Sacramento City Council
June 24, 2025

City of Sacramento
City Council - 2PM Report
915 I Street Sacramento, CA 95814
www.cityofsacramento.org
File ID: 2025-01266 6/24/2025
Suspension of Competitive Bidding and Contracts for Citywide Content Management System Upgrade [Two-Thirds Vote Required]
File ID: 2025-01266
Location: Citywide
Recommendation: Pass a Motion: 1) suspending competitive bidding by two-thirds vote as it is in the best interests of the City; and 2) authorizing the Interim City Manager or designee to execute: a) supplemental agreement 2022-0446-01 with Generis Enterprise Technology Limited (Generis) to purchase a Software as a Service (SaaS) subscription for the Citywide Content Management System (CCM) for an amount not-to-exceed $787,500 for five (5) years support and maintenance; and b) professional services agreement with Generis to provide one-time upgrade and implementation services for the CCM upgrade for an amount not-to-exceed $292,600.

Contact: Mrudul Sadanandan, Assistant Director, (916) 808-7894, [email protected]; Vijay Mamani, IT Supervisor, (916) 808-5085, [email protected]; Cassy Vaioleti, Program Specialist, (916) 808-8047, [email protected]; Ignacio Estevez, IT Manager, (916) 808-7349, [email protected]; Darin Arcolino, Chief information Officer, (916) 808-0403, [email protected]; Information Technology
Presenter: None.

Attachments:
1-Description/Analysis
2-Professional Service Agreement
3-Supplemental Agreement
Description/Analysis
Issue Detail: In 2008, the IT Department partnered with the City Clerk’s office to implement EMC Documentum as a central repository for document management and EMC Captiva for scanning and digitalization of paper documents, creating the Citywide Content Management System (CCM). This project involved the consolidation of multiple document management systems into a centralized system that provides integration with various enterprise applications like the City’s Finance and Human Resources System (eCAPS) and Department of Utilities (DOU) billing systems. Additionally,

File ID: 2025-01266 6/24/2025
CCM provides a comprehensive solution for digitizing paper documents, advanced document recognition and classification, integration, document security, retention, and supports publication on the city’s website for promoting transparency and reducing Public Records Request (PRA) workload.

Over the last 15 years, the IT Department has implemented transformative projects utilizing CCM to automate and digitize city business processes, such as Accounts Payable (AP) automation, digitalization of employee personnel files, DOU customer billing records, legislative, and contract documents. CCM’s document repository currently holds over 15 million city official documents. Due to the usability limitations of the CCM software offered by Documentum, the city procured CARA software offered by Generis as the front-end application for CCM. The CARA solution was embraced by users and is regularly utilized in the city for day-to-day business operations.

In 2017, OpenText acquired EMC Documentum and redirected their investment towards cloud technologies. Some of the core features and modules were deemed end-of-life while new software products were introduced.

Last year, Generis announced the end of support for CARA’s integration with Documentum by the end of 2024. The city currently does not have a license for the new front-end application from OpenText to replace CARA, and the proposed licensing cost for the OpenText module is not cost effective.

City has relied on an on-premise document management system to store, organize, and retrieve critical business documents. While the current system has served us well for over 17 years, technological advancements and changing business needs require us to upgrade CCM to ensure the seamless continuation of our document management processes.

In negotiations, IT was able to acquire preferred pricing directly from Generis to upgrade from our obsolete CCM to the new cloud-based CARA solution. The software has been updated and repackaged as a SaaS model. This will significantly reduce the cost and will improve functionality and provide enhanced adaptability to future business needs. Additionally, Generis is the sole software provider for the SaaS solution and can provide certified implementation and upgrade services.

Accordingly, staff recommend that the City Council suspend competitive bidding in the best interests of the City and authorize the purchase of Generis CARA products and the implementation services.

Policy Considerations: The requested action is in conformance with the Procurement of Goods and Professional Services Policies regarding the suspension of competitive bidding in the best interests of the City.

Economic Impacts: None.

File ID: 2025-01266 6/24/2025
Environmental Considerations: The report concerns administrative activities that will not have a significant effect on the environment and is exempt from CEQA review [CEQA Guidelines Sections 15061(b)(3); 15378(b)(2)].

Sustainability: Not applicable.

Commission/Committee Action: Not applicable.

Rationale for Recommendation: Replacing the onsite CCM systems with a cloud solution will result in increased efficiency, accessibility, security, and compliance, ultimately contributing to transparency and cost-effectiveness.

Rationale for the migrating to Cloud Document Management:
· Expiring CARA Support to Documentum: The impending expiration of CARA support poses a significant risk to the operational continuity of our document management system. Replacing with a cloud solution ensures ongoing technical support and timely updates to maintain system reliability.
· Enhanced Features: The existing document management system provides limited features, hampering our ability to adapt to the dynamic requirements of our business processes. A cloud -based solution will offer a more robust feature set, improving collaboration, version control, and document accessibility.
· Scalability, Flexibility and Security: Cloud solutions provide scalability and flexibility, allowing us to adjust resources based on demand. This ensures that our document management system can grow seamlessly with our organization, accommodating future needs without requiring significant modifications. The Cloud system will offer built-in redundancy and backup solutions, ensuring continuity of operations in case of unforeseen disasters or system failures. · Enhanced Accessibility: Cloud-based system will enable access to documents from any location and device with an internet connection, fostering collaboration among remote teams, clients, and partners.

Financial Considerations: No additional funding is required. Sufficient funding to purchase the annual software subscription services is available in Citywide IT Maintenance and Support Budget (80001090), and funding to purchase the one-time implementation and upgrade services is available in the Digital Strategy Project (A07000700).

Local Business Enterprise (LBE): Not applicable.

CARA First Amendment – CARA Saas Agreement

City Agreement No. 2022-0446-1

FIRST AMENDMENT OF
CITY AGREEMENT NO. 2022-0446
(CITY AGREEMENT NO. 2022-0446-1)

This First Amendment (the “Amendment”) of City Agreement No. 2022-0446 is by and between the City of Sacramento (“City” or “Customer” ), a charter city and municipal corporation of the state of California, and Generis Enterprise Technology Limited (“Generis”), a company registered in England and Wales with number 09870241 with its registered office at 71-75 Shelton Street, London, WC2H 9JQ (“Generis”) on ______________ (the “Effective Date”). The City and Generis, hereinafter may also be referred to separately as a “Party” or together as the “Parties.” This Amendment hereby supplements and modifies the Agreement to add certain subscriptions described herein on the basis of and subject to the terms and conditions set out in this Amendment including its annexes and order form(s).

RECITALS
Whereas, the Parties entered into City Agreement No. 2022-0446 (the “Agreement”) certain Generis software, described in that agreement.

Whereas, Customer wishes to use additional subscription services, namely, Generis’ CARA Life Sciences Platform as a service, a hosted software as a service subscription.

Whereas, Generis wishes to provide Customer with this subscription service.

AGREEMENT

NOW, THEREFORE, in consideration of the mutual agreements contained herein, and other good and valuable consideration, the receipt and sufficiency of which are hereby acknowledged, Customer and Generis hereby agree as follows:

TERMS AND CONDITIONS

In this Amendment any capitalised terms have the meaning ascribed to them in the clauses herein.

1. SERVICES AND SUPPORT

1.1 Generis will provide Customer with access through the internet to the services detailed more specifically in the Order Form (“Services”) substantially in the format in Appendix 7 to this Amendment during the Term.

Generis will perform the Services substantially in accordance with the Documentation ans with reasonable skill and care. The Services are provided on an “as-is” basis.

1.2 Generis shall use commercially reasonable efforts to make the Services available for at least 99.5% of the time except for planned or unplanned maintenance being carried out. (a) Planned maintenance will be carried out up to three (3) times annually for a duration of up to eight (8) hours each outside of core business hours in City’s time zone (PST) Generis will communicate any planned maintenance one month in advance of the maintenance window. If Customer has a significant business reason to object to the timing of the maintenance window, the Customer has to notify Generis within one (1) week of Generis’ communication in order to agree a mutually agreeable maintenance window.
(b) Unplanned maintenance, including but not limited to emergency maintenance and security patching, will be performed outside of core business hours the City’s time zone (PST) provided that Generis has used reasonable endeavours to give the Customer at least four (4) normal business hour’s notice in advance.

CARA First Amendment – CARA Saas Agreement

City Agreement No. 2022-0446-1

1.3 Generis will provide up to three (3) upgrades to the system annually, communicated a month in advance with the Customer and subject to mutual agreement on the dates. Customer can choose to delay or skip releases, up to a maximum of up to a maximum of three consecutive releases. Generis will notify the Customer of the supported dates of the particular versions implemented. The features and functionality of the Services may be modified from time to time at Generis’ sole discretion, provided that the security of the Services shall not be reduced. Generis will use reasonable commercial efforts to give Customer one (1) month prior written notice of any planned material modification to the features and functionality of the Services. Not included in the periodic modifications or upgrades are bespoke Customer configurations.

Modifications and upgrades to such configurations are subject to a separate service agreement and will be chargeable at Generis’ applicable consulting service rates.

1.4 If the Services do not conform with the terms of clause 1.1, Generis will, at its expense, use reasonable commercial efforts to correct any such non-conformance promptly. Such correction constitutes the Customer's sole and exclusive remedy for any breach of Generis’ obligation to provide the Services.

1.5 Generis’ shall be relieved of its obligation to provide the Services to the extent that any non-conformance is caused by:
(a) use of the Services contrary to Generis’ instructions, or (b) any modification or alteration of the Services by any party other than Generis or its duly authorized contractors or agents.

1.6 Generis will provide support for the Services to Customer as detailed in the Appendix – CARA Cloud Support.

1.7 Generis has no obligation to monitor the content provided by Customer or Customer’s use of the Services.

However, Generis is entitled to monitor the Customer’s use of the Service and may remove any content or prohibit any use of the Services it believes may be (or alleged to be) in breach of the Agreement.

2. SUBSCRIPTIONS

2.1 The Customer shall give access to the number of licensed users specified in the Order Form to use the Services and any related documentation for its own internal business operation.

2.2 The Customer may, from time to time during any Service Term, request to purchase additional licensed user subscriptions in excess of the number set out in the Order Form and Generis shall grant access to the Services and the related documentation to such additional users in accordance with the terms of this Amendment, subject to agreement of an amended Order Form.

2.3 Generis has the right to monitor user numbers and raise with the Customer any discrepancies between the number of licensed users and actual user numbers at any time. Should the number of actual users exceed the number of licensed users in two consecutive months or in four months of any rolling six-month period, Generis shall be entitled to invoice the Customer the license fee for such additional users proptionately to the fee rate agreed in the Order Form.

3. LICENCE

3.1 Generis hereby grants to the Customer a non-exclusive, non-transferable right and license, without the right to grant sublicences, to permit the number of licensed users to use the Services and the related documentation during the Term solely for the Customer's internal business operations.

3.2 The licence is restricted to use by Customer and its licensed users and does not include the right to use the Services on behalf of any third party or to provide services to any third party.

4. CUSTOMER’S RESPONSIBILITIES AND RESTRICTIONS

4.1 The Customer is responsible for procuring, maintaining and securing the network, internet and telecommunications connections that connect the Customer to the Services and ensure that its network and systems comply with any relevant specifications provided by Generis from time to time.

CARA First Amendment – CARA Saas Agreement

City Agreement No. 2022-0446-1

4.2 The Customer is responsible for obtaining and shall maintain all necessary licences, consents, and permissions necessary for Generis, its contractors and agents to perform their obligations under this Amendment, including without limitation the Services.

4.3 Customer will cooperate with Generis in connection with the performance of this Amendment. The Customer will make available such personnel and information as may be reasonably required and taking such other actions as Generis may reasonably request.

4.4 Customer is responsible for maintaining the security of the Customer account, passwords (including but not limited to administrative and user passwords) and files, and for all uses of Customer account with or without Customer’s knowledge or consent. Customer will cooperate with Generis in establishing a password and/or other procedures for verifying that only designated employees of Customer have access to administrative functions of the Services.

4.5 Customer assumes sole responsibility for any results obtained from its use of the Services and the Documentation, and for any conclusions drawn from such use.

4.6 Generis is permitted to disclose that Customer is one of its customers to any third-party, in its promotional material and on its website at its sole discretion, and Customer agrees to participate in Linkedin announcements, case studies, presentations, or other forms of publicity reasonably requested by Generis.

Such participation has been factored into the price reductions provided as part of this Amendment.

4.7 Customer will not, and will not permit any third party to:
(a) reverse engineer, decompile, disassemble or otherwise attempt to discover the source code, object code or underlying structure, ideas or algorithms of the Services or any software, documentation or data related to the Services or related software, described herein, (“Software”) other than permitted by applicable law;
(b) modify, translate, or create derivative works based on the Services or Software; or (c) use the Services or Software other than in accordance with this Amendment and in compliance with all applicable laws and regulations, intellectual property, consumer and child protection, obscenity or defamation.

5. PAYMENT OF FEES

5.1 Customer will pay Generis the subscription fees as set forth on the Order Form (the “Fees”). The Customer will further pay any additional fees invoiced as provided for in clause 2.3. Customer will pay Generis for any additional services, within the scope of this Amendment, such as integration fees or other consulting fees as provided in an Order Form.

5.2 All payments will be due within thirty (30) days of Customer’s receipt of the invoice and made in accordance with the payment schedule detailed in the Order Form and the method of payment specified in the invoice.

5.3 Unpaid Fees that are not subject to a good faith dispute are subject will incur a charge of one percent (1.0%) above the Bank of England base lending rate per month, or the maximum interest charge permitted by law, whichever is lower, plus all expenses of collection, including reasonable attorneys’ fees. Customer will give Generis notice if it is disputing certain Fees and the reasons for such dispute within the payment period of the relevant invoice. Without affecting any other right or remedy available to it, Generis shall have the right to suspend the access to the Services and the Software if the Customer fails to pay any amount due and within thirty (30) days from being notified by Generis that a payment is overdue. If the Customer remains in default not less than thirty (30) days after being notified to make such payment, Generis is entitled to terminate the Agreement for material breach in accordance with clause 8.2.

5.4 Fees under this Amendment are exclusive of all taxes, including national, state or provincial and local use, sales, value-added, property and similar taxes, if any. Customer agrees to pay such taxes (excluding US taxes based on Generis’ net income) unless Customer has provided Generis with a valid exemption certificate. In

CARA First Amendment – CARA Saas Agreement

City Agreement No. 2022-0446-1
the case of any withholding requirements, Customer will pay any required withholding itself and will not reduce the amount paid to Customer on account thereof.

5.5 Generis reserves the right to adjust the Fees annually with effect from the anniversary of the Effective Date in line with percentage increase reflected in the Consumer Price Index (CPI) during the previous twelve-month period or by up to 3%, whichever is the higher. Generis will give no less than one month’s notice in writing of the proposed changes.

6. CONFIDENTIALITY

6.1 “Confidential Information” means all information disclosed by a party (“Disclosing Party”) to the other party (“Receiving Party”), whether orally or in writing, that is designated as confidential or that reasonably should be understood to be confidential given the nature of the information and the circumstances of disclosure.

Each Party may disclose Confidential Information to the other Party during of the Term of this Agreement.

6.2 Each Party agrees that it shall:
(a) only use the Confidential Information for the purposes of this Agreement, (b) not divulge any Confidential Information of the other Party to any third person, (c) give access to Confidential Information only to those employees and contractors with a need to have access thereto for purposes of this Agreement, and
(d) take the same security precautions to protect against disclosure or unauthorized use of Confidential Information that it takes with its own Confidential Information.

6.3 The restrictions in this clause 6 will not apply with respect to any information that the Parties agree in writing is not confidential or may be disclosed or that the Receiving Party can document (a) is or becomes generally available to the public without any action by, or involvement of, the Receiving Party, or
(b) was in its possession or known by it prior to receipt from the Disclosing Party, or (c) was rightfully disclosed to it without restriction by a third party, or (d) was independently developed without use of any Confidential Information of the Disclosing Party.

6.4 Nothing in this Agreement will prevent the Receiving Party from disclosing the Confidential Information pursuant to any judicial or governmental order, provided that the Receiving Party gives the Disclosing Party reasonable prior notice of such disclosure to contest such order.

6.5 Both Parties will have the right to disclose the existence but not the terms and conditions of this Agreement, unless such disclosure is approved in writing by both Parties prior to such disclosure, or is included in a filing required to be made by a Party with a governmental authority (provided such party will use reasonable efforts to obtain confidential treatment or a protective order) or is made on a confidential basis as reasonably necessary to potential investors or acquirers.

7. INTELLECTUAL PROPERTY RIGHTS

7.1 The Customer acknowledges and agrees that Generis owns all intellectual property rights relating to the Services, the Software and any related documentation. Any suggestions, ideas, enhancement requests, feedback, recommendations or other information provided by Customer or any third party relating to the Service and/or the Software are hereby assigned to Generis.

7.2 Customer will not copy, distribute, reproduce or use any of the foregoing except as expressly permitted under this Agreement. This Agreement is not a sale and does not convey to Customer any rights of ownership in or related to the Service or Software, or any intellectual property rights.

7.3 Customer owns all right, title and interest in and to all data, information, and other materials submitted or made available by Customer to the Services (“Customer Data”). Customer hereby grants to Generis and its CARA First Amendment – CARA Saas Agreement

City Agreement No. 2022-0446-1
contractors a worldwide, non-exclusive, nontransferable, royalty-free license to use, copy, store, archive, access, process, creative derivative works of, reproduce, perform, display, modify, distribute and transmit Customer Data for the purposes of providing the Services to Customer.

8. TERM and TERMINATION

8.1 This Service Agreement comes into force on the Effective Date and shall continue for the Service Term specified in the Order Form. The Service Term will automatically be renewed for successive periods of one (1) year (a “Renewal Term”) unless the Customer gives at least ninety (90) days’ notice prior to the end of the Service Term or any Renewal Term that it wants to terminate the Agreement. The Fees for a Renewal Term shall be based on the Generis list price for the Service at the effective date of the renewal, unless agreed otherwise in writing by the Parties prior to the commencement of the Renewal Term. The Service Term together with any Renewal Term are defined as the “Term”.

8.2 Without affecting any other right or remedy available to it, either Party may terminate this Agreement with immediate effect by giving written notice to the other party if:
(a) the other party commits a material breach of any other term of this agreement and (if such breach is remediable) fails to remedy that breach within a period of sixty (60) days after being notified to do so; (b) becomes the subject of a petition in bankruptcy or any other proceeding relating to insolvency, receivership, liquidation or assignment for the benefit of creditors; (c) there is a change of control of the other party which adversely affects the terminating Party.

8.3 In the event that this Agreement is terminated by the Customer in accordance with clause 8.2, Error! Reference source not found. Generis will proportionally refund any prepaid Fees covering the remainder of the Term of the relevant Order Form(s) from the effective date of termination. If the Agreement is terminated by Generis in accordance with clause 8.2, the Customer will pay any unpaid Fees covering the remainder of the Term of all Order Forms affected by the termination. In no event will termination relieve the Customer of its obligation to pay any Fees payable to Generis prior to the effective date of termination.

8.4 All sections of this Service Agreement which by their nature should survive termination will survive termination, including, without limitation, restrictions, accrued rights to payment, confidentiality obligations, intellectual property rights, warranty disclaimers, indemnification and limitations of liability.

8.5 On termination of this Agreement for any reason:
(a) all licences granted under this Agreement shall immediately terminate and the Customer shall immediately cease all use of the Services and/or the Software; (b) any rights, remedies, obligations or liabilities of the parties that have accrued up to the date of termination, including the right to claim damages in respect of any breach of the agreement which existed at or before the date of termination shall not be affected or prejudiced; (c) Generis will use commercially reasonable efforts to remove and delete all Customer Data from the Service as outlined in Appendix Exit Management.

9. WARRANTIES

9.1 Each Party warrants to the other that it has the legal right and authority to enter into an perform its obligations under this Agreement.

9.2 Generis warrants that it has and will maintain all licences, consents and permissions necessary for the performance of its obligations under this Agreement.

9.3 Except as expressly stated in this Agreement, Generis does not make any express or implied warranty or representations with regard to the Services and the performance of its obligations under this Agreement. In particular, Generis excludes any warranty as to fitness for a particular purpose. All further warranties,

CARA First Amendment – CARA Saas Agreement

City Agreement No. 2022-0446-1
representation, conditions and all other terms of any kind implied by statute or common law are, to the fullest extent permitted by law, excluded from this Agreement.

9.4 The Customer represents and warrants that it has (or has obtained) the right to provide the Customer Data and such Customer Data does not infringe or misappropriate any third party rights.

10. DATA PROTECTION

10.1 Each Party shall comply with its obligations under the applicable Data Protection Laws and the Data Processing Appendix.

10.2 If Customer implements integrations with 3rd party tools including but not limited to Artificial Intelligence engines, Translation engines, publishing software, Generis will not be responsible for the security of the data in those 3rd party tools OR the transfer of the data to/from CARA to those 3rd party tools unless the integration leverages the HTTPS as part of the CARA API. Customer is responsible for ensuring the selection of the appropriate tools which provide the desired levels of data privacy and protection with those 3rd parties when entering into contracts to use them.

11. SOFTWARE SECURITY

11.1 Generis will not knowingly include, in any Generis Software provided to Customer hereunder, any computer code or other computer instructions, devices or techniques that intentionally disrupt, disable, harm, infect, defraud, damage, or otherwise impede in any manner, the operation of a network, computer program or computer system or any component thereof, including its security or user data.

11.2 Where Customer is contractually authorised on the basis of the Service described in the Order Form to elect when upgrades are implemented as part of the support services provided by Generis, Customer acknowledges that, if they do not implement any upgrades within the once-a-year period recommended by Generis, and particularly if they do not upgrade their version before the communicated end of its support date, Customer acknowledges that it shall be solely responsible for any potential security flaws which would otherwise be addressed in such upgrade newer versions of the Software. Generis shall not be liable to the Customer for any security breaches arising from such flaws.

11.3 Customer acknowledges that its responsibility under clause 4.4 above regarding the management of user accounts on their environments, including best practices of periodic review for access, limited use of Inline accounts and other such measures (implementation of MFA for example) is material for the security of the Services and the Software.

12. LIMITATION OF LIABILITY

12.1 Nothing in this agreement excludes the liability of either Party:
(a) for death or personal injury caused by the such Party's negligence; or (b) for fraud or fraudulent misrepresentation.

12.2 Subject to clause 12.1, Generis, its agents, Affiliates, licensors or suppliers shall have no liability to the Customer for any:
(a) loss of profits,
(b) loss of business,
(c) loss of wasted expenditure
(d) depeletion of goodwill and/or any similar loss
(e) loss or corruption of data or information, or
(f) any special, indirect or consequential loss, costs, damages, charges or expenses.

Generis will not be liable for any loss resulting from a cause over which it does not have direct control.

CARA First Amendment – CARA Saas Agreement

City Agreement No. 2022-0446-1

12.3 Generis’ total aggregate liability to the Customer, including in respect of any indemnity granted in this Agreement, whether in contract, tort (including negligence), misrepresentation or otherwise, shall not exceed the higher of £1,000,000 (one million Pounds) or the amount of Fees paid to Generis by the Customer in the twelve (12) month period preceding the date that a claim is first made.

12.4 Nothing in this Agreement excludes or limits the Customer’s liability for any breach, infringement or misappropriation of Generis’ Intellectual Property Rights.

13. INDEMNITY

13.1 Generis shall defend the Customer, its officers, directors and employees against any claim that the Customer's use of the Services or Documentation in accordance with this agreement infringes any United Kingdom patent effective as of the Effective Date, copyright, trade mark, database right or right of confidentiality, and subject to the limitation in clause 12.2, shall indemnify the Customer for any amounts awarded against the Customer in judgment or settlement of such claims, provided that:
(a) Generis is given prompt notice of any such claim;
(b) the Customer does not make any admission, or otherwise attempt to compromise or settle the claim and provides reasonable co -operation to the Generis in the defence and settlement of such claim, at the Generis’ expense; and
(c) Generis is given sole authority to defend or settle the claim.

13.2 Generis may, in the defence or settlement of any claim, procure the right for the Customer to continue using the Services, replace or modify the Services so that they become non -infringing or, if such remedies are not reasonably available, terminate this agreement on two (2) Business Days' notice to the Custom er without any additional liability or obligation to pay liquidated damages or other additional costs to the Customer , provided that Generis promptly refunds to Customer the proportionately of any unearned pre-paid Fees paid hereunder for the affected Services.

13.3 In no event shall Generis, its employees, agents and sub-contractors be liable to the Customer to the extent that the alleged infringement is based on:
(a) products, services, technology, materials or data not created or provided by Generis (including an y Customer Data) or use in connection or combination with such products, services, technology, materials or data not created or provided by Generis (where the alleged damages, costs or expenses arise from or relate to such combination);
(b) modification of the Services or Software by anyone other than Generis, modifications made after delivery by Generis or any part of the Services made in whole or in part in accordance with Customer specifications; or
(c) the Customer's use of the Services or Documentation in a ma nner contrary to the instructions given to the Customer by Generis; or
(d) the Customer's use of the Services is not strictly in accordance with this agreement.

13.4 The above clauses 13.1, 13.2 and 13.3 state the Customer's sole and exclusive rights and remedies, and Generis’ (including Generis’ employees', agents' and sub -contractors') entire obligations and liability, for infringement of any patent, copyright, trade mark, database right or right of confidentiality.

13.5 The Customer shall defend, indemnify and hold harmless Generis against claims, actions, proceedings, losses, damages, expenses and costs (including without limitation court costs and reasonable legal fees) arising out of or in connection with the Customer's use of the Services, the Customer’s obligations as well as warranties , provided that:
(a) the Customer is given prompt notice of any such claim;

CARA First Amendment – CARA Saas Agreement

City Agreement No. 2022-0446-1
(b) the Supplier provides reasonable co-operation to the Customer in the defence and settlement of such claim, at the Customer's expense; and
(c) the Customer is given sole authority to defend or settle the claim.

14. EXPORT COMPLIANCE

14.1 The Services and or the Software, other Generis technology and derivatives thereof may be subject to export laws, regulations and other restrictions of EU, the United Kingdom, or the United States of America.

Customer and Generis each represents that it is not on any U.S. government denied-party list. Customer may not provide to any person or entity or export or re-export or allow or permit the export or re-export of the Services or any software or anything related thereto or any direct or indirect product thereof in violation of any current or future restrictions, laws or regulations of the EU, the United Kingdom, or the United States of America.

14.2 Customer acknowledges and agrees that the Services or the Software, any other Generis technology and derivatives thereof will not be used or transferred or otherwise exported or re-exported to countries as to which the EU, United Kingdom or United States currently or in the future maintains a comprehensive embargo, or which maintains sanctions, restrictions of prohibitions which impact on the legality of the provision of the Controlled Subject Matter (collectively, “Embargoed Countries”), or to or by a national or resident thereof, or any person or entity, or any entity which is 50% or more owned or in any way controlled by any person or entity on the embargo or sanctions lists of the EU, United Kingdom or the United States of America . The lists of Embargoed Countries and Designated Nationals are subject to change without notice.

Use of the Service is a present and ongoing representation and warranty that the user is not located in, under the control of, or a national or resident of an Embargoed Country or Designated National. Any breach of this clause will entitle Generis to immediately terminate the Agreement and Customer will indemnify Generis in respect of any direct and indirect losses which Generis suffers as a result of Customer’s breach.

15. BUSINESS CONTINUITY AND SECURITY
Generis will provide the security and business continuity services as listed in the Appendix – Business Continuity and Security.

16. FORCE MAJEURE
Neither party shall be in breach of this Agreement or otherwise liable for any failure or delay in the performance of its obligations if such delay or failure results from events, circumstances or causes beyond its reasonable control.

The time for performance of such obligations shall be extended accordingly. If the period of delay or non- performance continues for three months, the party not affected may terminate this agreement by giving 15 days’ written notice to the affected party.

17. ENTIRE AGREEMENT and VARIATION
All Other Terms Remain in Force. Except as modified by this Amendment, the terms of the Agreement remain unchanged. If there is any inconsistency between the Agreement and this Amendment, the terms of this Amendment control.

18. MISCELLANEOUS

18.1 Severability. If any provision of this Agreement is found to be unenforceable or invalid, that provision will be limited or eliminated to the minimum extent necessary so that this Agreement will otherwise remain in full force and effect and enforceable.

CARA First Amendment – CARA Saas Agreement

City Agreement No. 2022-0446-1

18.2 Assignment. Except as expressly stated in this Agreement, neither party may otherwise assign this Agreement or any of its rights or obligations hereunder either in whole or in part without the prior written consent of the other party, and any attempted assignment or delegation without such consent will be void. Notwithstanding the foregoing, either party may assign this Agreement as part of a corporate reorganization, consolidation, merger, or sale of all or substantially all of its assets or business to which this Agreement relates.

18.3 Notices. All notices under this Agreement will be in writing and will be deemed to have been duly given when received, if personally delivered; when receipt is electronically confirmed, if transmitted by facsimile or e-mail; and upon receipt, if sent by certified or registered mail (return receipt requested).

Generis will receive notices at [email protected] for all matters relating to this Agreement.

Customer will receive notices at the email address City staff provides for all matters relating to this Agreement.

18.4 Relationship of the Parties. No agency, partnership, joint venture, or employment is created as a result of this Agreement and neither party has any authority of any kind to bind the other party in any respect whatsoever.

18.5 Governing law, jurisdiction and dispute resolution. This Agreement is governed by the laws of England and Wales. The courts of England and Wales will have exclusive jurisdiction with respect to any disputes arising out of or in connection with this agreement or its subject matter or formation. Prior to addressing any court the Parties will seek to resolve any dispute by mediation in accordance with the CEDR Model Dispute Resolution Procedure. The venue for any mediation will be London.

SIGNATURES
City of Sacramento

Signature:

Date:

Name:

Job Title:

Generis Enterprise Technology Limited

Signature:

Date:

Name:

Job Title:

APPROVED AS TO FORM:

ATTEST BY:

Jun 9, 2025

JAMES KELLEHER
CEO
Audreyell Anderson-White
Sr. Dep. City Attorney
Jun 9, 2025

CARA First Amendment – CARA Saas Agreement

City Agreement No. 2022-0446-1

ORDER FORM
FOR GENERIS SOFTWARE AS A SERVICE (SaaS)

Services: CARA Software as a Service
Service Term: The Services will be provided for five (5) years starting on the date of contractual sign off of this contract. After the end of the Initial Term, this Agreement will automatically renew for successive renewal terms of one (1) year (each, a “Renewal Term”, and together with the Initial Term, the “Service Term”) unless either party gives the other party notice of non-renewal at least ninety (90) days prior to the end of the then-current term.

Services: CARA Software Subscription
Number of authorized users: 5.000
Yearly CARA Subscription Fee: $ 150,000 Excluding Elastic – PROD-DEV Yearly 5TB: $ 7,500 (10TB in total)

Total Yearly Fee: $ 157,500

Five (5) - Year Total: $787,500

Hosting: The software underlying the Services will be hosted on a server under the control or direction of Generis.

Payment Schedule: Annual invoice issued upon execution of this Agreement; Net 30

Subscription: From contractual sign off / $ 157,500
Method of
Payment:

Wire transfer
The customer must provide a list of users who will get notifications for product releases, and ensure that going forward they maintain at least one such contact in our support database at all times to get such notifications.

Appendix 1 – Business
Continuity and Security

The following security and business continuity
services will be provided.

Cloud Operations
• Managed Service Partners and
Global Standard Infrastructure
Generiss
Generis works with industry leading tools to provide
24x7x365 support for your infrastructure. Generis
utilises leading global infrastructure as a service
platform such as Amazon Web Services (AWS),
Microsoft Azure and Google Cloud Platform (GCP) to
CARA SaaS Agreement

provide world class standards of scalability, security
and availability.
• Monitoring
As a part of our Cloud Operations services, Generis
will provide monitoring services for your
infrastructure.

• Infrastructure alarms based on defined
thresholds will be configured with automatic
notification of the managed services team when
thresholds are breached. An automated job
runs every 30 minutes to ensure that the
configured alarms are in a desired state as
defined by the configuration file. This recurring
job will overwrite any manual changes that are
made to the alarms it has created in order to
ensure proper functionality.
• The monitoring system will scan your
environment every minute. If a metric violates
its threshold, the service will create an alarm.

The alarm automatically notifies the managed
services team who will take action to address
any issue identified.
• Intrusion Detection
Generis runs intrusion detection and prevention
software 24/7/365. This performs vulnerability
scanning that finds cyber security weaknesses in
cloud systems, which we then remedy.
• Black Duck
Generis uses Black Duck Software to ensure open-
source security and license compliance in our
applications and containers.
• Backups and Disaster Recovery
/ Restore
Generis provides automated backup, retention, and
data lifecycle management services on your
infrastructure. During the project implementation,
Generis will set up recurring backups, scheduling,
and retention lifecycle policies. Our system allows
for snapshots, Machine Images, cross-region, and
multi-account backup replication. Our Backups
system functions via a region-based Lambda
function that runs on the master account. This
function triggers step functions that perform
snapshot and AMI backups, verify the success of
those backups and delete those backups at the end
of their lifecycle.

Disaster recovery / restore is done from the
backups.

Customizing Your Backups
Generis can customize your backups to fulfil various
business needs. The frequency of backups can be
changed between hourly, daily, monthly, or
annually. The retention of backups can be
customized as well. Generis standard is hourly
backups saved for 14 days and daily backups saved
for 90 days.
• Patching
Generis configure your system to include
Automated Patching, which allows for the
scheduling, execution, and validation of Operating
System updates. The system scans your
infrastructure, detects available updates, alerts us to the details of these updates, applies and validates
them, rolling back to previous versions as necessary.

Patches are applied during Maintenance Windows
using a strategy that maximizes uptime by validating
patching on lower level (development / test)
environments and making use of High- Availability
wherever possible.

CARA SaaS Agreement

• Data Loss Prevention
Data Loss Prevention (DLP) provides a series of
configurable notifications and optional restrictions
to address potential data loss. DLP includes:
• Take measures to protect your data like real-
time notifications, proactive blocking, and data
quarantine
• Automatically configure risk auditing and
infrastructure optimisation
• Enforce best practices for storage including IAM,
Security Groups, Encryption, and Networking
settings
• Notify me when Access Keys are exposed
• Notify me when objects are stored unencrypted
• Notify me when objects are publicly accessible
in non-public buckets
• Remove public access from objects in non-public
buckets
• Security Monitoring
We will manage the installation, maintenance,
monitoring, and remediation of security data
produced by automated alert systems. Security
monitoring software will be installed in your
environment to all communication between
instances.

Intrusion Detection
Intrusion Detection System (IDS) monitors attempts
to log in to your infrastructure resources and
reports each incident including a risk level. IDS is
automatically integrated with our Managed Services
Generis and will alert security threats in real time.

Event Logs
Event logs generated by instances in your
environment are reviewed and unexpected events
assessed.

• Infrastructure Security
software
Generis will install, maintain, and manage security
software in your environment, providing the
following:

Deep Security & File Integrity Monitoring
The Deep Security package detects and alerts on
unauthorized, malicious or out of policy changes to
OS and application files (directories, registry keys &
values).

Antivirus & Anti-Malware
Antivirus / Anti-Malware protects against the
installation of malware and viruses (including when
users inadvertently import content which might be
infected) on your environment that can be used to
attack systems and steal data.

Network Security Package
A host-based Intrusion Prevention System (IPS)
examines all incoming and outgoing traffic for
protocol deviations, policy violations, or content
that signals an attack and automatically protects
against known but un-patched vulnerabilities by
virtually patching (shielding) them from an unlimited
number of exploits, pushing protection without a
system reboot.
• Multi-Factor Authentication via
DUO Security
Generis configures multi-factor authentication
(MFA) at specific points in your environment. This is
installed on all components that require MFA to
protect your users.

CARA SaaS Agreement

Appendix 2 - Generis’
Acceptable Use Policy
Generis Acceptable Use Policy
This Acceptable Use Policy (this “Policy”) describes
prohibited uses of the web services offered by
Generis and its affiliates (the “Services”) and the
Cloud hosted CARA services provided by Generis
(the “Generis Cloud”). The examples described in
this Policy are not exhaustive. We may modify this
Policy at any time by posting a revised version on
the Generis Cloud. By using the Services or accessing
the Generis Cloud, you agree to the latest version of
this Policy. If you violate the Policy or authorize or
help others to do so, we may suspend or terminate
your use of the Services. This Policy is based on the
AWS Acceptable Use Policy since we are using the
AWS Infrastructure.

No Illegal, Harmful, or Offensive Use or Content
You may not use, or encourage, promote, facilitate
or instruct others to use, the Services or Generis
Cloud for any illegal, harmful, fraudulent, infringing
or offensive use, or to transmit, store, display,
distribute or otherwise make available content that
is illegal, harmful, fraudulent, infringing or offensive.

Prohibited activities or content include:
• Illegal, Harmful or Fraudulent Activities. Any
activities that are illegal, that violate the
rights of others, or that may be harmful to
others, our operations or reputation,
including disseminating, promoting or
facilitating child pornography, offering or
disseminating fraudulent goods, services,
schemes, or promotions, make-money-fast
schemes, Ponzi and pyramid schemes,
phishing, or pharming.
• Infringing Content. Content that infringes or
misappropriates the intellectual property or
proprietary rights of others.
• Offensive Content. Content that is
defamatory, obscene, abusive, invasive of
privacy, or otherwise objectionable, including
content that constitutes child pornography,
relates to bestiality, or depicts non-
consensual sex acts.
• Harmful Content. Content or other computer
technology that may damage, interfere with,
surreptitiously intercept, or expropriate any
system, program, or data, including viruses,
Trojan horses, worms, time bombs, or
cancelbots.

No Security Violations
You may not use the Services to violate the security
or integrity of any network, computer or
communications system, software application, or
network or computing device (each, a “System”).

Prohibited activities include:
• Unauthorized Access. Accessing or using any
System without permission, including
attempting to probe, scan, or test the
vulnerability of a System or to breach any
security or authentication measures used by
a System.
• Interception. Monitoring of data or traffic on
a System without permission.
• Falsification of Origin. Forging TCP-IP packet
headers, e-mail headers, or any part of a
message describing its origin or route. The
legitimate use of aliases and anonymous
remailers is not prohibited by this provision.

No Network Abuse
You may not make network connections to any
users, hosts, or networks unless you have
permission to communicate with them. Prohibited
activities include:
• Monitoring or Crawling. Monitoring or
crawling of a System that impairs or disrupts
the System being monitored or crawled.
• Denial of Service (DoS). Inundating a target
with communications requests so the target
either cannot respond to legitimate traffic or
CARA SaaS Agreement

responds so slowly that it becomes
ineffective.
• Intentional Interference. Interfering with the
proper functioning of any System, including
any deliberate attempt to overload a system
by mail bombing, news bombing, broadcast
attacks, or flooding techniques.
• Operation of Certain Network
Services. Operating network services like
open proxies, open mail relays, or open
recursive domain name servers.
• Avoiding System Restrictions. Using manual
or electronic means to avoid any use
limitations placed on a System, such as
access and storage restrictions.

No E-Mail or Other Message Abuse
You will not distribute, publish, send, or facilitate
the sending of unsolicited mass e-mail or other
messages, promotions, advertising, or solicitations
(like “spam”), including commercial advertising and
informational announcements. You will not alter or
obscure mail headers or assume a sender’s identity
without the sender’s explicit permission. You will
not collect replies to messages sent from another
internet service Generis if those messages violate
this Policy or the acceptable use policy of that
Generis.

Our Monitoring and Enforcement
We reserve the right, but do not assume the
obligation, to investigate any violation of this Policy or misuse of the Services or Generis Cloud. We may:
• investigate violations of this Policy or misuse
of the Services or Generis Cloud; or
• remove, disable access to, or modify any
content or resource that violates this Policy
or any other agreement we have with you for
use of the Services or the Generis Cloud.

We may report any activity that we suspect violates
any law or regulation to appropriate law
enforcement officials, regulators, or other
appropriate third parties. Our reporting may include
disclosing appropriate customer information. We
also may cooperate with appropriate law
enforcement agencies, regulators, or other
appropriate third parties to help with the
investigation and prosecution of illegal conduct by
providing network and systems information related
to alleged violations of this Policy.

Reporting of Violations of this Policy
If you become aware of any violation of this Policy,
you will immediately notify us and provide us with
assistance, as requested, to stop or remedy the
violation. To report any violation of this Policy,
please email [email protected]

CARA SaaS Agreement

Appendix 3 - CARA Cloud Support - Service Level Agreement (SLA)

Issue
Severity
Issue
Definition
First
Response
Critical
A critical production issue affecting all users with no workaround e.g.
• Production system used to provide the Services is not available
• A high-risk production security issue has been identified or there are data integrity issues
• A production issue affecting a large number of users who cannot perform a business-critical task
1 hour
24x7x365
High
• Major functionality is impacted, or significant
performance degradation is experienced, in a persistent manner and affecting many users; and there is no
reasonable workaround
4 Business
Hours
Medium • Standard functional or performance issue affecting some but not all users. A workaround is available
1 Business
Day
Low
• Minor functional or performance issue affecting a small number of users, and a workaround is available
• Enhancement requests
• Non-technical requests
2 Business
Days
For the purposes of this Agreement, the following terms have the following meanings:
'Business Day' means any day (other than a Saturday or Sunday) when banks are generally open for normal business in the City of London.
'Business Hours' means: 9am to 6pm GMT on a Business Day. 'Response' means providing a response to the Customer via the standard support channels.

Issue logging
Customer will log issues with Generis using the channel(s) provided to the Customer for such items (currently an online ticketing system) which may change from time to time. All updates will be given via this system.

CARA SaaS Agreement

The Escalation Process:

If an issue needs to be escalated where it has not been addressed or resolved in accordance with this SLA, the issue may be escalated for resolution to Generis in accordance with the following escalation path, and Generis will ensure that issues that are escalated are resolved promptly by the relevant escalation contact:
• Your nominated support / technical contact
• Your Customer Success Manager
• The Generis Support management [email protected] • The Generis senior management [email protected] Not included under the Standard Support Services (unless purchased additionally):

The following items are considered out-of-scope for standard Support Services:

CARA SaaS Agreement

Appendix 4 - Exit Management Plan
Overview
Upon termination of the Agreement Customer may need to leave the Generis CARA Cloud, and as such Generis has an Exit Management Plan in place, that is specifically designed to be extremely simple. It also covers the contractual obligations of Generis if Generis were to cease trading.

What you are entitled to
Customer is entitled to a one-time export of:
• All metadata (including relationship information and/or virtual document relationships) in Excel format (related to content via unique ID)
• All audit information in Excel format (related to content via unique ID) • All versions and renditions of all content in the original format (e.g. Word, PDF) • Documented evidence that the data integrity of the export was checked and verified When you are entitled to it
Customer is entitled to this one-time extraction once Customer or Generis have given notice of termination, at a time that is mutually agreed (acting reasonably), and within 1 month of the end of Customer contracted period.

How we provide it
Generis will export everything to a location of the Customer’s choosing to which Generis can extract directly, e.g. sFTP or other secure location. For an additional cost, a hardware transport can be provided so the content can be trucked to a customer location in an armoured vehicle.

Self-service options
Customers have many functions within the Services to be able to extract information to Excel / bulk export, so there are things that do not require Generis involvement.

CARA SaaS Agreement

Costs
There are no additional costs associated with a one-time data extraction. If Generis is required to extract samples ahead of time in order to facilitate data migration planning, and/or if is required to extract multiple times, this will be subject to a charge in accordance with our standard consulting rates for the number of days, understanding that there are tools Customer can use to do some of this themselves.

Deletion
The final part of the Exit Management Plan is secure wiping / deletion of the servers to NIST Standards.

Alternative Exit Option
Generis will provide a copy of the AWS S3 content bucket directly to City of Sacramento, in the case that City of Sacramento would like to migrate the environment on-premises. There will be no cost applicable.

The S3 bucket will be loaded onto a drive using the AWS Snowball (or similar service that exists at the time). The costs for the Snowball drive and transport to City of Sacramento will be the responsibility of City of Sacramento.

CARA SaaS Agreement

Appendix 5 – Data Processing Appendix
This Data Processing Appendix (“Appendix”) is effective as of the date set forth on the signature page hereto. This Appendix supplements the terms of the Master Service Agreement (the "Agreement").

Intending to be bound and for good and valuable consideration, the sufficiency of which is acknowledged by each party, Generis and Customer hereby agree as follows:

1. SCOPE AND PURPOSE

1.1. Compliance with GDPR. Each of Generis and Customer agree that they are entering into this Appendix for the purpose of complying with their respective regulatory obligations pursuant to the General Data Protection Regulation (EU) 2016/679 (“GDPR”). For purposes of this Appendix, the terms “Personal Data”, “Controller”, “Processor”, “Data Subject”, “Processing”, “Union”, and “Member State” shall be interpreted in accordance with Article 4 of the GDPR. This Appendix applies when Generis processes Personal Data belonging to an identifiable Data Subject in the Union or a Member State. In this context, Generis will act as “Processor” to the Customer who may act either as “Controller” or “Processor” with respect to the applicable Personal Data.

1.2. Confirmation of Data Processing Details. Generis hereby confirms that (a) the information contained in Annex 1 accurately reflects the subject matter, duration, purpose and nature of Generis’ Processing, (b) the information contained in Annex 2 accurately reflects the organizational and technical measures that Generis has put in place to keep the Customer’s Personal Data secure and (c) the information contained in Annex 3 accurately reflects the allocation of shared responsibilities with respect to the Services. As set forth on Annex 3, the public cloud Services offered by Generis are based on a shared responsibility model where Customer may be provided with a variety of tools and controls, including security features and functionalities provided by either Generis or a third-party, that Customer may use to retrieve, correct, delete or restrict Personal Data. Customer may use these controls as technical and organisational measures to assist it in connection with its obligations under the GDPR.

2. DUTIES WHEN PROCESSING

2.1. Duty to Comply with Customer Instructions. When Generis processes any Personal Data of a Data Subject in the Union that is identified to or identifiable by Generis in the course of providing the Services, Generis will, with respect to such Data Subject’s Personal Data, process such Personal Data only on documented instructions from Customer (which may be specific instructions, instructions of a general nature, instructions set out in a Service Order or Statement of Work or instructions otherwise communicated including through the Generis ticketing system or web portal), unless otherwise required to do so by Union or Member State law, in which case Generis shall inform Customer of that legal requirement before processing, unless prohibited by law from doing so. If Customer issues a direction to Generis which requires Generis to do something that is inconsistent with the terms of the Agreement, then Generis may wish to make a reasonable charge, in which case that charge will be as agreed in writing between the parties.

2.2. Duty to Implement Protections. After assessing the subject-matter and duration of the processing, the nature and purpose of the processing, and the type of personal data and categories of data subjects as set forth in Annex 1, Generis has implemented and shall maintain appropriate technical and organisational measures designed to protect the Customer’s Personal Data against CARA SaaS Agreement

unauthorised or unlawful processing and against accidental loss, destruction, damage, theft, alteration or disclosure. Generis and Customer agree that the appropriate technical and organisational measures contemplated by this Appendix shall be commensurate with the risk posed to the Personal Data by the Services provided by Generis and shall, at a minimum, include the measures set out in Annex 2 of this Amendment.

2.3. Duty to Inform and Assist. Generis shall immediately inform Customer if, in its opinion, an instruction for the Processing of Personal Data from Customer violates GDPR or any other Union or Member State data protection provisions known to Generis. Additionally, Generis agrees to assist Customer (a) by taking appropriate technical and organisational measures as set forth on Annex 2, (b) in fulfilling Customer's obligations to respond to requests from Data Subjects exercising their rights, to the extent reasonably practicable; and (c) in ensuring compliance with the obligations pursuant to Articles 32 to 36 of the GDPR, in each case, in a manner that takes into account the nature of the Processing and the Personal Data. Generis shall also provide reasonable assistance to Customer with any data protection impact assessments which Customer reasonably considers to be required pursuant to Article 35 or 36 of the GDPR.

3. PROTECTIONS AROUND PERSONNEL AND SUB-PROCESSORS

3.1. Commitment to Maintaining Confidentiality. Generis restricts its personnel from accessing Personal Data without authorisation consistent with the security standards described in Annex 2.

Generis hereby confirms and warrants that it takes reasonable steps to ensure that (a) Generis personnel who have access to Personal Data are reliable and competent, including through the use of background checks, (b) Generis personnel have committed themselves to confidentiality obligations, (c) Generis personnel have been informed of the confidential nature of the Personal Data and (d) Generis personnel receive ongoing annual training related to Generis’ regulatory obligations to protect the security and confidentiality of Personal Data. Generis will not intentionally disclose any Personal Data except as necessary to comply with the law or a valid order of a properly authorized enforcement agency, it being understood that in any such case, Generis will give Customer reasonable notice of such demand to allow Customer to seek a protective order or other appropriate remedy, unless Generis is legally prohibited from doing so.

3.2. Limitations on the Use of Sub-Processors. Customer understands and acknowledges that in connection with providing the Services, Generis may use one or more third-party infrastructure-as- a-service Generiss as a sub-processor. Other than with respect to the third-parties identified in Annex 1, Generis shall not engage another processor or otherwise subcontract any of its processing operations performed on behalf of Customer without the prior written consent of Customer, it being understood that such consent may be documented in a Service Order or Statement of Work agreed to between the parties. Where Customer does consent to Generis engaging a sub- contractor or sub-processor (an “Approved Sub”) to carry out any part of the Services, Generis will have responsibility for ensuring the reliability and competence of the Approved Sub and its personnel who may have access to the Personal Data. Generis shall include in any contract with any Approved Sub provisions which are equivalent to those in this Appendix or as otherwise required by GDPR. Generis shall keep a list of sub-processing agreements concluded under GDPR, which shall be updated at least once a year and shall be available to any properly authorized data protection supervisory authority. Customer hereby consents to Generis’ use of the sub-processors identified on Annex 1 as Approved Subs. Generis will remain responsible for its compliance with CARA SaaS Agreement

the obligations of this Appendix and for the acts of each Approved Sub that cause Generis to breach any of its obligations under this Appendix.

4. CUSTOMER ACCESS TO DATA AND INFORMATION

4.1. Access to Data at End of Processing. Customer hereby confirms that, at the end of the provision of Services relating to the intended Processing, Customer instructs and chooses for Generis to either (a) make such Personal Data available to Customer through a third-party Generis or (b) delete the Personal Data. Customer accepts and understands that Generis may use an Approved Sub that provides Customer with controls that Customer may use to retrieve or delete Personal Data and, in such case, Customer will have the ability to retrieve or delete Personal Data consistent with the terms and conditions determined by the Approved Sub. For the avoidance of doubt, once Customer directs or otherwise instructs Generis to close the public cloud account connected with Customer, Generis will delete all Personal Data in such account. Generis does not provide back-up or data recovery services unless such services are explicitly identified on a Service Order agreed to between the parties.

4.2. Access to Information in Connection with an Audit. Generis shall make available to Customer all information necessary to demonstrate compliance with the obligations set forth in Article 28 of the GDPR and allow for audits conducted by Customer or another auditor mandated or otherwise approved by Customer. Generis is certified under HITRUST and agrees to maintain an information security program for the Services that complies with the HITRUST standards. Generis uses external auditors to verify the adequacy of its security measures and hereby confirms that such audit work:
(a) will be performed at least annually; (b) will be performed according to HITRUST standards; (c) will be performed by independent third party security professionals at Generis’ selection and expense; and (d) will result in the generation of an audit report which will be Generis’ confidential information. At Customer’s written request, Generis will provide Customer with evidence of the requested third-party audit so that Customer can reasonably rely on this third-party work to confirm compliance under this Appendix. For the avoidance of doubt, Customer hereby agrees to exercise any right it may have to conduct an audit or inspection by instructing Generis to carry out an audit for its benefit with Coalfire Systems, Inc. or an equally reputable and qualified third-party.

4.3. Access to Information in Connection with a Data Breach. If Generis becomes aware of any accidental, unauthorised or unlawful destruction, loss, alteration, or disclosure of, or access to the Personal Data that Generis processes when providing the Services (a "Data Breach"), Generis will (i) notify Customer without undue delay, (ii) provide Customer with a description of the Data Breach and the type of Personal Data that was the subject of the Data Breach, as soon as such information can be collected and reasonably investigated, and (iii) comply with applicable laws and regulations of the state of California. Customer agrees that an unsuccessful security incident that does not result in any access or alteration to the Personal Data will not be subject to this Appendix.

Notification of a Data Breach, if any, will be delivered to the Customer contacts that Generis has on file by any means Generis selects, including via email. It is Customer’s responsibility to maintain and update accurate contact information with Generis.

5. CUSTOMER CONFIRMATIONS

5.1. Confirmation of Consents. Customer confirms and warrants that the processing, including the transfer itself, of the Personal Data has been and will continue to be carried out in accordance with CARA SaaS Agreement

the relevant provisions of the GDPR, including with respect to the prior gathering and retaining of all necessary consents for the Processing of the Personal Data.

5.2. Confirmation of Risk Assessment. Customer accepts that Customer has an obligation under the GDPR to perform a data protection impact assessment. Customer is responsible for reviewing the information made available by Generis relating to data security and making an independent determination as to whether the Services meets Customer’s requirements and legal obligations.

Customer hereby confirms that, after assessment of the requirements of the GDPR and a review of the information provided by Generis, Customer has determined that the security measures set forth on Appendix 2 are reasonably appropriate to protect the Personal Data against accidental or unlawful destruction or accidental loss, alteration, unauthorised disclosure or access and that these measures are designed to reasonably ensure a level of security appropriate to the risks presented by the Processing of the Personal Data.

5.3. Confirmation of Appropriate Measures. Customer will ensure compliance with its own internal security measures. Customer confirms and warrants that such measures are appropriate and sufficient to protect the Personal Data against accidental or unlawful destruction or accidental loss, alteration, unauthorised disclosure or access, including through the use of access controls and the use of encryption at the application and database level consistent with the shared responsibilities described in Annex 3. Customer shall ensure that its instructions comply with all laws, rules and regulations applicable to the Personal Data.

5.4. Confirmation of Control. Since Generis may make available to Customer certain tools and security features, either directly or through an Approved Sub, Customer accepts and agrees that Customer is responsible for (a) properly selecting the appropriate Services for its needs, (b) using the controls available in connection with the Service to ensure the ongoing confidentiality, integrity, availability and resilience of its systems, (c) using the controls available in connection with the Services to allow the Customer to restore the availability and access to Personal Data and (d) taking such steps as Customer considers adequate to maintain appropriate security, protection, and deletion of Personal Data, including without limitation the use of encryption technology and the implementation of access controls to protect Personal Data from unauthorised access.

6. COOPERATION WITH REGULATORY AUTHORITY

6.1. Cooperation Generally. Generis and Customer agree to cooperate with the appropriate supervisory authorities in connection with any violation of GDPR. Customer may provide a copy of this contract to the appropriate supervisory authority if it so requests or if required under the GDPR. If Generis is required to Process Personal Data by any Union or Member State law, Generis will inform Customer of this requirement before the Processing, unless that law prohibits this. Generis will also promptly notify Customer about any request received directly from a Data Subject without responding to that request, unless it has been otherwise authorised to do so.

6.2. Future Adoption of Standard Clauses. If the European Commission approves, or an applicable supervisory authority adopts, standard contractual clauses for the matters referred to in Article 28(3) and Article 28(4) of the GDPR pursuant to Article 28(7) or Article 28(8) of the GDPR (as appropriate) and Customer notifies Generis that it wishes to incorporate any element of any such standard contractual clauses into the Agreement, Generis will agree to the changes as reasonably CARA SaaS Agreement

required by Customer to achieve this. If at any time Customer reasonably believes that the European Commission or any supervisory authority requires that transfers of Personal Data be suspended, then Customer may, at its discretion, require Generis to cease processing Personal Data.

6.3. Data Subject Claims. If any Data Subject considers that the processing of Personal Data relating to him or her violates the protections set forth in the GDPR, then Generis and Customer accept and understand that such Data Subject shall have the rights set forth in Articles 77, 78, and 79 of the GDPR. With respect to third-party liability, Generis and Customer shall have no liability for any damages arising from a violation of the GDPR other than as required by Article 82. Customer agrees that any regulatory penalties incurred by Generis in relation to Personal Data that arise as a result of, or in connection with, Customer’s failure to comply with its obligations under this Appendix or the GDPR shall count towards and reduce Generis’ liability under the Agreement as if it were liability to the Customer under the Agreement.

Annex 1
Data Processing Details

The subject matter of the data processing under the Appendix is the Personal Data of identified or identifiable Data Subjects in the Union or a Member State. The duration of the data processing intended under the Appendix is determined by the terms of the Appendix and Agreement and may be limited as required by law. The purpose of the data processing under the Appendix is the provision of the Services initiated by Customer from time to time as set forth in the Agreement and the applicable Service Order or Statement of Work.

The nature of the processing involves cloud computing services that rarely require Generis to access any Personal Data. In general, Generis has very limited ability to identify any Personal Data because such data is encrypted or otherwise rendered unidentifiable by Customer prior to any processing by Generis.

Consequently, it is difficult for Generis to know when Personal Data is being processed without notice from Customer. Based on the definition of “Processing” set forth in Article 4 of the GDPR, the following chart reflects the type of processing performed by Generis:

Type of Processing Applicability to Generis
The collection and/or recording of sets of
personal data
Generis does not collect such data, it is
provided by Customer. Generis also does not
record such data, as the data is recorded on
third party systems when a public cloud
infrastructure Generis is used.

CARA SaaS Agreement

Type of Processing Applicability to Generis
The organisation and/or structuring sets of
personal data
Generis does provide services related to
structuring, organizing and designing cloud
architecture for Customers and this may take
into account the type of personal data, but is
rarely used to provide Generis with access to
the personal data.

Storage and/or retrieval of sets of personal
data
For public cloud services, Generis relies on a
cloud infrastructure Generis to store and
retrieve data. Generis can assist Customer in
manging or utilizing such third-party’s tools, but
is not the entity providing this type of
processing.

The adaptation, alteration, or combination of
sets of personal data
Generis does not intentionally alter data sets
unless directed by the Customer.

Consultation regarding sets of personal data Generis may provide consulting services to the Customer in connection with discussing
industry best practices.

The use, disclosure by transmission,
dissemination or otherwise making available of
sets of personal data
Generis does not use or make personal data
available except as required to provide the
services. As directed by Customer or as set
forth in a Service Order or Statement of Work,
Generis may cause the transmission of data.

The restriction of sets of personal data Generis may assist Customer use tools to create restrictions or access controls are personal
data.

The erasure or destruction of sets of personal
data
Generis will permanently erase or delete
personal data upon the end of processing
consistent with the instructions of Customer.

The Personal Data transferred pursuant to the Appendix concern the following categories of data subjects:
• Name, address, phone number and email

The Personal Data transferred pursuant to the Appendix concern the following types of data and the following special categories of data:
• Documents containing personal medical information

The approved sub-processors that may assist in providing the Services are:
• AWS
• Logicworks
CARA SaaS Agreement

Appendix 6 - Technical and Organizational Measures/TOMs General personal data will be processed. Processor shall implement the following technical and organizational security measures.

1. Physical access control
• Determining secure areas;
• Securing and limiting access routes;
• Telephones, data processing facilities and personal computers are located in a restricted area with limited access (when using laptops with removable storage devices, the data stored on those data carriers shall be encrypted);
• Determining access authorizations, including their documentat ion for employees and third parties; • Providing key cards;
• Limiting key cards;
• Every entry to the data center in which the personal data is stored shall be recorded, monitored and stored; and
• The data center in which the personal data is stored is secured using alarm systems and other measures.

2. System access control
Processor shall prevent data processing facilities from being used by unauthorized persons. • Identifying the terminal and/or terminal users of Processor’s systems; • Automatic log off of unused user terminal, identification and password required to log in again; • Assigning and securing identification keys;
• Allocating certain terminals and/or terminal users and identifying features exclusively for certain functions; • Encryption and password requirements according to applicable industry standards (minimum number of characters, use of special symbols); and
• Recording, monitoring and saving each instance of accessing data contents, to the extent supported by the system.

3. User access control
Processor shall ensure that every person who uses the data processing facilities and has access to Principal Data has a special access authorization regarding Principal Data and that this access is monitored. • Employee policies and training taking into account individual rights to access personal data; • Effective and appropriate disciplinary measures against individuals who access personal data without authorization;
• Release of data only to authorized persons;
• Encryptions according to applicable industry standards and Principal’s instruction; and • Guidelines that regulate saving backup copies

4. Transfer control
Processor shall ensure that when electronically transferring or saving Principal Data on data carri ers, the data cannot be read, copied, modified or deleted without authorization and that it can then be checked and determined which individuals or authorities shall receive Principal Data to be transferred via data transmission equipment.

CARA SaaS Agreement

• The most modern firewalls and encryption technology shall be used to secure the interfaces and lines on which the data is sent;
• Ensuring that personal data is accessed only on Processor’s local network or on a secure VPN connection; • Encryptions of data transfers according to applicable industry standards; and • Preventing personal data from being stored without encryption on portable storage media and laptops or other portable terminals.

5. Input control
Processor shall ensure that it can be checked and determined afterward who processed Principal Data and at what time in data processing facilities.
• Taking system access control measures, as described in number 2 above; • Measures to protect from unauthorized reading, modifying and/or deleting stored data; and • Electronic record of the entry and/or deletion of personal data, to the extent supported by the system.

6. Contract control
Processor shall ensure that Principal Data can be processed only strictly according to Principal’s instructions. • Clear instructions to Processor regarding the scope of the processing of personal information. The scope shall be restricted to Principal’s requirements regarding the specific system development and database management (e.g., creating new report templates if processing personal da ta is necessary for testing purposes); and
• Ensuring rights are granted to regular access and monitoring with the help of Processor. In so doing, an appropriate notification period shall be observed, and Processor’s security guidelines shall be taken into account.

7. Availability control
Processor shall ensure that Principal Data is protected from accidental destruction or loss and that it is always available to Principal.
• Infrastructure redundancy;
• Regulations that forbid saving personal data on local memory devices (workplace); and • Carrying out backups regularly.

8. Separation rule
Processor shall ensure that Principal Data (potentially) collected for different purposes is processed separately. • Security measures that ensure that in each case only authorized users have access to the data; • Modules in Processor’s database differentiate which data is used for what purpose, e.g., distinction based on function and functionality;
• Data is stored in the database in separate standardized directories and organized according to the modules or functions it supports; and
• Interfaces, batch processing and reports are each designed only for a certain purpose and function, so that data created for a certain purpose can be processed separately.

9. Documentation control
CARA SaaS Agreement

Processor shall ensure that documentation of all essential processing steps allows verification of the data processing facilities and that it is possible to verify that Principal Data was processe d exclusively according to Principal’s instructions.

10. Guarantee
Processor pledges that the technical and organizational measures from this Exhibit 3 (Technical and organizational Measures) are observed and implemented.

11. Data processing location
Principal Data shall be processed at the following locations:

City: Frankfurt Country: Germany
Data is only accessed within the controller's systems. There is no offline storage of data. • Due to the processing of
• Special categories of personal data
• Employee data
• Data processing in technical facilities outside of the EU/EEA the following additional technical and organizational security measures shall be taken:

None

CARA SaaS Agreement

Appendix 7 – Data privacy with 3rd party tool integrations If Customer implements integrations with 3rd party tools including but not limited to Artificial Intelligence engines, Translation engines, publishing software, Generis will not be responsible for the security of the data in those 3rd party tools OR the transfer of the data to/from CARA to those 3rd party tools unless the integration leverages the HTTPS as part of the CARA API. Customer is responsible for ensuring the selection of the appropriate tools which provide the desired levels of data privacy and protection with those 3rd parties when entering into contracts to use them.