislation, in particular providing sufficient guarantees to implement appropriate technical and organizational measures in such a manner that the Processing will meet the requirements of applicable Data Protection Legislation. Where a Sub-Processor fails to fulfil such data protection obligations, Manage shall remain fully responsible and liable for the performance of such Sub-Processor's obligations.
6.4 Changes to Sub-Processors.
(a) Unless otherwise agreed by the Parties, at least sixty (60) days before authorizing any new Sub-Processor to access Customer Data or Personal Data, Manage shall provide notice of such change by posting to https://support.imanage.com/resources/Subprocessors.htm, which shall have a mechanism allowing Customer to subscribe to notifications of new Sub-Processors. Within thirty (30) days of such notice being posted, Customer may object to the appointment of an additional Sub-Processor on reasonable grounds, provided in writing to Manage, in which case iManage shall have the right to cure the objection through one of the following options (to be selected at Manage's sole discretion):
(1) iManage will cancel its planned use of Sub-Processor or will offer an alternative plan to provide the Services without using such Sub-Processor;
(2) Manage will take the corrective steps, if any, identified by Customer in its objection as sufficient to remove Customer's objection, and proceed to use the Sub-Processor; or (3) Manage may cease to provide, or Customer may agree not to use (temporarily or permanently), the particular aspect of the Services that would involve the use of such Sub-Processor, subject to a mutual agreement of the Parties to adjust the remuneration for the Services considering the reduced scope of the Services.
(b) If none of the above options are reasonably available or the objection otherwise has not been resolved to the mutual satisfaction of the Parties within thirty (30) days after Manage's receipt of Customer's objection pursuant to this DPA, either Party may terminate the Agreement and Customer will be entitled to a pro-rata refund for prepaid Fees for Services not performed as of the date of termination.
Emergency Replacement of a Sub-Processor, Manage may replace a Sub-Processor at any time if the need for the change is urgent and necessary, and the reason for the change is beyond Manage's reasonable control. In 21 DocuSign Envelope ID: 387DE0A6-E450-4D58-6 773BF83010CA DocuSign Envelope ID: B2679106-09D1-4F3B-85BC-A5D62F3C5463 such instance, iManage shall notify Customer of the replacement Sub-Processor as soon as reasonably practicable, and Customer shall retain the right to object to the replacement Sub-Processor pursuant to paragraph 6.4 above. Customer will not be entitled to any remuneration or accrue any rights of termination due to the emergency replacement.
7. Cooperation.
7.1 Requests from Data Subjects.
(a) iManage will assist the Customer, in a manner consistent with the functionality or performance of the Services and Manage's role as a Processor, in respect of any Data Subject requests to exercise one or more of their rights under applicable Data Protection Legislation. To the extent legally permitted, Customer shall be responsible for any costs arising from Manage's provision of such assistance beyond the existing functionality or performance of the Services.
(b) If iManage receives a request from one of Customer's Data Subjects to exercise one or more of its rights under applicable Data Protection Legislation, Manage will instruct the Data Subject to make its request directly to Customer. Customer will be responsible for responding to any such request.
7.2 Supervisory Authorities. Manage shall notify Customer without undue delay if a Supervisory Authority makes any inquiry or request for disclosure regarding Personal Data provided by Customer to Manage.
Other Cooperation. Taking into account the nature of Processing and the information available to Manage, Manage shall provide reasonable assistance to Customer in ensuring compliance with obligations:
(a) to ensure an appropriate level of security;
(b) in cases of a Security Incident, to provide appropriate notifications to Supervisory Authorities and Data Subjects, in accordance with applicable Data Protection Legislation; where required under applicable Data Protection Legislation, to carry out assessments of the impact of envisaged Processing operations on the protection of Personal Data; (d) where required under applicable Data Protection Legislation, to consult with Supervisory Authorities with regard to matters related to such Processing; and
(e) to demonstrate compliance with the obligations concerning Processing of Personal Data carried out on behalf of a Controller and allow for and contribute to audits, including inspections, conducted by Customer or another auditor mandated by Customer pursuant to paragraph 9.1 below.
8. Retention and Deletion of Customer Data and Personal Data.
8.1 Personal Data. Subject to paragraph 8.2, Manage shall delete or return Personal Data in accordance with the mutual agreement of the Parties save to the extent that iManage is required by any applicable Law to retain some or all of the Personal Data. In such event, Manage shall extend the protections of the Agreement and this DPA to such retained Personal Data and limit any further Processing of such Personal Data only to those limited purposes for which, and only for so long as, such retention is required by applicable Law.
Cloud Services. At all times during the applicable Order Term, Customer shall have the ability to access, extract, and delete Customer Data. Manage will retain Customer Data stored in the Cloud Services for ninety (90) days after expiration or termination of Customer's subscription so that Customer may extract Customer Data. After said 90-day period ends, Manage will disable Customer's account and delete all Customer Data (within thirty (30) days) and, where required by Law, shall certify to Customer that it has done so, save to the extent that Manage is required by any applicable Law to retain some or all of such Customer Data. In such event, Manage shall extend the protections of the Agreement and this DPA to such retained Customer Data and limit any further Processing of such Customer Data only to those limited purposes for which, and only for so long as, such retention is required by applicable Law. Nothing contained herein shall require iManage to alter, modify, delete, or destroy backups or other media created in the ordinary course of business for purposes of disaster recovery and business continuity, so long as such backups or other media are kept solely for such purposes and are overwritten, recycled, or otherwise remediated in the ordinary course of business and, in any event, not longer than ninety (90) days after creation. Manage has no liability for the deletion of any data, including Customer Data and Personal Data as described in this paragraph 8.
9. Security Reports, Audits and Records.
9.1 Security Reports and Audits.
22 DocuSign Envelope ID: 387DE0A6-E450-4D58-84C 3BF83010CA DocuSign Envelope ID: B2679106-09D1-4F3B-858C-A5D62F3C5463 (a) To the extent Customer's audit requirements under the Standard Contractual Clauses or Data Protection Legislation cannot reasonably be satisfied through (i) audit reports provided by Manage, (i) documentation, or (iii) other compliance information that Manage makes generally available to its customers, iManage will, not more than one time per calendar year, promptly respond to Customer's audit requests. Before the commencement of an audit, Customer and Manage will mutually agree upon the scope, timing, duration, control and evidence requirements, and fees for the audit, provided that this requirement to agree will not permit Manage to unreasonably delay performance of the audit. To the extent needed to perform the audit, Manage will make the processing systems, facilities and supporting documentation relevant to the Processing of Customer Data and Personal Data by Manage, its Affiliates, and its Sub-Processors (where possible) available. Such an audit will be conducted by an independent, accredited third-party audit firm, during regular business hours, with reasonable advance notice to Manage (not less than twenty days), and subject to reasonable confidentiality and security procedures. Neither Customer nor the auditor shall have access to any data from Manage's other customers or to Manage systems or facilities not involved in the Services. Customer is responsible for all costs and fees related to such audit, including all reasonable costs and fees for any and all time Manage expends for any such audit, in addition to the rates for services performed by Manage. If the audit report generated as a result of Customer's audit includes any finding of material non-compliance, Customer shall share such audit report with Manage and Manage shall promptly cure any material non-compliance.
(b) If the Standard Contractual Clauses apply, then this paragraph is in addition to Clause 5 paragraph f and Clause 12 paragraph 2 of the Standard Contractual Clauses. Nothing in this paragraph varies or modifies the Standard Contractual Clauses or affects any Supervisory Authority's or Data Subject's rights under the Standard Contractual Clauses or Data Protection Legislation.
Records of Processing Activities. Manage shall maintain, to the extent and in the manner required by applicable Data Protection Legislation, a record of all categories of Processing activities carried out on behalf of Customer and, to the extent applicable to the Processing of Personal Data on behalf of Customer, make such record available to Customer upon request.
10. Obligations of Customer.
10.1 Customer acknowledges that: (a) Customer will comply with all applicable Data Protection Legislation (including its obligations thereunder); (b) Customer is responsible for determining whether the Cloud Services are appropriate for storage and Processing of Customer Data and Personal Data; (c) Customer has the right to transfer, or provide access to, Customer Data and Personal Data to Manage and its Sub-Processors for Processing in accordance with the terms of the Agreement and this DPA; (d) Customer is solely responsible for fulfilling any third-party notification obligations related to a Security Incident; and (e) Customer specifically acknowledges that its use of the Services will not violate the rights of any Data Subject, including, without limitation, those that have opted-out from sales or other disclosures of Personal Data, to the extent applicable under Data Protection Legislation.
10.2 Customer Data Sharing. The Cloud Services may enable Authorized Users to share Customer Data or invite third- party users to use and access the Cloud Services. Such third-party users may access, view, download, and share Customer Data. Customer understands and agrees that: (a) it is solely Customer's and its Authorized Users' choice to share Customer Data; (b) Manage cannot control third parties with whom Customer or Authorized Users have shared Customer Data; and (c) Customer and/or its Authorized Users are solely responsible for their sharing of any Customer Data through the Cloud Services.
11. Modification, Supplementation, and Term.
11.1 Manage may modify or supplement this DPA, with notice to Customer, (a) if required to do so by a Supervisory Authority or other government or regulatory entity, (b) if necessary to comply with applicable Data Protection Legislation, (c) to implement Standard Contractual Clauses, or (d) to adhere to an approved code of conduct or certification mechanism approved or certified pursuant to Articles 40, 42 and 43 of the GDPR or analogous provisions of other applicable Data Protection Legislation. In the event that such required modification or supplement results in Customer becoming non-compliant with Law that is applicable to Customer, Customer may terminate the Agreement (and any impacted Orders)), and Customer will be entitled to a pro-rata refund for prepaid Fees for Services not performed as of the date of termination.
11.2 This DPA is effective upon Customer's use of the Services for which Manage is a Processor or Sub-Processor.
11.3 This DPA shall remain in force as long as Manage Processes Customer Data or Personal Data on behalf of Customer.
12. Transfers of Customer Data and Personal Data and Location 23 DocuSign Envelope ID: 387DE0A6-E450-4D58-8 173BF83010CA DocuSign Envelope ID: B2679106-09D1-4F3B-858C-A5D62F3C5463
12.1 Customer acknowledges that Manage and its Sub-Processors may Process Customer Data and Personal Data in countries that are outside of the European Economic Area ("EEA") and the United Kingdom, including, but not limited to, the United States. This will apply even where Customer has agreed with Manage to host Customer Data in the EEA or the United Kingdom, if such Processing is necessary to provide support-related or other services requested by Customer.
12.2 iManage will abide by the requirements of the Data Protection Legislation regarding the collection, use, transfer, retention, and other Processing of Personal Data from the EEA and the United Kingdom. All transfers of Personal Data to a third country or an international organization (including any relevant Sub-Processor) that does not ensure an adequate level of protection will be subject to appropriate safeguards as described in Article 46 of the GDPR and UK GDPR, and such transfers and safeguards will be documented according to Article 30(2) of the GDPR or UK GDPR (as applicable).
12.3 All transfers of Customer Data and Personal Data out of the EEA and the United Kingdom shall be governed by the Standard Contractual Clauses, except for transfers (a) to and from any country which has a valid adequacy decision from the European Commission or the UK Government (as applicable), or (b) to and from any organization which ensures an adequate level of protection in accordance with the applicable Data Protection Legislation. Subject to the foregoing and where indicated as applicable in Schedule 1 of this DPA, execution of an Order, or this DPA, by Customer includes execution of the Standard Contractual Clauses. In the event any Standard Contractual Clauses include a transition period for implementation, Manage shall ensure the updated Standard Contractual Clauses shall be implemented prior to the expiration of such transition period (including in respect of transfers to any Sub-Processors which rely on the Standard Contractual Clauses).
12.4 Location of Customer Data. All Customer Data shall be stored in the geographic region set forth in the applicable Order. Customer acknowledges that Manage may provide the Services from regions other than those set forth in the applicable Order, including but not limited to, the United States, the United Kingdom, Canada, Australia, and/or India and, thus, Manage Personnel in such locations may have access to Customer Data. Notwithstanding the foregoing, Manage does not control or limit the region or regions from, in, or to which Customer or Authorized Users may access, move, store or otherwise Process Customer Data.
13. California Consumer Privacy Act (CCPA).
13.1 If Manage is Processing Personal Data within the scope of the CCPA (CCA Data"), iManage makes the following additional commitments to Customer. iManage will Process CCA Data on behalf of Customer and, not retain, use, or disclose CCA Data for any purpose other than for the purposes set out in this DPA and as permitted under the CCPA, including under any "sale" exemption. In no event will iManage "sell" or "share" (as those terms are defined in the CCPA) any CCPA Data. Manage (a) will not combine CCPA Data that iManage receives from, or on behalf of, Customer with personal information that Manage receives from, or on behalf of, another person or persons, or collects from its own interaction with a consumer, provided that iManage may combine CCPA Data to perform any business purpose as defined in regulations adopted pursuant to the CCPA; (b) grants Customer the right to take reasonable and appropriate steps to help ensure that Manage uses CCPA • Data in a manner consistent with Customer's obligations under the CCPA; (c) shall notify Customer in the event that Manage determines it can no longer meet its obligations under the CCPA; and (d) grants Customer the right, upon notice, to take reasonable and appropriate steps to stop and remediate unauthorized use of CCPA Data.
14. HIPAA Business Associate.
14.1 If Customer is a "covered entity" or a "business associate" and provides "protected health information" (as those terms are defined in 45 CFR § 160.103) to Manage, the HIPAA Business Associate Agreement attached hereto as Schedule 2 of this DPA is incorporated by reference into this DPA and the Agreement.
15. Family Educational Rights and Privacy Act.
15.1 If Customer is an educational agency or institution to which regulations under the Family Educational Rights and Privacy Act ("FERPA") apply, Manage agrees to abide by the applicable limitations and requirements imposed by 34 CFR 99.33(a).
16. Miscellaneous.
16.1 Manage and its Affiliates have appointed a data protection officer, EU representative, and UK representative.
Manage EMEA Limited acts as Manage LLC's UK representative. The data protection officer may be reached at [email protected]. Details of the EU representative can be found within Manage's privacy notice at https://imanage.com/about/privacy-noticel.
24 DocuSign Envelope ID: 387DE0A6-E450-4D58-84l . 3BF83010CA DocuSign Envelope ID: B2679106-09D1-4F3B-858C-A5D62F3C5463
16.2 If there is a conflict between the Agreement and this DPA, the terms of this DPA will control. In the event of any conflict or inconsistency between this DPA and the Standard Contractual Clauses, the Standard Contractual Clauses shall prevail.
16.3 To the fullest extent permitted by Law, any claims brought under this DPA and/or the Standard Contractual Clauses shall be subject to the terms and conditions of the Agreement, including but not limited to, any applicable exclusions and limitations set forth therein. For the sake of clarity, Manage's aggregate liability arising out of this DPA and/or the Standard Contractual Clauses shall in no event exceed the limitations set forth in the Agreement. 25 DocuSign Envelope ID: 387DE0A6-E450-4D58-E 773BF83010CA DocuSign Envelope ID: B2679106-09D1-4F3B-858C-A5D62F3C5463 Schedule 1 to Data Protection Agreement
Standard Contractual Clauses
The Parties agree that the applicable Standard Contractual Clauses are incorporated into the DPA by reference, as if they had been set out in full, and are populated as follows. Unless expressly stated below, any optional clauses contained within the Standard Contractual Clauses shall not apply.
The following Standard Contractual Clauses shall apply where Personal Data is transferred to a third country (unless the transfer is permitted on the basis of an adequacy decision):
a) CONTROLLER → PROCESSOR (Module Two) ("Controller to Processor Standard Contractual Clauses") if Customer, acting as a Controller, is making a restricted transfer of Personal Data subject to the GDPR and/or the UK GDPR (as applicable) to iManage, acting as a Processor; b) PROCESSOR → PROCESSOR (Module Three) ("Processor to Processor Standard Contractual Clauses") if Customer, acting as a Processor, makes a restricted transfer of Personal Data subject to the GDPR and/or the ÜK GDPR (as applicable) to Manage acting as a Processor; and/or c) PROCESSOR → CONTROLLER (Module Four) ("Processor to Controller Standard Contractual Clauses") if iManage, acting as a Processor, makes a restricted transfer of Personal Data subject to the GDPR and/or the UK GDPR (as applicable) to Customer, acting as a Controller.
UK Addendum
The Parties agree that the UK Addendum is incorporated into the DPA by reference, as if it had been set out in full, and is populated and shall be read against the EU SCCs as follows. Unless expressly stated below, any optional clauses contained within the UK Addendum shall not apply.
Start Date
The UK Addendum is effective from the effective date of the Agreement.
1. Table 1: Parties
Exporter and key contact: As set out in Annex 1 of the Standard Contractual Clauses below.
Importer and key contact: As set out in Annex 1 of the Standard Contractual Clauses below.
2. Table 2: Selected SCCs, Modules and Clauses
As applicable, Module 2, Module 3 or Module 4 of the EU SCCs as incorporated by reference into Schedule 1 of this DPA including any supplementary clauses set out within Schedule 1 of this DPA.
3. Table 3: Appendix Information
As set out in Annex 1 and Annex 2 of the of the Standard Contractual Clauses below.
4. Table 4: Ending this Addendum when the Approved Addendum Changes In the event the Information Commissioner's Office issues a revised Approved Addendum, in accordance with Section 18 of the UK Addendum which as a direct result of such changes has a substantial, disproportionate and demonstrable increase in: (a) the data importer's direct costs of performing its obligations under the Addendum; and/or (b) the data importer's risk under the Addendum, the data importer may terminate this UK Addendum on reasonable written notice to the data exporter in accordance with Table 4 and paragraph 19 of the UK Addendum.
Supplementary clauses for Module Two and Module Three:
Erasure and deletion: For the purposes of Clause 8.5, Section Il of Module Two and Module Three of the Standard Contractual Clauses the data importer shall delete the Personal Data in accordance with paragraph 8.1 of the DPA. 26 DocuSign Envelope ID: 387DE0A6-E450-4D58-84L 3BF83010CA DocuSign Envelope ID: B2679106-09D1-4F3B-858C-A5D62F3C5463 Audit: The Parties acknowledge that the data importer complies with its obligations under Clause 8.9, Section Il of Module Two and Module Three of the Standard Contractual Clauses by (i) acting in accordance with paragraph 9.1 of the DPA and (i) exercising its contractual audit rights it has agreed with its Sub-Processors. For the purposes of Clause 8.9(e), Section Il of Module Three of the Standard Contractual Clauses, the data exporter shall ensure the results are provided to the relevant controllers) on a confidential basis and that the controllers) have committed themselves to confidentiality in respect of the same.
Notifications: For the purposes of Clause 8, Section Il of Module Three of the Standard Contractual the data exporter shall use all reasonable endeavors to ensure any instructions provided by the relevant controllers) are directed via the data exporter. The data exporter shall be responsible for ensuring any notifications provided by the data importer are promptly notified to the relevant controllers) in order to fulfil the data importer's notification obligations pursuant Sub-Processors: For the purposes of Clause 9, Section Il of Module Two and Module Three of the Standard Contractual Clauses, the Parties agree that option 2: general written authorization shall apply, and the data importer shall notify the data exporter of any changes in accordance with paragraph 6 of the DPA. For the purposes of Clause 9, Section Il of Module Three of the Standard Contractual Clauses, the data importer shall notify the data exporter of any changes to a Sub-Processor and the data exporter shall be responsible for ensuring such notifications are provided to the relevant controllers) and shall inform the data importer of any objections within the time frames specified. Copies of any Sub-Processor agreements (redacted as appropriate) requested from the data importer shall be provided to the data exporter for onward provision to the relevant controller, as applicable.
Data Subject Rights: For the purposes of Clause 10(a) to (c) Section II of Module Three of the Standard Contractual Clauses, the Parties acknowledge that given the nature of the Processing by the data importer it would not be appropriate for the data importer to notify or assist the controller directly in respect of any requests received from a Data Subject.
Transfer impact assessment: For the purposes of Clause 14(c), Section III of Module Two and Module Three of the Standard Contractual Clauses, the data exporter acknowledges that iManage may transfer Personal Data to the countries listed at https://support.imanage.com/resources/Subprocessors.htm. The data exporter acknowledges a transfer impact assessment has been made available by the data importer on or prior to the date of the Agreement which the data exporter accepts as sufficient to fulfil the data importer's obligations pursuant to Clause 14(c) and 14(a) of the Standard Contractual Clauses.
For the purposes of Clause 14(c), 15.1(b) and 15.2, Section Ill of Module Two and Module Three of the Standard Contractual Clauses, the Parties agree that "best efforts" and the obligations of the data importer under clause 15.2 shall mean exercising the degree of skill and care, diligence, prudence and foresight which would reasonably and ordinarily be expected from a leading practice engaged in a similar type of undertaking under the same or similar circumstances and shall not include actions that would result in civil or criminal penalty such as contempt of court under the laws of the relevant jurisdiction.
Governing law and Jurisdiction: For the purposes of Clause 17 and 18, Section IV of Module Two and Module Three of the EU SCCs, the Parties agree that the laws and courts of the Republic of Ireland will apply. For the purpose of the UK Addendum, the Parties acknowledge and accept that the laws and courts of England and Wales will apply.
Supplementary clauses for Module Four:
Erasure and Deletion: For the purposes of Clause 8.1(d), Section I of Module Four of the Standard Contractual Clauses, the data exporter shall delete the Personal Data in accordance with paragraph 8.1 of the DPA.
Governing law and Jurisdiction: For the purposes of Clauses 17 and 18, Section IV of Module Four of the EU SCCs and the UK Addendum, the Parties agree that the laws and courts of England and Wales will apply. 27 DocuSign Envelope ID: 387DE0A6-E450-4D58-{ 773BF83010CA DocuSign Envelope ID: B2679106-09D1-4F3B-85BC-A5D62F3C5463 Annex 1 to the Standard Contractual Clauses (Module Two and Module Three) A. List of Parties
Data exporter: Customer is the data exporter. The data exporter is a user of the Services.
The data exporter's data protection contact (and EU/UK representative if applicable) is as detailed in the Order or as otherwise provided to the data importer.
Data importer: The data importer is the Manage entity identified in the applicable Order. The data importer provides the Services.
The data importer's data protection contact details are as specified in the DPA.
B. Description of Transfer
Data Subjects: The categories of Data Subjects whose Personal Data may be Processed in connection with the Services are determined and on tried data septer in older, in adar, and eure time ad presents o data exporter, and employees or contractors of data exporter's prospects and customers.
Categories of data: The categories of Personal Data are determined by data exporter in its sole discretion and may include but are not limited to: first and last name, employer, role, professional title, and contact information (e.g., email, phone, physical address).
philosophical beliefs, trade union membership or health data.
Frequency, duration, and retention: The Personal Data is transferred on a continuous basis determined by the data exporter. The data importer will Process the Personal Data for the duration of the Agreement and will retain the Personal Data in accordance with paragraph 8.1 of the DPA.
Nature and purpose of the Processing: Manage will Process Customer Data and Personal Data only as described and subject to the limitations herein (a) to provide Customer the Services in accordance with the Documented Instructions, and (b) for business operations incident to providing the Services to Customer, which may include () delivering functional capabilities as licensed, configured, and used by Customer and its Authorized Users, (i) preventing, detecting, and repairing problems, including Security Incidents, and (iii) providing technical support, professional planning, advice, guidance, data migration, deployment, and solution/software development services.
Sub-Processors: Any Sub-Processor appointed by the data importer will Process the Personal Data to assist the data importer in providing the Services as described above for the duration of the Agreement.
C. Competent Supervisory Authority:
The competent Supervisory Authority shall be detailed in the relevant Order or otherwise determined in accordance with Clause 13, Section Il of Module Two and Module Three of the EU SCCs. In respect of the UK Addendum, the competent supervisory shall be read as Information Commissioner.
28 DocuSign Envelope ID: 387DE0A6-E450-4D58-84C 3BF83010CA DocuSign Envelope ID: B2679106-09D1-4F3B-858C-A5D62F3C5463 Annex 1 to the Standard Contractual Clauses (Module Four) A. List of Parties
Data exporter: The data exporter is the iManage entity identified in the applicable Order. The data exporter provides the Services.
The data exporter's data protection contact details are as specified in the DPA.
Data importer: Customer is the data importer. The data importer is a user of the Services.
The data importer's data protection contact (and EU/UK representative if applicable) is as detailed in the Order or as otherwise provided to the data exporter.
B. Description of Transfer
Data Subjects: The categories of Data Subjects whose Personal Data may be Processed in connection with the Services are derained and entroled by data roper a ole direct adar, and burners times and prospects or data importer, and employees or contractors of data importer's prospects and customers.
Categories of data: The categories of Personal Data are determined by data importer in its sole discretion and may include but are not limited to: first and last name, employer, role, professional title, and contact information (e.g., email, phone, physical address).
Special categories of data: Special categories of Personal Data, if any, are determined by data importer in its sole discretion and may include, but are not limited to, information revealing racial or ethnic origin, political, religious, or philosophical beliefs, trade union membership or health data.
Frequency, duration, and retention: The Personal Data is transferred on a continuous basis determined by the data importer. The data exporter will Process the Personal Data for the duration of the Agreement and will retain the Personal Data in accordance with paragraph 8.1 of the DPA.
Nature and purpose of the Processing: iManage will Process Customer Data and Personal Data only as described and subject to the limitations herein (a) to provide Customer the Services in accordance with the Documented Instructions, and (b) for business operations incident to providing the Services to Customer, which may include (i) delivering functional capabilities as licensed, configured, and used by Customer and its Authorized Users, (ii) preventing, detecting, and repairing problems, including Security Incidents, and (iii) providing technical support, professional planning, advice, guidance, data migration, deployment, and solution/software development services.
Sub-Processors: Any Sub-Processor appointed by the data exporter will Process the Personal Data to assist the data exporter in providing the Services as described above for the duration of the Agreement. 29 DocuSign Envelope ID: 387DE0A6-E450-4D58-2 773BF83010CA DocuSign Envelope ID: B2679106-09D1-4F3B-858C-A5D62F3C5463 Annex 2 to the Standard Contractual Clauses
Security measures implemented by the data importer
measures set forth in Exhibit B to the Agreement are hereby incorporated into this Annex 2 by this reference and are binding on the data importer as if they were set forth in this Annex 2 in their entirety.
Security Measure Practices
Encryption. Manage encrypts Customer Data at rest within the Cloud Services using ciphers at least as strong as 256-bit AES. Customer Data in transit to and from the Cloud Services is transferred to/from the Cloud Services across encrypted network connections Pseudonymisation and and/or protocols (i.e., HTTPS and/or VPN). Backups of Customer Data are encrypted and Encryption stored in a secondary data center.
Key Management. iManage provides Customer the opportunity to choose whether Manage or Customer controls the encryption key related to Customer Data.
Standards. Commercially reasonable and appropriate methods and safeguards are utilized to protect the confidentiality, availability, and integrity of Customer Data and Personal Data.
Confidentiality. Manage ensures that Manage Personnel authorized to access Customer Data and Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
Training. All Manage Personnel with access to Customer Data and Personal Data receive annual training.
Ongoing Confidentiality, Backups. 24/7 managed backup services are provided that include Customer Data storec Integrity, Availability and in the primary site backed up on at least a daily basis to a secondary site. Manage provides Resilience backup services for all components of the solution included in the Cloud Services. Backups are maintained for a period of ninety days in the primary data center, and ninety days in the secondary data center.
Disaster Recovery. iManage maintains disaster recovery capabilities designed to minimize disruption to the Cloud Services. Included within these plans is disaster recover incident management, procedures for the recovery of access to Customer Data in the secondary data center, as well as the periodic testing/exercising of the disaster recovery plan.
Regularly Testing, Vulnerability Testing. Manage conducts vulnerability testing of the Cloud Services on a Assessing and Evaluating monthly basis.
the Effectiveness of the
Measures pondiraed by an heenage uparty org penetration testing of the Cloud Services, ccess Policy. An access control policy (physical, technical, and administrative) based o east privileges principles is enforces
Access Authorization.
• An authorization management system is maintained and designed to ensure that User Identification and
Authorization
Data have a separate, unique username.
• Access to Customer Data and Personal Data is restricted solely to Manage Personnel who have a need to access such Customer Data or Personal Data it connection with the Services or as otherwise required by applicable Law Authentication.
30 DocuSign Envelope ID: 387DE0A6-E450-4D58-84C 3BF83010CA DocuSign Envelope ID: B2679106-09D1-4F3B-858C-A5D62F3C5463 Security Measure Practices
•Industry standard practices, including strong authentication, are utilized to identify and authenticate all Manage Personnel who attempt to access the iManage network or information systems
• Manage ensures that access rights are revoked for all Manage Personnel immediately upon the termination of their employment, contractual or other relationships with Manage.
Protection of Customer Encryption. Customer Data in transit to and from the Cloud Services is transferred to/from Data During Transmission the Cloud Services across encrypted network connections and/or protocols (i.e., hypertext transfer protocol secure (HTTPS) and/or virtual private network (VPN)).
Encryption. Customer Data at rest within the Cloud Services is encrypted using ciphers a Protection of Customer least as strong as 256-bit advanced encryption standard (AES) Data During Storage
secondary at centkups. Backups of Customer Data are encrypted and stored in a Security Safeguards. Physical security safeguards are maintained at any facilities where Manage hosts Customer Data or Personal Data. Physical access to such facilities is onl granted following a formal authorization procedure and access rights are reviewed periodically.
Physical Security
acilities must be limited to identified and authorized individuals. Such facilities use a variet acilities. Such facilities are rated as Tier 3 data centers or greater, and access to suc of industry standard systems to protect against loss of Customer Data and Personal Data due to power supply failure, fire, and other natural hazards.
Event Logging
Event Logging. Manage logs access and use of information systems containing Customer Data.
Malicious Software. Anti-malware controls are maintained to help prevent malicious software from causing accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Data.
System Configuration
Asset Inventory. Asset inventories of computing equipment and media used in connection with the processing of Customer Data are maintained. Access to such inventories is restricted to authorized Manage Personnel.
Information Security Management.
• Manage has appointed one or more security officers responsible for coordinating and monitoring the security rules and procedures.
•
Da and Persial Data against acidity program disested to loss, learner, Governance and unauthorized disclosure, or access.
Management
Manage Personnel. Manage maintains written policies and procedures that address the roles and responsibilities of Manage Personnel, including both technical and non-technica personnel, who have access to Customer Data and Personal Data in connection witt roviding the Services. ata Management. Manage maintains commercially reasonable controls for informatio overnance and data management in connection with the Cloud Services Certification of Processes Standards. Manage adheres, and at altimes will adhere, to information security practices at least as protective of Customer Data as identified in ISO 27001 and ISO 27017 (or 31 DocuSign Envelope ID: 387DE0A6-E450-4D58-84 73BF83010CA DocuSign Envelope ID: B2679106-09D1-4F3B-858C-A5D62F3C5463 Security Measure Practices
substantially equivalent or replacement standards) or other generally accepted authoritative standards (e.g., SSAE 16, SOC2).
Independent Assessments. On an annual basis, iManage has an independent third-party continuity plan is maintained that is compliant with ISO 2230 curily standards. A business organization conduct an independent assessment of Data Minimization. Manage shall make reasonable efforts to use the minimum necessary Customer Data and Personal Data to provide the Services.
Data Minimization / Data
Quality Data Quality. At all times during the applicable Order Term, Customer shall have the ability o amend and delete Customer Data to assist the Customer with its data minimization an data quality obligations.
Data Retention. Manage will retain Customer Data stored in the Cloud Services for ninety (90) days after expiration or termination of Customer's subscription so that Customer may extract Customer Data. After said 90-day period ends, Manage will disable Customer's Data Retention account and delete all Customer Data and Personal Data (within thirty (30) days) and, where required by Law, shall certify to Customer that it has done so, save to the extent that Manage is required by any applicable Law to retain some or all of such Customer Data.
Accountability. Manage defines accountability as holding individuals accountable for their internal control responsibilities.
Control Activities. Specific control activities that Manage has implemented in this are are described below.
Accountability • An employee sanction procedure is in place and documented to communicate that an employee may be terminated for noncompliance with a policy and/or procedure; A performance review of employees is conducted on an annual basis to evaluate he performance of employee against expected levels of performance and onduct and hold them accountable for their internal control responsibilities Portability. At all times during the applicable Order Term, Customer shall have the ability to access, extract, and delete Customer Data.
Portability and Erasure
logically separated from data of other Manage customers. 32 DocuSign Envelope ID: 387DE0A6-E450-4D58-8: 73BF83010CA DocuSign Envelope ID: 82679106-09D1-4F3B-858C-A5D62F3C5463 Schedule 2 to Data Protection Agreement
HIPAA Business Associate Agreement
If Customer is a Covered Entity or a Business Associate and includes Protected Health Information in Customer Data, incorporated into the Agreement. If there is any conflict between a provision in this BAA and a provision in the Agreement, Professional Services Data, or Support Data, the terms of this HIPAA Business Associate Agreement ("BAA") shall be this BAA will control.
1. Definitions. Except as otherwise defined in this BAA, capitalized terms shall have the definitions set forth in HIPAA, and if not defined by HIPAA, such terms shall have the definitions set forth in the Agreement. "Breach Notification Rule" means the Breach Notification for Unsecured Protected Health Information Final Rule. "Business Associate" shall have the same meaning as the term "business associate" in 45 CFR § 160.103 of HIPAA.
"Covered Entity" shall have the same meaning as the term "covered entity" in 45 CFR § 160.103 of HIPAA. "HIPAA" collectively means the administrative simplification provision of the Health Insurance Portability and Accountability Act enacted by the United States Congress, and Its implementing regulations, including the Privacy Rule, the Breach Notification Rule, and the Security Rule, as amended from time to time, including by the Health Information Technology for Economic and Clinical Health ("HITECH") Act and by the Modifications to the HIPAA Economic and Clinical Health Act and the Genetic Information Nondiscrimination Act; Other Modifications to the , Security, Enforcement, and Breach Notification Rules under the Health Information Technology for HIPAA Rules; Final Rule.
"Privacy Rule" means the Standards for Privacy of Individually Identifiable Health Information. "Protected Health Information" shall have the same meaning as the term "protected health information" in 45 CFR § 160.103 of HIPAA, provided that it is limited to such protected health information that is received by iManage from, or created, received, maintained, or transmitted by iManage on behalf of, Customer through Manage's provision of the Services.
"Security Rule" means the Security Standards for the Protection of Electronic Protected Health Information.
2. Permitted Uses and Disclosures of Protected Health Information.
Performance of the Agreement. Except as otherwise limited in this BAA, Manage may Use and Disclose Protected Health Information for, or on behalf of, Customer as specified in the Agreement; provided that any such Use or Disclosure would not violate HIPAA if done by Customer, unless expressly permitted under paragraph 2.2 below.
Management, Administration, and Legal Responsibilities. Except as otherwise limited in this BAA, Manage may Use and Disclose Protected Health Information for the proper management and administration of Manage and/or to carry out the legal responsibilities of Manage, provided that any Disclosure may occur only if: (a) Required by Law; or (b) iManage obtains written reasonable assurances from the person to whom the Protected Health Information is Disclosed that it will be held confidentially and Used or further Disclosed only as Required by Law or for the purpose for which it was Disclosed to the person, and the person notifies Manage of any instances of which it becomes aware in which the confidentiality of the Protected Health Information has been breached.
3. Responsibilities of the Parties with Respect to Protected Health Information.
Manage's Responsibilities. To the extent iManage is acting as a Business Associate, Manage agrees to the following:
(a) Limitations on Use and Disclosure. Manage shall not Use and/or Disclose the Protected Health Information Information for any activity not authorized under the Agreement and/or this BAA. Manage shall not use Protected Health Information for any advertising, Marketing, or similar commercial purpose of Manage or any 33 DocuSign Envelope ID: 387DE0A6-E450-4D58-84 73BF83010CA DocuSign Envelope ID: B2679106-09D1-4F3B-858C-A5D62F3C5463 third party. Manage shall not violate the HIPAA prohibition on the sale of Protected Health Information.
Manage shall make reasonable efforts to Use, Disclose, and/or request the minimum necessary Protected Health Information to accomplish the intended purpose of such Use, Disclosure, or request.
Safeguards. Manage shall: (i) use reasonable and appropriate safeguards to prevent Use and Disclosure of Protected Health Information other than as permitted in this BAA; and (ii) comply with the applicable requirements of 45 CFR Part 164 Subpart C of the Security Rule. (c) Reporting. iManage shall report to Customer: (i) any Use and/or Disclosure of Protected Health Information that is not permitted or required by this BAA of which Manage becomes aware; (il) any Security Incident of which it becomes aware, provided that notice is hereby deemed given for Unsuccessful Security Incidents (as defined below) and no further notice of such Unsuccessful Security Incidents shall be given; and/or (iii) any Breach of Customer's Unsecured Protected Health Information that Manage may discover (in accordance with 45 CFR § 164.410 of the Breach Notification Rule). Notification of a Breach will be made in accordance with paragraph 5 of Exhibit C to the Agreement. Taking into account the level of risk reasonably likely to be presented by the Use, Disclosure, Security Incident, or Breach, the timing of other reporting will be made consistent with Manage's and Customer's legal obligations.
For purposes of this paragraph, "Unsuccessful Security Incidents" mean, without limitation, pings, and other broadcast attacks on Manage's firewall, port scans, unsuccessful log-on attempts, denial of service attacks, and any combination of the above, as long as no such incident results in unauthorized access, acquisition, Use, or Disclosure of Protected Health Information. Manage's obligation to report under this paragraph is not and will not be construed as an acknowledgement by iManage of any fault or liability with respect to any Use, Disclosure, Security Incident, or Breach.
Subcontractors. In accordance with 45 CFR SS 164.502(e)(1)(ii) and 164.308(b)(2) of HIPAA, Manage shall require its Subcontractors who create, receive, maintain, or transmit Protected Health Information on behalf of iManage to agree in writing to: (i) the same or more stringent restrictions and conditions that apply to Manage with respect to such Protected Health Information; (i) appropriately safeguard the Protected Health Information; and (il) comply with the applicable requirements of 45 FR Part 164 Subpart C of the Security Rule. Manage remains responsible for its Subcontractors' compliance with obligations in this BAA.
Disclosure to the Secretary. Manage shall make available its internal practices, records, and books relating to the Use and/or Disclosure of Protected Health Information received from Customer to the Secretary of the Department of Health and Human Services for purposes of determining Customer's compliance with HIPAA, subject to attorney-client and other applicable legal privileges.
Access. The Parties acknowledge and agree that Manage does not maintain Protected Health Information in a Designated Record Set for Customer. In the event that there is a change in the Services that iManage such that iManage commences maintaining Protected Health Information in a Designated Record Set, then Manage, at the request of Customer, shall within fifteen (15) days make access to such Protected Health Information available to Customer in accordance with 45 CFR § 164.524 of the Privacy Rule.
(g) Amendment. Subject to paragraph 3.1(f) above, if Manage maintains Protected Health Information in a Designated Record Set for Customer, then Manage, at the request of Customer, shall within fifteen (15) days make available such Protected Health Information to Customer for amendment and incorporate any reasonably requested amendment in the Protected Health Information in accordance with 45 CFR § 164.526 of the Privacy Rule.
(h) Accounting of Disclosure. Manage, at the request of Customer, shall within thirty (30) days make available to Customer such information relating to Disclosures made by Manage as required for Customer to make any requested accounting of Disclosures in accordance with 45 CFR § 164.528 of the Privacy Rule. (i) Performance of a Covered Entity's Obligations. To the extent Manage is to carry out a Covered Entity obligation under the Privacy Rule, Manage shall comply with the requirements of the Privacy Rule that apply to Customer in the performance of such obligation.
3.2 Customer Responsibilities.
(a) No Impermissible Requests. Customer shall not request Manage to Use or Disclose Protected Health Information in any manner that would not be permissible under HIPAA if done by a Covered Entity (unless permitted by HIPAA for a Business Associate).
(b) Customer Notification Obligations. Customer shall notify Manage of any (i) limitation(s) in the notice of privacy practices of a Covered Entity under HIPAA, to the extent that such limitation may affect Manage's use or 34 DocuSign Envelope ID: 387DE0A6-E450-4D58-8 73BF83010CA DocuSign Envelope ID: B2679106-09D1-4F3B-858C-A5D62F3C5463 disclosure of Protected Health Information; (i) changes in, or revocation of, the permission by an Individual to use or disclose their Protected Health Information, to the extent that such changes may affect Manage's use or disclosure of Protected Health Information; and (iii) restriction on the use or disclosure of Protected Health Information that a Covered Entity has agreed to or is required to abide by under HIPAA, to the extent that such restriction may affect Manage's use or disclosure of Protected Health Information. (c) Contact Information for Notices, Customer hereby agrees that any reports, notification, or other notice by Manage pursuant to this BAA may be made electronically. Customer shall provide contact information on the Manage support website found at https://help.imanage.com (or such other location or method of updating contact information as Manage may specify from time to time) and shall ensure that Customer's contact information remains up to date during the term of this BAA. Failure to submit and maintain as current the aforementioned contact information may delay Manage's ability to provide Breach notification under this BAA.
(d) Safeguards and Appropriate Use of Protected Health Information. Customer is responsible for implementing appropriate privacy and security safeguards to protect its Protected Health Information in compliance with HIPAA. Without limitation, it is Customer's obligation to not include Protected Health Information in: (i) information Customer submits to technical support personnel through a technical support request or to community support forums; or (ii) Customer's address book or directory information.
4. Applicability of BAA. This BAA is applicable to only the Services.
5. Term and Termination.
5.1 Term. This BAA shall continue in effect until the earlier of (a) termination by a Party for breach as set forth in paragraph 5.2 below, or (b) expiration or termination of the Agreement.
5.2 Termination for Breach. Upon written notice, either Party immediately may terminate the Agreement and this BAA if the other Party is in material breach or default of any obligation in this BAA. Either Party may provide the other a thirty (30) day period to cure a material breach or default within such written notice.
Return, Destruction, or Retention of Protected Health Information Upon Termination. Upon expiration or termination of this BAA, Manage shall return or destroy all Protected Health Information in its possession, if it is feasible to do so, and as set forth in the applicable termination provisions of the Agreement. If it is not feasible to return or destroy any portions of the Protected Health Information upon termination of this BAA, then Manage shall extend the protections of this BAA, without limitation, to such Protected Health Information and limit any further Use or Disclosure of the Protected Health Information to those purposes that make the return or destruction infeasible for the duration of the retention of the Protected Health Information.
6. Miscellaneous.
6.1 Interpretation. The Parties intend that this BAA be interpreted consistently with their intent to comply with HIPAA and other applicable federal and state law. Except where this BAA conflicts with the Agreement, all other terms and conditions of the Agreement remain unchanged. Any captions or headings in this BAA are for the convenience of the Parties and shall not affect the interpretation of this BAA.
6.2 Amendment; Waiver. This BAA may not be modified or amended except in a writing duly signed by authorized representatives of the Parties. A waiver with respect to one event shall not be construed as continuing, as a bar to, or as a waiver of any right or remedy as to subsequent events.
6.3 No Third-Party Beneficiaries. Nothing express or implied in this BAA is intended to confer, nor shall anything in this BAA confer, upon any person other than the Parties, and the respective successors or assigns of the Parties, any rights, remedies, obligations, or liabilities whatsoever.
6.4 Severability. In the event that any provision of this BAA is found to be invalid or unenforceable, the remainder of this BAA shall not be affected thereby, but rather the remainder of this BAA shall be enforced to the greatest extent permitted by law.
No Agency Relationship. It is not intended that an agency relationship (as defined under the Federal common law of agency) be established hereby expressly or by implication between Customer and Manage under HIPAA or the Privacy Rule, Security Rule, or Breach Notification Rule. No terms or conditions contained in this BAA shall be construed to make or render iManage an agent of Customer. 35 DocuSign Envelope ID: 387DE0A6-E450-4D58-84 73BF83010CA DocuSign Envelope ID: B2679106-09D1-4F3B-858C-A5D62F3C5463 For the Contract between the City of
EXHIBIT B
PAYMENT PROVISIONS
{PLEASE NOTE THAT THE CITY OF RICHMOND SHALL NOT PAY FOR SERVICES
THAT EXCEED THE CONTRACT PAYMENT LIMIT UNLESS A CONTRACT
AMENDMENT HAS BEEN APPROVED BY THE CITY COUNCIL OR THE CITY
MANAGER)
1. Provided Contractor is not in default under this Contract, Contractor shall be compensated as provided below.
2. Any and all payments made pursuant to this Contract shall be subject to the Contract Payment Limit. The Payment Limit includes expenses (phones, photo copying, meals and travel etc. Invoices, shall be adequately detailed, based on accurate records, and be in a form reasonably satisfactory to the City. Contractor may be required to provide back-up material upon request.
3. Contractor shall submit timely invoices to the following address:
Attention: City of Richmond, Finance Department - Accounts Payable Project Manager: Ivania Navarrete Department: City Attorney's Office PO Box 4046
Richmond, CA 94804-0046
4. All invoices that are submitted by Contractor shall be subject to the approval of the City's Project Manager, Ivania Navarrete before payments shall be authorized.
5. The City will pay invoice(s) within 45 days after completion of services to the City's satisfaction. The City shall not pay late fees or interest.
6. A Richmond business license shall be obtained before any payment under this Contract shall be authorized and the business license must be kept current during the term of this Contract for payments to continue to be authorized
7. All insurance coverage required by this Contract shall be provided by the Contractor before this Contract shall be executed by the City. The insurance coverage must be kept current during the term of this Contract for payments to continue to be authorized.
DocuSign Envelope ID: 387DE0A6-E450-4D58-8. 73BF83010CA DocuSign Envelope ID: B2679106-09D1-4F3B-858C-A5D62F3C5463 For the Contract between the City of
Richmond and
iManage LLC
EXHIBIT C
AUTHORIZED REPRESENTATIVES AND NOTICES
1. Notices. All notices, demands, statements, or communications provided for by this Contract shall be in writing and may be delivered by deposit in the United States mail, postage prepaid. Notices to the City shall be addressed to the Department Head and (as delineated below in section 1.1) to the project manager responsible for the administration of or the supervision of the scope of work under this Contract. Notices to the Contractor shall be addressed to the party designated by Contractor (as delineated below in section 1.2). Notice shall be deemed delivered (a) upon personal delivery; (b) as of the fifth business day after mailing by United States certified mail, postage prepaid, addressed to the proper party; or (c) as of 12:00 p.m. on the second business day immediately after the day it is deposited with and accepted by Federal Express, or a similar overnight courier service, addressed to the proper party and marked for next business day morning delivery. For the purposes of this Contract, a "business day" means any day Monday through Friday that is not a holiday recognized by the federal government or the State of California.
1. 1 CITY hereby designates as its Authorized Representative the Project Manager whose name and address are as follows:
Ivania Navarrete
City of Richmond
Richmond, CA 94804-0046
1.2 CONTRACTOR hereby designates as its Authorized Representative the Project Manager whose name and address are as follows:
Trevor Mathias
iManage LLC
71 S. Wacker, Suite 400
Chicago, IL 60606
DocuSign Envelope ID: 387DE0A6-E450-4D58-84 73BF83010CA DocuSign Envelope ID: B2679106-09D1-4F3B-858C-A5D62F3C5463
EXHIBIT D
GENERAL CONDITIONS
1. Independent Contractor. Contractor acknowledges, represents and warrants that Contractor is not a regular or temporary employee, joint venturer or partner of the City, but rather an independent Contractor. This Contract shall not be construed to create an agency, servant, employee, partnership, or joint venture relationship. As an independent Contractor, Contractor shall have no authority to bind City to any obligation or to act as City's agent except as expressly provided herein. Due to the independent Contractor relationship created by this Contract, City shall not withhold state or federal income taxes, the reporting of which shall be Contractor's sole responsibility.
2. Brokers. Contractor acknowledges, represents and warrants that Contractor has not hired, retained or agreed to pay any entity or person any fee, commission, percentage, gift, or any other consideration, contingent upon or resulting from the award or making of this Contract.
3. City Property. The rights to applicable plans, drawings, reports, calculations, data, specifications, videos, graphics or other materials prepared for or obtained pursuant to this Contract, which, upon request, are to be delivered to City within a reasonable time, shall be deemed assigned to City. If applicable, Contractor shall prepare check prints upon request. Notwithstanding the foregoing, Contractor shall not be obligated to provide to City proprietary software or data which Contractor has developed or had developed for Contractor's own use; provided, however, that Contractor shall, pursuant to Section 15 below, indemnify, defend and hold harmless City from and against any discovery or Public Records Act request seeking the disclosure of such proprietary software or data.
4. Patents, Trademarks, Copyrights and Rights in Data. Contractor shall not publish or transfer any materials, discoveries, developments, concepts, designs, ideas, know how, improvements, inventions and/or original works of authorship resulting from activities supported by this Contract without the express prior written consent of the City Manager. If anything resulting from activities supported by this Contract is patentable, trademarkable, copyrightable or otherwise legally protectable, City reserves the exclusive right to seek such intellectual property rights. Notwithstanding the foregoing, Contractor may, after receiving City's prior written consent, seek patent, trademark, copyright or other intellectual property rights on anything resulting from activities supported by this Contract. However, City reserves, and Contractor irrevocably grants, a nonexclusive, fully paid-up, royalty-free, assumable, perpetual, worldwide license, with the right to transfer, sublicense, practice and exploit said license and the right to make, have made, copy, modify, make derivative works of, use, sell, General Conditions/EJ/TE 01-19-11 1 of 13
DocuSign Envelope ID: 387DE0A6-E450-4D58-8+ 73BF83010CA DocuSign Envelope ID: B2679106-09D1-4F3B-858C-A5D62F3C5463 import, and otherwise distribute under all applicable intellectual properties without restriction of any kind said license.
Contractor further agrees to assist City, at City's expense, in every proper way to secure the City's rights in any patents, trademarks, copyrights or other intellectual property rights relating thereto, including the disclosure to City of all pertinent information and data with respect thereto. Contractor shall also assist City in the execution of all applications, specifications, oaths, assignments, recordations, and all other instruments which City shall deem necessary in order to apply for, obtain, maintain and transfer such rights, or if not transferable, to waive such rights. Contractor shall further assist City in the execution of all applications, specifications, oaths, assignments, recordations and all other instruments which City shall deem necessary in order to assign and convey to City, and any assigns and nominees the sole and exclusive right, title and interest in and to any patents, trademarks, copyrights or other intellectual property rights relating thereto. Contractor further agrees that its obligation to execute or cause to be executed, when it is in Contractor's power to do so, any such instruments or papers shall continue during and at all times after the end of Contractor's services and until the expiration of the last such intellectual property right. Contractor hereby irrevocably designates and appoints City, and its duly authorized officers, agents and servants, as its agent and attorney-in-fact, to act for and in its behalf and stead to execute and file any such applications and to do all other lawfully permitted acts to further the application for, prosecution, issuance, maintenance or transfer of letters of patents, copyright and other registrations. This power of attorney is coupled with an interest and shall not be affected by Contractor's subsequent incapacity.
5. Inspection. Contractor's performance, place of business and records pertaining to this Contract are subject to monitoring, inspection, review and audit by authorized representatives of the CITY, the State of California, and the United States Government.
If the project or services set forth in Exhibit A shall be performed on City or other public property, City shall have the right to inspect such work without notice. If such project or services shall not be performed on City or other public property, City shall have the right to inspect such work upon reasonable notice.
6. Services. The project or services set forth in Exhibit A shall be performed to the full satisfaction and approval of City. In the event that the project or services set forth in Exhibit A are also itemized by price, City, in its sole discretion, may, upon notice to Contractor, delete certain items or services set forth in Exhibit A, in which case there shall be a corresponding reduction in the amount of compensation paid to Contractor.
General Conditions/EJ/TE 01-19-11 2 of 13
DocuSign Envelope ID: 387DE0A6-E450-4D58-84 73BF83010CA DocuSign Envelope ID: B2679106-09D1-4F3B-858C-A5D62F3C5463 Contractor shall, at its own cost and expense, furnish all facilities and equipment necessary for Contractor to complete the project or perform the services required herein, unless otherwise provided in Exhibit A.
7. Records. Contractor shall keep and make available for inspection and copying by authorized representatives of the City, the State of California, and the United States Government, the Contractor's regular business records and such additional records pertaining to this Contract as may be required by the City.
Contractor shall retain all documents pertaining to this Contract for a period of five (5) years after this Contract's termination (or for any further period that is required by law) and until all Federal or State audits are complete and exceptions resolved for this contract's funding period. Upon request, CONTRACTOR shall make these records available to authorized representatives of the CITY, the State of California, and the United States Government.
Contractor shall keep full and detailed accounts, maintain records, and exercise such controls as may be necessary for proper financial management under this Contract. The Contractor's accounting and control systems shall be satisfactory to City. Contractor's accounting systems shall conform to generally accepted accounting principles and all records shall provide a breakdown of total costs charged under this Contract, including properly executed payrolls, time records, utility bills, invoices and vouchers. The City shall be afforded prompt access to Contractor's records, books, and Contractor shall preserve such project records for a period of at least five (5 years after the termination of this Contract, or for such longer period as may be required by law.
Contractor shall permit City and its authorized representatives and accountants to inspect, examine and copy Contractor's books, records, accounts, correspondence, instructions, drawings, receipts, subcontracts, purchase orders, vouchers, memoranda and other data relating to the project or services set forth in Exhibit A, and any and all data relevant to this Contract at any reasonable time for the purpose of auditing and verifying statements, invoices, or bills submitted by Contractor pursuant to this Contract and shall provide such assistance as may be reasonably required in the course of such inspection. Contractor shall also allow City access to the record keeping and accounting personnel of Contractor.
City further reserves the right to examine and re-examine said books, records, accounts, and data during the five (5 year period following the termination of this Contract; and Contractor shall in no event dispose of, destroy, alter, or mutilate said books, records, accounts, and data in any manner whatever for five (5 years after the termination of this Contract.
General Conditions/EJ/TE 01-19-11 3 of 13
DocuSign Envelope ID: 387DE0A6-E450-4D58-8: 73BF83010CA DocuSign Envelope ID: B2679106-09D1-4F3B-858C-A5D62F3C5463 Pursuant to California Government Code § 10527, the parties to this Contract shall be subject to the examination and audit of representatives of the Auditor General of the State of California for a period of three (3) years after final payment under this Contract. The examination and audit shall be confined to those matters connected with the performance of this Contract including, but not limited to, the cost of administering this Contract.
8. Changes and Extra Work. All changes and/or extra work under this Contract shall be performed and paid for in accordance with the following:
Only the City Council or the City Manager may authorize extra and/or changed work. Contractor expressly recognizes that other City personnel are without authorization to either order extra and/or changed work or waive contract requirements. Failure of Contractor to secure the authorization for such extra and/or changed work shall constitute a waiver of any and all right to adjustment in contract price due to such unauthorized work and Contractor thereafter shall be entitled to no compensation whatsoever for performance of such extra and/or changed work.
If Contractor is of the opinion that any work which Contractor has been directed to perform is beyond the scope of this Contract and constitutes extra work, Contractor shall promptly notify City of the fact. The City shall make a determination as to whether or not such work is, in fact, beyond the scope of this Contract and constitutes extra work. In the event that City determines that such work does constitute extra work, City shall provide extra compensation to Contractor on a fair and equitable basis. A change order or Contract Amendment providing for such compensation for extra work shall be negotiated between City and Contractor and executed by Contractor and the appropriate City official.
In the event City determines that such work does not constitute extra work, Contractor shall not be paid extra compensation above that provided herein and if such determination is made by City staff, said determination may be appealed to the City Council; provided, however, a written appeal must be submitted to the City Manager within five (5) days after the staff's determination is sent to Contractor. Said written appeal shall include a description of each and every ground upon which Contractor challenges the staff's determination.
9. Additional Assistance. If this Contract requires Contractor to prepare plans and specifications, Contractor shall provide assistance as necessary to resolve any questions regarding such plans and specifications that may arise during the period of advertising for bids, and Contractor shall issue General Conditions/EJ/TE 01-19-11 4 of 13
DocuSign Envelope ID: 387DE0A6-E450-4D58-8-. 73BF83010CA DocuSign Envelope ID: B2679106-09D1-4F3B-858C-A5D62F3C5463 any necessary addenda to the plans and specifications as requested. In the event Contractor is of the opinion that City's requests for addenda and assistance is outside the scope of normal services, the parties shall proceed in accordance with the changes and extra work provisions of Section 8 of these General Conditions.
10. Professional Ability. Contractor acknowledges, represents and warrants that Contractor and its employees are skilled and able to competently provide the services hereunder, and possess all professional licenses, certifications, and approvals necessary to engage in their occupations.
City has relied upon the professional ability and training of Contractor as a material inducement to enter into this Contract. Contractor shall perform in accordance with generally accepted professional practices and standards of Contractor's profession. In the event that City, in its sole discretion, desires the removal of any person employed or retained by Contractor to perform services hereunder, such person shall be removed immediately upon receiving notice from City.
11. Business License. Contractor shall obtain a Richmond Business License before performing any services required under this Contract. The failure to so obtain such license shall be a material breach of this Contract and grounds for immediate termination by City; provided, however, that City may waive the business license requirement in writing under unusual or extraordinary circumstances without necessitating any modification of this Contract to reflect such waiver.
12. Termination Without Default. Notwithstanding any provision herein to the contrary, City may, in its sole and absolute discretion and without cause, terminate this Contract at any time prior to completion by Contractor of the project or services hereunder, immediately upon written notice to Contractor. Contractor may terminate this Contract at any time in its sole and absolute discretion and without cause upon 30 days' written notice to City. In the event of termination by either party, Contractor shall be compensated for: (1) all authorized work satisfactorily performed prior to the effective date of termination; (2) necessary materials or services of others ordered by Contractor for this Contract, prior to receipt of notice of termination, irrespective of whether such materials or services of others have actually been delivered, provided that Contractor is not able to cancel such orders. Compensation for Contractor in such event shall be determined by City in accordance with the percentage of the project or services completed by Contractor; and all of Contractor's finished or unfinished work product through the time of the City's last payment shall be transferred and assigned to City. Additionally, in the event of such termination, the City may proceed with the work in any reasonable manner it chooses.
General Conditions/EJ/TE 01-19-11 5 of 13
DocuSign Envelope ID: 387DE0A6-E450-4D58-84 73BF83010CA DocuSign Envelope ID: B2679106-09D1-4F3B-858C-A5D62F3C5463
13. Termination in the Event of Default. Should Contractor fail to perform any of its obligations hereunder, within the time and in the manner provided or otherwise violate any of the terms of this Contract, City may immediately terminate this Contract by giving written notice of such termination, stating the reasons for such termination. Contractor shall be compensated as provided in Section 12 of these General Conditions; provided, however, there shall be deducted from such amount the amount of damage, including attorney's fees, expert witness fees and costs, if any, sustained by City by virtue of Contractor's breach of this Contract. Additionally, in the event of such termination, the City may proceed with the work in any reasonable manner it chooses.
14. Conflict of Interest. Contractor acknowledges, represents and warrants that Contractor shall avoid all conflicts of interest (as defined under any federal, state or local statute, rule or regulation, or at common law) with respect to this Contract. Contractor further acknowledges, represents and warrants that no City official or employee has any economic interest, as defined in Title 2, California Code of Regulations §§ 18703.1 through 18703.5, with Contractor that would invalidate this Contract. Contractor acknowledges that in the event that Contractor shall be found by any judicial or administrative body to have any conflict of interest (as defined above) with respect to this Contract, all consideration received under this Contract shall be forfeited and returned to City forthwith. This provision shall survive the termination of this Contract for one (1) year.
15. Indemnification.
(a) If this Contract is a contract for design professional services subject to California Civil Code Section 2782.8(a) and Contractor is a design professional, as defined in California Civil Code Section 2782.8(b)(2), Contractor shall hold harmless, defend and indemnify the City, its officers, agents, employees, and volunteers from and against any and all claims, damages, losses, and expenses including attorneys' fees arising out of, or pertaining to, or relating to the negligence, recklessness, or willful misconduct of the Contractor, except where caused by the active negligence, sole negligence, or willful misconduct of the City. To the fullest extent permitted by law, Contractor shall immediately defend and indemnify the City and its officers, agents, employees, and volunteers from and against any and all liabilities, regardless of nature or type, that arise out of, pertain to, or relate to the negligence, recklessness, or willful misconduct of the Contractor, or its employees, agents, or subcontractors.
Liabilities subject to the duties to defend and indemnify include, without limitation, any and all claims, losses, damages, penalties, fines, and judgments; associated investigation and administrative expenses; defense costs, including but not limited to reasonable attorneys' fees; court costs; and costs of alternative dispute resolution. Contractor's obligation to General Conditions/EJ/TE 01-19-11 6 of 13
DocuSign Envelope ID: 387DE0A6-E450-4D58-8:: 73BF83010CA DocuSign Envelope ID: B2679106-09D1-4F3B-858C-A5D62F3C5463 indemnify applies unless it is finally adjudicated that the liability was caused by the sole active negligence or sole willful misconduct of an indemnified party.
(b) If this Contract is not a contract for design professional services subject to California Civil Code Section 2782.8(a) or Contractor is not a design professional as defined in California Civil Code Section 2782.8(b)(2), Contractor shall indemnify, defend, and hold harmless the City, its officers, agents, employees and volunteers from any and all claims, suits, or actions of every name, kind and description, brought forth on account of injuries to or death of any person or damage to property arising from or connected with the willful misconduct, negligent acts, errors or omissions, ultra-hazardous activities, activities giving rise to strict liability, or defects in design by Contractor or any person directly or indirectly employed by, or acting as, the agent for Contractor in the performance of this Contract, including the concurrent or successive passive negligence of the City, its officers, agents, employees or volunteers.
(c) It is understood that the duty of Contractor to indemnify and hold harmless includes the duty to defend as set forth in Section 2778 of the California Civil Code. Contractor shall be obligated to defend, in all legal, equitable, administrative, or special proceedings, with counsel approved by the City, the City and its officers, agents, employees, and volunteers, immediately upon tender to Contractor of the claim in any form or at any stage of an action or proceeding, whether or not liability is established. An allegation or determination that persons other than Contractor are responsible for the claim does not relieve Contractor from its separate and distinct obligation to defend under this Section 15. The obligation to defend extends through final judgment, including exhaustion of any appeals. The defense obligation includes an obligation to provide independent counsel if Contractor asserts that liability is caused in whole, or in part, by the negligence or willful misconduct of an indemnified party. (d) The review, acceptance or approval of the Contractor's work or work product by any indemnified party shall not affect, relieve or reduce the Contractor's indemnification or defense obligations. This Section 15 survives completion of the services or the termination of this Contract.
The provisions of this Section 15 are not limited by, and do not affect, the provisions of this Contract relating to insurance.
(e) Acceptance of insurance certificates and endorsements required under this Contract does not relieve Contractor from liability under this Section
15. This Section 15 shall apply whether or not such insurance policies are determined to be applicable to any such damages or claims for damages.
16. Safety. Contractor acknowledges that the City is committed to the highest standards of workplace safety. Contractor shall perform all work hereunder in full compliance with applicable local, state and federal safety requirements including but not limited to Occupational Safety and Health Administration requirements, and shall assume sole and complete General Conditions/EJ/TE 01-19-11 7 of 13
DocuSign Envelope ID: 387DE0A6-E450-4D58-84 73BF83010CA Docusign Envelope ID: B2679106-09D1-4F3B-858C-A5D62F3C5463 responsibility for the safety of Contractor's employees and any subContractor's employees. If a death, serious personal injury or substantial property damage occurs in connection with the performance of this Contract, Contractor shall immediately notify the City by telephone.
17. Insurance. Insurance requirements are set forth in Exhibit F to this Contract. Contractor shall abide by the insurance requirements set forth in said Exhibit F
18. Non-Liability of Officials and Employees of the City. No official or employee of the City shall be personally liable for any default or liability under this Contract.
19. Compliance with Laws. Contractor shall comply with all federal, state and local laws, statutes, ordinances, rules and regulations, and the orders and decrees of any courts or administrative bodies or tribunals, with respect to this Contract, including without limitation environmental laws, employment discrimination laws and prevailing wage laws. Compliance under this provision includes compliance with all provisions of the Richmond Municipal Code ("Municipal Code"), including Chapters 2.50, 2.52, 2.56, and 2.60, if applicable.
Contractor acknowledges that under § 2.60.070 of the Municipal Code ("Living Wage Ordinance"), Contractor shall promptly provide to City documents and information verifying its compliance with the Living Wage Ordinance. Also as prescribed in § 2.60.070, Contractor shall notify each of its affected employees with regards to the wages that are required to be paid pursuant to the Living Wage Ordinance.
Contractor shall comply with § 2.28.030 of the Municipal Code, obligating every Contractor or subcontractor under a contract or subcontract with the City for public work or for goods or for services to retrain trom discriminatory employment or subcontracting practices on the basis of race, color, sex, sexual orientation, religious creed, national origin or ancestry of any employee, any applicant for employment or any potential subcontractor.
Contractor acknowledges that the City's Drug Free Workplace Policy, Violence in the Workplace Policy and the Policy Against Workplace Harassment, are available on the City's website at
http://www.ci.richmond.ca.us/workplacepolicies. Contractor agrees to abide by the terms and conditions of said policies.
20. Limitations upon Subcontracting and Assignment. This Contract binds the heirs, successors, assigns and representatives of Contractor. The Contractor shall not enter into subcontracts for any work contemplated General Conditions/EJ/TE 01-19-11 8 of 13
DocuSign Envelope ID: 387DE0A6-E450-4D58-84 73BF83010CA DocuSign Envelope ID: B2679106-09D1-4F3B-858C-A5D62F3C5463 under this Contract and shall not assign this Contract, nor any portion hereof or monies due or to become due, without the prior written consent of the City Council or its designee.
Contractor acknowledges that the services which Contractor shall provide under this Contract are unique, personal services which, except as otherwise provided herein, Contractor shall not assign or sublet to any other party without the prior written approval of City, which approval may be withheld in City's sole and absolute discretion. In the event that City, in writing, approves any assignment or subletting of this Contract or the retention of subcontractors by Contractor, Contractor shall provide to City upon request copies of each and every subcontract contract prior to the execution thereof by Contractor and subcontractor. Any assignment by Contractor of any or all of its rights under this Contract without first obtaining City's prior written consent shall be a default under this Contract.
The sale, assignment, transfer or other disposition of any of the issued and outstanding capital stock of Contractor (if applicable), or of the interest of any general partner or joint venturer or syndicate member if Contractor is a partnership or joint-venture or syndicate, which shall result in a change of control of Contractor, shall be deemed an assignment. For this purpose, control shall mean fifty percent or more of the voting power or twenty-five percent or more of the assets of the corporation, partnership or joint-venture.
21. Integration. This Contract constitutes the entire agreement between the parties concerning the subject matter hereof and supersedes any previous oral or written agreement; provided, however, that correspondence or documents exchanged between Contractor and City may be used to assist in the interpretation of the Exhibits to this Contract.
22. Modifications and Amendments. This Contract may be modified or amended only by a change order or Contract Amendment executed by both parties and approved as to form by the City Attorney.
23. Conflicting Provisions. In the event of a conflict between these General Conditions and those of any Exhibit or attachment hereto, these General Conditions shall prevail; provided, however, that any Special Conditions as set forth in Exhibit E shall prevail over these General Conditions. In the event of a conflict between the terms and conditions of any two or more Exhibits or attachments hereto, those prepared by City shall prevail over those prepared by the Contractor, and the terms and conditions preferred by the City shall prevail over those preferred by the Contractor.
24. Non-exclusivity. Notwithstanding any provision herein to the contrary, the services provided by Contractor hereunder shall be non-exclusive, and General Conditions/EJ/TE 01-19-11 9 of 13
DocuSign Envelope ID: 387DE0A6-E450-4D58-8+ 73BF83010CA DocuSign Envelope ID: B2679106-09D1-4F3B-858C-A5D62F3C5463 City reserves the right to employ other Contractors in connection with the project.
25. Exhibits. All Exhibits hereto are made a part hereof and incorporated herein by reference; provided, however, that any language in Exhibit A which does not pertain to the project description, proposal, scope of services, or method of compensation (as applicable), or any corresponding responsibilities of City, shall be deemed extraneous to, and not a part of, this Contract.
26. Force Majeure. Neither party hereto shall be considered in default in the performance of its obligations hereunder to the extent that the performance of such an obligation is prevented or delayed by reason of acts of God, strikes, boycotts, lock-outs, inability to procure materials not related to the price thereof, tailure of power, restrictive governmental laws and regulations enacted after the date of this Contract, riots, civil unrest, acts of terrorism, insurrection, war, declaration of a state or national emergency or other reasons of a like nature not within the reasonable control of such party.
27. Time of the Essence. Time is of the essence of this Contract. Contractor and City agree that any time period set forth in Exhibit A represents their best estimates with respect to completion dates and both Contractor and City acknowledge that departures from the schedule may occur.
Therefore, both Contractor and City will use reasonable efforts to notify one another of changes to the schedule. Contractor shall not be responsible for performance delays caused by others, or delays beyond Contractor's control, and such delays shall extend the times for performance of Contractor's work.
28. Confidentiality. Contractor agrees to comply with, and to require its employees, agents and partners to comply with, all applicable State or Federal statutes or regulations respecting confidentially, including but not limited to, the identity of persons served under this Contract, their records, or services provided them, and assures that:
All applications and records concerning any individual made or kept by Contractor or any public officer or agency in connection with the administration of or relating to services provided under this Contract will be confidential, and will not be open to examination for any purposes not directly connected with the administration of such service.
No person will publish or disclose or permit or cause to be published or disclosed, any list of persons receiving services, except as may be required in the administration of such service.
General Conditions/EJ/TE 01-19-11 10 of 13
DocuSign Envelope ID: 387DE0A6-E450-4D58-84 73BF83010CA DocuSign Envelope ID: B2679106-09D1-4F3B-858C-A5D62F3C5463
29. Third Parties. Nothing herein shall be interpreted as creating any rights or benefits in any third parties. For purposes hereof, transferees or assignees as permitted under this Contract shall not be considered "third parties."
30. Governing Law. This Contract shall be construed in accordance with the law of the State of California without regard to principles of conflicts of law.
This Contract is made in Contra Costa County, California, and any action relating to this Contract shall be instituted and prosecuted in the courts of Contra Costa County, California.
31. Nonrenewal. Contractor understands and agrees that there is no representation, implication, or understanding that the services provided by Contractor under this Contract will be purchased or renewed by the City under a new contract following expiration or termination of this Contract and waives all rights or claims to notice or hearing respecting any failure by City to continue the purchase of all or any failure to continue purchase of all or any such services from Contractor.
32. Claims. Any claim by Contractor against City hereunder shall be subject to Government Code §§ 800 et seg. The claims presentation provisions of said Act are hereby modified such that the presentation of all claims hereunder to the City shall be waived if not made within six months after accrual of the cause of action.
33. Interpretation. This Contract shall be interpreted as if drafted by both parties.
34. Warranty. In the event that any product shall be provided to the City as part of this Contract, Contractor warrants as follows: Contractor possesses good title to the product and the right to transfer the product to City; the product shall be delivered to the City free from any security interest or other lien; the product meets any specifications contained herein; the product shall be free from material defects in materials and workmanship under normal use for a period of one (1) year from the date of delivery; and the product shall be fit for its intended purposes). Notwithstanding the foregoing, consumable and maintenance items (such as light bulbs and batteries) shall be warranted for a period of one hundred and eighty (180) days from the date of delivery. All repairs during the warranty period shall be promptly performed by Contractor, at Contractor's expense, including shipping.
35. Severability. In the event that any of the provisions or portions or applications thereof of this Contract are held to be unenforceable or invalid by any court of competent jurisdiction, City and Contractor shall negotiate an equitable adjustment in the provisions of the Contract with a view General Conditions/EJ/TE 01-19-11 11 of 13
DocuSign Envelope ID: 387DE0A6-E450-4D58-8+ 73BF83010CA DocuSign Envelope ID: B2679106-09D1-4F3B-858C-A5D62F3C5463 toward effecting the purpose of this Contract, and the validity and enforceability of the remaining provisions or portions or applications thereof, shall not be affected thereby.
36. Authority. City warrants and represents that the signatory hereto (the Mayor of the City of Richmond or the City Manager) is duly authorized to enter into and execute this Contract on behalf of City. The party signing on behalf of Contractor warrants and represents that he or she is duly authorized to enter into and execute this Contract on behalf of Contractor, and shall be personally liable to City if he or she is not duly authorized to enter into and execute this Contract on behalf of Contractor.
37. Waiver. The waiver by City of any breach of any term or provision of this Contract shall not be construed as a waiver of any subsequent breach.
Inspections or approvals, or statements by any officer, agent or employee of the City relating to the Contractor's performance, or payments therefore, or any combination of these acts, shall not relieve the Contractor's obligation to fulfill this Contract as prescribed; nor shall the City be thereby stopped from bringing any action for damages or enforcement arising from any failure to comply with any of the terms and conditions of this Contract.
38. Possessory Interest. If this Contract results in the Contractor having possession of, claim to or right to the possession of land or improvements, but does not vest ownership of the land or improvements in the same person, or if this Contract results in the placement of taxable improvements on tax exempt land (Revenue and Taxation Code 107), such interest or improvements may represent a possessory interest subject to property tax, and Contractor may be subject to the payment of property taxes levied on such interest.
39. Performance and Final Acceptance.
Contractor represents that it is experienced, qualified, registered, licensed, equipped, organized and financed to perform the services under this Contract.
Contractor shall perform the services under this Contract with that degree of skill and judgment normally exercised by professional firms performing services of a similar nature in the State of California, and shall be responsible for the professional quality, technical accuracy and coordination of the services it performs under this Contract. In addition to the other rights and remedies which City may have, Contractor shall, at its own expense, correct any services which fail to meet the above standard.
General Conditions/EJ/TE 01-19-11 12 of 13
DocuSign Envelope ID: 387DE0A6-E450-4D58-84 73BF83010CA DocuSign Envelope ID: B2679106-09D1-4F3B-858C-A5D62F3C5463 City shall provide Contractor an opportunity to cure errors and omission which may be disclosed during the review of submittals, with no increase in the authorized Contract Payment Limit. Should Contractor fail to make necessary corrections in a timely manner, such corrections shall be made by the City and the cost thereof shall be charged to Contractor.
If warranted, City shall determine, and Contractor may request such determination, that Contractor has satisfactorily completed performance of this Contract. Upon such determination, City shall issue to Contractor a written Notice of Final Acceptance, after which Contractor shall not incur further costs under this Contract. Contractor shall respond to such Notice of Final Acceptance by executing and submitting to City a Release and Certificate of Final Payment.
40. Survival. The rights and obligations of the parties which by their nature survive termination or completion of the services covered by this Contract shall remain in full force and effect after termination or completion.
General Conditions/EJ/TE 01-19-11 13 of 13
DocuSign Envelope ID: 387DE0A6-E450-4D58-8‹ 73BF83010CA DocuSign Envelope ID: B2679106-09D1-4F3B-858C-A5D62F3C5463 For the Contract between the City of
Richmond ana
iManage LLC
EXHIBIT E
SPECIAL CONDITIONS
The General Conditions are hereby amended to include the following modifications and/or provisions (if applicable):
The terms and conditions of the Manage Cloud Services Agreement found at https://support.imanage.com/worksite/iManage_Cloud_Services_Agreement.pdf (the "CSA") shall govern the City's use of any Products or Services provided or made available to the City by Contractor. In the event of a conflict between this Standard Contract and the CSA, the CSA shall control.
Contractor shall not be required to obtain a business license.
The City shall not be permitted to terminate any portion of the contract for convenience, or to delete or diminish items, services or quantity during an agreed contract term.
Contractor shall have the authority to select subcontractors without seeking City approval.
Section 27 of Exhibit D is hereby deleted.
Contractor does not warrant that the products and services provided will be free from material defects.
Manage shall retain ownership rights in any software, intellectual property or other products or services Manage provides or makes available under this contract Notwithstanding anything to the contrary in this contract, Contractor's total aggregate liability (including costs and expenses) under this contract, the CSA, or applicable law, arising out of or relating to unauthorized access to, use or disclosure of Customer Data (including Personal Data) (both as defined in the CSA) shall not exceed $1,000,000.
Exhibit F is hereby modified as described in Exhibit F-1 attached.
DocuSign Envelope ID: 387DE0A6-E450-4D58-84 73BF83010CA DocuSign Envelope ID: B2679106-09D1-4F3B-858C-A5D62F3C5463 For the Contract between the City of
Richmond and
iManage LLC
EXHIBIT F
INSURANCE PROVISIONS
During the entire term of this Contract and any extension or modification thereof, the CONTRACTOR shall keep in effect insurance policies meeting the insurance requirements specified in the insurance provisions which are attached hereto and incorporated herein by this reference.
DocuSign Envelope ID: 387DE0A6-E450-4D58-8. 73BF83010CA DocuSign Envelope ID: B2679106-09D1-4F3B-858C-A5D62F3C5463 Exhibit F
Section 8
City of Richmond Insurance Requirements - Type 5:
Vendors, Suppliers, Small Grant Recipients & Nonprofit
Organizations
In all instances where CONTRACTOR or its representatives will be conducting business and/or providing services to the City of Richmond (City), or will be awarded City of Richmond (City) funds to provide programs or services, the City requires the following MINIMUM insurance requirements and limits.
CONTRACTOR shall procure and maintain for the duration of the contract, agreement, or other order for work, services or supplies, insurance against claims for injuries to persons or damages to property which may arise from or in connection with the performance of the work hereunder and the results of that work by the CONTRACTOR, its agents, representatives, or subcontractors. Maintenance of proper insurance coverage is a material element of the contract. Failure to maintain or renew coverage or to provide evidence of renewal may be treated by the City as a material breach of contract.
CONTRACTOR agrees that in the event of loss due to any of the perils for which it has agreed to provide Commercial General Liability insurance, CONTRACTOR shall look solely to its insurance for recovery.
CONTRACTOR hereby grants to CITY, on behalf of any insurer providing Commercial General Liability insurance to either CONTRACTOR or CITY with respect to the services of CONSULTANT herein, a waiver of any right tr ubrogation which any such insurer of said CONTRACTOR may acquire against the CITY by virtue of the payment o any loss under such insurance.
Originates resent presents, naming the City an additional insured for general liability, as well as a waiver of subrogation for Workers' Compensation insurance, shall be received and approved by the City before any work may begin. However, failure to do so shall not operate as a waiver of these Insurance requirements.
City reserves the right to modify or require additional coverages for specific risk exposures depending on scope of CONTRACTORS work.
Minimum coverage is detailed below. The policy limits of coverage shall be made available to the full limits of the policy. The minimum limits stated herein shall not serve to reduce the policy limits of coverage of CONTRACTOR.
Minimum Scope of Insurance - the following forms shall be provided and coverage shall be at least as broad as the following:
1. Insurance Services Office Commercial General Liability coverage (ISO Occurrence Form CG 0001)
2. Insurance Services Office Automobile Liability coverage (ISO Form CA 0001, Code 1, Any Auto) Original and Separate Additional Insured Endorsements for General Liability (ISO Form CG 20 10 11/85 or its equivalent) with primary and non-contributory language.
4. Workers' Compensation insurance as required by the State of California including Employer's Liability (for CONTRACTOR's with employees);
5. Original and Separate Waiver of Subrogation for Workers' Compensatlon Insurance.
6. Fidelity Bond/Crime Coverage - in an amount stipulated by City depending upon scope of contract.
Required Coverage Minimum Limits
Employers Liabiligion and Statutory limits as required by the State of California including $1 million mployers' Liability per accident, per employee for bodily iniury or disease FCONTRACTOR is self-insured, provide a certificate of Permission to Sel Insure, signed by the California Department of Industrial Relations and Self.
Insurance. If contractor Is a sole proprietor (has no emplovees) thar contractor must sign "Contractor Release of Liability" located at:
tp://www.ci.richmond.ca.us/index.aspx?nid=
General Liability ,000,000 per occurrence for bodily injury, personal injury and proper primary and excess limit. damage. If the policy includes a general aggregate, either the general ombinea aggregate shall apply separately to this project, service or location or the Imit $a milloned gregregate limit shall be twice the per occurrence Policy shall also include coverage for liability arising out of the use and peration of any City-owned or City-furnished equipment used or operate y the CONTRACTOR, its personnel, agents or subcontractor. licy shall be endorsed to name the City of Richmond as an addition sured per the conditions detailed beloi
Type 5 - Page 1 of 3
Doriend. Contamhar 2011
DocuSign Envelope ID: 387DE0A6-E450-4D58-84 73BF83010CA DocuSign Envelope ID: B2679106-09D1-4F3B-858C-A5D62F3C5463 _Exhibit F
Section 8
City of Richmond Insurance Requirements - Type 5:
Vendors, Suppliers, Small Grant Recipients & Nonprofit
Organizations
Automobile Liability (If auto Is used.) $1,000,000 per occurrence for bodily Injury and property damage.
Fidelity Bond/Crime Coverage
(Applies if receiving City
funds.)
Required Policy Conditions
Additional Insured Endorsement Applicable to General Liability Coverage. he City of Richmond, its officers, officials, employees, agents and injury, deaths and property damage or destruction arising in any respec directly or indirectly in the performance of this contract ISO form CG 20 10 (11/85) or its equivalent is required. The endorsement must not exclude products and completed operations coverage. If it does, then CG 20 37 (10/01) is also required.
SAMPLE ENDORSEMENT can be found at:
http://www.ci.richmond.ca.us/index.aspx?nid=61.
Walver of Subrogation contractor's insurer will provide a Waiver of Subrogation in favor of the Cit Endorsement Form or Workers' Compensation Insurance providing coverage during the life o this contract.
SAMPLE ENDORSEMENT can be found at
http://www.ci.richmond.ca.us/index.aspx?nid=61.
Primary and Noncontributory The contractor's Insurance coverage must be primary coverage as it pertains to the City, Its officers, officials, employees, agents and volunteers. Any insurance or self insurance maintained by the City is wholly separate from the insurance of the contractor and in no way relleves the contractor from its responsibility to provide insurance
A. M. Best Rating : VII or Better. If the A.M. Best Rating falls below the required rating CONTRACTOR must replace coverage immediately and provide notice to City Deductibles and Self-Insured
Retentions
Contractor is responsible for satisfaction of the deductible and/or self-insured retention for each loss.
Umbrella/Excess Liability Policies
If an Umbrella or Excess Liability Policy is used to meet the liability limits, coverage shall be as broad as specified for underlying coverages and cover those insured in the underlying policies.
Type 5 - Page 2 of 3
Daviend. Contamhar 7011
DocuSign Envelope ID: 387DE0A6-E450-4D58-84 73BF83010CA DocuSign Envelope ID: B2679106-09D1-4F3B-858C-A5D62F3C5463 -Exhibit F
Section 8
City of Richmond Insurance Requirements - Type 5:
Vendors, Suppliers, Small Grant Recipients & Nonprofit
Organizations
Subcontractors
subject to all of the requirements stated herein.
ONTRACTOR agrees to defend and indemnify the City of Richmond for any damage resulting to it from failure o Ither CONTRACTOR or any subcontractor to take out or maintain the required Insurance policies. The fact tha insurance is obtained by CONTRACTOR, andor CONTRACTOR's subcontractors, will not be deemed to release or minish the liability of CONTRACTOR, including, without limitatic the required insurance coverage.
Verification of Coverage
rette ensements shall be received and approved by the City before work may begi The City of Richmond reserves the right to require complete, certified coples of all required insurance policie Including endorsements affecting the coverage at any time. riginal insurance certificates and required policy endorsements shall be mailed or delivered to th esignated Project Manager for the City of Richmon
Insurance certificates and endorsements may be faxed to the Designated Project Manager. However, Contractor must mall the original certificates and endorsements to Designated Project Manager once faxed.
Continuous Coverage
CONTRACTOR shall maintain the required insurance for the life of the contract. Should the CONTRACTOR cease to have insurance as required during this time, all work by the CONTRACTOR pursuant to this agreement shall cease unti insurance acceptable to the City is provided. In the event that CONTRACTOR fails to comply with the City's surance requirements, the City may take such action as it deems necessary to protect the City's interests. Su tion may include but is not limited to termination of the contract, withholding of payments, or other actions the City deems approprlate.
If services or the scope of work extend beyond the expiration dates of the required Insurance pollcies initially approved by the City, CONTRACTOR must provide updated certificates and endorsements indicating that the required coverage, terms and conditions are still in place. Renewal certificates and updated endorsements shall be mailed to the Designated Project Manager.
Cancellation
CONTRACTOR shall ensure that coverage shall not be cancelled, reduced or otherwise materially changed except after thirty (30) days' prior written notice has been given to the City.
Reporting Requirements
Any fallure to comply with reporting or other provisions of the policies Including breaches of warranties shall no affect coverage provided to the City, its officers, officials, employees or volunteers.
Consistent with Public Policy
Type 5 - Page 3 of 3
Daulead. Contamhar 3011
DocuSign Envelope ID: 387DE0A6-E450-4D58-84 73BF83010CA DocuSign Envelope ID: B2679106-09D1-4F3B-858C-A5D62F3C5463 City of Richmond - Manage
Exhibit F-1
The following changes and clarifica Pons are hereby made to Exhibit F:
• Contractor is not obligated to look solely to Contractor's insurance for recovery. Contractor may elect to pay the recovery without u? lizing Insurance. The limita @ons of liability agreed upon in the Special CondiGons override any other representa @on. • The Contractor is authorized to use those proprietary form it possesses which are equivalent" to, the ISO standards referenced in the City's insurance requirements. • The City may not require addi onal coverages or modify the required coverages or amounts beyond those listed in Exhibit F (as modified in this Exhibit F-1). • General Liability: Contractor's limits are $1,000,000 per occurrence, $2,000,000 general aggregate. However, Contractor does have umbrella insurance in the amount of $10,000,000. • Contractor's Crime coverage is $1,000,000 aggregate
• Contractor is not required to make its deducebles, self-insured reten sons subject to the City approval or otherwise grant the City the right to reduce or eliminate the deduc@ bles or self- insured reten @on.
• Any indemnifica & on will only be up to the applicable limita @ons of liability contained in the Special Condions.
• Contractor is not required to provide the City with Contractor's insurance policies. Contractor shall, however, provide the City with the requisite insurance cer ficates and endorsements upon request.
• The sentence that reads "In the event that CONTRACTOR fails to comply with the City's insurance requirements, the City may take such ac @on as it deems necessary to protect the City's interests" in the "Con@nuous Coverage" sec @on of Exhibit Fis hereby stricken. • Contractor and the City agree to replace "material change" with "material diminishment" in the Cancella @on sec @on. Contractor may make changes (such as increasing policy limits, or other changes that would not be relevant to a third party).
DocuSign Envelope ID: 387DE0A6-E450-4D58-84 73BF83010CA DocuSign Envelope ID: B2679106-09D1-4F3B-858C-A5D62F3C5463
CITY OF RICHMOND
Sanctuary City Compliance Statement
iManage LLC
The undersigned, an authorized agent of
"Contractor"), has had an opportunity to review the requirements of City of Richmond Ordinance 12-18 (hereafter "Sanctuary City Contracting Ordinance" or "SCCO"). Contractor understands and agrees that the City may choose with whom it will maintain business relations and may refrain from contracting with any person or entity that provides Data Broker or Extreme Vetting services to the U.S. Immigration and Customs Enforcement Division of the United States Departnent of Homeland Security ("ICE"). Contractor understands the meaning of the following terns used in the SCCO:
a. "Data Broker" means either of the following:
i. The collection of information, including personal information about consumers, from a wide variety of sources for the purposes of reselling such information to their customers, which include both private-sector business and government agencies; ii. The aggregation of data that was collected for another purpose from that for which it is ultimately used.
b. "Extreme Vetting" means data mining, threat modeling, predictive risk analysis, or other similar services."
Contractor understands that it is not eligible to receive or retain a City contract if at the time the Contract is executed, or at any time during the term of the Contract, it provides Data Broker or Extreme Vetting services to ICE.
Contractor further understands and agrees that Contractor's failure to comply with the SCCO shall constitute a material default of the Contract and the City Manager may terninate the Contract and bar Contractor from bidding on future contracts with the City for five (5) years from the effective date of the contract termination.
By executing this Statement, Contractor certifies that it complies with the requirements of the SCCO and that if at any time during the term of the Contract it ceases to comply, Contractor will promptly notify the City Manager in writing. Any person or entity who knowingly or willingly supplies false information in violation of the SCCO shall be guilty of a misdemeanor and subject to a $1,000 Based on the foregoing, the undersigned declares under penalty of perjury under the laws of the State of California that the foregoing is true and correct. Executed this 27th day of June _ 2023, Chicago , California/Illinois at
Clinton M Crosier
Printed Name: _Title: _General counsel, VP. secretary
Clinton Me (rosier 6/27/2023
Signed: Date:
213027473.
iManage LLC
Business Entity:
Vendor SCCO Compliance Statement (Augt2020)