Attachment-C-1_Cognizant Santa Maria SOW_FINAL.pdf — Santa Maria City Council, March 19, 2024 (part 2 of 4)

16. What organization/recent customer would the Vendor recommend for a site visit? We have other Cities in California within driving distance for you to visit. We will arrange a visit at the appropriate time.

17. Please disclose any outstanding litigation against your company.

Collaborative is an indirect wholly owned subsidiary of Cognizant Technology Solutions Corporation. Cognizant is a publicly traded organization. All material present and pending litigations and investigations are disclosed by Cognizant in its public filings as and to the extent required by applicable securities laws, rules, and regulations.

18. Please list any third-party vendors you’re partnering with and proposing as part of your response, as well as the products and versions proposed, and the scope areas/functionality they will be providing. • SpryPoint
• CamAm Technologies
• ADP
• DebtBook

City of Santa Maria
Enterprise Resource Planning (ERP) Software
and Implementation Services
November 14, 2022

Collaborative Solutions, LLC. Proprietary & Confidential 118

Vendor name: Collaborative Solutions, LLC.

19. Confirm (Yes/No) that your system will comply with all California State and Federal Employment Laws and Regulations, including future changes. You may add any comments below.

Yes ☒

No ☐

Vendor name: SpryPoint Services Inc.

Software brand name: SpryPoint
Software version proposed
(years in production):

All SpryPoint solutions are updated on two-week cycles. SpryCIS – Deployed in production since 2020
SpryEngage – Deployed in production since 2016 SpryMobile – Deployed in production since 2012
Is Vendor prime contractor: Yes ☐ No ☒

1. What are the top three differentiators of your company and its proposed solution? SpryCIS supports new functionality required by regulators and demanded by customers which many legacy CIS vendors are unable to meet. These advantages include:
• SaaS – SpryPoint offers the first true SaaS platform built specifically for municipal utilities. Our application does not require any hardware and SpryPoint looks after all security, performance, back- up & recovery. Customers are always on the most recent version of the software and we push updates to our customers every two weeks.
• Modern Functionality – SpryCIS extends beyond the typical functionality of legacy CIS solutions with additional functionality to address mobility, Customer Relationship Management (CRM), Customer engagement & communication, Smart Grid, AMI/MDM, complex rates and conservation and efficiency initiatives.
• Application Programming Interfaces (API's) – Our platform includes a comprehensive (API) framework to enable easier integration to other critical systems Advanced Metering Infrastructure (“AMI”), Meter Data Management (“MDM”), Outage Management System (“OMS”). • Scalability – SpryCIS is a true SaaS solution has been designed in a scalable manner to support both smaller and larger utilities. Our platform includes both horizontal and vertical scalability.

2. What strategic alliance have you made to further strengthen your product and services? • SpryPoint is the preferred CIS partner of Workday (ERP) • SpryPoint is working with three separate companies as System Integrators or Service Delivery Partners of the SpryPoint Platform.
• SpryPoint is an Amazon Web Services (AWS) and is closely aligned with AWS.

3. How do you guarantee the services provided by your company?

City of Santa Maria
Enterprise Resource Planning (ERP) Software
and Implementation Services
November 14, 2022

Collaborative Solutions, LLC. Proprietary & Confidential 119

Vendor name: SpryPoint Services Inc.

SpryPoint guarantees its services by first building out a Statement of Work (SOW) that is agreed upon by both SpryPoint and the City. Upon acceptance of the SOW SpryPoint issues out a standard contract alongside our Service License Agreement (SLA).

4. What is your marketplace focus?
☒ Small/Local Governments ☒ Large Government (e.g., counties /states) ☒ Other: Specify Utilities

5. What is your preferred customer size (quantify in terms of budget, customers, population, etc.)? Municipal utilities running legacy CIS systems that are not taking advantage of cloud technology. Our target market is progressive utilities that embrace the value of SaaS and who service between 10,000 and 250,000 accounts.

6. Please describe the level of research and development investment you make in your products (i.e. – annual budget, head count, etc.).

We invest heavily into research and development. Our current development team consists of 30 full-time employees (FTEs) (Including CTO and VP of Software) out of the 74 total FTE’s working at SpryPoint. As a relatively new platform, our annual R&D spend exceeded over 50% of annual revenue over the past 3 years.

We included a high-level description of our R&D approach below:

The advent of cloud computing has enabled the development of infinitely scalable commercial applications and unprecedented productivity through continuous innovation and integration. SpryPoint’s development approach leverages the improved channels and newly enabled workflows and capabilities of agile methodologies across product management, software design, development, testing, deployment, and support.

SpryPoint’s platform is at the cutting edge of technology relative to our competitors, and we are constantly adding functionality and enhancing our solutions SpryPoint only maintains one version of code and all enhancements that are made across our customer base are included with the core product so that all customers can benefit. Each SpryPoint application has a product roadmap based on customer feedback and includes planned enhancements.

7. How many years have you been selling your solution to the public sector? SpryPoint was founded in 2011 and has been providing solutions to the public sector for 11 years.

City of Santa Maria
Enterprise Resource Planning (ERP) Software
and Implementation Services
November 14, 2022

Collaborative Solutions, LLC. Proprietary & Confidential 120

Vendor name: SpryPoint Services Inc.

9. How many fully operational customer installations, in total, has the Vendor completed? California Nationally
Local Government 3 31
Other public sector
Other non-public sector 1
Overall: 3 32

10. How many current system implementations of your solution are in-process within both the State of California and the region of the country that includes the State of California? Current in-process Implementations
State of California 0
Region 7
Total: 7

11. Please state the year the Vendor started in the business of selling the proposed solution to local governments:

City of Santa Maria
Enterprise Resource Planning (ERP) Software
and Implementation Services
November 14, 2022

Collaborative Solutions, LLC. Proprietary & Confidential 121

Vendor name: SpryPoint Services Inc.

Product: Launch Year
SpryCIS 2020
SpryEngage 2016
SpryMobile 2012
SpryIDM 2022

12. Where is the Vendor’s closest support facility/sales office to Santa Maria, California? SpryPoint is headquartered on Prince Edward Island, Canada but has employees throughout Canada and recently incorporated in the United States.

13. Where is the Vendor’s company headquarters?
SpryPoint is headquartered on Prince Edward Island, Canada 401 - 45 Queen Street, Charlottetown, PE C1A 4A4

14. Please list the Vendor’s sales in the previous three years:

Year Sales
2021 SpryPoint is disrupting the CIS market and has been selected on 18 competitive Utility Billing (CIS) transactions since going live with our first CIS customer in 2020.

Recent sale figures for the past three years will be available upon shortlist. Revenue and Bookings growth has been greater than 100% year-over-year for the past three years.
2020
2019

15. How many total employees does the Vendor have in each of the following categories? Area Number
Sales/Marketing 2
Management/Administration 6
Help Desk Staff 15
Development Staff 30
Project Management 21
Cybersecurity *Included in Development and Help Desk Staff Other (please list)
Total: 74

16. What organization/recent customer would the Vendor recommend for a site visit?

City of Santa Maria
Enterprise Resource Planning (ERP) Software
and Implementation Services
November 14, 2022

Collaborative Solutions, LLC. Proprietary & Confidential 122

Vendor name: SpryPoint Services Inc.

This is dependent on whether the visit will be completed in person or remote. The closest customer to Santa Maria which is live on SpryCIS is the City of East Palo Alto, CA and Aurora, CO. We strongly recommend that the City’s team speak with all the references we have provided.

1. City of East Palo Alto (Veolia), CA

2. City of Summerside, PE
3, Easton Utilities, MD

4. City of Charlottetown, PE

5. Aurora Water, CO

6. Florida Keys Aqueduct Authority, FL

17. Please disclose any outstanding litigation against your company.

Not applicable. No outstanding litigation against our company.

We strongly recommend that the City consider our partner, Workday, your new ERP provider. Together, SpryPoint and Workday will provide the City with a state-of-the-art SaaS platform for ERP and Utility Billing, long into the future.

19. Confirm (Yes/No) that your system will comply with all California State and Federal Employment Laws and Regulations, including future changes. You may add any comments below.

Yes ☒ No ☐

City of Santa Maria
Enterprise Resource Planning (ERP) Software
and Implementation Services
November 14, 2022

Collaborative Solutions, LLC. Proprietary & Confidential 123

Vendor name: Can/Am Technologies, Inc.

Software brand name: Teller Cashiering
Software version proposed
(years in production):

7.5 Is Vendor prime contractor: Yes ☐ No ☒

1. What are the top three differentiators of your company and its proposed solution? Teller’s key differentiators are its technology, its clients and its ability to seamlessly integrate with other software applications. We highly encourage you to talk to our clients. All our clients are used as references.

2. What strategic alliance have you made to further strengthen your product and services? Can/Am has a myriad of alliances and strategic partnerships within the local/state government environment, which is our only market. This includes financial integrators, multiple software applications, hardware providers, credit processors, Amazon, etc. We are also member of a number of government organizations such as National Government Finance Officers.

3. How do you guarantee the services provided by your company? All services required by the District will be performed by Can/Am employees. We have a very high level of client service expectation and by performing all projects including support services ourselves it ensures that our clients are receiving the absolute best service possible. A detailed implementation project plan will be constructed with the District that will have milestones. Service payments are tied to those milestones.

Again, talk to our clients about our service and our commitment to them.

4. What is your marketplace focus?
☒ Small/Local Governments ☒ Large Government (e.g., counties /states) ☒ Other: Specify

5. What is your preferred customer size (quantify in terms of budget, customers, population, etc.)? Can/Am clients serve a population of 50,000 up to 1.95 million. Recent new clients are City of Miami, City of Salt Lake City, Fond du Lac County, WI and City of Amarillo, TX

6. Please describe the level of research and development investment you make in your products (i.e. – annual budget, head count, etc.).

City of Santa Maria
Enterprise Resource Planning (ERP) Software
and Implementation Services
November 14, 2022

Collaborative Solutions, LLC. Proprietary & Confidential 124

Vendor name: Can/Am Technologies, Inc.

Can/Am is highly focused on research and development, continually enhancing our applications and developing new ones. There are several principles that guide Teller product development:
• Market Vision and Direction
o Teller is constantly being enhanced and improved based on our understanding of the product market, sales initiatives, and client feedback.
o We are continuously expanding our integration capabilities and set of implemented integrations with payment processing and business system partners.
• Client Requests and Enhancements
o We actively incorporate client requests on the functionality of Teller. This includes bug fixes, usability enhancements, and new client funded functionality. • Project Requirements
o We are actively improving Teller to support current project requirements • Technology Upgrades
We work hard to keep Teller updated on a technology stack that is current and supportable. Teller on average focuses about 30% of revenue back into R & D. Can/Am averages 30% of revenue re-invested in R & D.

7. How many years have you been selling your solution to the public sector? 17 years

9. How many fully operational customer installations, in total, has the Vendor completed? California Nationally
Local Government 6 27
Other public sector

City of Santa Maria
Enterprise Resource Planning (ERP) Software
and Implementation Services
November 14, 2022

Collaborative Solutions, LLC. Proprietary & Confidential 125

Vendor name: Can/Am Technologies, Inc.

Other non-public sector
Overall: 6 27

11. Please state the year the Vendor started in the business of selling the proposed solution to local governments:
2004

12. Where is the Vendor’s closest support facility/sales office to Santa Maria, California? Lakewood, CO

13. Where is the Vendor’s company headquarters?
Lakewood, CO

14. Please list the Vendor’s sales in the previous three years:

Year Sales
2021 $2.0M
2020 $1.3M
2019 $1.0M

15. How many total employees does the Vendor have in each of the following categories? Area Number
Sales/Marketing 2

City of Santa Maria
Enterprise Resource Planning (ERP) Software
and Implementation Services
November 14, 2022

Collaborative Solutions, LLC. Proprietary & Confidential 126

Vendor name: Can/Am Technologies, Inc.

Management/Administration 3
Help Desk Staff 6 (combined with implementation staff)
Development Staff 10
Project Management 1
Cybersecurity 1
Other (please list)
Total: 27

16. What organization/recent customer would the Vendor recommend for a site visit? All Can/Am clients are referenceable and available for a site visit

17. Please disclose any outstanding litigation against your company.

Can/Am has never had any litigation of any kind taken against it.

N/A

19. Confirm (Yes/No) that your system will comply with all California State and Federal Employment Laws and Regulations, including future changes. You may add any comments below.

Yes ☒ No ☐

City of Santa Maria
Enterprise Resource Planning (ERP) Software
and Implementation Services
November 14, 2022

Collaborative Solutions, LLC. Proprietary & Confidential 127

Vendor name: ADP
Software brand name: ADP Employment Tax Service
Software version proposed
(years in production):

ADP, Inc.

Is Vendor prime contractor: Yes ☐ No ☐

1. What are the top three differentiators of your company and its proposed solution? Our solution offers our clients several advantages:

Established interfaces with major ERP providers. ADP maintains and updates tax compliance information in support of these established interfaces, which effectively eliminate most of the regular interface updates clients may need with other solutions. When tax compliance information is updated, our clients test the extract to ensure the environment is sound and load the applicable changes to their payroll systems.

Elimination of a separate file format for the collection of Form W-2-related data. To simplify and reduce client effort, ADP eliminated the need for a separate data collection to complete year-end information return filing for federal Forms W-2 and their state/local jurisdiction equivalents. This means employers have a better chance of ensuring tax returns and Forms W-2 are filed in balance with each other, which is the ultimate tax agency requirement. Using the same source data to drive production of tax returns, Forms W- 2, and annual reconciliations help to achieve this goal/requirement.

Single file Form W-2 process. As an optional service, the fourth-quarter tax file can be used to produce the employee Forms W-2 (printing and/or posting). This ADP differentiator saves you time since only one file needs to be sent to ADP. In addition, there is no chance of having discrepancies in your fourth-quarter filing and employee Forms W-2.

Agency notice turnaround (market-leading) response times. Although our standard is 10 business days or fewer, 95 percent of tracers and inquiries are completed within five business days or fewer.

Amendment processing routines. In most situations, vendors produce original returns. Returns can be reproduced and resent if data is lost. ADP takes all employee detail and wage-level data, and it becomes part of a permanent database — which is the basis for amendment processing. The city can make changes to your payroll system, close the quarter and send the new file to ADP. We take the new file, compare it to the processed file and identify all differences. More than 80 percent of submitted amendments are completed within 10 business days or less. The City’s administrative responsibilities are reduced, and turnaround times are quick.

Balance-Before-Go. Since accurate deposit and filing activity only occurs when ADP systems reflect the exact information residing in the City’s payroll system of record, the provided extract reporting gives you quick, easy assurance you have provided complete, accurate information for subsequent processing. This balance- before-you-go capability is unique to ADP.

Online portal. ADP’s online SmartCompliance platform gives integrated access to our SmartCompliance products (employment tax, wage garnishments, wage payments and Form W-2 management).

2. What strategic alliance have you made to further strengthen your product and services?

City of Santa Maria
Enterprise Resource Planning (ERP) Software
and Implementation Services
November 14, 2022

Collaborative Solutions, LLC. Proprietary & Confidential 128

Vendor name: ADP
ADP maintains and updates tax compliance information in support of established interfaces with major ERP providers, which effectively eliminate most of the regular interface updates clients may need with other solutions. When tax compliance information is updated, our clients test the extract to ensure the environment is sound and load the applicable changes to their payroll systems.

As a Workday payroll client, data is extracted from your Workday tenant to the ADP integration platform via ADP SmartConnect and Workday native APIs. The necessary data elements are transformed into the specific formats ADP requires to perform services.

3. How do you guarantee the services provided by your company? ADP will warrant that, during the term of the executed agreement, our contracted services will operate substantially in accordance with ADP’s published documentation and/or specifications. Any additional warranties will need to be specifically negotiated.

4. What is your marketplace focus?
☐ Small/Local Governments ☐ Large Government (e.g., counties /states) ☒ Other: Specify ADP is the largest filer and
depositor of taxes in the U.S. We serve both
public sector clients as well as private sector
organizations of all size and industries.

5. What is your preferred customer size (quantify in terms of budget, customers, population, etc.)? ADP is the largest filer and depositor of taxes in the U.S. We serve organizations of all size and industries.

6. Please describe the level of research and development investment you make in your products (i.e. – annual budget, head count, etc.).

ADP’s business vision is to be the HCM market leader. To accomplish this goal, ADP invests significantly in solutions and continues to budget R&D dollars.

In fiscal year 2022, ADP invested $1.21 billion from continuing operations in development and programming, migration to new computing technologies, the development of new solutions and maintenance of existing technologies (including purchases of new software and software licenses). With total revenue of $16.5 billion, investment dollars accounted for approximately 13.7 percent of revenue in fiscal year 2022.

Our research and development technology strategy is based on reliability, scalability and open architecture.

We evaluate the technology landscape for hardware components and configurations that allow us to provide administrative services to our clients more effectively.

7. How many years have you been selling your solution to the public sector?

City of Santa Maria
Enterprise Resource Planning (ERP) Software
and Implementation Services
November 14, 2022

Collaborative Solutions, LLC. Proprietary & Confidential 129

Vendor name: ADP
ADP has provided general payroll services since our inception in 1949 and standalone tax services since 1997.

8. How many fully operational customer installations of the version proposed in this RFP, currently in production, has the Vendor completed?
California Nationally
Local Government
Other public sector
Other non-public sector
Overall: Between payroll clients and
standalone tax clients, ADP
supports employment tax
services for more than 770,000
U.S. organizations.

9. How many fully operational customer installations, in total, has the Vendor completed? California Nationally
Local Government
Other public sector
Other non-public sector
Overall: ADP has serves more than
770,000 U.S. organizations.

City of Santa Maria
Enterprise Resource Planning (ERP) Software
and Implementation Services
November 14, 2022

Collaborative Solutions, LLC. Proprietary & Confidential 130

Vendor name: ADP

11. Please state the year the Vendor started in the business of selling the proposed solution to local governments:

ADP has provided general payroll services since our inception in 1949 and standalone tax services since 1997.

12. Where is the Vendor’s closest support facility/sales office to Santa Maria, California? Employment tax is delivered and supported from our San Dimas, California, office.

13. Where is the Vendor’s company headquarters?
Roseland, NJ

14. Please list the Vendor’s sales in the previous three years:

Year Sales
2021 (FY 2022): $16.5 billion
2020 (FY 2021) $15 billion
2019 (FY 2020) 14.6 billion

15. How many total employees does the Vendor have in each of the following categories? Area Number
Sales/Marketing
Management/Administration
Help Desk Staff
Development Staff
Project Management
Cybersecurity
Other (please list) ADP employs approximately 60,000 associates worldwide (excluding our partners resources). A general breakdown of the associate population is:
• Customer service and support: 60 percent.
• Training and implementation: 10 percent.
• Product development: 10 percent.
• Sales, finance, marketing and administration: 20 percent.

City of Santa Maria
Enterprise Resource Planning (ERP) Software
and Implementation Services
November 14, 2022

Collaborative Solutions, LLC. Proprietary & Confidential 131

Vendor name: ADP

Total: 60,000

16. What organization/recent customer would the Vendor recommend for a site visit? ADP’s policy is to not release key client contact names until their approvals have been obtained and only if ADP is a finalist for the prospective outsourcing business. Please let us know once ADP is named a finalist, and we will gladly arrange this contact and establish a format for dialogue. We appreciate being considered for your business, and we recognize you may not be able to reach a final decision without validation from existing clients.

Our clients’ day-to-day activities are focused on their businesses. Because it is our business to assist our clients by reducing their daily responsibilities instead of adding to them, we are extremely sensitive to their schedules.

We know you will appreciate this consideration and will understand our reference policy.

Please visit our website at
https://www.adp.com/resources/what-others-say.aspx [adp.com] to view client testimonial videos and success stories and hear how ADP is helping our clients achieve their business goals.

17. Please disclose any outstanding litigation against your company.

ADP has a corporate litigation team that manages litigations and certain pre-litigation claims and disputes, primarily for matters within the United States. The records of matters that the corporate litigation team maintains contain confidential information, including information protected by the attorney-client privilege.

Accordingly, subject to complying with ADP’s public disclosure obligations and to respond to lawfully served discovery requests or subpoenas, ADP’s policy is to not disclose information within the records of ADP’s corporate litigation department to persons outside ADP other than ADP’s outside counsel. ADP discloses in its periodic filings with the Securities and Exchange Commission (SEC) all material asserted and unasserted claims pursuant to the standards set forth in Financial Accounting Standards Statement No. 5. This information is publicly available at
www.sec.gov [sec.gov].

To the best of ADP’s knowledge, there are currently no pending litigation claims against ADP, or litigation claims that have been resolved within the past five (5) years, that would materially adversely affect ADP’s ability to enter into an agreement with, or to provide the proposed services to, the City.

ADP does not rely on third party vendors for employment tax or W-2 services.

19. Confirm (Yes/No) that your system will comply with all California State and Federal Employment Laws and Regulations, including future changes. You may add any comments below.

Yes ☒ No ☐

City of Santa Maria
Enterprise Resource Planning (ERP) Software
and Implementation Services
November 14, 2022

Collaborative Solutions, LLC. Proprietary & Confidential 132

Vendor name: Fifth Asset, Inc. d/b/a DebtBook
Software brand name: DebtBook
Software version proposed
(years in production):

The software has been in production since February 2020.

We’re on version 1.31 and release new versions weekly.

Is Vendor prime contractor: Yes ☐ No X

1. What are the top three differentiators of your company and its proposed solution?

1. DebtBook offers both Debt and Lease Management within a single application to make sure local governmental financial professionals can see the whole picture and manage their funds in a consolidated application rather than disparate systems. This means ongoing reporting and year end audit notes are consistent and come from the same place.

2. Made for Governments - The best way to make sure a solution meets a client’s needs is to sit at a table with them and truly understand what those needs are. At DebtBook we have done just that. We initially built the software based on the challenges of local government and continue to iterate as those challenges evolve.

3. White Glove Onboarding - There is no point in getting good software if you can't get your information into the software. DebtBook removes the traditional headache of implementing new software through our White Glove Onboarding in which we do 90% of the work and have the City confirm the details.

2. What strategic alliance have you made to further strengthen your product and services? DebtBook has strategic partnerships with governmental professionals across the country. These include Municipal Advisors, Bond Counsel and Auditors who serve local government finance teams.

DebtBook works in collaboration with these professionals and our clients to continue to improve our product.

3. How do you guarantee the services provided by your company? DebtBook guarantees uptime of the application in our SLA. We have also tested of our approach and outputs with multiple industry professionals. Lastly, we have undergone SOC 1 and SOC 2 type audit reports, which we are happy to provide.

4. What is your marketplace focus?
X Small/Local Governments X Large Government (e.g., counties /states) ☐ Other: Specify

5. What is your preferred customer size (quantify in terms of budget, customers, population, etc.)? DebtBook works with clients of all size. We work with clients as large as Boston, MA and as small as Ocean Isle Beach, NC (population 600) and many in between.

City of Santa Maria
Enterprise Resource Planning (ERP) Software
and Implementation Services
November 14, 2022

Collaborative Solutions, LLC. Proprietary & Confidential 133

Vendor name: Fifth Asset, Inc. d/b/a DebtBook

6. Please describe the level of research and development investment you make in your products (i.e. – annual budget, head count, etc.).

DebtBook has dedicated personnel within the organization who are focused on the continual development of the product, which includes routine meetings with clients and industry professionals.

7. How many years have you been selling your solution to the public sector? DebtBook has been selling our solution in the Public Sector since the product became available in 2020. (2.5 years).

9. How many fully operational customer installations, in total, has the Vendor completed? California Nationally
Local Government 40 467
Other public sector 0 0
Other non-public sector 0 0
Overall: 40 467

City of Santa Maria
Enterprise Resource Planning (ERP) Software
and Implementation Services
November 14, 2022

Collaborative Solutions, LLC. Proprietary & Confidential 134

Vendor name: Fifth Asset, Inc. d/b/a DebtBook
Region
Total: 741

11. Please state the year the Vendor started in the business of selling the proposed solution to local governments:
2020

12. Where is the Vendor’s closest support facility/sales office to Santa Maria, California? Charlotte, NC

13. Where is the Vendor’s company headquarters?
Charlotte, NC

14. Please list the Vendor’s sales in the previous three years:

Year Sales
2021 $2,725,000
2020 $280,000
2019 NA

15. How many total employees does the Vendor have in each of the following categories? Area Number
Sales/Marketing 17
Management/Administration 10
Help Desk Staff 4
Development Staff 15
Project Management 0
Cybersecurity 2
Other (please list) Implementation (13), Account Management (5), Business Development (7), Accounting Product Enablement (14)
Total:

16. What organization/recent customer would the Vendor recommend for a site visit?

City of Santa Maria
Enterprise Resource Planning (ERP) Software
and Implementation Services
November 14, 2022

Collaborative Solutions, LLC. Proprietary & Confidential 135

Vendor name: Fifth Asset, Inc. d/b/a DebtBook
Vista, CA

17. Please disclose any outstanding litigation against your company.

There is no outstanding litigation against our company.

There are no third-party vendors included in our response.

19. Confirm (Yes/No) that your system will comply with all California State and Federal Employment Laws and Regulations, including future changes. You may add any comments below.

Yes X No ☐

• Technical and Vendor Requirements Form
Form B: Technical and Vendor Hosting Requirements Form

20. Indicate Tier certification for design and operation of the hosting locations mentioned above. Indicate if a private link (MPLS or EVPL) can be set up to the hosting locations mentioned above.

Workday customers do not require any VPN or MPLS to connect with their Workday instance. All user communication with Workday’s Enterprise Cloud Applications uses industry standard transport layer security (TLS/HTTPS) encryption for the transmission of private or confidential information over public networks using a web browser. TLS 1.3 is the standard encryption protocol used. Additionally, the Workday application provides Enterprise Interface Builder (EIB) functionality that allows Workday Customers the ability to build simple and secure integrations to transmit data, both inbound and outbound, with Workday. Insecure transport protocols, including secure file transport protocol (SFTP) and e-mail, require Pretty Good Privacy (PGP) encryption of files by default unless configured by the customer’s designated security personnel, which is systematically enforced. Workday can be configured to restrict access by IP addresses via a whitelist for allowed IP ranges or a blacklist of source IP addresses that are never allowed for authentication. Customers can define ranges of IP addresses as client networks and use them in authentication policies to designate blocked and allowed networks for accessing Workday.

21. How do you track monthly usage for subscription-based services?

City of Santa Maria
Enterprise Resource Planning (ERP) Software
and Implementation Services
November 14, 2022

Collaborative Solutions, LLC. Proprietary & Confidential 136

Workday’s contractual Service Availability SLA is 99.7%, excluding scheduled maintenance. Workday's service level commitments are set out in the Workday Production Support and Service Level Availability Policy (SLA) (located at
https://www.workday.com/content/dam/web/en-us/documents/legal/workday- production-support-and-service-level-availability-policy.pdf).

Service Availability in a given month is calculated as a percentage equal to [(# of minutes the Workday Production System is available in the month – number of minutes of Scheduled Downtime during the month) / (total number of minutes in the month – number of minutes of Scheduled Downtime during the month)].

There are no exceptions to our availability SLA. For example, unlike some other service providers, Workday doesn't exclude downtime related to emergency maintenance. In some cases other vendors don't even commit to a planned downtime duration - they provide a maintenance start time but not an end time. Workday publishes our maintenance calendar one year in advance so that customers can plan ahead (some vendors provide only a few days' notice of upcoming maintenance, and consider this "planned" maintenance).

Workday’s Service Response SLA is: (i) not less than *50% of (online) transactions complete in one (1) second or less and (ii) not more than 10% of (online) transaction complete in 2 and a half (2.5) seconds or more. In reality we far exceed this commitment since ~95% of all cumulative Workday on-line transactions complete within 1 second. Workday is the only enterprise SaaS solution in our market that contractually commits to the performance of the application. Service Response is the processing time of the Workday production tenants in the Workday production data center to complete transactions submitted from a web browser.

We monitor every tenant with the goal of detecting problems before they impact end users/customers. We use a variety of tools and industry best practices across our Network Operations Centers to detect and correct anomalies.
*Not applicable to Workday Adaptive Planning or Workday Strategic Sourcing.

22. Does the system interface support a browser interface with or without the help of additional components? Is the interface compatible with mobile devices? Since Workday is a full SaaS platform, Workday takes care of all the hardware requirements. As a client, you would only need to worry about the browsers that you would need to access the platform.

Browser Info
• Workday officially supports the latest supported version of Microsoft Internet Explorer 11, and the latest supported version that is automatically released by each of the following browser technologies: Mozilla Firefox, Google Chrome, Microsoft Edge ("IE" mode is not supported), Apple Safari (only supported on Mac OS X), and Opera
• Supported on Apple and Android devices via mobile app and HTML5 enabled browser Network Info
• Network communication with Workday is performed using TCP/IP, encrypted via TLS 1.2. • In terms of internet bandwidth consumption, Workday is a very light-weight application. Network testing shows 5,000 users only require about 100kbps of bandwidth. Within HR applications, the number of concurrent users is generally 1% of the total workforce. • Server-side hardware and software is all managed by the Workday service and hosted outside your organization.

City of Santa Maria
Enterprise Resource Planning (ERP) Software
and Implementation Services
November 14, 2022

Collaborative Solutions, LLC. Proprietary & Confidential 137

23. Please describe the minimum commitment term (in years) for a vendor-hosted option and note the term assumed for determining the proposed costs.

Workday’s Master Subscription Agreement (MSA) is non-cancelable and non-refundable based upon a minimum three (3) year commitment. That said, Workday has assumed a 5-year subscription term with a 3-year optional renewal years for the purposes of providing the proposed costs.

24. Please list the connectivity options and carriers available at your hosting facility.

We have a diverse set of 4-6 Tier1 and Tier2 ISPs per co-location. Exact carriers continue to change for the right mix of reliability and redundancy. Our focus is plenty of diversity and bandwidth to serve our customers globally.

25. Estimate the bandwidth that your solution will require based upon users, application environment, and any other factors.

In terms of internet bandwidth consumption, Workday is a very light-weight application. Network testing shows 5,000 users only require about 100kbps of bandwidth.

System Performance

26. How much notification will you give the City in advance of any scheduled downtime? Planned downtime is predictable as maintenance windows are planned and published a year in advance on the Workday Community. Major feature releases are performed semi-annually during a regularly planned maintenance window.

27. What is your process for notifying the customer and fixing bugs once they have been identified? At Workday, our goal is to deliver functionality at a rapid pace to provide you with the functionality and enhancements you need, while being mindful of your busy schedules and mission critical business processes.

We deliver product features and services in two ways:
• Weekly Service Updates - which occur within the weekend maintenance window and deliver timely fixes and enhancements that are non-impactful to customers. • Feature Releases - delivered on a 6-month schedule, which contain a significant number of new features and functionality; these features are delivered “turned off”, so you can review them before putting them into production.

Below we provide further insight into what is appropriate for delivery in a Weekly Service Update and in contrast what we will target for a Feature Release.

Weekly Service Update
• Net new features or enhancements to existing functionality

City of Santa Maria
Enterprise Resource Planning (ERP) Software
and Implementation Services
November 14, 2022

Collaborative Solutions, LLC. Proprietary & Confidential 138

• Minor UI modifications (e.g., field spacing, font sizing, text shading, drop-shadow weight) • Architecture and Data Center improvements
• New capabilities like the ability to cancel a background report • New Reporting components (Report Fields and Report Data Sources) • New web services or updates to existing web services
• Payroll Compliance Updates
• Bug fixes
• All of the above are documented in the Weekly Service Update Notes Feature Release
• Net new features
• Enhancements to existing functionality, including UI improvements • New web services or updates to existing web services
• Bug Fixes
• New Products
• A 5-week preview window leading up to the Feature Release date to test, plan and build communications for the upcoming release
Workday provides access to Preview tenants where we will continue to introduce features between Feature Releases. Preview tenants allow you to try out features and test alongside your own configurations, provide feedback to us, and learn about them in advance of their availability in Production.

28. Please provide the total number of clients and corresponding number of end-users of hosted solutions currently supported by your proposed solution.

Workday has over 5,700 core Workday Financial Management and Workday HCM customers. These customers range in size from 200 employees to 2 million+ employees.

29. What system/application availability and response time will your proposed system meet? What are the City’s responsibilities to ensure this level of performance? Workday’s Service Response SLA is: (i) not less than 50% of (online) transactions complete in one (1) second or less and (ii) not more than 10% of (online) transaction complete in 2 and a half (2.5) seconds or more. In reality we far exceed this commitment since ~95% of all cumulative Workday on-line transactions complete within 1 second. Workday is the only enterprise SaaS solution in our market that contractually commits to the performance of the application. Service Response is the processing time of the Workday production tenants in the Workday production data center to complete transactions submitted from a web browser. Workday reports back to customers its performance against the SLA monthly and quarterly. There is not a specific responsibility for the customer, it is provided as part of the service.

Security

30. Describe the identification and authorization capabilities of your proposed solution for users.

City of Santa Maria
Enterprise Resource Planning (ERP) Software
and Implementation Services
November 14, 2022

Collaborative Solutions, LLC. Proprietary & Confidential 139

Authentication
Workday security access is role-based, supporting LDAP Delegated Authentication, SAML for single sign- on, and x509 certificate authentication for both user and web services integrations.

Single-Sign-On Support - SAML allows for a seamless, single-sign-on experience between the customer’s internal web portal and Workday. Customers log in to their organization's internal web portal using their enterprise username and password and are then presented with a link to Workday, which automatically gives customers access without having to log in again. Workday also supports OpenID Connect.

Workday Native Login - For customers who wish to use our native login, Workday only stores our Workday password in the form of a secure hash as opposed to the password itself. Unsuccessful login attempts are logged as well as successful login/logout activity for audit purposes. Inactive user sessions are automatically timed out after a specified time, which is customer configurable by user.

Multifactor Authentication - We recommend that customers use multifactor authentication (MFA).

Workday allows customers to bring in their own MFA provider that is backed by the TOTP (time-based one-time passcode) algorithm. Workday also allows end users of customers to receive a one-time passcode delivered via an email-to-SMS gateway mechanism. Lastly, Workday supports challenge questions as an additional mechanism to prove a user’s identity.

Step-Up Authentication - If someone leaves their console open or multiple users access Workday from the same device, organizations that use SAML as an authentication type can secure against unauthorized access by identifying critical items within Workday. This allows customers to force a secondary authentication factor that users must enter to access those items.

Customer end users must have valid credentials (e.g., a valid User ID and password) to access Workday services. The majority of customers configure Single Sign-on (SSO) to use credentials from external sources, such as in their identity management solution or a directory service.

Authorization
The Workday application enforces group policy-based security for authorization. The application prevents any user from directly accessing the production database. Workday-delivered and customer- created security groups, combined with predefined security policies, grant or restrict user access to functionality, business processes, reports, and data—whether accessed online or through web services.

31. Provide list of compatible directory services and identity access management solutions. Describe how your system interoperates with Active Directory.

Workday supports single sign-on platforms via SAML 2.0 or Google OpenID Connect. The single sign-on integration may work alongside the delegated authentication mechanism. For Active Directory, Single Sign-on can be set up by invoking the Active Directory Federation Services (ADFS) function.

Workday also supports multiple IDMs and have pre-build integrations with partners such as Azure, Okta, OneLogin and Ping Identity. Workday can also act as an IDP, if needed. Workday provides integration with Azure Active Directory for single signon. Details can be found here Tutorial: Azure Active Directory single sign-on (SSO) integration with Workday | Microsoft Docs.

Additionally, a connector is provided for provisioning with Active Directory. Directions for configuring this can be found here
https://docs.microsoft.com/en-us/azure/active-directory/saas-apps/workday- inbound-tutorial.

32. Confirm ability to back up the data to an external third-party on-premise or cloud-based storage environments, and costs associated to exporting the data. Please provide list of compatible backup/recovery solutions.

City of Santa Maria
Enterprise Resource Planning (ERP) Software
and Implementation Services
November 14, 2022

Collaborative Solutions, LLC. Proprietary & Confidential 140

Workday maintains back up and disaster recovery plans and tests them regularly. Workday commits to a recovery time objective of twelve (12) hours – measured from the time that the Workday Production Service becomes unavailable until it is available again. Workday commits to a recovery point objective of one (1) hour – measured from the time that the first transaction is lost until the Workday Production Service became unavailable. During regular operations the production configurations and data are kept up-to-date at the alternate site. The production databases have a remote copy of the databases kept at our secondary data center.

The focus of our Workday Hosted Operation is on Security, Performance, and Reliability. Workday utilizes five data centers as co-location facilities. In the United States, they are located in Oregon (primary), Virginia (primary/secondary) and Georgia (secondary). Workday also has two European data centers in production, based in Ireland and the Netherlands. Co-location facilities primarily provide Workday with space in their data centers along with redundant power sources, and Internet connectivity. Workday ensures that each of our data centers provides state-of-the-art security for our customers.

Workday has established failover capabilities between the primary and secondary data centers. Should a disaster be declared at the primary data center, Workday will quickly bring customers online from the secondary data center. Backup data from production are encrypted and transmitted over secure connections to the corresponding secondary data center.

Workday provides an SLA for uptime of 99.7% against unplanned downtime.

33. Describe on-going security testing done for your data centers such as penetration testing, vulnerability scanning, etc.

Workday contracts with third-party expert firms to conduct independent internal and external network, system, and application vulnerability assessments.

Application
Workday utilizes a third party to conduct web application-level security assessments. These assessments generally include testing, where applicable, for:
• Cross-site request forgery
• Services scanning
• Improper input handling (e.g. cross-site scripting, SQL injection, XML injection, cross-site flashing) • XML and SOAP attacks
• Weak session management
• Data validation flaws and data model constraint inconsistencies • Insufficient authentication viii)Insufficient authorization Network
External vulnerability assessments scan all internet-facing assets, including firewalls, routers, and web servers for potential weaknesses that could allow unauthorized access to the network. In addition, an authenticated internal vulnerability network and system assessment is performed to identify potential weaknesses and inconsistencies with general system security policies.

34. Indicate cybersecurity solutions that are in place to prevent, detect, contain and recover from security threats such as malware injection, ransomware, side channel attacks, exploitation of API vulnerabilities, or distributed denial of service (DDoS) attacks.

City of Santa Maria
Enterprise Resource Planning (ERP) Software
and Implementation Services
November 14, 2022

Collaborative Solutions, LLC. Proprietary & Confidential 141

To ensure services are available and that problems are identified, investigated, and resolved, Workday uses a combination of monitoring tools and incident response protocols. Network intrusion prevention systems (IPS) monitor critical network segments for atypical network patterns in the Customer Data environments as well as traffic between web servers and the load balancers. System generated alerts are sent to the Infrastructure staff if suspicious network activity is detected, for further investigation, analysis, and resolution as appropriate.

In an effort to stay current with the most cutting-edge security tactics, Workday partners with a leading provider to protect against DDoS attacks. This provider has massive Internet connectivity, and technology that filters out security threats and passes clean traffic to our data centers.

If this question is pertaining to Contention-Based Protocols (CBPs), then it is a wireless telecommunication specification and not directly relevant to the Workday service.

35. Indicate what support will be provided to carry out forensic investigation of security incidents.

Workday has a detailed, multi-tiered response process for security incidents that involves several organizations within Workday. Incidents are classified into 4 levels of severity. A detailed communication plan is in place that takes into the account the severity level of the incident and determines who within Workday must be involved to resolve the issue, how the issue is resolved, and the type of communication sent internally and to customers. More details can be provided under NDA.

36. How are hosted software applications deployed for use by numerous customers (dedicated servers for each hosted customer, or is a single set of applications utilized for all customers)? Workday is a true multi-tenant cloud software as a service solution. All Workday customers are on exactly the same version of the software at all times. Scheduled maintenance and major feature updates are provided to customers at exactly the same time.

37. Indicate if you comply or do not comply with the following:

Requirement Comply?
YES NO
The system shall be available 24 x 7 with a minimum of 99.95% uptime, measured on a monthly basis (excluding maintenance windows).
☐ ☒
Data shall reside in the United States at all times. ☒ ☐ All system data and files shall be regularly backed up to a secondary data center/disaster recovery site outside of the main data center’s same weather pattern and power grid.

Backups shall occur such that the City loses no more than 2 hours of transactions due to an unexpected outage.
☒
☐
Hosting Providers/Respondents shall have a documented Security Incident Response Plan (SIRP) that addresses the Respondent’s plan for preventing, detecting, and responding to security breaches or cyberattacks in which the City’s data or operations may be compromised.
☒ ☐

City of Santa Maria
Enterprise Resource Planning (ERP) Software
and Implementation Services
November 14, 2022

Collaborative Solutions, LLC. Proprietary & Confidential 142

Hosting Providers/Respondents shall have a documented Disaster Recovery Plan (DRP) that addresses recovery and maintenance of system data and operations in response to hazard or emergency scenarios. This plan shall be tested regularly to ensure that it is both tangible and actionable.
☒ ☐
Hosting Providers/Respondents shall have a documented Business Continuity Plan (BCP) that addresses localized or system outages that create an impact to one or more business functions. The BCP should account for the rapid restoration of services and redundancies in technology or process.
☒ ☐
Hosting Providers /Respondents shall undergo a SSAE 18 SOC2 Type 2 audit covering at a minimum the Security and Availability Principles on an annual basis and must have no unaddressed material concerns. Respondent shall provide a copy of their most recent audit report prior to contract award.
☒ ☐
Hosting Providers/Respondents shall support and be compliant with all relevant regulations and requirements including, but not limited to:

PCI-DSS
FERPA,

IPAA/HITECH
GDPR.
☒ ☐

• Project Management Approach Form
Form C: Project Management Approach Form

38. How does the Vendor plan to manage the material that is produced during the project through potential solutions such as a collaboration environment?
Project documentation will be stored in a collaboration tool, SharePoint site, provided by Collaborative.

This site will have a dashboard showing current status, timeline, and is the repository for Risk Logs, Action Items, Issues and Decisions. All project members will have access. All workbooks with requirements and design documents will also be stored in the SharePoint site. Any data that includes Personal Identifiable Information has to be stored on an SFTP site provided by Collaborative. This includes data conversion files, issues or screenshots that contain employee data, etc.

All project documentation will be left with City of Santa Maria at the end of the project including configuration workbooks (which will actually be turned over to the client earlier than the end), integrations design documents, integrations operating guides, integrations recurrence tracker, and all training materials developed as part of the implementation.

39. Provide specific information on project close-out activities to support to the City.

City of Santa Maria
Enterprise Resource Planning (ERP) Software
and Implementation Services
November 14, 2022

Collaborative Solutions, LLC. Proprietary & Confidential 143

As part of our proprietary Cynergy™ methodology, cutover planning activities would occur toward the end of Testing stage while documentation of the City’s specific cutover planning approach and cutover checklist would be prepared during the Testing Stage.

Cutover planning approach documents the strategy, communications, timeline of activities, tenant information, roles and responsibilities and logistics during the cutover period. This plan is owned by the Engagement Manager and the City’s Project Manager and will be used to report and manage progress related to the cutover period.

The cutover checklist is an integral tool during the cutover period and supports the cutover plan. The cutover checklist includes a timeline of activities during the cutover process and records the person identifying the action, description, dependencies, and the time. The final plan will be presented to the team along with the cutover checklist for approval.

The final Go/No-Go decision will take place after completing the all the testing (E2E testing, Parallel Testing, User Testing, Regression testing etc.) and before launching into the Deploy Stage. The testing results, cutover checklist and Workday required Go-Live checklist are critical elements for the Go/No-Go decision-making process. These documents will be presented to the City’s project sponsor and project executives and a roll call meeting will be conducted to formally document the decision and also served as the basis for obtaining the signed off from the City’s Project Manager and project sponsor.

40. What percentage of the Project Manager's time will be devoted to the project? A Collaborative project manager typically has 1-2 projects that they are managing at any one time, depending upon the size of the projects. For the Santa Maria project, we would anticipate our project manager providing about 20 hours a week of support to the City.

41. What percentage of the Project Manager's time will be spent on site? In pre-Covid times, our typical ratio was 30% onsite, 70% offsite for our resources. Our objective with travel is to be a good steward of the City’s resources. So we look to be onsite during key periods of the project (i.e., Planning phase, Architect, the early weeks of testing, go-live) where face-to-face time is beneficial to the project. When work can just as easily be performed remotely, we will work offsite. We will work with the City to arrive at a travel schedule that best meets your overall needs.

42. What is the total proposed duration of the implementation? Collaborative is recommending a 50 month long implementation (Plan through Go-Live) with a recommended 6-week Strategy phase up front and 6 weeks of Production support following go-live.

City of Santa Maria
Enterprise Resource Planning (ERP) Software
and Implementation Services
November 14, 2022

Collaborative Solutions, LLC. Proprietary & Confidential 144

• Report Development Form
Form D: Report Development Form
Workday Response:

43. What is the query tool and report writer that Vendor is proposing? The Workday Report Framework is a full featured reporting platform that allows for selecting, filtering, and summarizing data elements that are provided as part of the Workday service. The Workday Reporting Framework allows you to configure reports that you can run from your home page, from the Favorites page or as the results of a search. With Workday reports, you can take action or drill down on data to obtain additional information. The report can be downloaded to an Excel spreadsheet or a PDF document. Rather than downloading sensitive data to Excel we offer the option to keep the data safe in Workday and export it from a report to a worksheet - which is the equivalent of Google Sheets but it's actually a Workday functionality - so it's the same Workday user experience, security, data model, etc.

Reports can be copied and configured to your unique requirements, whether the report was delivered by Workday or created by your organization.

With Workday, reports are embedded directly within business processes, with full drill down capabilities.

Augmented analytics provide personalized insights based on role, surfacing insights that would otherwise go unnoticed. You can also bring any external data into Workday, blend it with existing people and finance data, and present it securely through Workday’s reporting framework.

44. What reports are available out of the box? Provide a list here and samples at the end of this section.

Over the years, traditional ERP applications struggled to provide meaningful business insight into the organizations they support. As a result, organizations invested in costly, complex bolt-on reporting or business intelligence systems that are disconnected from any user or organizational context. Workday provides actionable business analytics that are seamlessly available throughout the application and are provided at no additional cost or complexity.

Workday delivers over 4,800 categorized reports within the subscription. Most often, there is a report that can act as the starting point, with the ability to copy the report and edit in the remaining field requirements.

With Workday reporting, you can:
• Take advantage of reports and analytics that are simple to build, simple to deploy, and simple to use • Gain business insight at any time and from anywhere—in reports, on dashboards, in alerts, on mobile devices, or embedded in business process tasks
• Make fact-based decisions with multi-dimensional analysis and the ability to drill down to transaction- level detail
• Empower business users and reduce dependency on IT support • Lower ownership costs with zero infrastructure overhead or extra subscription fees

45. Describe your process for determining the scope of what reports will have to be developed (not out-of-the- box) and what effort it will take to develop and test them?

City of Santa Maria
Enterprise Resource Planning (ERP) Software
and Implementation Services
November 14, 2022

Collaborative Solutions, LLC. Proprietary & Confidential 145

The reporting framework is provided with the Workday service at no additional cost.

The Workday Report Writer provides the following report types for creating custom reports and custom analytics:
• Simple Report: A Simple Report provides straightforward design options for ad hoc reporting. • Advanced Report: An Advanced Report provides comprehensive transactional reporting including access to related business objects and multiple levels of headings and subtotals. Advanced reports also enable the use of sub-filters, run time prompts, charts, Worklets, and report sharing. Advanced Reports can expose the report as a web service with the click of a check box. • Matrix Report: A Matrix Report provides the foundation for multi-dimensional analysis. It can summarize data based upon the object data model. The resulting matrix is displayed as a table and/or chart that users can drill through to see the associated detail. You can control the detail data that users see when they drill down by selecting the desired fields when defining the report. Matrix reports provide additional features including filtering, run time prompts, Worklets and report sharing. • Search Report: A Search Report displays search results based on values selected for faceted filters on the report.
• Trending Report: A Trending Report reports on and analyzes trends in worker data such as headcount and attrition. By using either Standard Reports or Custom Reports, you can analyze important trends in your workforce directly in Workday without the need for a third-party analytical tool • Transposed Report: A Transposed report interchanges the rows and corresponding columns on the report for optimal display.
• nBox Report: An nBox Report summarizes and encapsulates employee talent data in a configurable visual box format.
• Composite reporting. Composite reports are primarily targeted for financial analysis and can combine data from multiple data sources into a single report by using sub reports. • Discovery Board: Workday also offers the ability to do data visualization, to build reports by Drag & Drop to analyze the data in real time.
• Worksheets: Worksheets are an excel-like interface to allow for spreadsheet creation and collaboration with real-time data, all within Workday's single security model.

Reports created with the Workday Reporting Framework can also be utilized as outbound integrations - either synchronous or asynchronous web services.

City of Santa Maria
Enterprise Resource Planning (ERP) Software
and Implementation Services
November 14, 2022

Collaborative Solutions, LLC. Proprietary & Confidential 146

Collaborative Response:

Form D: Report Development Form

43. What is the query tool and report writer that Vendor is proposing? Workday has several reporting tools, each designed for specific use cases. Please see the “Reporting Tools Comparison 2022R2.pdf” document in the Appendix C: Additional Information.

44. What reports are available out of the box? Provide a list here and samples at the end of this section.

Workday provides over 4,000 standard reports that can be used out of the box or potentially copied and used as the starting point to create customized reports.

The Report Writer tool allows authorized users the ability to create several unique types of reports such as:
• Simple
• Advanced
• Matrix
• Trending
• Transposed
• nBox
• Search
• Composite
Reports in Workday are intended to be interactive or “actionable” in the sense that the data returned is often a hyperlink with drillable functionality.

In addition to the Report Writer tool, Workday has recently introduced a new reporting tool known as Discovery Boards, which allows users to use a drag and drop interface to quickly analyze data and easily convert to dashboards and scorecards. This tool, which was initially designed for the data scientists, can also serve the purpose of an intuitive drag and drop interface to support basic ad hoc queries.

A representative list of available delivered reports and a collection of report samples are both available in the Appendix C: Additional Information (Workday 2022R1 Standard Report Examples and Workday 2022R1 Standard Report Listing).

45. Describe your process for determining the scope of what reports will have to be developed (not out-of-the- box) and what effort it will take to develop and test them? Effective use of Workday’s reporting capabilities can be a key differentiator between a satisfactory implementation and a highly successful one. To prepare for addressing your reporting needs, the Strategic Implementation Planning engagement includes a Strategic Readiness Workshop on Reporting & Analytics.

Findings from that session are incorporated with related areas such as Integrations, Foundation Data Model, and Job Architecture to provide a “big picture”, data-centric understanding of what City of Santa Maria’s reporting requirements will be.

In this phase we review required regulatory reports, executive reports, management reports and establish your approach to dashboards. Clients begin the process of documenting their specific reporting scope using

City of Santa Maria
Enterprise Resource Planning (ERP) Software
and Implementation Services
November 14, 2022

Collaborative Solutions, LLC. Proprietary & Confidential 147

43. What is the query tool and report writer that Vendor is proposing? the Collaborative Report Tracker which will continue through the implementation. Reports are prioritized to ensure that go-live critical reports are developed first.

During the Architect phase, reports which represent key business requirements will be addressed and documented. These requirements may be met either by configured Workday functionality or by reports. Some custom reports will be built by functional consultants as the solution for a given business requirement. Clients send designated resources to Workday report writing training and develop most reports internally. This development typically occurs during the Configure & Prototype and Testing stages of the project. Collaborative recommends that all report development be completed in time for the reports to be accurately tested during the relevant testing cycle.

Cynergy™ methodology also includes documentation of reporting and calculation field naming standards to be followed by both Collaborative and client resources to ensure reporting clarity and accuracy.

A limited number of Collaborative’s consulting hours are typically specified as dedicated to report writing and may be used for assistance on complex reporting or to guide the overall reporting effort.

Following numerous requests from our clients over the years for us to develop dashboards and scorecards, we decided to create a pre-packaged Workday Advanced Report Dashboards & Analytics offering. We have essentially taken the best-of-the best of the Workday dashboards and scorecards that we have created and have developed three offerings: HCM, System Administration and Financials. This optional offering is unique in the Workday ecosystem and can provide City of Santa Maria leadership and management teams with real-time analytics to facilitate strategic and operational decisions.

City of Santa Maria
Enterprise Resource Planning (ERP) Software
and Implementation Services
November 14, 2022

Collaborative Solutions, LLC. Proprietary & Confidential 148

• Training Form
Form E: Training Form
Workday Response:

46. What is your recommended approach to training (End-user, train the trainer, hybrid approach), for the City, and why?
Workday has provided descriptions of our training elsewhere in this response. Workday recommends that your Functional Leads / Project Team be trained by Workday by using Workday’s Learn In Person / Learn Virtual / Learn Independent Training by utilizing the proposed Training Credits.

This approach gets your Project Team up to speed quickly and in a timely manner so that they can be maximally effective in deploying the Workday software.

Members of your Functional Lead Team, and perhaps your Training Resource (if you have one) will work with Collaborative Solutions to develop End User Training. This is a bit of a hybrid Train the Trainer approach, but it has been very successful for both Collaborative Solutions and Workday. The Adoption Kit is used for the purpose of training End Users.

Workday’s Learn On Demand libraries are used for periodic refresher training or topic focused training for your Workday System Administrators and Support staff.

47. What types of training documentation will be developed by the Vendor? Workday provides online documentation and page-specific help on virtually every page in our application.

Training materials are provided for all Learn Virtual and Learn Independent courses. These training materials are provided in an eBook format. Training materials may only be used to support the specific, intended training activity and may not be duplicated without Workday’s prior written consent.

48. Describe the opportunities for ongoing training.

Learn On-Demand, Learn Virtual, and Learn Independent course offerings are designed for ongoing learning within your organization on the Workday system. These targeted role-based offerings will allow your employees to understand the principles, functionality, and processes associated with the following areas:
• All Workday Products/SKUs
• Integrations
• Reporting and Analytics

49. Describe online training options.

Workday has made all training available virtually to meet COVID restrictions. Here is a list of our training delivery methods:

Workday Education Courses and Delivery Methods:

Workday Education offers a variety of options to meet your training needs, including the following:

Learn Virtual provides the advantages of live instructor-led training without the expense and time associated with travel. These courses are a combination of lecture, demonstration, and hands-on

City of Santa Maria
Enterprise Resource Planning (ERP) Software
and Implementation Services
November 14, 2022

Collaborative Solutions, LLC. Proprietary & Confidential 149

activities to reinforce learning. Attendees participate remotely through Zoom and connect to our training environment via the Internet to complete the hands-on activities. These offerings are topic- specific and designed to focus on key Workday principles and functionality.

Learn Independent enables our customer to be more self-sufficient. This learning experience combines videos, interactive exercises, quizzes, and tests into a comprehensive online learning curriculum that students can complete at their own pace.

Learn On-Demand is a cost-effective alternative to traditional education delivery, providing access to training 24/7 from any computer. Created in short, targeted segments, Learn On-Demand is perfectly suited for system administrators who need immediate access to specific training. These offerings are topic-specific and designed to focus on key Workday principles and functionality.

Adoption Kit is a collection of templates and resources designed to support and accelerate end-user training and your Workday rollout. It includes a combination of hosted or downloadable videos, job aids, facilitation guides, and marketing materials. All content can be downloaded and tailored to your needs or used as-is.

Workday Pro is a customer-focused accreditation program targeted at customers who want to actively engage and work side by side with the Ecosystem on a path to develop a similar level of knowledge and expertise. It consists of a number of tracks, each with relevant courses plus a written test.

Form E: Training Form
Collaborative Response:

46. What is your recommended approach to training (End-user, train the trainer, hybrid approach), for the City, and why?
End-user training is a fundamental component of our Organizational Change & Training (OC&T) methodology. Our traditional training approach is to provide training tailored to end users and other stakeholders, dependent on the specific roles and business functions they perform. Prior to training, the end users and managers receive communications about the new technology and business processes to build their awareness and enthusiasm about the upcoming changes.

The first step in our training development methodology involves developing an End-User Training Strategy, which serves as a roadmap for all training activities. Collaborative and the City of Santa Maria would jointly define the training philosophy to ensure that the most effective education for the City of Santa Maria environment is delivered to end users.

Following the development of the End-User Training Strategy, we conduct thorough assessments of each client's needs during Architect Workshops and Customer Confirmation Sessions, and with that information derive a detailed Training Needs Assessment. These assessments are validated with the client functional team leads and project management prior to building a detailed Training Curriculum Plan for the various end-user populations. We have found that applying a range of training methods works best for most of our clients.

Once training methods have been selected and a meaningful amount of training materials drafted, clients may also elect to have Collaborative assist in User Experience Sessions (UES). While not a form of testing, UES generally occurs during the Test Stage to take advantage of the general stability of most configuration expected by that time. UES focuses on true end-user populations who have not yet been exposed to Workday. During UES, participants do not have the ability to change the system. Instead, we create an "experience" for end-users to explore the system and build their first impressions. The goal of

City of Santa Maria
Enterprise Resource Planning (ERP) Software
and Implementation Services
November 14, 2022

Collaborative Solutions, LLC. Proprietary & Confidential 150

UES is to pilot the system with a group of users who have had no prior exposure to gain an additional, candid perspective on how the new system will be received and whether it is meeting overall end-user project objectives. Feedback from UES also allows the OC&T workstream to pressure-test initial training materials. Combined, this information helps the training team identify and drive focused revisions and adjustments to training materials and plans, in turn ensuring the maximum impact and benefit of your training program.

The following outlines a hybrid approach and various types of end-user training delivery method options we would recommend for the deployment of Workday:

Train-the-Trainer:
• Provides tools and expertise to City of Santa Maria’s in-house functional and/or training teams, allowing for enhanced knowledge transfer, flexible deployment, and ongoing internal training capacity
• Client must provide training resources
• Customized On-Demand Training Videos:
• Can pair with objective assessment tools to determine the level of the end-user’s comprehension of the delivered material
• End-users can view on-demand and as needed to support their successful completion of transactions in Workday
• Webinars/Presentations to Introduce City of Santa Maria Specific Configuration and Processes:
• Large audience can receive the same message at the same time over a broad geographic area • Reduced delivery cost
• Not repeatable unless recorded
• Job Aids & Quick Reference Guides:
• Resource documentation used to aid in learning new processes and troubleshooting • Can be linked within Workday system, providing support at the point of need • Must be updated as system changes occur to remain relevant

47. What types of training documentation will be developed by the Vendor? Collaborative's approach to training is to provide you with materials that serve as preparation during the initial Workday rollout and to provide enduring value to The City of Santa Maria after the initial transition is complete. Point-of-need resources like quick reference guides and job aids typically constitute a large portion of the training collateral that will be developed, followed closely by modular, reusable presentations that you can adapt into eLearning resources or LMS modules, such as Train-the Trainer presentations and collateral. These training materials become on-demand references for your workforce after you go live with Workday, and many of our clients choose to include them within new employee onboarding plans and function-specific trainings for new members of their HR organization.

Our training materials are developed in standard, broadly available formats such as Microsoft Word, and the City of Santa Maria’s project team will be provided with editable versions of any training collateral so you can easily maintain and update your training materials as needed for Workday updates or new functionality you deploy in the future.

48. Describe the opportunities for ongoing training.

City of Santa Maria
Enterprise Resource Planning (ERP) Software
and Implementation Services
November 14, 2022

Collaborative Solutions, LLC. Proprietary & Confidential 151

All training materials provided or developed as part of your Workday deployment will be owned by the City of Santa Maria to update and utilize for ongoing training post-deployment. Additionally, training offerings are available as both ad-hoc services supplied through a Lean-On services contract, or in conjunction with the structured deployment of new Workday features and functionality.

49. Describe online training options.

Given the current climate, we have recent experience in successfully holding all Train-the-Trainer sessions virtually rather than in-person. Virtual training sessions may be a desirable option in some cases regardless of the ability to travel. Collaborative recommends the following when conducting training virtually:
• Sessions will be no more than 2-3 hours in length. This may mean users must attend multiple sessions to gain all necessary instruction
• Class size will be no more than 40 participants to ensure ample instructor/participant interaction, and support for hands-on practice activities during the virtual session • A client IT resource will be on hand to troubleshoot non-Workday technical issues as they arise • Follow up virtual open labs may be scheduled to allow participants additional time to practice in a training tenant and ask questions
• Quizzes will be included throughout the training to ensure participant engagement

Collaborative will work with the City of Santa Maria to determine if virtual training sessions will be utilized rather than in-person training sessions based on the ability for trainers and participants to travel at the time training is executed as well as feasibility of travel given the participant geography.

Collaborative also has expertise in developing and deploy training videos along with eLearning courses as a form of online training. These types of training allow participants the opportunity to complete training within their schedules and can allow for tracking completion rates.

City of Santa Maria
Enterprise Resource Planning (ERP) Software
and Implementation Services
November 14, 2022

Collaborative Solutions, LLC. Proprietary & Confidential 152

• Staffing Plan Form
Form F: Staffing Plan Form

43. Assuming health restrictions permit doing so, identify the degree to which Vendor staff will be onsite versus off-site during the project.

Due to the cloud-based nature of Workday and our clients' desire to keep travel-related expenses to a minimum, our typical ratio is 30% onsite and 70% remote. That said, Collaborative is very client-focused and flexible in this area and will modify our ratio based on what works best for City of Santa Maria. Our Engagement Manager will work with your Project Manager to determine the optimal ratio for onsite services for City of Santa Maria.

44. Use the table provided below to identify the number of the City business staff expected to be committed to the project implementation. Initial identification of project roles has been provided but should be supplemented or revised by Vendors based on their experience in implementing their product in similar environments.

Project Role Project Responsibilities FTE
51a. Executive Sponsor(s) • Obtaining appropriate funding and approvals. • Ensuring all appropriate resources are available for
the project.
• Resolving issues that are impeding the progress of
the project.
• Providing overall direction to the City Project
Manager.
• Sign-off on key deliverables/project milestones.

Assuring project delivery and quality control.
☐
51b. Project Manager The City Project Manager is a dedicated resource focused, specifically on the Workday implementation.

While we understand there are many other activities
linked to the implementation, this resource needs to be dedicated full-time to the project. Responsibilities
include the following:
• Establishing and managing the project details,
deliverables, schedules, tasks, assignments, and
execution.
• Coordinating business teams and support teams.
• Driving the implementation of the optimized
processes.
• Managing the resolution of issues.

Anticipating and resolving issues that could impact the project budget, schedule, scope, or quality.
☐

City of Santa Maria
Enterprise Resource Planning (ERP) Software
and Implementation Services
November 14, 2022

Collaborative Solutions, LLC. Proprietary & Confidential 153

51c. Project Administrator ☐
51d. Functional Process
Owners
Functional Team
(Global Process Owners, Process Leads and
SMEs/Business Analysts)
Business Analysts are those familiar with the City’s
business processes and systems. These individuals
provide information to the Collaborative Principal
Consultant(s) to configure the Workday solution.

Responsibilities include:
• Communicate functional requirements that need
to be configured in Workday.
• Describe current business processes and work
with team to simplify and improve.
• Work with Collaborative Principal Consultant to
help map and load data into Workday.
• Actively participate in all testing activities.
• Validate data converted into Workday solution.

Perform end-user training.
☐
51e. Functional Process
Team Participants (per
member involvement)
See 51d
☐
51f. Training Coordinator
Team Lead
The Training Lead is focused on planning and executing
the end-user training activities for the City. He or she is the primary counterpart to Collaborative Training Lead
and is responsible for providing primary insight into the City’s training resources and references, as well as
competing projects or interests related to end-user
training. The Training Lead is the primary liaison
between the project team and other internal resources
needed to plan, execute, and deploy the various
training-related deliverables. As needed, the City may
choose to assign Organizational Change Lead and the
Training Lead roles and responsibilities to a single
resource.
☐
51g. Change Management
Team Lead
The Organizational Change Lead is focused on planning
and executing the change management and
communications activities for the City. He or she is the primary counterpart to the Collaborative Organizational Change lead and is responsible for providing primary
insight into the City’s culture, operations, and
competing projects or interests. The Organizational
Change Lead is the primary liaison between the project
team and other internal resources needed to execute
☐

City of Santa Maria
Enterprise Resource Planning (ERP) Software
and Implementation Services
November 14, 2022

Collaborative Solutions, LLC. Proprietary & Confidential 154

and deploy the various change management and
communications activities. He or she is responsible for reviewing and approving all change management and
communications-related deliverables.
51h. Communications Team
Lead
See 51g ☐
51i. Other Roles Technical Team
(Integration Lead, Integration Engineers/ Developers,
and Data Conversion Specialist):

Technical resources perform the following:
• Support the conversion and loading of data
contained in existing systems.
• Design and develop custom integrations outlined
in the SOW.
• Develop custom reports.

Test Lead:

The Test Lead develops and manages the overall City’s
Test Strategy and Plan, conducting overall execution of the Client prescribed End-to-End (including
Integrations), UAT, and Parallel test process for either Workday Payroll or Payroll Interface from start to end of the test period. The Test Lead is responsible for
successfully managing defect resolutions; resolving test issues via coordination of City and Collaborative test
teams as required to complete testing on tenant for
successful completion of Workday test; and the overall
test strategy outlines, test approach, roles and
responsibilities, test tools, scenarios by tester and
success criteria for each of the test stages. The Test Lead may also support the Collaborative Data Consultant with data validation activities associated with test and tenant development.

Internal Auditor
The Internal Auditor works with the Project Team to
ensure proper procedures are followed and proper
documentation is created for the implementation of
Workday. This person is responsible for providing
compliance-related guidance and expertise to the
Project Team.

Training, Communications, and Change Management
Support Resources
Depending on the specific strategies and plans the City establishes as part of its Organizational Change &
Training program, additional City resources will be
needed at various times throughout the project
☐

City of Santa Maria
Enterprise Resource Planning (ERP) Software
and Implementation Services
November 14, 2022

Collaborative Solutions, LLC. Proprietary & Confidential 155

lifecycle to support and execute the communications,
change management, and training plans. These roles
often include:
• Training Developers responsible for developing
and revising the end-user training collateral as
defined in the Training Curriculum Plan.
• Communications Leads/Developers responsible
for developing, revising, and deploying the end-
user communications collateral as defined in the
Communications Plan.
• Trainers and Super Users responsible for gaining
advanced familiarity with the new systems and
user support tools, and in turn planning and
delivering pre-Go-Live and ongoing training to
end-user audiences.

Change Champions responsible for generating
awareness and support around future changes within
their designated areas of influence.

52. Use the table below to identify the number of technical resources expected to be committed to the project implementation. Initial identification of project roles has been provided but should be supplemented or revised by Vendors based on their experience in implementing their product in similar environments.

Project Role # of FTEs Skill Set
Required
Training
Required?
Training
Provided?
52a. Help Desk The role of Help
Desk will be
discussed during
the
implementation.

Collaborative
Solutions
expects the
City of Santa
Maria SMEs to
be well versed
in their area.

Training is not
required but
recommended.

Collaborative
Solutions
expects the
City of Santa
Maria SMEs to
be well versed
in their area.

Training is not
required but
recommended.

Training will be
provided based
on your
Workday
subscription. In
addition, hands-
on experience
and knowledge

City of Santa Maria
Enterprise Resource Planning (ERP) Software
and Implementation Services
November 14, 2022

Collaborative Solutions, LLC. Proprietary & Confidential 156

transfer
sessions will be
conducted
throughout your
implementation.
52c. DBA DBA is not a role
on a Workday
implementation,
unless the City of
Santa Maria
requires one to
extract their data
from legacy
Collaborative
Solutions
expects the
City of Santa
Maria SMEs to
be well versed
in their area.

N/A N/A
52d. Report Developer Please see table
below for overall
project level of
effort.

Collaborative
Solutions
expects the
City of Santa
Maria SMEs to
be well versed
in their area.

Training is not
required but
recommended.

Collaborative
Solutions
expects the
City of Santa
Maria SMEs to
be well versed
in their area.

Training is not
required but
recommended.

Training will be
provided based
on your
Workday
subscription. In
addition, hands-
on experience
and knowledge
transfer
sessions will be
conducted
throughout your
implementation.
52f. System Administrator Please see table
below for overall
project level of
effort. The
specific
expectations of
the System
Administrator will
Collaborative
Solutions
expects the
City of Santa
Maria SMEs to
be well versed
in their area.

Training is not
required but
recommended
Training will be
provided based
on your
Workday
subscription. In
addition, hands-
on experience
and knowledge

City of Santa Maria
Enterprise Resource Planning (ERP) Software
and Implementation Services
November 14, 2022

Collaborative Solutions, LLC. Proprietary & Confidential 157

be discussed
during the
implementation.
transfer
sessions will be
conducted
throughout your
implementation.
52g. Security Administrator The role of
Security
Administrator will
be discussed
during the
implementation.

Collaborative
Solutions
expects the
City of Santa
Maria SMEs to
be well versed
in their area.

Training is not
required but
recommended.

Collaborative
Solutions
expects the
City of Santa
Maria SMEs to
be well versed
in their area.

Training is not
required but
recommended.

Training will be
provided based
on your
Workday
subscription. In
addition, hands-
on experience
and knowledge
transfer
sessions will be
conducted
throughout your
implementation.

City of Santa Maria
Enterprise Resource Planning (ERP) Software
and Implementation Services
November 14, 2022

Collaborative Solutions, LLC. Proprietary & Confidential 158

• Ongoing Support Services Form
Form G: Ongoing Support Services Form
Support and Maintenance

53. Provide the minimum, maximum, and average response times (hours) provided as part of the basic support agreement and average actual response time for the past twelve (12) months.

Workday has a very specific set of service level agreements that apply to all customers. Availability of Workday production environment at the data center connection point is committed to meet or exceed

99.7%. Service Availability for a given month is calculated as a percentage equal to [(# of minutes the Workday Production System is available in the month – number of minutes of Scheduled Downtime during the month) / (total number of minutes in the month – number of minutes of Scheduled Downtime during the month)]. All service disruptions outside of regularly scheduled maintenance counts against the availability SLA. Workday monitors every tenant for availability and alerts our operations staff if there are any issues. Workday also monitors performance of every request, and alerts are issued when responses are slow or resulting in errors. Trends are proactively monitored before they become problems.

Our SLA states that >50%* of transactions will process within 1 second, and that no more than 10% of transactions take greater than 2.5 seconds to process. Our SLA also covers our Disaster Recovery and Updates strategy. Workday commits that in a service outage requiring a failover to a separate data center, the total length of the outage (RTO) will not exceed 12 hours and the recovery point (RPO) will not exceed 1 hour. Updates are applied during planned outage windows.

Workday provides a Case Response time SLA as follows: Response Time is the period from the time the Production case was logged in the Customer Center until Workday responds to Customer and/or escalation within Workday, if appropriate.
• Severity Level 1 < 30 Minutes
• Severity Level 2 < 1 hour
• Severity Level 3 < 4 hours
• Severity Level 4 < 24 hours
• Severity Level 5 < 24 hours
Workday's service level commitments are set out in the Workday Production Support and Service Level Availability Policy (SLA) (located at
https://www.workday.com/en-us/legal/contract-terms-and- conditions/index/exhibits.html).
*Not applicable to Workday Adaptive Planning or Workday Strategic Sourcing.

54. Describe Help Desk services for technical support and end users. Specify days and hours and any escalation options and procedures.

Collaborative does not offer a help desk phone number; however, you will be in regular contact with your dedicated Engagement Manger via email/phone.

55. Identify the party or business unit that is responsible for the support options provided above.

City of Santa Maria
Enterprise Resource Planning (ERP) Software
and Implementation Services
November 14, 2022

Collaborative Solutions, LLC. Proprietary & Confidential 159

Support and Maintenance
Collaborative Solutions’ Continuous Value Services group is responsible for the support options described above.

56. Provide the following regarding the number of business staff the City should expect to be committed to providing on-going application support:
• Role
• Responsibility
• Estimated time commitment in terms of FTE time

Role Responsibility Estimated commitment in FTE
Collaborative Solutions customers have an average of 2-4 employees supporting Workday. Management Application
Services provide for Staff Augmentation for short term support. Staff Augmentation is used when a customer wants to supplement their internal Workday Team in a full-time capacity during periods of resource constraints such as during transition times of attrition or during leaves of absence.

Determining the ideal number of business staff members required to appropriately support Workday once in Production is dependent on several variables which make it inadvisable to provide a concrete estimate during pre-sales. These variables include things such as the desired level of involvement of functional area professionals in contributing to the ongoing support of the system, the level of IT involvement appropriate for a given customer, the complexity of the configuration decisions made by the customer, the nature of the consumer-provider relationship between IT and their internal customers, organizational philosophy, and the project justification itself.

Collaborative’s Advisory team guides customers through evaluating these and other decision points in our Service Delivery Model and Production Governance offerings which are designed to complement our implementation services and prepare customers to get the most out of their implementation. In these offerings, we incorporate discussion of roles and responsibilities involved in properly maintaining and leveraging your Workday system. Collaborative’s recommended guidance on questions related to specific numbers and types of supporting resources is to thoroughly evaluate your Workday Support Model within the context of your broader Service Delivery Model to be sure the appropriate resources are leveraged in both the business and IT.

57. For ongoing IT staff resources, please provide the following information:
• Type of positions required (e.g., help desk, trainer, DBA, report developer, application support, system administrator, security administration, etc.)
• Number of FTEs within each position

City of Santa Maria
Enterprise Resource Planning (ERP) Software
and Implementation Services
November 14, 2022

Collaborative Solutions, LLC. Proprietary & Confidential 160

Support and Maintenance
• Skill sets required for each position
• Training required and whether the Vendor provides this training

Posit
ion
# FTE Skill Sets
Required
Training
Required
Vendor
Training
Determining the ideal number of business
staff members required to appropriately
support Workday once in Production is
dependent on several variables which make it
inadvisable to provide a concrete estimate
during pre-sales. These variables include
things such as the desired level of
involvement of functional area professionals
in contributing to the ongoing support of the
system, the level of IT involvement
appropriate for a given customer, the
complexity of the configuration decisions
made by the customer, the nature of the
consumer-provider relationship between IT
and their internal customers, organizational
philosophy, and the project justification
itself.

58. It is anticipated that all system updates, security updates and release patches will be applied in a timely manner. For any on-premises components these should be easily downloadable, if applicable.

An accumulation patch process is desired. Provide information on how software updates are received, processed, and distributed, including but not limited to:
58a. Use of tools to deploy new versions and patches
Release Management Services (optional)
Activity Functional Scope/Support Activity Detail
Release Management  • Preparation Pack
• Release Packs
• Detailed Showcase
• Audit Reports
• 2 Hour personal review per release

58b. Additional information

City of Santa Maria
Enterprise Resource Planning (ERP) Software
and Implementation Services
November 14, 2022

Collaborative Solutions, LLC. Proprietary & Confidential 161

Support and Maintenance
N/A

59. Do you limit the number of City staff who can call in for ongoing support? If yes, explain your model and how additional staff can be included? If there is no limitation, the maintenance agreement should clearly state this fact. Are you agreeable to include such language in our contract? We do not limit the number of staff who can call in for ongoing support. Including such language in our contract is permissible.

60. Describe the types of support needed to keep the product under current support and to keep the product up-to-date.

Workday Respoken:

At Workday, we're uniquely positioned to take advantage of innovations from the industry’s most visionary technology teams. For you, that means continuously evolving solutions aimed squarely at meeting your current needs and anticipating what’s next. Workday utilizes a continuous update model that provides two major feature releases per year and performs smaller service updates throughout the year. In our Cloud model, all customers are updated to the most current release of the system, and the Support organization is available at any time should the need arise

Collaborative Response:

Differentiators for Our Continuous Value Services
Collaborative’s Workday Continuous Value Services (CVS) Practice is dedicated to supporting Workday Customers that are in production. Although our CVS practice often collaborates with our primary professional services organization, they are exclusive, separate, and dedicated to providing support for existing Workday customers. We are committed to driving self-sufficiency for our customers in an efficient, scalable, and value driven model. Knowledge Transfer is key to our joint success and incorporated into our standards of delivery.

We work with our customers to target “high value” support opportunities. This means we focus on efforts which will drive stabilization followed by optimization across all deployed Workday Functionality rather than operating primarily in a traditional help desk model that focuses in on “break/fix”. While a limited amount of break/fix is unavoidable in a system as dynamic as Workday, our vast experience supporting Workday customers has led us the belief that both integration and functional support should evolve towards targeting ongoing enhancements, support of optimization efforts, and adapting to changing business requirements. Doing so moves our customers from operating in a reactive, legacy ERP manner to proactively increasing the value realized from their Workday investment.

We are now offering our CVS Global Service Delivery Enablement Gold package that provides comprehensive support throughout your Workday journey. The value of the deliverables within this

City of Santa Maria
Enterprise Resource Planning (ERP) Software
and Implementation Services
November 14, 2022

Collaborative Solutions, LLC. Proprietary & Confidential 162

Support and Maintenance
package represent over 1000 hours of effort, the majority of which will be executed by onshore resources. Our services are grouped into five areas:
• Customer Experience Management
• Workday Support Services
• Release Management Services
• Reporting and Integrations Management Services
• Advisory and Optimization Services

CVS Service Delivery Enablement- Optional Services
Customer Experience Management
Activity Functional Scope/Support Activity Detail
Portfolio Management  • Service delivery management
• Metric and usage reporting
• Ticket management and Escalation Management
• Change orders and enhancement requests
• High touch personalized engagement mutually defined with Customer
• Quarterly initiative check-ins and Semi-Annual Account Reviews • Ongoing leadership oversight
• Partnership for future initiatives and road-mapping
• Bi-weekly Financial Reporting
Onboarding/Knowledge
Transfer (KT)

• Completion of Collaborative onboarding documentation
• Completion of Customer support workbook to facilitate Knowledge transfer
• Wishlist collection
• Sales to Service
• Ticketing system setup and training
• Squad Assignment
• Customer Kickoff Meeting
Functional Architect • A dedicated resource in order to validate cross-functional impacts, review tickets, and work with the consultants to ensure the best outcomes for the customer.

Workday Support Services
Activity Functional Scope/Support Activity Detail

City of Santa Maria
Enterprise Resource Planning (ERP) Software
and Implementation Services
November 14, 2022

Collaborative Solutions, LLC. Proprietary & Confidential 163

Support and Maintenance
Consulting Lean-On
Hours
• Workday Support and Troubleshooting
• New Functionality Review
• Reporting and Integrations
• Workday Solution Optimization
• Knowledge Transfer
• Organizational Change and Training (OC&T) Post-Production Services • Note: Strategy hours/consulting may be used, a rate conversion will need to occur
Release Management Services
Activity Functional Scope/Support Activity Detail
Release Management  Preparation Pack
Release Packs
Detailed Showcase
Audit Reports
2 Hour personal review per release
Reporting and Integrations Management Services
Activity Functional Scope/Support Activity Detail
Integrations Support  • Collaborative to offer an annual Integrations Health Check across all of Customer’s integrations. The integrations will be reviewed for efficiency and to ensure they are functioning properly. • An integrations dashboard for the Customer to continuously monitor integrations.

Advanced Reporting
Dashboard

• Advanced Dashboard built with nearly 60 deployed reports • Including areas:
• HCM
• System Administration
• Financial Management (opt)
Advisory and Optimization Services
Activity Functional Scope/Support Activity Detail
Workday Roadmap
Planning and Strategy
• Facilitated alignment of vision, stakeholder value perceptions, goals, and success outcomes and measures

• Joint prioritization of roadmap items based upon bandwidth and goal alignment
• Reporting to support roadmap activities
Governance Model
Workshop
• Alignment with executive leadership

City of Santa Maria
Enterprise Resource Planning (ERP) Software
and Implementation Services
November 14, 2022

Collaborative Solutions, LLC. Proprietary & Confidential 164

Support and Maintenance
• Outline how to enable business leaders and decision makers • Define processes for break/fix support, enhancements, and feature release uptake
User Adoption and
Reinforcement
• User adoption diagnostic and results
• End-user adoption and sustainment white paper
• Top Ten (10) Workday delivered reports for adoption and remediation
• Personal Remediation Consultation of up to 40 hours
Annual Event Planning  • Guidebooks to support Affordable Care Act (ACA), Open Enrollment, Year End, Advanced Compensation, and Talent and Performance • Two (2) Personal Module Reviews across the different functional areas of Workday
Tenant Analysis and
Plan (TA&P)

• Provide analysis and optimization recommendations on
two (2) modules within a tenant e.g. HCM, Recruiting,

61. Do you need remote access to the server to support/maintain it? If yes, describe the method(s) and security used.

Workday Response:

Workday uses a screen sharing tool to share desktops between a support analyst and a customer if we need to work together on a problem. We also have a special support role which can access your Sandbox and Production systems, if needed, for problem diagnosis. Access using this special support role is controlled by the customer.

All data transfers are performed using SFTP protocol. All the laptops that are used by the consultants are fully encrypted with pre-boot password protected encryption. Data is hosted by Workday and is encrypted before it is written to the database.

We use a public/private key pair to authenticate with our SFTP server. Client data is transmitted using only SSH. All our consultant’s laptops have full disk encryption. Keys are assigned to an individual and it is managed by our IT department. The key is associated to the specific client project once approval for the access has been granted.

62. Do you offer post-go live support? If so, what is the duration? Continuous Value Services
Upon going live, our clients often seek to continue to expand the partnership by leveraging one or more of our Workday support and optimization services within Collaborative’s Continuous Value Services offering (CVS). Whether the client is looking for assistance on functional or technical Workday support activities, targeted optimization of owned but not yet deployed Workday functionality, or the deployment of brand-new Workday functions, Collaborative has demonstrated success in all facets of

City of Santa Maria
Enterprise Resource Planning (ERP) Software
and Implementation Services
November 14, 2022

Collaborative Solutions, LLC. Proprietary & Confidential 165

Support and Maintenance
post Go-Live Workday engagements. Our ability to deploy and support the entire Workday Platform allows us to be a one-stop shop for any Workday-related engagements for your organization.

Collaborative is a leading global provider of Workday full platform post-production services with true flexibility and a knowledge transfer approach proven to drive client self-sufficiency. Offers also include strategic roadmapping, post deployment governance services, and comprehensive Workday Organizational Change & Training Services to make the most of your Workday investment.

We are committed to driving self-sufficiency for our customers in an efficient, scalable, and value driven model. CVS contracts are 1-3 years long. At the end of each contract an evaluation is made with the client to determine if the client is self-sufficient or if a renewal contract should be considered.

City of Santa Maria
Enterprise Resource Planning (ERP) Software
and Implementation Services
November 14, 2022

Collaborative Solutions, LLC. Proprietary & Confidential 166

Support and Maintenance

63. Will the vendor contractually agree to the following? Contractual Inquiry Term Condition Yes No
66a. Provide staff for training and implementation ☒ ☐
63d. Ongoing cost for software modules is waived until the implementation phase for the given modules begins
☐ ☒
Comments:

Software Updates and Distribution Workday Response:

64. Describe the product release cycle including:
64a. Frequency of upgrades/enhancements or new versions (major and minor version releases) At Workday, our goal is to deliver functionality at a rapid pace to provide you with the functionality and enhancements you need, while being mindful of your busy schedules and mission critical business processes.

Below we provide further insight into what is appropriate for delivery in a Weekly Service Update and in contrast what we will target for a Feature Release.

Weekly Service Update
• Net new features or enhancements to existing functionality • Minor UI modifications (e.g., field spacing, font sizing, text shading, drop-shadow weight) • Architecture and Data Center improvements
• New capabilities like the ability to cancel a background report • New Reporting components (Report Fields and Report Data Sources) • New web services or updates to existing web services
• Payroll Compliance Updates
• Bug fixes

City of Santa Maria
Enterprise Resource Planning (ERP) Software
and Implementation Services
November 14, 2022

Collaborative Solutions, LLC. Proprietary & Confidential 167

Support and Maintenance
• All of the above are documented in the Weekly Service Update Notes Feature Release
• Net new features
• Enhancements to existing functionality, including UI improvements • New web services or updates to existing web services
• Bug Fixes
• New Products
• A 5-week preview window leading up to the Feature Release date to test, plan and build communications for the upcoming release
Workday provides access to Preview tenants where we will continue to introduce features between Feature Releases. Preview tenants allow you to try out features and test alongside your own configurations, provide feedback to us, and learn about them in advance of their availability in Production.

64b. Contents of release
As a customer of Workday, you can gain access to the Workday Customer Community, our primary vehicle for customer communications including online forums and brainstorms. The Workday Community supports, educates, and empowers our customers by connecting them with peers and partners. Members share ideas and best practices through a variety of collaboration tools, including contributed solutions, forums, and user groups. And if customers have great ideas for product enhancements, they can let us know. In fact, we've put more than 5,200 brainstormed ideas into the product. It’s a model of shared success that’s only possible with our unique technology platform. The Workday Community is a private community exclusively available to Workday customers and implementation partners.

Workday provides several types of documentation intended to help you with various scenarios of supporting Workday:

1. Services Update Notes - we publish service update notes weekly to document fixed bugs. In addition, we include notifications of any enhancements delivered with the service update.

2. Announcing Workday - approximately one month before the Release Preparation window for a feature release, we publish early release notes under the title of Announcing Workday. o Announcing describes the most highly anticipated features and enhancements planned for the release.
o Announcing is not a comprehensive list of the features planned for the release.

3. What's New Report - is a standard Workday report that you can run in your Preview or Production tenant. What's New release notes provide information about new features and enhancements delivered to each tenant. We update the report weekly. o We notify you in the weekly service update notes when we add features or move features from Preview to Production.
o We created the What's New report to provide you with a source of information that you can easily download to a spreadsheet to help you plan and manage your testing of the release.

City of Santa Maria
Enterprise Resource Planning (ERP) Software
and Implementation Services
November 14, 2022

Collaborative Solutions, LLC. Proprietary & Confidential 168

Support and Maintenance

4. Workday Administrator Guide - is an extensive and detailed how-to guide for configuring and using Workday.
64c. How long release takes to implement
In the Workday application, Feature Releases are delivered twice a year, where all customers are updated to the most current version of the system.

To prepare for these Feature Releases, customers are provided perpetual access to a Sandbox Preview tenant where they are able to evaluate new functionality. New features, with the exception of security updates, are delivered in a "toggled off" state (disabled) in order to minimize impact to our customers.

This provides our customers the ability to evaluate and determine if and when to turn on new functionality for use in the Production tenant.

Patches and fixes are applied to all customer environments during weekly and monthly maintenance windows. Workday applies weekly patches, which typically takes a few hours, on Friday nights.

Because Workday customers are configuring their environment, rather than customizing with unique code and logic, Workday can deliver these patches and Feature Releases without disrupting customer environments. In this way, all customers of Workday are always update safe.

64d. Use of release notes
Please see the previous response.

64e. Backward version compatibility and support of back versions All Workday customers are always on the same version of the software. With each release, all customers are updated to the most current version of the system, so there are no back versions to support.
64f. Timeframe/policy on moving to new versions
Workday performs all of the tasks typically associated with a software upgrade and patching process on behalf of our customers. We refer to these as Feature Releases rather than upgrades to emphasize the difference. In the Workday application, Feature Releases are delivered twice a year, where all customers are updated to the most current version of the system. While updates are pushed out to all customers at the same time, most new features are delivered turned off and customers can enable them, at their leisure. The only exceptions to this are regulatory requirements.

Patches and fixes are applied to all customer environments during weekly and monthly maintenance windows. Workday applies weekly patches, which typically takes a few hours, on Friday nights.

64g. Automatic product upgrades or on demand
All Workday updates are automatic and completed by Workday staff in our operation center.

City of Santa Maria
Enterprise Resource Planning (ERP) Software
and Implementation Services
November 14, 2022

Collaborative Solutions, LLC. Proprietary & Confidential 169

Support and Maintenance
64h. Ease of implementation for City staff versus need to contract for services Workday performs all of the tasks typical to a traditional upgrade for all of our customers. There shouldn't be a need to contract for outside services. Once an update is officially released and available, all customer Sandbox Preview environments, which are replicas of their production system, are updated. All customer data, business process configurations, report definitions, etc. will have been tested and updated as part of the Workday process. Customers then have 5 weeks for testing the update prior to delivery to their production environment. There are two major updates a year, but compliance enhancements are pushed out throughout the year.

64i. Use of tools to deploy new versions and patches
Workday performs all of the tasks typical to a traditional upgrade for all of our customers. There shouldn't be a need to contract for outside services. Once an update is officially released and available, all customer Sandbox Preview environments, which are replicas of their production system, are updated. All customer data, business process configurations, report definitions, etc. will have been tested and updated as part of the Workday process. Customers then have 5 weeks for testing the update prior to delivery to their production environment. There are two major updates a year, but compliance enhancements are pushed out throughout the year.

64j. Additional information

Customizations

65. How can the City customize or configure the software directly without Vendor involvement? Workday provides configuration frameworks with the service that are available to customers to do their own configuration. In addition, customers who would like to extend the functionality can do so without Vendor involvement.

66. How are local customizations or configurations maintained when installing new releases of the Vendor’s software?
In the Software-as-a-Service environment, Workday strives to provide deep functionality and flexibility so that each organization can meet their requirements while maintaining a system that is customization-free. Workday’s focus is to maintain a strategy that allows us to provide cost-effective but flexible solutions and the ability to leverage new features and enhancements going forward.

Workday does not operate on a model of “customization” but rather configuration. Everything from branding to validation rules, to custom objects to Business Processes is available for configuration by a customer. These configurations – many of which would be considered “customizations” in the legacy application world – are retained seamlessly when Workday services are updated behind-the-scenes.

City of Santa Maria
Enterprise Resource Planning (ERP) Software
and Implementation Services
November 14, 2022

Collaborative Solutions, LLC. Proprietary & Confidential 170

Support and Maintenance
All Workday customers are on exactly the same version of the service and all customers are update to new versions at exactly the same time. Configurations are automatically brought forward to the new version without effort on the customer's part. Because they are configurations and not customizations, they do not break during the update process.

Workday provides details for new Feature Updates in the Release Center that is part of the Workday Community customer collaboration site. This provides details on new features, training videos, and other tools to prepare for the update.

• Client Reference Form
Client Reference Form
Vendor name: Collaborative Solutions & Workday
Customer name: City of Ontario, CA
Customer contact: Toni McNaughton
Customer phone number: (909) 395-2064
Customer E-mail address [email protected]
System which Solution Replaced PeopleSoft
Describe Nature of Project and Services Provided to This Client:

The City adopted Workday HCM in 2016. Workday services provided the original implementation and Collaborative Solutions came in to support the newly adopted HRIS platform. After 3 years of supporting the City, Collaborative won an RFP to implement Workday financials in 2021/2022. The City of Ontario went live on Workday Financials in July of 2022. Adopting Workday functionality like Budgets, Procurement, Business Assets, Workday Planning, Grants/ Projects, Inventory, etc.

Configuration of Solution Implemented (Hardware, Software):

No hardware necessary as Workday is completely SaaS. The city enjoys the full platform offered by workday to include all Human Capital Management, Payroll, and Financials.

City of Santa Maria
Enterprise Resource Planning (ERP) Software
and Implementation Services
November 14, 2022

Collaborative Solutions, LLC. Proprietary & Confidential 171

Vendor name: Collaborative Solutions & Workday
Customer name: City of San Mateo, CA
Customer contact: Rich Lee
Customer phone number: (650) 522-7102
Customer E-mail address [email protected]
System which Solution Replaced Tyler Eden
Describe Nature of Project and Services Provided to This Client:

Plante Moran was also selected by the City of San Mateo to assist with moving off Tyler Eden. Collaborative Solutions and Workday we selected as their as their new partner going forward. The city went live in early November 2022. San Mateo has been a fantastic customer to work with.

Configuration of Solution Implemented (Hardware, Software):

No hardware necessary as Workday is completely SaaS. The city enjoys the full platform offered by workday to include all Human Capital Management, Payroll, and Financials.

City of Santa Maria
Enterprise Resource Planning (ERP) Software
and Implementation Services
November 14, 2022

Collaborative Solutions, LLC. Proprietary & Confidential 172

Vendor name: Collaborative Solutions & Workday
Customer name: City of Kent
Customer contact: Kari Endicott
Customer phone number: (253) 856-4611
Customer E-mail address [email protected]
System which Solution Replaced JD Edwards
Describe Nature of Project and Services Provided to This Client:

The City of Kent came to Collaborative Solutions with the challenge of systemic processing errors in Time Entry and Payroll. We helped them move from their previous ERP (JD Edwards) to Workday by deploying HCM Core, Benefits, Talent, Compensation, Time Tracking, Absence, Payroll, Reporting, Integrations, Organizational Change & Training, and completing a Data Conversion. They initially chose Collaborative because of our customer focus and a culture fit with their team. Workday enabled them to standardize processes, policies, and data values across the city. We were on schedule and on budget throughout entire project. Close management of scope, deliverables, and deadlines was critical and this was a true partnership.

Configuration of Solution Implemented (Hardware, Software):

No hardware necessary as Workday is completely SaaS. The city enjoys the full platform offered by workday to include all Human Capital Management, Payroll, and Financials.

• For Vendors who are proposing a hosted solution, supply a copy of your Independent Service Auditor’s Opinion Letter from your most recent audit for SSAE 16 Type II.

N/A

* If a vendor includes a sub-contractor in their proposal response, each sub-contractor must complete this form.

City of Santa Maria
Enterprise Resource Planning (ERP) Software
and Implementation Services
November 14, 2022

Collaborative Solutions, LLC. Proprietary & Confidential 173

Section 13 - Addenda
Include all original, signed copies of addenda in this section.

City of Santa Maria, CA

Addendum 1
October 19, 2022

Addendum #1 – Responses to Questions regarding the Request for Proposal for ERP Software and Implementation Services released October 3, 2022.

The following changes/clarifications have been made to the original Request for Proposal.

Additional questions submitted prior to the response deadline will be answered in a separate addendum.

1. Question: We would like to request a 15-day extension of the due date to Tuesday, 11/22. This will provide adequate time to prepare our joint response with Oracle as well as get the hardcopy response to your office (along with the electronic copy).

Answer: The City has extended the proposal submission deadline to 11/14 at 5:00 PM Pacific Time.

2. Question: An early question came up when I noticed the final addendum and responses to vendor questions will be posted on 11-2-22. A hard copy needs to be mailed and delivered by 11-7-22. Not much time to react and ensure a solid response once the vendors have all the possible information. Is there a consideration to extend the due date?
Answer: The City has extended the proposal submission deadline to 11/14 at 5:00 PM Pacific Time.

3. Question: Upon review of your Fiscal Years 2022-24 Budget document, you have allocated a total of $3.2M for the ERP replacement project in fiscal years 2022-23 and 2023-24.

1. Would you mind sharing more details about the funding for the project and the intended use of the funding:

2. Is the $3.2M to be used for both capital expenditure items (eg implementation services) as well as operating expenditure items (eg recurring software subscriptions)?

3. If it does not include operating expenditures, how much funding is there for operating expenditures on a go forward basis?

4. Does the City have any additional funding available but not currently appropriated or designated for use with this project (eg ARPA funding)?

City of Santa Maria, CA

Answer: The budget is for costs associated with implementation, including software or subscription costs during implementation. The City will consider additional funding, if necessary, based on evaluation of proposals received.

4. Question: I would like to submit the clarification question below:

According to the timeline on page 5 of the RFP, responses to the Vendor RFP clarification questions are released only a few days before proposal submissions are due.

Would you consider extending the proposal submission deadline or moving up the questions submission deadline to provide responses sooner? Answer: The City has extended the proposal submission deadline to 11/14 at 5:00 PM Pacific Time.

5. Question:

1. Please confirm # of customers served is approximately 20k.

2. Please confirm the # of utility Service Order (mobile) users is 10. a. Full Users – are Field Technicians, Dispatchers, or anybody else with "write" access. Is this 10?
b. Light Users - are users with “Read Only” access - typically Management to view reports & data. Does the City have any?

3. What organization is used for bill print?

4. How many years of historical utility data is the City looking to convert? Would the City consider that vendors convert 3 years and archive the remaining? Archived data is unlimited and can be accessed (read-only) and reported on.

5. Does the City offer budget or levelized billing?

6. Does the City offer a Special Payment Arrangement?

7. Is an electronic signature okay for the original copy?

8. Please provide a phone number for couriers.

Answer:

1. The number of utility customers served is approximately 23,000.

2. The number of utility Service Order (mobile) users is 10. a) Yes, there are 10 full users.
b) The City has approximately 10 light users.

3. Infosend for bill printing.

4. Please refer to the data conversion tab of the pricing form. The City would consider converting 3 years and archiving the remaining.

5. The City does not offer budget billing or levelized billing.

6. Yes, the City offers payment arrangements for customers.

City of Santa Maria, CA

7. The City requires a wet signature on the original copy of the RFP form that will be mailed to the address listed in the proposal. A digital copy may be a scanned copy of the signed original RFP form.

8. The contact information for couriers will be Diana Reed at (805) 925-0951 ex. 1672.

Art Rustin, National Director, Government Sales

City of Santa Maria
Enterprise Resource Planning (ERP) Software
and Implementation Services
November 14, 2022

Collaborative Solutions, LLC. Proprietary & Confidential 177

Appendix A: Master Services Agreement

WORKDAY ® PROPRIETARY AND CONFIDENTIAL 1
©2022 WORKDAY , INC .

Exceptions, Assumptions, and Conditions
The submission of this Proposal is predicated upon the following exceptions, assumptions, and conditions, notwithstanding anything contained in the RFP to the contrary:

Workday uses its standard contractual documents to form the basis of our customer relationships; as such, various traditional RFP concepts such as warranting to requirements, attachment of RFPs or proposals to contracts, etc. are not compatible with Workday’s one-to-many model. Accordingly, any terms and conditions in the RFP are rejected by Workday. Workday’s proposals are predicated on use of Workday’s standard contractual documents, and are subject to high level exceptions such as the following:

1. Workday’s response to RFPs contains Workday intellectual property and may contain confidential and/or trade secret information. Any and all confidential and/or trade secret information provided by Workday is subject to and governed by the terms and conditions of any applicable non-disclosure agreement (“NDA”) between the parties, any other agreement between them that contains confidentiality obligations, as well as statutory laws related to the protection of trade secrets and confidential information. By continuing to read Workday’s response, recipient agrees to hold any confidential information stated therein in accordance with the terms of the NDA and other confidentiality obligations. To the extent open records type laws may be applicable to the proposal response, recipient agrees to maintain confidentiality in the materials to the best of recipient’s ability under such laws, and to provide Workday with reasonable notice should an open records request be filed for these materials such that Workday may defend its position. Notwithstanding anything to the contrary in the RFP or any portal by which information is submitted (including any click through terms required by any such portal), all parties reviewing the information in Workday’s response agree that such information may only be used to consider recipients interest in using Workday as a supplier with respect to the opportunity described in the RFP. Neither Workday’s response nor anything in it may be compiled with third party information, manipulated or used to evaluate any opportunity other than the one for which it was provided.

2. One of the cornerstones of Workday’s business model is a fair allocation of risks and benefits. To this end, Workday offers an industry leading Limitation of Liability in our Master Subscription Agreement.

Please read our Limitation of Liability in conjunction with the Master Subscription Agreement as a whole, as there are significant protections built in for our customers. Except as specifically provided for in our Master Subscription Agreement, Workday takes exception to unlimited liability, or any liabilities outside of Workday’s Master Subscription Agreement.

3. Workday's contractual approach provides customers with the opportunity to negotiate terms and conditions of the SaaS solutions separately from the deployment, providing an advantage from both a terms and conditions standpoint as well as a pricing standpoint. By dealing directly with the SaaS provider, a customer has an unfiltered voice, and need never be concerned with whether their message has reached the SaaS provider. Therefore, Workday requires separate contracts for our subscription SaaS solutions, and for professional services such as those for implementation of the solution. Additionally, any third-party solutions must be contracted for separately and are not resold by Workday.

4. Workday’s proposal is an offer to negotiate on the basis of Workday’s contractual documents.

Therefore, this proposal is not a firm offer but is instead an offer to negotiate in good faith. The pricing in this proposal is valid for 90 days unless otherwise stated in the document.

5. Because Workday’s SaaS solutions are pre-ex isting, and running on the same code line, same version, with the same functionality, Workday’s model does not contemplate the concept of inspection and/or acceptance requirements. While inspection and acceptance may be applicable to certain aspects of implementation of the solution, these concepts do not apply to the solution itself.

WORKDAY ® PROPRIETARY AND CONFIDENTIAL 2
©2022 WORKDAY , INC .

6. Workday’s one-to-many model means all of our cust omers receive the same robust security controls.

Due to the shared, unified infrastructure of Workday’s one-to-many business model, Workday cannot agree to utilize individual customer security policies. Our customers, all of whom understand and accept Workday’s security program and controls, include Public Sector, Financial Sector, Healthcare, Pharma, Aerospace and Defense, and other highly regulated industries that require high levels of protection for their data. Please review our Universal Data Processing Exhibit, our Universal Security Exhibit, and our service availability and performance commitments found in the Workday Production Support and Service Level Availability Policy located at https://www.workday.com/en- us/legal/contract-terms-and-conditions/index/exhibits.html and updated by Workday from time to time.

Workday will provide our SOC 2 and other reports to customers under non-disclosure agreement and/or will discuss security controls at your convenience.

7. As a non-customizable solution, Workday warr ants our applications will perform materially in accordance with the Workday Documentation (our administrator guide). Workday doesn’t attach or warrant to the proposal response. It is up to the individual customer to determine whether the solution fits their needs.

8. Workday provides customers with tools applicable to the Workday solution, to assist customers in maintaining compliance with laws applicable to them. However, customers do not outsource their compliance needs to Workday. Workday Customers are responsible for compliance with laws applicable to them. Customers should make certain the Workday solutions are configured for compliance requirements applicable to them.

9. Workday’s industry leading solutions, do cumentation and methodologies contain Workday confidential information as well as Workday trade secrets. Workday requires our customers and potential customers to ensure all materials are kept confidential in accordance with any applicable non-disclosure agreements and/or in accordance with applicable Freedom of Information/Open Records laws in your jurisdiction. Please return the Proposal unread if you are unable to comply with this requirement.

10. Workday’s Master Subscription Agreement is carefully tailored in accordance with Workday’s business model, and reflects Workday’s customer service philosophy. For that reason, Workday takes exception to indemnifications outside of patent and copyright claims as per Workday’s Master Subscription Agreement.

11. Workday offers its products and services for customers’ internal business use only, and not in connection with any federal prime or subcontracts. Consequently, Workday does not accept federal regulations or “flow downs” other than those applicable to Workday’s business.

12. Existing Customers Only: Workday and your organization have an existing Master Subscription Agreement (“MSA”) which shall serve as the framework for any add-on transaction(s).

13. Joint proposals with partners: Workday may, for your convenience, include partner responses to bring your organization the most comprehensive solution possible. Workday does not resell these solutions and is not offering to act as a prime contractor nor as a joint venture, etc. Each company whose responses are included would contract directly and separately with your organization and be independently responsible for their own deliverables.

14. Joint proposal with VNDLY: Workday may be including VNDLY responses to bring your organization a comprehensive solution. VNDLY, a Workday Company, is a cloud-based vendor management system to manage non-employee workforce programs. VNDLY’s solution is not currently fully integrated with the Workday Service and accordingly, Workday’s HCM/FINS/Analytics Solutions and Workday’s VNDLY solution may be provided under separate MSAs/exhibits and your organization may contract with separate entities.

WORKDAY ® PROPRIETARY AND CONFIDENTIAL 1
©2022 WORKDAY, INC.

Workday’s Contractual Approach
Workday’s industry leading one-to-many model is different from its competition and it isn’t always reflected accurately through the lens of a traditional RFP process. Workday provides all customers the same version of its true SaaS solution that is configurable but not customizable. It is not possible to change the application for any particular customer. Our customers see the following benefits:
• One Security Model. Workday provides protections that traditional software vendors can’t. We build and continually update rigorous safeguards into every aspect of our service to maintain the highest level of security.
• One User Experience. A single experience for all Workday customers that is easy and engaging to use. Workday provides an intuitive, consumer-like experience for both web and mobile users that empowers you to manage your own changes and engage with the workforce. • One Community. Workday customers support each other in a vibrant community where they share knowledge, best practices, and even actual templates they’ve created. It’s also where our customers collaborate on innovation ideas, which in turn helps influence the Workday product roadmap.

An innovative one-to-many model such as this necessitates a consistent contracting approach with accurate descriptions of what we are delivering and how we deliver it. If selected and the parties are entering into the negotiation phase, upon request, Workday agrees to provide a cross-reference as to where provisions are addressed in the Workday contract documents as compared to the sample terms and conditions provided in the RFP.

All materials provided to your organization as part of Workday’s response to this solicitation (collectively, the “Proposal”), may be used solely in connection with your review of this Proposal, provided, however, that:
• You keep all Proposal information in confidence pursuant to the underlying Non-Disclosure Agreement (“NDA”) between the parties if applicable, and/or your jurisdiction’s Open Records or Freedom of Information Act type laws;
• No confidential information contained in this Proposal is used for any purpose other than evaluating Workday’s suitability for the project;
• You agree this Proposal is the copyrighted intellectual property of Workday, and cannot be reproduced or redistributed in any way without the express prior written consent of Workday; and • The Proposal is shared only with your organization’s employees and/or agents on a need to know basis.

In addition, Workday’s industry leading solutions, documentation and methodologies may contain Workday confidential information as well as Workday trade secrets. Notwithstanding anything else set forth in the RFP or content of this Proposal (and as an exception to anything to the contrary set forth therein), Workday requires that our customers and potential customers agree that all materials are kept confidential in accordance with any applicable non-disclosure agreements and/or in accordance with applicable Freedom of Information/Open Records laws in your jurisdiction. Please return the Proposal unread if you are unable to comply with this requirement.

Regardless of any inconsistent terms in the RFP or content of this Proposal, the Proposal is intended as a general description of the products and services that may be provided and the general business relationship Workday is currently contemplating with your organization. The Proposal does not represent or create any contractual obligation or commitment by Workday. While a reasonable good faith attempt has been made to ensure the information contained in the Proposal is correct, Workday does not warrant to the contents of the Proposal. Workday is providing our response pursuant to your requirement. The Confidential Information (as defined in the NDA) that Workday has provided in our response is subject to and governed by the terms and conditions of our NDA with you.

WORKDAY ® PROPRIETARY AND CONFIDENTIAL 2
©2022 WORKDAY, INC.

You agree that any third party portal provider that you choose to facilitate the submission of information by Workday in support of an RFP (“Portal Provider”) is acting as the Customer’s Representative (as defined in the NDA) and, as such, you shall at all times remain responsible for that Portal Provider ’s compliance with the terms of the NDA. Notwithstanding anything to the contrary (including any click through terms required by any Portal Provider), all parties reviewing the information in Workday’s response agree that such information may only be used to assist you in your selection of a service provider. Neither Workday’s response nor anything in it may be compiled with third party information and/or manipulated by you or a Portal Provider in any way.

Please see the Exceptions, Assumptions and Conditions section of the Proposal.

Forward-Looking Statements
This document may contain forward-looking statements for which there are risks, uncertainties, and assumptions. If the risks materialize or assumptions prove incorrect, Workday’s business results and directions could differ materially from results implied by the forward-looking statements. Forward-looking statements include any statements regarding strategies or plans for future operations; any statements concerning new features, enhancements or upgrades to our existing applications or plans for future applications; and any statements of belief. Further information on risks that could affect Workday’s results is included in Workday, Inc’s filings with the Securities and Exchange Commission which are available on the Workday investor relations webpage: www.workday.com/company/investor_relations.php Forward-looking statements are subject to and carry a risk of change. Accordingly, Workday assumes no obligation for, shall not be bound by, and does not intend to update any forward-looking statements that may be included in our response.

Trademark Notices: All rights reserved. Workday and the Workday logo are registered trademarks of Workday, Inc. All other brand and product names are trademarks or registered trademarks of their respective holders.

A note about copyright: Workday has included copyright notices on its proposal materials. Workday is not seeking to assert any copyright to those portions of its proposal pages which are copied from the Request for Proposal. The copyright in materials copied from the Request for Proposal remains in their original author.

00375627.0 - Confidential
Workday Universal Data Processing Exhibit
Frequently Asked Questions

(For information purposes only, this FAQ does not form part of any contract.) Workday Universal Data Processing Exhibit – City of Santa Maria ©2022 Workday (UDPE Global v22.5) Page 1 of 5
Protecting our customers’ personal data is one of Workday’s highest priorities and is integral to the success of our business. These FAQs provide information to assist customers when (1) selecting Workday as a n enterprise cloud provider to process their workers’ personal data and (2) reviewing Workday’s Universal Data Processing Exhibit.

These FAQs do not form part of the contract and are for informational purposes only.

What is Workday’s role?
Workday acts as a processor or service provider for the personal data our customers submit electronically into our enterprise cloud applications or, where applicable, submit to Workday for implementation and consulting services (“Personal Data”). As such, Workday processes Personal Data on behalf of and according to our customers’ instructions who are the controllers (or businesses).

Does Workday make available a data processing agreement? Workday offers a comprehensive Universal Data Processing Exhibit (“DPE”) that operates seamlessly as part of Workday’s MSA to provide robust contractual terms for Workday’s processing of Personal Data.

The DPE supports Workday's one -to-many service delivery model and our underlying technical and operational processes, such as our certifications, the performance of audits and our use of subprocessors.

Will Workday’s DPE work for companies operating globally? Workday has customers around the globe, so we offer our customers industry -leading data processing terms that address data protection requirements around the globe. Our DPE incorporates the core privacy principles that underlie many international data protection laws.

Traditionally, European data protection laws have been among the world’s strictest. To prov ide our global customers with a robust framework, we have used the strict GDPR requirements as the baseline for our DPE. As new laws take effect, including comprehensive state privacy laws in the United States, we adjust as necessary to ensure continued co mpliance with data protection laws.

Does Workday comply with data protection laws?
Workday complies with all data protection laws directly applicable to Workday.

Nevertheless, it is our customers’ responsibility to determine whether it is appropriate for them to use our enterprise cloud applications to process their Personal Data in light of the specific laws and regulations to which they are subject. It is al so our customers’ responsibility to configure and use our enterprise cloud applications in a manne r consistent with their legal and regulatory obligations.

How does the CCPA apply to Workday’s enterprise services? To the extent the CCPA applies to Workday’s enterprise services, Workday acts as a service provider, which is defined by the CCPA as an ent ity that processes information on behalf of a business. Workday’s customers act as the business, which the CCPA defines as an entity that determines the purposes and means of the processing of consumers’ personal information. (These concepts are similar to the data processor and data controller roles under the EU’s General Data Protection Regulation.)
Under the CCPA, a service provider processes personal information provided by a business for a business purpose pursuant to a written contract, provided that the contract prohibits the entity receiving the information from retaining, using, or disclosing personal information for any purpose other than for the specific purpose of performing the services specified in the contract for the business. Workday’s standard subscription agreement and data protection terms with our customers provide that we can process our customers’ data only to provide the services they’ve contracted for. 00375627.0 - Confidential
Workday Universal Data Processing Exhibit
Frequently Asked Questions

(For information purposes only, this FAQ does not form part of any contract.) Workday Universal Data Processing Exhibit – City of Santa Maria ©2022 Workday (UDPE Global v22.5) Page 2 of 5
Subprocessors
Does Workday use subprocessors?
Workday uses subprocessors to provide the Covered Services . Any subprocessor that Workday engages to process our customers’ Personal Data undergoes a thorough information security and data protection due diligence review and agrees to abide by data protection terms no less protective than the DPE.

Which subprocessors is Workday using?
Workday’s subprocessor list can be accessed through the Workday website at https://www.workday.com/en- us/legal/subprocessors.html.

How does Workday inform our customers about new subprocessors? Workday will update the subprocessor list at least thirty days prior to authorizing a new subprocessor to process Personal Data. Customers can subscribe to receiving email notifications for e ach Covered Service by signing up here. Our customers are responsible for ensuring that the individuals in their organization who need to be notified about new subprocessors (e. g., their Privacy Team or Data Protection Officer) subscribe to the relevant Covered Service email updates and monitor their email accounts.

Can customers object to Workday’s use of a new subprocessor? Where required by law, Workday’s customers can object to Workday’s use of a new subprocessor on reasonable grounds relating to data protection. If Workday decides to retain a subprocessor to which a customer has objected, then the customer has the option to terminate the affected Covered Service.

For International Data Transfers
Is Personal Data transferred outside of Europe in connection with Workday enterprise cloud applications? In order to provide its enterprise cloud applications, Workday may use subprocessors (both Workday affiliates and third parties) located outside the European Economic Area ("EEA"), the United Kingdom (“UK”) and Switzerland (together, "Europe"). For example, Workday provides 24/7 follow-the-sun support which necessarily means a degree of processing data in multiple time zones. For the purpose of international transfers, Workday Limited (our European headquarters in Ireland) is the "data exporter" under the GDPR and our customers are not transferring personal data outside of Europe.

How does Workday protect Personal Data transferred outside of Europe? Workday uses the following data transfer mechanisms to legitimize transfers of Personal Data outside of Europe to meet its compliance duties:

Adequacy Decisions
The European Commission recognizes certain countries around the world as offering an adequate level of protection for personal data. The UK and Switze rland recognize the same countries. Workday relies on adequacy decisions in relation to transfers of Personal Data to New Zealand, Switzerland or the UK.

Binding Corporate Rules
Workday is one of the few companies worldwide to have an approved set of Proc essor Binding Corporate Rules (or “BCRs”). BCRs are a set of internal data protection policies that govern personal data processing within a multinational group. Under its BCRs, Workday can share the Personal Data it processes on behalf of its customers wi thin its group in compliance with EU data protection laws. A list of enterprise cloud applications covered by the BCRs is provided in Addendum B of the DPE. The BCRs are accessible on Workday’s website at https://www.workday.com/en-us/why-workday/security-trust.html. 00375627.0 - Confidential
Workday Universal Data Processing Exhibit
Frequently Asked Questions

(For information purposes only, this FAQ does not form part of any contract.) Workday Universal Data Processing Exhibit – City of Santa Maria ©2022 Workday (UDPE Global v22.5) Page 3 of 5
Standard Contractual Clauses
Workday offers the European Commission’s Standard Contractual Clauses (Commission Implementing Decision 2021/914 of 4 June 2021) (“SCCs” ). The new SCCs were introduced in June 2021 to incorporate additional protections for transferred data.

The UK’s Information Commissioner Office has validate d the European Commission’s SCCs as an equal alternative to the UK only international data transf er agreement (“UK IDTA”). This simplifies the position for businesses with UK data. For consistency across our customer base, we implement the SCCs via the ICO's "UK Addendum" as opposed to the UK IDTA within Workday’s IGDTPA.

Switzerland has recognized the SCCs as the basis for personal data transfers to a country without an adequate level of data protection, provided that the necessary adaptations and amendments are made for use under Swiss data protection legislation (as set out below).

Does Workday’s DPE cover professional services delivered by Workday? Yes, Workday’s DPE covers consulting and professional services delivered by Workday.

General Data Protection Regulation
What is the General Data Protection Regulation?
The General Data Protection Regulation (the “EU GDPR”) is a European data protection law that took effect on May 25, 2018. The EU GDPR sets a global standard for data protection compliance by implementing strict requirements on how organizations handle and protect personal data. Following Brexit, section 3 of the European Union (Withdrawal) Act 2018 brought the EU GDPR into UK law (the "UK GDPR"). For the purpose of our relationship with our customers, at this time, they do not differ in substance, so we refer to both laws collectively as "GDPR." We are committed to supporting our customers’ journey to compliance with the GDPR when they use Workday’s enterprise cloud applications.

How does Workday assist our customers in fulfilling their obligations to resp ond to data subject requests under Chapter III of the GDPR?
Workday offers a suite of configurable features to help customers respond to their workers’ requests to access, correct, delete or restrict the processing of their Personal Data and comply with data portability requests under the GDPR.

What technical and organizational measures has Workday implemented to protect Personal Data? Workday has implemented robust technical and organizational measures designed to protect our customers’ Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data.

However, data security is a shared responsibility. Our customers are responsible for implementing and maintaining privacy protections and security measures for components of the Workday enterprise cloud applications that they control.

Workday is certified to various industry standards such as ISO 27001, 27017, and 27018. See Workday's SOC 2 reports for more information on our technical and organizational measures.

Furthermore, Workday adheres to the EU Cloud Code of Conduct (EUCoC) which provides independent third -party verification of Workday’s technical and organizational measures. According to Article 28 (5) of the EU GDPR, adherence to a Code of Conduct can be used to demonstrate that sufficient guarantees have been made to implement appropriate technical and organizational measures as a data processor. Workday’s adherenc e report can be accessed at https://eucoc.cloud/en/public-register/list-of-adherent-services/. 00375627.0 - Confidential
Workday Universal Data Processing Exhibit
Frequently Asked Questions

(For information purposes only, this FAQ does not form part of any contract.) Workday Universal Data Processing Exhibit – City of Santa Maria ©2022 Workday (UDPE Global v22.5) Page 4 of 5
How does Workday assist our customers fulfilling their obligation to notify personal data breaches? Under the GDPR, our customers, as controllers, must notify the competent data protection supervisory authority without undue delay and, where feasible, not later than 72 hours after becoming aware of a personal data breach, unless the breach is unlikely to result in a risk to the rights and freedoms of natural per sons.

Workday maintains incident response policies and plans, including a security incident policy, an incident response plan and a breach disclosure plan. If Workday becomes aware of a personal data breach affecting our customers’ Personal Data, Workday will notify our customers without undue delay and assist our customers to meet their personal data breach notification obligations by providing the relevant information regarding the personal data breach.

How does Workday assist our customers with the GDP R requirements to conduct data protection impact assessments and prior consultations in relation to their use of a Workday enterprise cloud application? To help identify risks to individuals’ rights, Article 35 of the GDPR requires controllers to carry out a Data Protection Impact Assessment (“DPIA”) if a specific processing activity is likely to result in a “high risk” to the rights and freedoms of an individual.

Where customers require additional information from Workday to carry out a DPIA in relation t o their use of our enterprise cloud applications, they can rely on the information in Workday’s application audit reports and certifications. In addition, our customers can request Workday’s assistance under our optional, fee-based Customer Audit Program.

Does Workday’s DPE meet the GDPR requirements for a data processing agreement? Workday’s DPE addresses the specific data processing agreement requirements laid out in Article 28 of the GDPR. The quick reference checklist below identifies each of the speci fic requirements of Article 28 GDPR and matches them against the relevant sections of Workday’s DPE.

GDPR Requirement Relevant Section in
DPE
Art. 28 (3) Subject-matter and duration of the processing, the nature and purpose of the processing. Sec. 11.1
Art. 28 (3) Type of personal data and categories of data subjects. Sec. 11.1 Art. 28 (3) (a) Processor processes the personal data only on documented instructions from the controller. Sec. 2.2
Art. 28 (3) (b)
Persons authorized to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

Sec. 5
Art. 28 (3) (c) Processor has taken all measures required pursuant to Article 32 (Security of Processing). Sec. 7
Art. 28 (3) (d) Processor respects the conditions referred to in paragraph 2 and 4 for engaging another processor. Sec. 3
00375627.0 - Confidential
Workday Universal Data Processing Exhibit
Frequently Asked Questions

(For information purposes only, this FAQ does not form part of any contract.) Workday Universal Data Processing Exhibit – City of Santa Maria ©2022 Workday (UDPE Global v22.5) Page 5 of 5
Art. 28 (3) (e)
Processor assists the controller by appropriate technical and organizational measures, insofar as this is possible, for the fulfilment of the controller's obligation to respond to requests for exercising the data subject's rights.

Sec. 4
Art. 28 (3) (f)
Processor assists the controller in ensuring compliance with the obligations pursuant to Articles 32 to 36.

Article 32 (Security of processing) Sec. 7
Article 33 (Notification of a personal data breach to the supervisory authority)
Article 34 (Communication of a personal data breach to the data subject) Sec. 6
Article 35 (Data protection impact assessment)
Article 36 (Prior consultation)
Sec. 11.2
Art. 28 (3) (g) Processor will, at the choice of the controller, delete or return all the personal data to the controller after the end of the provision of services. Sec. 9 Art. 28 (3) (h)
Processor makes available to the controller all information necessary to demonstrate compliance with the obligations laid down in this Article and allow for and contribute to audits , including inspections, conducted by the controller or another auditor mandated by the controller.

Sec. 8
00375627.0 – Confidential

UNIVERSAL DATA PROCESSING EXHIBIT

Workday Universal Data Processing Exhibit – City of Santa Maria ©2022 Workday (UDPE Global v22.5) Page 1 of 11
This Universal Data Processing Exhibit is an exhibit to the Agreement between Workday and Customer and sets forth the obligations of the parties regarding the Processing of Personal Data pursuant to such Agreement.

1. Definitions
Unless otherwise defined below, all capitalized terms have the meaning given within the applicable Agreement and/or exhibits thereto.
“Agreement” means the MSA, the Professional Services Agreement, and Order Forms, including any exhibits or attachments applicable to the Covered Service.
“CCPA” means the California Consumer Privacy Act, Cal. Civ. Code § 1798.100 et seq., and its implementing regulations.
“Covered Data” means (i) Customer Data, (ii) Professional Services Data, and (iii) any other electronic data or information submitted by or on behalf of Customer to a Covered Service. “Covered Service” means (i) any Service provided under an Order Form that specifically refers to this DPE, and/or, (ii) any Professional Services.
“Customer Audit Program” means Workday’s optional, fee-based customer audit program as described in the Customer Audit Program Order Form for Covered Services. “Data Controller” or “Controller” means the entity which, alone or jointly with others, determines the purposes and means of the Processing of Personal Data.
“DPE” means this Universal Data Processing Exhibit including any appendices, annexures or documents incorporated by reference.
“Data Processor” or “Processor” means the entity which Processes Personal Data on behalf of the Data Controller, including as applicable any “service provider” as that term is defined by the CCPA. “Data Protection Laws” means all data protection laws applicable to the Processing of Personal Data under this DPE, including local, state, national and/or foreign laws, treaties, and/or regulations, including without limitation the GDPR, and implementations of the GDPR into national law, and CCPA, in each case as may be amended or superseded from time to time.
“Data Subject” means the person to whom the Personal Data relates. “Europe” or “European” means the European Economic Area (“EEA”), the United Kingdom (“UK”), and Switzerland. “GDPR” means either or both the (i) General Data Protection Regulation (EU) 2016/679 ("EU GDPR"), and (ii) the EU GDPR as it forms part of UK law by virtue of section 3 of the European Union (Withdrawal) Act 2018 (" UK GDPR") as the context may require.
“Personal Data” means any Covered Data that relates to an identified or identifiable natural person. “Personal Data Breach” means (i) a ‘personal data breach’ as defined in the GDPR affecting Personal Data, and (ii) any Security Breach affecting Personal Data.
“Processing” or “Process” means any operation or set of operations performed on Personal Data or sets of Personal Data, such as collecting, recording, organizing, structuring, storing, adapting or altering, retrieving, consulting, using, disclosing by transmission, disseminating or otherwise making available, aligning or combining, restricting, erasing or destroying.
“Professional Services” means the professional or consulting services provided to Customer under a Professional Services Agreement.
“Professional Services Agreement” means any agreement between the parties for the provision of consulting or professional services, including but not limited to the following agreements or terms: the Professional Services 00375627.0 – Confidential

UNIVERSAL DATA PROCESSING EXHIBIT

Workday Universal Data Processing Exhibit – City of Santa Maria ©2022 Workday (UDPE Global v22.5) Page 2 of 11
Agreement, the Delivery Assurance terms, the Professional Services Addendum, and/or the Consulting and Training Addendum and Amendment.
“Professional Services Data ” means electronic data or information that is provided to Workday under a Professional Services Agreement for the purpose of b eing input into a Service, or Covered Data accessed within or extracted from the Customer’s tenant or instance to perform the Professional Services. “Restricted Country” means: (i) where the EU GDPR applies, a country outside of the EEA which is not subje ct to an adequacy determination by the European Commission; (ii) where the UK GDPR applies, a country outside the UK which is not based on adequacy regulations pursuant to Section 17A of the UK Data Protection Act 2018 as amended or replaced (“UK DPA”); and (iii) where the Swiss Federal Act on Data Protection of June 19, 1992 as amended or replaced (“Swiss FADP”) applies, a country outside Switzerland which has not been recognized to provide an adequate level of protection by the Federal Data Protection and Information Commissioner. "Restricted Transfer" means: (i) where the EU GDPR applies, a transfer of Personal Data from the EEA to a Restricted Country; (ii) where the UK GDPR applies, a transfer of Personal Data from the UK to a Restricted Country; and (i ii) where the Swiss FADP applies, a transfer of Personal Data from Switzerland to a Restricted Country. “SCCs” means (i) where the EU GDPR applies, the standard contractual clauses annexed to the European Commission’s Implementing Decision 2021/914 of 4 Ju ne 2021 for the transfer of Personal Data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council (" EU SCCs"); and (ii) where the UK GDPR applies, the “International Data Transfer Addendum to the EU Commission Standard Contractual Clauses” issued by the Information Commissioner under s.119A(1) of the UK DPA ("UK Addendum"). “Subprocessor” means a Workday Affiliate or third -party entity engaged by Workday or a Workday Affiliate as a Data Processor under this DPE.
“Subprocessor List” means the subprocessor list identifying the Subprocessors that are authorized to Process Personal Data, accessible through Workday’s website (currently located at https://www.workday.com/en- us/legal/subprocessors.html).
“Workday BCRs” or “BCRs” means Workday’s Processor Binding Corporate Rules. The Workday BCRs are accessible through Workday’s website (currently located at https://www.workday.com/en-us/why-workday/security-trust.html).

2. Processing Personal Data

2.1 Scope and Role of the Parties. This DPE applies to the Processing of Personal Data by Workday to provide the Covered Service. For the purposes of this DPE, Customer is the Data Controller and Workday is the Data Processor, except when Customer acts as a Data Processor of Personal Data, in which case Workday is a subprocessor.

2.2 Instructions for Processing. Workday shall Process Personal Data in accordance with Customer’s documented instructions. Customer instructs Workday to Process Personal Data to provide the Covered Service in acco rdance with the Agreement (including this DPE) and as further specified via Customer’s use of the Covered Service. Customer may provide additional instructions to Workday to Process Personal Data, however Workday shall be obligated to perform such additional instructions only if they are consistent with the terms and scope of the Agreement and this DPE. To the extent the CCPA applies to Personal Data, Workday will not (i) Sell Personal Data, nor (ii) retain, use or disclose Personal Data for any purpose other than to provide the Covered Services in accordance with the Agreement. The Term “Sell” shall have the meaning set forth in the CCPA.

2.3 Compliance with Laws. Workday shall comply with all Data Protection Laws applicable to Workday in its role as a Data Processor Processing Personal Data. Customer shall comply with all Data Protection Laws applicable to Customer as a Data Controller and shall obtain all necessary consents, and provide all necessary notifications, to Data Subjects to enable Workday to carry out lawfully the Processing contemplated by this DPE. Customer shall ensure that any instruction it issues to Workday complies with applicable Data Protection Laws. Workday shall inform Customer without undue delay if, in its reasonable opinion, an instruction issued by Customer violates applicable European Data Protection Laws. 00375627.0 – Confidential

UNIVERSAL DATA PROCESSING EXHIBIT

3. Subprocessors

3.1 Use of Subprocessors. Customer hereby agrees and provides a general authorization that Workday and Workday Affiliates may engage Subprocessors. Workday or the relevant Workday Affiliate engaging a Subprocessor shall ensure that such Subprocessor has entered into a written agreement that is no less protective than this DPE. Workday shall be liable for the acts and omissions of any Subprocessors to the same ex tent as if the acts or omissions were performed by Workday.

3.2 Notification of New Subprocessors. Workday shall make available to Customer a Subprocessor List and provide Customer with a mechanism to obtain notice of any updates to the Subprocessor List. At least thirty (30) days prior to authorizing any new Subprocessor to Process Personal Data, Workday shall provide notice to Customer by updating the Subprocessor List.

3.3 Subprocessor Objection Right. This Section 3.3 shall apply only where and to the extent that Customer is established within Europe or where otherwise required by Data Protection Laws applicable to Customer. In such event, if Customer objects on reasonable grounds relating to data protection to Workday’s use of a new Subprocessor then Customer shall promptly, and within fourteen (14) days following Workday’s notification pursuant to Section 3.2 above, provide written notice of such objection to Workday. Should Workday choose to retain the objected -to Subprocessor, Workday will notify Customer at least fourteen (14) days before authoriz ing the Subprocessor to Process Personal Data and Customer may terminate the relevant portion(s) of the Covered Service within thirty (30) days. Upon any termination by Customer pursuant to this Section, Workday shall refund Customer any prepaid fees for t he terminated portion(s) of the Covered Service that were to be provided after the effective date of termination.

4. Data Subject Rights

4.1 Assistance with Data Subject Requests. Workday will, in a manner consistent with the functionality of the Covered Service and Workday’s role as a Data Processor, provide reasonable support to Customer to enable Customer to respond to Data Subject requests to exercise their rights under applicable Data Protection Laws (“Data Subject Requests”).

4.2 Handling of Data Sub ject Requests. For the avoidance of doubt, Customer is responsible for responding to Data Subject Requests. If Workday receives a Data Subject Request or other complaint from a Data Subject regarding the Processing of Personal Data, Workday will promptly f orward such request or complaint to Customer, provided the Data Subject has given sufficient information for Workday to identify Customer.

5. Workday Personnel
Workday shall require screening of its personnel who may have access to Personal Data and shall require such personnel (i) to Process Personal Data in accordance with Customer’s instructions as set forth in this DPE, (ii) to receive appropriate training on their responsibilities regarding the handling and safeguarding of Personal Data; and (iii) to b e subject to confidentiality obligations which survive their termination of employment.

6. Personal Data Breach
If Workday becomes aware of a Personal Data Breach, it shall without undue delay notify Customer in accordance with the Security Breach provisions of the MSA. Workday shall take appropriate measures to address and mitigate the adverse effects of the Personal Data Breach. To the extent Customer requires additional information from Workday to meet its Personal Data Breach notification obligations u nder applicable Data Protection Laws, Workday shall provide reasonable assistance to provide such information to Customer taking into account the nature of Processing and the information available to Workday.

7. Security of Processing
Workday shall impleme nt and maintain appropriate technical and organizational measures to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data as described in the Universal Security Exhibit.
00375627.0 – Confidential

UNIVERSAL DATA PROCESSING EXHIBIT

8. Audit
Customer agrees that, to the extent applicable, Workday’s then -current SOC 1 and SOC 2 audit reports (or comparable industry-standard successor reports) and/or Workday’s ISO certifications will be used to satisfy any audit or inspection requests by or on behalf of Customer, and Workday shall make such reports available to Customer. If Customer requires additional information, including information necessary to demonstrate compliance with this DPE, or an audit related to the Covered Service, such i nformation and/or audit shall be made available in accordance with Workday’s Customer Audit Program.

9. Return and Deletion of Personal Data
Upon termination of the Covered Service, Workday shall return and delete Personal Data in accordance with the relevant provisions of the Agreement.

10. Transfers of European Personal Data

10.1 Transfer Safeguards. The transfer safeguards listed below shall apply to all Restricted Transfers.

10.2 BCRs. For the Covered Services identified in Addendum B, the Workday BCRs apply to the Processing of Personal Data of a Customer or Customer Affiliate established in the EEA. In this event, all provisions of the Workday BCRs are incorporated by this reference a nd shall be binding and enforceable for Customer according to Section 1.4 of the Workday BCRs as if they were set forth in this DPE in their entirety. If any conflict or inconsistency arises between thi s DPE and the Workday BCRs, the Workday BCRs shall prevail.

10.3 Processor-to-Processor SCCs. Where Workday is located within Europe, Workday has implemented and complies with the SCCs for any Restricted Transfers of Personal Data from Workday (as “data exporter”) to Subprocessors (as “data importers”).

10.4 Controller-to-Processor SCCs. Where Workday is located in a Restricted Country, the SCCs will apply to any Restricted Transfers from Customer (as “data exporter”) to Workday (as “data importer”) as follows:

10.4.1 EU Personal Data. In relation to Personal Data protected by the EU GDPR, the EU SCCs will apply completed as follows:
(i) Module 2 applies unless the Customer is a Processor in which case Module 3 applies; (ii) in Clause 7, the optional docking clause will not apply; (iii) in Clause 9, Optio n 2 will apply, and the time period for prior notice of subprocessor changes will be in accordance with the notification process set out in Section 3.2 of this DPE; (iv) in Clause 11, the optional redress language will not apply; (v) in Clause 17, Option 1 will apply, and the EU SCCs will be governed by the law specified in the MSA, provided that law is an EEA Member State law recognizing third party beneficiary rights, otherwise, the laws of Ireland apply; (vi) in Clause 18(b), disputes shall be resolved b efore the courts specified in the MSA, provided these courts are located in an EAA Member State, otherwise those courts shall be the courts of Ireland; (vii) Annex I of the EU SCCs shall be deemed completed with the information set out in Annex I to this DPE; and (viii) Annex II of the EU SCCs shall be deemed completed with the information set out in Annex II to this DPE.

10.4.2 UK Personal Data. In relation to Personal Data protected by the UK GDPR (“UK Personal Data”) , the UK Addendum will apply as follows:
(i) the EU SCCs, completed as set out in Section 10.4.1 above, shall also apply to transfers of UK Personal Data; 00375627.0 – Confidential

UNIVERSAL DATA PROCESSING EXHIBIT

Workday Universal Data Processing Exhibit – City of Santa Maria ©2022 Workday (UDPE Global v22.5) Page 5 of 11
(ii) the UK Addendum shall be deemed executed (and incorporated by this reference) between the transferring Customer and Workday, and the E U SCCs shall be deemed amended as specified by Part 2 (Mandatory Clauses) of the UK Addendum in respect of the transfer of UK Personal Data; (iii) Tables 1 to 3 of the UK Addendum shall be deemed completed with relevant information from within this DPE and the EU SCCs, completed as set out in Section 10.4.1 above;
(iv) the start date of the UK Addendum (as set out in Table 1) shall be the effective date of this DPE; and (v) Table 4 of the UK Addendum shall be deemed completed “neither party”.

10.4.3 Swiss Personal Data. In relation to Personal Data protected by the Swiss F ADP, the EU SCCs will apply amended and adapted as follows:
(i) the Swiss Federal Data Protection and Information Commissioner is the exclusive supervisory authority; (ii) the term "membe r state" must not be interpreted in such a way as to exclude Data Subjects in Switzerland from the possibility of suing for their rights in their place of habitual residence (Switzerland) in accordance with Clause 18; and (iii) references to the GDPR in th e EU SCCs shall also include the reference to the equivalent provisions of the Swiss FADP.

10.4.4 Clarifications. The SCCs will be subject to the following clarifications:
(i) Workday will allow Customer to conduct audits as described in the SCCs in accordance with Section 8 of this DPE. (ii) Customer consents to Workday appointing Subprocessors in accordance with Section 3 of this DPE, and Customer may exercise its right to object to Subprocessors under the SCCs in the manner set out in Section 3. (iii) Workday shall return and delete Customer’s data in accordance with Section 9 of this DPE. (iv) Customer agrees that any assistance that Workday provides to Customer under the SCCs shall be provided through the Customer Audit Program.
(v) Nothing in this Sec tion 10.4 of this DPE varies or modifies the SCCs nor affects any supervisory authority’s or Data Subject’s rights under the SCCs. If any provision of this DPE contradicts, directly or indirectly, the SCCs, the SCCs shall prevail.

11. Additional European Terms

11.1 Description of Processing . The agreed subject-matter, the nature, purpose and duration of data processing, the types of Personal Data and categories of Data Subjects are set forth in Addendum A to this DPE.

11.2 Data Protection Impact Assessments (“DPIA(s)”) and Prior Consultations. Customer agrees that, to the extent applicable, Workday’s then -current SOC 1 and SOC 2 audit reports (or comparable industry -standard successor reports) and/or Workday’s ISO certifications will be used to carry out Customer’s DPIAs and prior consultations, and Workday shall make such reports available to Customer. To the extent Customer requires additional assistance to meet its obligations under GDPR Article 35 and 36 to carry out a DPIA and prior consultation with the competent supervisory authority related to Customer’s use of the Covered Service, Workday will, taking into account the nature of Processing and the information available to Workday, provide such assistance to Customer through the Customer Audit Program.

12. General Provisions

12.1 Customer Affiliates. Customer is responsible for coordinating all communication with Workday on behalf of its Affiliates with regard to this DPE. Customer represents that it is authorized to enter into this DPE and any SCCs entered into under this DPE, issue instructions, and make and receive any communications or notifications in relation to this DPE on behalf of its Affiliates.
00375627.0 – Confidential

UNIVERSAL DATA PROCESSING EXHIBIT

12.2 Termination. The term of this DPE will end simultaneously a nd automatically at the later of (i) the termination of the Agreement or, (ii) when all Personal Data is deleted from Workday’s systems.

12.3 Conflict. This DPE is subject to the non -conflicting terms of the Agreement. With regard to the subject matter of this DPE, if inconsistencies between the provisions of this DPE and the Agreement arise, the provisions of this DPE shall prevail with regard to the parties’ data protection obligations.

12.4 Customer Affiliate Enforcement. Customer’s Affiliates may enforce the terms of this DPE directly against Workday, subject to the following provisions:
i. Customer will bring any legal action, suit, claim or proceeding which that Affiliate would otherwise have if it were a party to the Agr eement (each an “ Affiliate Claim ”) directly against Workday on behalf of such Affiliate, except where the Data Protection Laws to which the relevant Affiliate is subject require that the Affiliate itself bring or be party to such Affiliate Claim; and ii. for t he purpose of any Affiliate Claim brought directly against Workday by Customer on behalf of such Affiliate in accordance with this Section, any losses suffered by the relevant Affiliate may be deemed to be losses suffered by Customer.

12.5 Remedies. Customer’s remedies (including those of its Affiliates) with respect to any breach by Workday, its Affiliates and Subprocessors of the applicable terms of this DPE, and the overall aggregate liability of Workday and its Affiliates arising out of, or in connection with the Agreement (including this DPE) will be subject to any aggregate limitation of liability that has been agreed between the parties under the Agreement.

12.6 Miscellaneous. The section headings contained in this DPE are for reference purposes only and shall not in any way affect the meaning or interpretation of this DPE.

00375627.0 – Confidential

UNIVERSAL DATA PROCESSING EXHIBIT

ADDENDUM A
Description of Processing

ANNEX I
A. LIST OF PARTIES
Data exporter
Data exporter: Customer

Contact details: The individuals designated as named contacts by Customer in Customer’s account

Relevant activities: Use of Workday’s enterprise cloud applications.

Signature and Date: By entering into the Agreement, data exporter is deemed to have signed these SCCs incorporated herein as of the effective date of the Agreement.

Data exporter role: The data exporter’s role is set forth in the DPE.

Data importer
Data importer: Workday

Contact details: Workday Privacy Team, [email protected]

Relevant activities: Provide and support enterprise cloud applications, including human resource and financial management.

Signature and Date: By entering into the Agreement, data importer is deemed to have signed these SCCs incorporated herein as of the effective date of the Agreement.

Data importer role: Processor

00375627.0 – Confidential

UNIVERSAL DATA PROCESSING EXHIBIT

Workday Universal Data Processing Exhibit – City of Santa Maria ©2022 Workday (UDPE Global v22.5) Page 8 of 11
B. DESCRIPTION OF TRANSFER
Categories of data subjects whose personal data is transferred

1. Customer’s job applicants, candidates, current and former employees and other workers, as well as related persons.

2. Employees or contact persons of Customer’s prospects, customers, business partners and suppliers.

Categories of personal data transferred
Customer determines the categories of personal data processed within Covered Services subscribed to. Typically, the transferred personal data will include the categories of data identified below:

1. Applicants, employees and other workers: Name; contact information (including home and work address; home and work telephone numbers; mobile telephone numbers; web address; instant messenger; home and work email address); marital status; citizenship information; visa information; national and go vernmental identification information; drivers’ license information; passport information; banking details; military service information; date of birth and birth place; gender; employee identification information; education, language(s) and special competencies; certification information; probation period and employment duration information; job or position title; business title; job type or code; business site; company, supervisory, cost center and region affiliation; work schedule and status (full-time or part-time, regular or temporary); compensation and related information (including pay type and information regarding raises and salary adjustments); payroll information; allowance, bonus, commission and stock plan information; leave of absence information ; employment history; work experience information; information on internal project appointments; accomplishment information; training and development information; award information; membership information.

2. Related persons: Name and contact information of d ependents or beneficiaries (including home address; home and work telephone numbers; mobile telephone numbers); date of birth; gender; emergency contacts; beneficiary information; dependent information.

3. Prospects, customers, business partners and suppliers : Name and contact information (including work address; work telephone numbers; mobile telephone numbers; web address; instant messenger; work email address); business title; company.

4. Learners: Name and contact information (including work address; work tel ephone numbers; mobile telephone numbers; instant messenger; work email address); business title; company; enrollment information, including completion of courses, exam results and feedback provided.

Sensitive data transferred (if applicable) and applied r estrictions or safeguards that fully take into consideration the nature of the data and the risks involved, such as for instance strict purpose limitation, access restrictions (including access only for staff having followed specialized training), keeping a record of access to the data, restrictions for onward transfers or additional security measures.

Unless otherwise agreed, the transferred Personal Data may comprise special categories of personal data, such as ethnicity, religious beliefs, trade union me mbership information and health data (employee sick leave, disability information). Taking into consideration the nature of the data and the risk of varying likelihood and severity for the rights and freedoms of natural persons, Workday has implemented the technical and organizational measures as described in Annex II, including specialized training of staff and system access logs, to ensure an appropriate level of protection for such sensitive data.

Frequency of the transfer (e.g. whether the data is transferred on a one-off or continuous basis) Transfers will be made on a continuous basis.
00375627.0 – Confidential

UNIVERSAL DATA PROCESSING EXHIBIT

Workday Universal Data Processing Exhibit – City of Santa Maria ©2022 Workday (UDPE Global v22.5) Page 9 of 11
Nature of the processing
Workday acts as a processor for the Personal Data Customer submits electronically into Workday’s enterprise cloud applications or provides to Workday in connection with a Professional Services engagement.

1. Processing Personal Data to set up, operate, maintain and support the enterprise cloud applications

2. Storage of Personal Data in secure data centers

3. Provision of Professional Services

Purpose(s) of the data transfer and further processing
Provide and support enterprise cloud applications, including human resource and financial management.

The period for which the personal data will be retained, or, if that is not possible, the criteri a used to determine that period
Personal data will be retained for the duration of the Agreement in accordance with DPE Section 12.2t.

For transfers to (sub-) processors, also specify subject matter, nature and duration of the processing The subject matte r and duration of the processing is outlined above within this Annex. The nature of the specific sub - processing services are further particularized within the Subprocessor List (currently located at:
https://www.workday.com/en-us/legal/subprocessors.html).

C. COMPETENT SUPERVISORY AUTHORITY
Identify the competent supervisory authority/ies in accordance with Clause 13 The competent supervisory authority determined in accordance with Cla use 13 of the EU SCCs unless required otherwise by DPE Sections 10.4.2 (UK Personal Data) and 10.4.3 (Swiss Personal Data). 00375627.0 – Confidential

UNIVERSAL DATA PROCESSING EXHIBIT

ANNEX II
Technical and Organizational Measures
The technical and organizational measures set forth in the Security Exhibit have been implemented by the data importer to ensure an appropriate level of security, taking into account the nature, scope, context and purpose of the processing, and the risks for the rights and freedoms of natural persons.

00375627.0 – Confidential

UNIVERSAL DATA PROCESSING EXHIBIT

ADDENDUM B
BCR Covered Services

Covered Service Applicable SKU Names
HCM/FIN/ANALYTICS Human Capital Management, Cloud Connect for Benefits, Workday Payroll, Cloud Connect for Third Party Payroll, Time Tr acking, Recruiting, Learning (excluding Media Cloud), Learning for Extended Enterprise, Core Financials, Expenses, Procurement, Inventory, Grants Management, Projects, Projects Billing, Workday Prism Analytics and Student
Workday Adaptive Planning Workday Adaptive Planning SKUs, such as Planning & Analytics, Workforce Planning, Financial Planning, Sales Planning, Operational Planning, however defined in the applicable order form.

Workday Extend Workday Cloud Platform

00375627.0 - Confidential

UNIVERSAL SECURITY EXHIBIT

©2019 Workday 19.5 Page 1 of 2
This Workday Universal Security Exhibit applies to the Covered Service and Covered Data. Capitalized terms used herein have the meanings given in the Agreement, including attached exhibits, that refers to this Workday Universal Security Exhibit.

Workday m aintains a comprehensive, written information security program that contains administrative, technical, and physical safeguards that, taking into account the state of the art, the costs of implementation and the nature, scope, contex t and purposes of processing of Covered Data as well as the associated risks, are appropriate to (a) the type of information that Workday will store as Covered Data; and (b) the need for security and confidentiality of such information. Workday’s security program is designed to:
 Protect the confidentiality, integrity, and availability of Covered Data in Workday’s possession or control or to which Workday has access;
 Protect against any anticipated threats or hazards to the confidentiality, integrity, and availability of Covered Data;  Protect against unauthorized or unlawful access, use, disclosure, alteration, or destruction of Covered Data;  Protect against accidental loss or destruction of, or damage to, Covered Data; and  Safeguard information as set forth in any local, state or federal regulations by which Workday may be regulated.

Without limiting the generality of the foregoing, Workday’s security program includes:

1. Security Awareness and Training. Mandatory employee security awareness and training programs, which include:
a) Training on how to implement and comply with its information security program; and b) Promoting a culture of security awareness.

2. Access Controls. Policies, procedures, and logical controls:
a) To limit access to its information systems and the facil ity or facilities in which they are housed to properly authorized persons;
b) To prevent those workforce members and others who should not have access from obtaining access; and c) To remove access in a timely basis in the event of a change in job respon sibilities or job status.

3. Physical and Environmental Security. Controls that provide reasonable assurance that access to physical servers at the data centers housing Covered Data is limited to properly authorized individuals and that environmental cont rols are established to detect, prevent and control destruction due to environmental extremes.

4. Security Incident Procedures. A security incident response plan that includes procedures to be followed in the event of any security breach of any application or system directly associated with the accessing, processing, storage or transmission of Covered Data.

5. Contingency Planning. Policies and procedures for responding to an emergency or other occurrence (for example, fire, vandalism, system fa ilure, pandemic flu, and natural disaster) that could damage Covered Data or production systems that contain Covered Data.

6. Audit Controls. Technical or procedural mechanisms put in place to promote efficient and effective operations, as well as compliance with policies.

7. Data Integrity. Policies and procedures to ensure the confidentiality, integrity, and availability of Covered Data and to protect it from disclosure, improper alteration, or destruction.

8. Storage and Transmission Security . Security measures to guard against unauthorized access to Covered Data that is being transmitted over a public electronic communications network or stored electronically. 00375627.0 - Confidential

UNIVERSAL SECURITY EXHIBIT

9. Secure Disposal. Policies and procedures regarding the secure disposal of ta ngible property containing Covered Data, taking into account available technology so that such data cannot be practicably read or reconstructed.

10. Assigned Security Responsibility . Assigning responsibility for the development, implementation, and mainte nance of its information security program, including:
a) Designating a security official with overall responsibility; and b) Defining security roles and responsibilities for individuals with security responsibilities .

11. Testing. Regularly testing the ke y controls, systems and procedures of its information security program to validate that they are properly implemented and effective in addressing the threats and risks identified.

12. Monitoring. Network and systems monitoring, including error logs on s ervers, disks and security events for any potential problems. Such monitoring includes:
a) Reviewing changes affecting systems handling authentication, authorization, and auditing; b) Reviewing privileged access to Workday production systems processing Covered Data; and c) Engaging third parties to perform network vulnerability assessments and penetration testing on a regular basis.

13. Change and Configuration Management. Maintaining policies and procedures for managing changes Workday makes to production systems, applications, and databases processing Covered Data. Such policies and procedures include:
a) A process for documenting, testing and approving the patching and maintenance of the Covered Service; b) A security patching process that requires patching systems in a timely manner based on a risk analysis; and c) A process for Workday to utilize a third party to conduct web application level security assessments. These assessments generally include testing, where applicable, for:
i) Cross-site request forgery
ii) Services scanning
iii) Improper input handling (e.g. cross-site scripting, SQL injection, XML injection, cross-site flashing) iv) XML and SOAP attacks
v) Weak session management
vi) Data validation flaws and data model constraint inconsistencies vii) Insufficient authentication
viii) Insufficient authorization

14. Program Adjustments. Workday monitors, evaluates, and adjusts, as appropriate, the security program in light of:
a) Any relevant changes in technology and any internal or external threats to Workday or the Covered Data; b) Security and data privacy regulations applicable to Workday; and c) Workday’s own changing business arrangements, such as mergers and acquisitions, alliances and joint ventures, outsourcing arrangements, and changes to information systems. 00375627.0 - Confidential

Main Subscription Agreement - City of Santa Maria
©2022 Workday v22.8 i
Frequently Asked Questions about the Workday Contract Documents

Thank you for reviewing Workday’s contract documents! We recognize that sometimes attorneys and contract professionals are asked to review an agreement without a good picture of what is being purchased and how it works. We hope to provide an explanation of Workday’s products and methodologies through this FAQ and that it will prove useful as you review the Workday documents. This FAQ does not form part of the contract and will be deleted in the next version of the contract documents you receive. In addition to this FAQ, the attached Agreement has comments embedded throughout the Agreement to highlight some areas where we may need to tailor the Agreement to better fit y our organization. You do not need to delete these highlighted comments, as Workday will remove them automatically in the next version.

1. What is my organization purchasing from Workday?
Workday provides fully functional enterprise cloud applications through the web using a genuine one-to -many cloud delivery model. Workday updates the Service and backs up the data. All customers are on the same version of Workday’s applications so that all customers on a specific application are on the same release using the same operational infrastructure and the same security and support operations. Workday’s Service is highly configurable by each customer; however, the Service is not customizable.

2. How is Workday’s Service different from installed, on premise software? Workday’s cloud-based, mobile-first applications operate on a true one-to -many business model. Some cloud providers are essentially an outsourced hosting provider, serving a customized version of another company’s software or of their own installed and customized software, which leads to burdensome upgrades and may result in associated maintenance fees. Workday’s one-to -many business model allows for a more cost -effective delivery of solutions by keeping all customers on the same release at all times. Workday customers avoid costly and disruptive upgrades; and Workday
handles the upgrade process during its normal support windows.

3. How does Workday protect the data?
Workday’s development methodology includes Privacy by Design. Protecting the security and privac y of our customers’ data is a top priority for Workday. Workday maintains a comprehensive security program that takes into account the nature and purposes of the Service, the legal and regulatory environment, and our customers’ need for security and confidentiality. Workday monitors, evaluates, and adjusts this security program in light of changing technology and the changing legal and business environments in which it operates. More details are described below and in Question 4.

Data Security:
• Controls: Workday's security program uses controls described in Workday's Universal Security Exhibit as documented in Workday's most recent third-party SOC Reports. Because our SOC reports are SOC Type II audits, independent auditors attest to the operating effectiveness of our security controls. Through our SOC reports, Workday provides customers with objective evidence that Workday is maintaining its security controls as claimed, by verifying the results of the audited testing of controls as they are recorded in t he audit reports.

Workday makes our SOC reports available to our customers, providing independent verification of and visibility into the security controls protecting their data. Workday provides additional protection in Section 5 of the Agreement in whic h Workday contractually commits that our security controls will not be materially decreased during the term of the Agreement.
• Background Screening: Workday performs background checks on employees who will interact with Customer Data. Our SOC reports list the tests we perform and confirm that Workday has indeed performed them. • Employee Training: Workday is proud of our employee training. Workday’s Universal Security Exhibit requires, and the SOC report confirms the types of training Workday provides our personnel.

Data Privacy:
• Universal Data Processing Exhibit: The Agreement includes an exhibit that details the terms and conditions applicable to Workday’s processing of Personal Data, which makes up a part of our Customer Data. This Universal Data Processing Exhibit provides our customers with contractual protections relating to Workday’s practices, as well as our compliance with data protection laws applicable to Workday as a data processor.

Compliance:
• Compliance with Laws: In Section 6 of the Agreement, Workday warrants that it will comply with all Laws applicable to its performance of the Agreement.
00375627.0 - Confidential

Main Subscription Agreement - City of Santa Maria
©2022 Workday v22.8 ii

Depending upon which Workday Services a customer selects, the Workday’s Service may store human resources data, financial information, or student data. Workday regards all Customer Data as confidential and does not distinguish differences in its treatment of personally identifiable information or other Customer Data, holding all to equally high standards. Customer Data are encrypted in the database within the secured data centers. Workday does not access or use Customer Data for any purpose unrelated to delivering, supporting, improving and maintaining the Cloud services without a separate agreement pertaining to any additional use. In this manner, customers remain in control of their data and are responsible for determining appropriate data access and use for the parties they authorize.

Because Workday runs the Workday Service for all customers on the basis of a single customer experience with a standard approach to security, production support, service availability, and data privacy, we provide all customers with the same level of protection. W orkday's ability to provide a consistently high level of service relies on the standardization of our processes, including security and data privacy methodologies. The details of Workday's controls are always available to customers through the Universal Security Exhibit, Service Level Agreement, Universal Data Processing Exhibit, and the SOC audit reports. These controls are all incorporated as obligations in the Agreement, with a warranty that Workday will never materially decrease these obligations. For this reason, Workday does not agree to individual customer security policies or data definitions as this is not practical in light of Workday’s business model, nor desirable in a multi-tenant delivery model.

4. Why can't my security and privacy exhibits be joined to the contract? As a true cloud provider, Workday operates a multi-tenanted platform where all customers share a platform and single version of the application with logical segregation of data between customers. All of our security controls are designed from the ground up for a native cloud environment, and a consistent set of security controls is applied to our Services, including all environments where data from our customers is present. This means, however, that we cannot contractually commit to individual customers’ security or privacy standards, polices, or definitions without breaking our business model.

Workday maintains a formal and comprehensive security program designed to ensure the accessibility, confidentiality, and integrity of Customer Data, and protect against security threats and data breaches, while preventing unauthorized access. These controls form part of our business model and enable Workday to meet our SLA commitments around Service Availability, recovery time objective, recovery point objective, and security while also enabling Workday to continually enhance and develop our security and privacy programs to the benefit of all customers. The specifics of Workday’s security program are detailed in our Universal Security Exhibit, our third-party security audits, and through Workday’s international certifications. Workday commits to never materially decrease the protections provided by our then current audit reports and the Exhibits to the Agreement, and the Documentation. In addition, our privacy controls are described in our Universal Data Processing Exhibit, so customers have contractual commitments detailing how Workday complies with data protections laws applicable to Workday in our role as a data processor.

5. How do we get our data back when the relationship ends? Customers always own their data throughout the course of the relationship. (See Section 3 of the Agreement, “Proprietary Rights”). Customers can download copies of their data stored in the Workday Service at any time during the Term.

Workday has a standard process for a final data download upon termination of relationship, which can also be found in the Agreement (see Section 9 for the sub-section entitled “Retrieval of Customer Data”).

6. Does Workday offer an SLA?
Yes, Workday has a service level agreement, so customers always know Workday’s commitments regarding service levels. The success of Workday's cloud delivery business model is predicated upon the efficiency of multi-tenant infrastructure. Since Workday has the same operational business model for our entire customer base, the SLA cannot be modified by any individual customer. Workday provides service credits in the event of certain SLA failures that can be found in the SLA Credit provision of the Agreement (see Section 10.11 for the sub-section entitled “Workday SLA Service Credits”).

7. Does Workday provide protection against fraud in the selection process? Yes. Workday addresses concerns about procurement fraud a little differently from what some customers may be used to, but still offers robust protection against fraud during the selection process.

Workday does not attach the RFP or proposal to its agreements, as this methodology isn’t consistent with Workday’s one to many business model. Workday’s Service is highly configurable but not customizable. Additionally, Workday provides numerous updates that increase functionality and can provide stronger security and other protections over time.

Therefore, it is quite likely that the Service has improved between the time a prospective customer issues an RFP, 00375627.0 - Confidential

Main Subscription Agreement - City of Santa Maria
©2022 Workday v22.8 iii
vendors respond, the customer reviews and awards, and the parties begin negotiations. Workday’s frequent release schedule means that any proposal describing features and functionality is a snapshot in time which becomes outdated in part by the next release. Although the configuration/deployment process is shorter with Workday’s Service than with typical installed software equivalents, there are likely to be multiple additional updates by the time the Workday Service goes live, making the proposal substantially out of sync with what is actually being delivered.

Instead of warranting to functional specifications in the RFP or attaching RFP responses to the contract, Workday provides an ongoing warranty to the Workday Documentation (which is the administrative guide for the Service) that persists for the lifetime of the subscription. Workday’s Documentation is online and available to customers as part of the Workday Service. This means that instead of warranting for a f inite period, Workday will be warranting that as long as a customer subscribes to the Workday Service, it will materially conform to its then-current Documentation. Additionally, Workday warrants that changes to the Workday Service will not materially dec rease functionality of the Workday Service.

Accordingly, customers receive a long-term warranty that functionality will not materially degrade despite changes in delivery technology. Furthermore, Workday does not limit its direct liability for fraud, so our customers have a strong protection against any kind of fraud in the procurement process. We believe that these protections offer a much stronger protection than what has typically been provided for commercial software. When vendors attach RFPs and proposals to contracts, they usually do so in a way which provides a warranty that is either only for the version of the software that was current when the proposal was written, or only for a very limited time (1-2 years), so it would often expire before the customer was using the solution in production.

8. What is Workday’s pricing methodology?
Workday’s business model is structured on a multi- year subscription with a pricing model based on the number of workers, other size metrics, and, for some services, usage. During the contractually agreed upon term, the subscription fee may not be reduced. Thus, Workday cannot accommodate a customer’s request to decrease their payments to Workday based upon a reduction in customer’s employee count or applicable usage regardless of the reason for such reduction (customer downsizing, customer acquired by another entity, etc.).

9. Does Workday offer a termination for convenience?
Workday does not agree with the concept of “termination for convenience.” A fundamental element of Workday's business model is that the parties enter into a multi-year agreement to which both parties are committed during the specified term.

The only exception is where there is a statutory mandate requiring such a right, and it will impact Workday’s flexibility when it comes to pricing structure. Workday will, however, provide certain public sector customers with a right to terminate under certain conditions should the customer’s funding cease despite the customer’s good faith efforts.

10. Does Workday offer an acceptance test period?
Workday's cloud-based business delivery model is fundamentally different than other business delivery models. Since Workday runs the Service for all customers in the same manner, the viability of the Service has already been demonstrated by the existing customers who run their businesses on the same Service. Thus, the concept of an acceptance test is obsolete and does not exist in Workday’s business model. The Statement of Work for the Workday deployment however, which is between customers and their deployment services provider, typically includes deployment “gating” functions that are similar to a milestone acceptance test for the deployment. It is not the Workday Service that is being accepted, but the configuration or other deployment activity.

11. Will Workday permit customers to audit Workday?
To maintain the security of Workday's Service and facilities, Workday prefers not to host operational audits. Financial audits to confirm that invoices are correct are possible, but generally unnecessary for Services where pricing is based on a subscription level rather than usage. Rather than incur the operational disruption caused by thousands of customers conducting operational audits, Workday provides customers with objec tive evidence that Workday is maintaining its security controls through its engagement of independent third parties to produce SOC audit reports. If a customer desires to conduct its own operational audit, Workday has an audit program that a customer may elect to participate in for a fee.

12. Does Workday offer unlimited liability or a broad indemnification for all harm arising from the contract? Workday does not offer unlimited liability in most situations, nor does it agree to a broad indemnification clause.

Workday’s C-level management team has never viewed the Workday business proposition as including an outsourcing of risk, nor does Workday act as an insurer. Workday, however, does recognize that damages arising from certain situations should be unlimited and understands that our customers are concerned about the protection of their data and the remedies available in the event of a security breach. We believe that Workday’s approach is unique in the industry 00375627.0 - Confidential

Main Subscription Agreement - City of Santa Maria
©2022 Workday v22.8 iv
because it covers the primary costs associated with a breach of Personal Data and consequently provides an exceptionally high level of protection for our customers. • Specified remediation costs for certain types of security breach outside Limitation of Liability: In Section

8.4 of the Agreement, Workday has agreed to pay certain remediation costs. These listed costs are not subject to any limitation of liability. Specifically, in the event that any unauthorized access to or acquisition of Personal Data is caused by Workday’s breach of its security and/or privacy obligations under the Agreement, Workday will pay the reasonable and documented costs incurred by customers in connection with the following items: (a) costs of any required forensic investigation to determine the cause of the breach, (b) providing notification of the security breach to applicable government and relevant industry self -regulatory agencies, to the media (if required by applicable Law) and to individuals whose Personal Data may have been accessed or acquired, (c) providing credit monitoring service to individuals whose Personal Data may have been accessed or acquired for a period of one year after the date on which such individuals were notified of the unauthorized access or acquisition for such individuals who elected such credit monitoring service, and (d) operating a call center to respond to questions from individuals whose Personal Data may have been accessed or acquired for a period of one year after the date on which such individuals were notified of the unauthorized access or acquisition. The four items specified above are the only items associated with a data security breach that are outside limitation of liability and Workday will not consider adding any other items to the remediation costs which are outside the limitation of liability. • Indemnified claims and direct damages arising out of “bad acts” are not subject to limitation : Workday includes several standard carveouts from its general limitation of liability, including its intellect ual property indemnification obligation and damages arising from deliberate wrongdoing, gross negligence, and fraud.

Workday will not consider adding simple negligence to these carve outs because we do not act like an insurer. • Other damages / breaches are subject to Limitation of Liability : A fundamental principle of Workday's business model is that any other damages and any other breaches of the Agreement are subject to a limitation of liability (see Section 8 of the Agreement).
• To reduce uncertainty, Workday characterizes certain damages as direct. Government fines and third-party claims arising from a party’s breach are considered direct damages but are not indemnified or unlimited (unless one of the “bad acts” carve outs applies).

13. How is the Workday Service priced?
The Order Form for the subscription to the Service has the pricing, generally based on full time equivalent employees as the pricing metric. Workday requires an initial minimum three-year subscription term and does not agree to termination for convenience clauses unless there is a statutory mandate for such clauses. The subscription term starts upon Order Form execution. Immediately after Order Form execution, Workday creates the customer -specific tenant, which is used throughout the deployment phase. Order Forms for training also start their term upon execution; the training products are used throughout the deployment and the classroom training credits are typically used very early in the deployment project because they are for project team training, not end-user training. Customers and their deployment services vendor create end-user training using the Adoption Kits.

14. What are the Contract Documents?
• Main Subscription Agreement (“Agreement”): General business and legal terms for all Workday Services. • Order Forms: Incorporate the terms of the Main Subscription Agreement and describe a specific Service subscription, training product subscription, or a defined consulting subscription. The Main Subscription Agreement is not designed for deployment engagements, which are handled under a Professional Services Agreement. Some Workday offerings are not part of the core Workday Service and additional terms for those offerings are attached to the applicable Order Form.
• Workday Universal Security Exhibit : This sets forth the minimum -security controls and procedures that Workday agrees to follow. Given the fact that the Workday Service is operated on a single code line through a shared environment and infrastructure, the security controls used by Workday apply to all customers. This document is available at https://www.workday.com/en-us/legal/contract-terms-and-conditions/index.html

and Workday does not modify it s shared environment, infrastructure, or security controls for individual customers.
• Workday Production Support and Service Level Availability Policy (“SLA”): Contains terms applicable to all Workday customers regarding production support and uptime commitments. This document is available at https://www.workday.com/en-us/legal/contract-terms-and-conditions/index/exhibits.html and Workday does not modify its support infrastructure or commitments for individual customers. 00375627.0 - Confidential

Main Subscription Agreement - City of Santa Maria
©2022 Workday v22.8 v
• Workday Universal Data Processing Exhibit : Incorporates additional terms required by data protection laws.

This document is available at https://www.workday.com/en-us/legal/contract-terms-and- conditions/index.html and Workday does not modify its shared environment, infrastructure, security or privacy controls for individual customers.
• Professional Services Agreement (“PSA”) : Used only if a customer is purchasing the deployment services directly from Workday. Has general business and legal terms related to the delivery of consulting services. If your organization is purchasing deployment services directly from Workday, most of our customers have found it most efficient to wait until we have completed negotiations over the Agreement to begin on the PSA; in fact, we have a short -form PSA which works for the vast majority of our customers because it leverages the business/legal issues in the Agreement which are the same across both types of services. Where a customer’s Agreement has been highly negotiated and the short -form PSA will not work, we still find it efficient to negotiate the PSA after the Agreement and begin negotiations on the PSA by importing many of the agreed-upon changes from the Agreement. The ownership, warranty and warranty remedies, IP infringement remedies, limitation of liability, and termination rights are different in the PSA due to the different nature of the services and will not be imported word for word.
• Delivery Assurance Order Form: Used only if a customer is purchasing the deployment services from a Workday Partner (no PSA or SOW required). Maps out specific check points in the deployment process where Workday verifies the Partner deployment process is proceeding in accordance with Workday guidelines and requirements.
• Statement(s) of Work : Incorporate the terms of the PSA and describe a specific consulting engagement, generally for deployment of Workday’s Services.

A quick word about redlining.

Workday has provided certain contract documents in Word and others in PDF format. The PDF format documents are ones that represent Workday’s one-to -many model infrastructure and operational policies and procedures and are not modified for individual customers, either in the document or indirectly through modification in other documents. Word documents are provided in a format that allows redlined changes but does not allow cust omers to accept those changes.

Workday tracks all changes carefully in order to have a complete record of the negotiation. You can modify comments, so one effective way to solicit internal contributions without having Workday “see” them is to have one of ficial “scribe” who makes redlined changes and ask all other reviewers to just use the comments feature in Word, which the Scribe can remove or edit before returning to Workday. Workday can generate redlines showing changes from any two specified versions upon request. We also ask that you not strip our locking off and send us a document that has been generated without the metadata from our document management system included; such documents are not capable of the automated comparisons that our document management system can generate and importing, comparing, and verifying such documents is a labor intensive project that will delay negotiations and final signatures, which may affect any time based pricing incentives provided by Workday.

The comments that are embedded throughout the initial draft of the Agreement can be removed by Workday using automated features within Word, so there is no need for you to redline through them.

Workday’s Signature Process
Workday uses Adobe Sign, an electronic signature tool which allows parties to sign electronically. Use of this process is strongly preferred by Workday, as it ensures the document was not altered, the document is confidential, and both Workday and the customer can track where the document is in the signature process. Many of Workday’s activation processes are triggered based on the electronic signature. It is Workday’s policy that the customer signs first. Use of wet signatures, or requests that Workday sign first may delay final signatures, which may affect time-based pricing incentives provided by Workday.

00375627.0 - Confidential

MAIN SUBSCRIPTION AGREEMENT

Main Subscription Agreement - City of Santa Maria
©2022 Workday v22.8 Page 1 of 13
Documents Agreement Number
Main Subscription Agreement (v22.8) Agreement #: 00375627.0 Subscription Order Form Order Form #:

Training Order Form Order Form #:
*Subscription Order Form – Innovation Services – No Fee Order Form #:
*Delivery Assurance Order Form #:
*Professional Services Agreement (v19.5) PSA #:
*Statement of Work Statement of Work #:
*Add related agreement number if applicable.

By executing this document (“Signature Document”), the undersigned agree they are duly authorized signatories and all documents listed in the above table are entered into between the parties, effective as of the later of the dates beneath the parties’ signatures below (“Effective Date”). References to Signature Document and Effective Date in the Main Subscription Agreement shall mean those terms as defined in the preceding sentence.

City of Santa Maria
110 E Cook St
Santa Maria, California 93454
United States

Workday, Inc.
6110 Stoneridge Mall Road
Pleasanton, CA 94588
Signature Signature

Name Name

Title Title

Date Signed Date Signed

Approved as to Legal Form by:

00375627.0- Confidential

MAIN SUBSCRIPTION AGREEMENT

Main Subscription Agreement - City of Santa Maria
©2022 Workday v22.8 Page 2 of 13
This Main Subscription Agreement, effective as of the Effective Date set out in the Signature Document, is by and between Workday, Inc. ("Workday") a Delaware corporation with offices at 6110 Stoneridge Mall Road, Pleasanton, CA 94588 and City of Santa Mar ia [COMMENT: Please confirm that this is your organization’s full and correct name.](“Customer”), with offices at 110 E Cook St , Santa Maria, California 93454, United States. Whereas Workday provides a subscription Service to which Customer intends to subscribe, this Agreement establishes the business relationship and allocation of responsibilities regarding the Service and the parties therefore agree as follows:

1. Provision of Service.

1.1 Workday Obligations. During the Term, Workday shall: (i) make the Service and Improvements available to Customer in accordance with the Documentation, the SLA and pursuant to the terms of this Agreement; and (ii) not use Customer Data except to provide the Service, prevent or address service or technical problems, or verify Improvements, in accordance with this Agreement and the Documentation, or in accordance with Customer’s instructions.

1.2 Customer Obligations. Customer may enable access to the Service for use only by Authorized Parties solely for the Internal Business Purposes of Customer and its Affiliates in accordance with the Documentation and not for the benefit of any third parties for a level of use not exceeding the Pricing Metrics on the applicable Order Form. Customer is responsible for all Customer Affiliate and Authorized Party use of the Service and compliance with this Agreement.

Customer shall: (a) have sole responsibility for the accuracy, quality, and legality of all information submitted to Workday, including, but not limited to Customer Data; (b) take commercially reasonable efforts to prevent unauthorized access to or use of the Service through login credentials of Authorized Parties, and notify Workday promptly of any unauthorized access or use ; and (c) take commercially reasonable efforts to prevent the sending of or storage of Malicious Code in connection with use of the Service. Customer shall not: (i) use the Service in violation of Laws; (ii) in connection with use of the Service, send or store infringing, obscene, threatening, or otherwise unlawful or tortious material, including material that violates privacy rights; (iii) send or store Malicious Code in connection with use of the Service; (iv) interfere with or disrupt performance of the Service or the data contained therein; or (v) attempt to gain access to the Service or its related systems or networks in a manner not set forth in the Documentation.

2. Fees.

2.1 Invoices and Payment. Subscription Fees and all other fees due hereunder will be invoiced to Customer in the United States and payment will be remitted by Customer from the United States. Except where indicated otherwise on an applicable Order Form, all fees due hereunder (except fees subject to good faith dispute) shall be due and payable within thirty (30) days of invoice date. Workday will send all Customer invoices electronically (by email or otherwise) . Workday shall email invoices to Customer within two business days of the date of the invoice. All fees are quoted and payable in United States Dollars and are based on access rights acquired and not actual usage. [COMMENT: If your organization is subject to a statutory prompt payment act, let us know and provide the citation so we can make this section consistent with it.] Customer shall provide Workday with complete and accurate billing and contact information including a valid email address. Upon Workday’s request, Customer will make payments via electronic bank transfer. All remittance advice and invoice inquiries can be directed to [email protected].

2.2 Non-cancelable and non -refundable. Except as specifically set forth to the contrary under Section 6.2 “Warranty Remedies”, Section 7 “Indemnification”, Section 9.3 “Effect of Termination”, and for credits due pursuant to Section 10.11 “Workday SLA Service Credits”, all payment obligations under any and all Order Forms are non-cancelable and all payments made are non-refundable.

2.3 Overdue Payments. Except with respect to charges subject to a reasonable and good faith dispute, any payment not received from Customer by the due date may accrue, at Workday's discretion, late charges at the rate of

1.5% [COMMENT: Workday does n ot agree to eliminate late fees because pricing is based on an expectation of timely payment. If a statutory prompt payment act applies, we will adjust this clause to reflect it. ] of the outstanding balance per month, or the maximum rate permitted by law, whichever is lower, from the date such payment was due until the date paid.

2.4 Non-Payment and Suspension of Service. Except with respect to charges subject to a reasonable and good faith dispute, if Customer's account is more than thirty (30) days past due, in addition to any other rights or remedies it may have under this Agreement or by law, Workday reserves the right to suspend the Service upon thirty (30) days written notice, without liability to Customer, until such amounts are paid in full. Such notice shall clearly and prominently 00375627.0- Confidential

MAIN SUBSCRIPTION AGREEMENT

Main Subscription Agreement - City of Santa Maria
©2022 Workday v22.8 Page 3 of 13
state that the Service is at risk of suspension and shall not solely take the form of an invoice with an overdue notice.[COMMENT: Please note that the earliest Workday could suspend the Service is 90 days after invoice date—Net 30 days to pay+30 days late before demand can be sent + 30 day cure period.]

2.5 Taxes. This section applies only if Customer has not provided Workday with a tax exemption certificate authorized and honored by applicable taxing authorities that covers all Taxes. Subscription Fees and all other fees invoiced pursuant to this Agreement do not include, and may not be reduced to account for, any taxes, which may include local, state, provincial, federal or foreign taxes, levies, duties or similar governmental assessments of any nature, including, but not limited to, value-added taxes, excise, use, goods and services taxes, consumption taxes or similar taxes and foreign withholding taxes (collectively defined as “Taxes”). Customer is responsible for paying all Taxes imposed on the Service or any other services provided under this Agreement. If Workday has a legal obligation to pay or collect Taxes for which Customer is responsible under this Agreement, the appropriate amount shall be computed based on Customer’s address listed in the Signature Document which will be used as the ship-to address on the Order Form, and invoiced to and paid by Customer, unless Customer provides Workday with a valid tax exemption certificate authorized by the appropriate taxing authority.

3. Proprietary Rights.

3.1 Ownership and Reservation of Rights to Workday Intellectual Property. Workday and its licensors own all right, title and interest in and to the Service, Documentation, and other Workday Intellectual Property Rights. Subject to the limited rights expressly granted hereunder, Workday reserves all rights, title and interest in and to the Service and Documentation, including all related Intellectual Property Rights. No rights are granted to Customer hereunder other than as expressly set forth herein.

3.2 Grant of Rights. Workday hereby grants Customer (for itself and those of Customer’s Af filiates and Authorized Parties for whom Customer enables access to the Service) a non-exclusive, non-transferable, right to use the Service and Documentation solely for the Internal Business Purposes of Customer and its Affiliates and solely during the Term, subject to the terms and conditions of this Agreement within the scope of use defined in the relevant Order Form. The Service is provided in U.S. English. Workday has translated portions of the Service into other languages and unless otherwise indicated in the applicable Order Form, Customer may use any available translated portions of the applicable Service.

3.2 Restrictions. Customer shall not (i) modify or copy the Service or Documentation or create any derivative works based on the Service or Docum entation; [COMMENT: Should Customer purchase the Workday Adoption Kit to create end-user training materials; the Order Form for the Adoption Kit includes a more expansive right to use the Adoption Kit materials consistent with that purpose.] (except for ar chival copies of the Documentation for use consistent with this Agreement); (ii) license, sublicense, sell, resell, rent, lease, transfer, assign, distribute, time share, offer in a service bureau, or otherwise make the Service or Documentation available t o any third party, other than to Authorized Parties as permitted herein; (iii) reverse engineer or decompile any portion of the Service or Documentation, including but not limited to, any software utilized by Workday in the provision of the Service and Documentation, except to the extent required by Law; or (iv) access the Service or Documentation in order to build any commercially available product or service except as otherwise provided in an applicable Order Form.

3.3 Ownership of Customer Data. As between Workday and Customer, Customer owns its Customer Data. [COMMENT: Workday anticipates that some Customer Data may not actually be owned by a customer, but Workday will not assert any ownership rights.]

3.4 Customer Input. [COMMENT: Customer Input is not the same as Customer Data. Customer Input is suggestions about future improvements to the Service and other feedback-type information. ] Workday shall have a royalty-free, transferable, sub-licensable, irr evocable, perpetual license to use, and incorpor ate into its services, any Customer Input. Workday shall have no obligation to make Customer Input an Improvement. Customer shall have no obligation to provide Customer Input.

4. Confidentiality. [COMMENT: If you are subject to FERPA let us know and Workday can add appropriate language.]

4.1 Confidentiality. A party shall not disclose or use any Confidential Information of the other party except as reasonably necessary to perform its obligations or exercise its rights pursuant to this Agreement or with the other party's prior written permission.

00375627.0- Confidential

MAIN SUBSCRIPTION AGREEMENT

4.2 Protection. Each party agrees to protect the Confidential Information of the other party in the same manner that it protects its own Confidential Information of like kind, but in no event using less than a reasonable standard of care.

4.3 Compelled Disclosure. [COMMENT: If you are subject to a public records law, this section covers public records act requests. This section can be tailored to reflect your public records law.] A disclosure by one party of Confidential Information of the other party to the extent required by Law shall not be considered a breach of this Agreement, provided the party so compelled promptly provides the other party with prior notice of such compelled disclosure (to the extent legally permitted), follows the process set forth in the applicable public records law(s), and provides reasonable assistance, at the other party's cost, if the other party wishes to contest the disclosure. Subject to the foregoing, in the event of any request by a government agency or law enforcement authority for access to Customer Data, Workday will seek to redirect the inquiry to Customer. In all such cases, Workday will take all reasonable and legally permissible measures to protect the Customer Data and to inform Customer of such demand.

4.4 Business Associate Exhibit. If Customer concludes that the Service will include access to Customer Data that is protected by the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), and Customer is a Covered Entity as defined under HIPAA, the parties agree to attach Workday’s Business Associate Exhibit to this Agreement, which shall apply to Workday’s receipt, maintenance or transmission of Protected Health Information from, or on behalf of Customer, as described in such Exhibit. [COMMENT: Workday has a model Business Associate Exhibit which meets the requirements of HIPAA and HITECH. We require customers to use our BAE rather than their own because most BAE/BAA documents are written with the assumption that the Business Associate is a true outsourcing bureau and tha t any requests for Covered Data (as defined under HIPAA) will be fulfilled by the Business Associate. This is not the case with Workday. We provide tools that customers use to manage their data but do not actively manage it ourselves. Customers, not Workday, are responsible for fulfilling requests about Covered Data.]

4.5 Remedies. If a party discloses or uses (or threatens to disclose or use) any Confidential Information of the other party in breach of confidentiality protections hereunder, the party who owns the Confidential Information shall have the right, in addition to any other remedies available, to seek injunctive relief to enjoin such acts, it being acknowledged by both parties that any other available remedies may be inadequate.

4.1 Exclusions. Confidential Information shall not include any information that: (i) is or becomes generally known to the public without breach of any obligation between the parties; (ii) was known to a party prior to its disclosure by the other party without breach of any obligation between the parties; (iii) was independently developed by a party without breach of any obligation between the parties; or (iv) is received from a third party without breach of any obligation owed to the other party. Customer Data shall not be subject to the exclusions set forth in this section.

5. Customer Data.

5.1 Protection and Security. Workday maintains a security program that conforms to the Workday Universal Security Exhibit attached hereto (“Security Exhibit”) and is further described in Workday’s most recently completed Service Organization Control 1 (SOC1) and Service Organization Control 2 (SOC2) audit reports or industry -standard successor reports. The most recently com pleted SOC1 and SOC2 (or industry standard successor audit reports) as of the Effective Date are referred to as the "Current Audit Reports". In no event during the Term shall Workday materially decrease the protections provided by the controls set forth in the Security Exhibit and the Current Audit Reports. Upon Customer’s request, Workday will provide Customer with a copy of Workday’s Current Audit Reports or comparable industry-standard successor reports prepared by Workday’s independent third-party auditor. The Universal Data Processing Exhibit attached hereto (the “Data Processing Exhibit” or “DPE”) will apply to the processing of Personal Data.

Customer understands that its use of the Service and compliance with any terms hereunder does not constitute compliance with any Law. Customer understands that it has an independent duty to comply with any and all Laws applicable to it.

5.2 Unauthorized Disclosure. If either party believes that there has been a Security Breach, such party must promptly notify the other party, unless legally prohibited from doing so, within forty -eight (48) hours or any shorter period as may be required by Law; provided, however, that Customer is not required to notify Workday in any case where Customer reasonably determines that the Security Breach presents no threat to the Service. [COMMENT: At present, there are no state data breach statutes requiring less than 48 hours.] Additionally, each party will reasonably assist the other party in mitigating any potential damage. [COMMENT: See Section 8.4 below for special remedies when Personal Data has been exposed in certain circumstances.] As soon as reasonably practicable after any such 00375627.0- Confidential

MAIN SUBSCRIPTION AGREEMENT

Main Subscription Agreement - City of Santa Maria
©2022 Workday v22.8 Page 5 of 13
Security Breach that is not clearly attributable to Customer or its Authorized Parties, Workday shall conduct a root cause analysis and, upon request , [COMMENT: At present, Workday’s ticketing system requires a request to trigger sharing of the root cause analysis and remediation plan.] will share the results of its analysis and its remediation plan with Customer. Unless prohibited by Law, each party shall provide the other party with reasonable notice of, and the opportunity to review and comment on the content of all public notices, filings, or press releases about a Security Breach that identify the other party by name prior to any such publication.

6. Warranties and Disclaimers.

6.1 Warranties. Each party warrants that it has the authority to enter into this Agreement and shall comply with all Laws in connection with its performance of this Agreement. Workday warrants that during the Term [COMMENT: These warranties run for the lifetime of the Agreement, not for 90 days to 1 year as was usually the case with installed software.] (i) the Service shall perform materially in accordance with the Documentation; (ii) the functionality of t he Service will not be materially decreased during the Term; and, (iii) to the best of Workday’s knowledge, the Service does not contain any Malicious Code. Order Forms for Related Services may have warranties specific to those Related Services. [COMMENT: (ii) is a protection against the “split the functionality into 2 modules, rename, and make customers buy a new license” strategy certain vendors have used in the past. While everyone expects the functionality to change over time, changes cannot materially decrease the functionality, security, or SLA commitments.]

6.2 Warranty Remedies. In the event of a breach of the warranty set forth in Section 6.1 (i), (ii) and (iii), (a) Workday shall correct the non-conforming Service at no additional charge to Customer, or (b) in the event Workday is unable to correct such deficiencies after good-faith efforts, Workday shall refund Customer amounts paid that are attributable to the defective Service from the date Workday received such notice (as set forth in Section 6.3 below) through the date of remedy, if any. The remedies set forth in this subsection shall be Customer’s sole remedy and Workday’s sole liability for breach of these warranties unless the breach of warranty constitutes a material breach of this Agreement and Customer elects to terminate this Agreement in accordance with the Section entitled “Termination.”

6.3 Notice Obligations. To receive the warranty remedies set forth above, Customer must promptly report deficiencies in writing to Workday, but no later than thirty (30) days of the first date the deficiency is identif ied by Customer, or, in the case of a Related Service, no later than thirty (30) days after delivery of such Related Service. [COMMENT: Workday cannot offer a longer warranty on the Related Service because the work is often superseded by a new release or related to a very specific point in a deployment] Customer’s failure to notify Workday within such thirty (30) day period shall not affect Customer’s right to receive the remedy in Section 6.2(a) unless Workday is somehow unable, or impaired in its ability to, correct the deficiency due to Customer’s failure to notify Workday within the thirty (30) day period. Notice of breaches of the warranty in Section 6.1(i), (ii), or (iii) shall be made through Workday’s then-current error reporting system; notices of breaches of any other warranty shall be made in writing to Workday in accordance with the Notice provisions of this Agreement.

6.4 DISCLAIMER. EXCEPT AS EXPRESSLY PROVIDED HEREIN AND TO THE MAXIMUM EXTENT PERMITTED

BY APPLICABLE LAW, THE PARTIES M AKE NO WARRANTIES OF ANY KIND, WHETHER EXPRESS, IMPLIED,

STATUTORY OR OTHERWISE, AND SPECIFICALLY DISCLAIM ALL IMPLIED WARRANTIES, INCLUDING ANY

WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE WITH RESPECT TO THE SERVICE AND RELATED SERVI CES AND THE DOCUMENTATION. WORKDAY DOES NOT WARRANT THAT THE SERVICE WILL BE ERROR FREE OR UNINTERRUPTED. THE LIMITED WARRANTIES PROVIDED HEREIN ARE

THE SOLE AND EXCLUSIVE WARRANTIES PROVIDED TO CUSTOMER IN CONNECTION WITH THE PROVISION OF THE SERVICE.

7. Indemnification

7.1 Workday Indemnity. Workday shall defend Customer, as Workday’s expense, from any third party Claim against Customer alleging that the use of the Service as contemplated under this Agreement infringes or misappropriates such [COMMENT: Workday limits indemnification to infringement; any other claims would be handled as breach of contract cases and subject to the limitation of liability. ] third party’s Intellectual Property Rights and Workday shall indemnify and hold Customer harmless against any Losses relating to such third party Claim.

7.2 Customer Indemnity. If and only if Customer is not legally prohibited from indemnifying its vendors, Customer shall defend Workday, at Customer’s expense, from any third-party claim against Workday alleging that the use of (1) Customer Data, or (2) data submitted by Customer, its Affiliates or its Authorized Parties pursuant to its use of the Service 00375627.0- Confidential

MAIN SUBSCRIPTION AGREEMENT

Main Subscription Agreement - City of Santa Maria
©2022 Workday v22.8 Page 6 of 13
infringes or misappropriates such third-party’s Intellectual Property Rights and Customer shall indemnify and hold Workday harmless against any Losses related to such Claim.

7.3 Conditions. The indemnitor’s obligations in Section 7.1 and 7.2 are conditioned on the indemnitee (a) promptly giving written notice of the third-party Claim to the indemnitor (although a delay of notice will not relieve indemnitor of its obligations under this Section except to the extent that the indemnitor is prejudiced by such delay), (b) giving the indemnitor sole control of the defense and settlement of the third-party Claim (although indemnitor may not settle any third-party Claim unless it unconditionally releases indemnitee of all liability); and (c) providing to indemnitor, at indemnitor’s cost, all reasonable assistance. [COMMENT: Any infringement suit will likely impact all customers using the particular solution, so Workday needs to be able to have a consolidated defense. If yours is a public sector organization where, by statute, the State AG needs to decide whether to participate in the defense, please provide information to Workday about the AG’s position; we are able to accommodate such statutory mandates.]

7.4 Exceptions. Workday shall have no liability for Claims or Losses to the extent arising from (a) modification of the Service by anyone other than Workday; (b) use of the Service in a manner inconsistent with this Agreement or Documentation (c) use of the Service in combination with any other product or service not provided by Workday.

7.5 Continued Use of the Service. If Customer is enjoined from using the Service or Workday reasonably believes it will be enjoined, Workday shall have the right, at its sole option, to obtain for Customer the right to continue use of the Service or to replace or modify the Service so that it is no longer infringing. If neither of the foregoing options is reasonably available to Workday, then the applicable Service may be terminated at either party’s option and Workday’s sole obligation and liability related to the subject matter of this Section 7, in addition to the indemnification obligations herein, shall be to refund any prepaid fees for the applicable Service t hat was to be provided after the effective date of termination.

7.6 Exclusive Remedy. Sections 7.1 through 7.3 state each indemnitee’s exclusive remedies and the indemnitor’s sole obligations related to the subject matter of this Section.

8. Limitation of Liability.

8.1 LIMITATION OF LIABILITY. TO THE MAXIMUM EXTENT PERMITTED BY LAW AND EXCEPT WITH RESPECT TO (i) INTELLECTUAL PROPERTY INDEMNIFICATION OBLIGATIONS IN SECTION 7, (ii) EITHER PARTY’S RECKLESS MISCONDUCT, GROSS NEGLIGENCE, WILLFUL MISCONDUCT AND/OR FRAUD, (iii) WORKDAY’S REMEDIATION OBLIGATIONS IN SECTION 8.4; OR (iv) CUSTOMER’S PAYMENT OBLIGATIONS, THE

MAXIMUM LIABILITY OF EITHER PARTY WHICH INCLUDES ITS RESPECTIVE AFFILIATES, AND IN THE CASE OF WORKDAY, ALSO INCLUDES WORKDAY’S THIRD PARTY LICENSORS FOR ANY AND ALL CLAIMS (INDIVIDUALLY

AND IN THE AGGREGATE) ARISING OUT OF OR RELATING TO THIS AGREEMENT, WHETHER IN CONTRACT,

TORT OR OTHERWISE, IS LIMITED TO AN AMOUNT EQUAL TO THE FEES ACTUALLY PAID BY CUSTOMER

UNDER THIS AGREEMENT FOR THE SERVICE FROM WHICH THE CLAIM(S) AROSE (OR, FOR A CLAIM(S)

ARISING BEFORE THE FIRST ANNIVERSARY OF THE EFFECTIVE DATE, THE AMOUNT PAID OR PAYABLE FOR THE FIRST TWELVE (12) MONTH PERIOD) (“GENERAL CAP”, EXCEPT THAT FOR BREACHES OF EITHER PARTY’S CONFIDENTIALITY , SECURITY OR PRIVACY OBLIGATIONS THE BREACHING PARTY’S MAXIMUM

TOTAL AGGREGATE LIABILITY UNDER THIS AGREEMENT SHALL BE INCREASED TO FEES PAID OR PAYABLE UNDER THE AGREEMENT DURING THE IMMEDIATELY PRECEDING TWENTY -FOUR (24)-MONTH PERIOD FOR THE SERVICE FROM WHICH THE CLAIM AROSE (“ENHANCED CAP”).

8.2 EXCLUSION OF DAMAGES EXCEPT FOR WORKDAY’S IP INDEMNIFICATION OBLIGATIONS IN SECTION 7, IN NO EVENT SHALL EITHER PARTY OR ITS AFFILIATES HAVE LIABILITY FOR LOST PROFITS OR REVENUES, LOSS OF USE OR DATA (UNLESS CAUSED BY WORKDAY’S FAILURE TO BACK UP CUSTOMER DATA IN

ACCORDANCE WITH ITS OBLIGATIONS HEREUNDER), BUSINESS INTERRUPTION, OR INDIRECT, SPECIAL,

INCIDENTAL, PUNITIVE, CONSEQUENTIAL, OR COVER DAMAGES, HOWEVER CAUSED, WHETHER IN

CONTRACT, TORT OR OTHERWISE, EVEN IF THE PARTY OR ITS AFFILIATES HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. THE EXCLUSIONS IN THIS SECTION WILL NOT APPLY TO THE EXTENT PROHIBITED BY LAW. CUSTOMER’S PAYMENT OBLIGATIONS SHALL NOT BE CONSIDERED WORKDAY’S LOST PROFITS. [COMMENT: Workday does not believe it is practical from a business perspective for two entities to enter into a transaction where consequential damages are conceivable, regardless of the basis. Consequential damages are difficult to predict and can be wildly inflated. It isn’t reasonable for Workday to assume such a risk, given the nature of our relationship, and the consideration provided (i.e. subscription fees for a service). Please 00375627.0- Confidential

MAIN SUBSCRIPTION AGREEMENT

Main Subscription Agreement - City of Santa Maria
©2022 Workday v22.8 Page 7 of 13
note, however, that defense costs under the indemnification obligations are considered direct damages, as are amounts paid by either party pursuant to a court award other than a default judgment.]

8.3 CLASSIFICATION OF CERTAIN DAMAGES. SUBJECT TO SECTION 8.1, AND NOTWITHSTANDING SECTION 8. 2, IF EITHER PARTY BREACHES ITS OBLI GATIONS UNDER THIS AGREEMENT, THE FOLLOWING WILL BE CONSIDERED DIRECT DAMAGES: (1) AMOUNTS PAID TO AFFECTED THIRD PARTIES AS DAMAGES OR SETTLEMENTS ARISING FROM THE BREACH; (2) AMOUNTS PAID FOR FINES AND PENALTIES IMPOSED BY ANY GOVERNMENTAL AUTHORITY ARISING FROM THE BREACH; AND (3) REASONABLE LEGAL FEES, TO DEFEND AGAINST THIRD-PARTY CLAIMS ARISING FROM THE BREACH.

8.4 Workday Remediation of Certain Unauthorized Disclosures. In the event that any unauthorized access to or acquisition of Personal Data is caused by Workday’s breach of its security and/or privacy obligations under this Agreement, Workday shall pay the reasonably necessary, documented costs incurred by Customer in connection with the following items: (a) costs of any reasonably required forensic investigation to determine the cause of the breach, (b) providing notification of the security breach to applicable government and relevant industry self-regulatory agencies, to the media (if required by Law) and to individuals whose Personal Data may have been accessed or acquired, (c) providing credit monitoring service to individuals whose Personal Data may have been accessed or acquired for a period of one year (or to the extent required by Law) after the date on which such individuals were notified of the unauthorized access or acquisition for such individuals who elected such credit monitoring service, and (d) operating a call center to respond to questions from individuals whose Personal Data may have been accessed or acquired for a period of one year (or to the extent required by Law) after the date on which such individuals were notified of the unauthorized access or acquisition.

NOTWITHSTANDING THE FOREGOING, OR ANYTHING IN THIS AGREEMENT TO THE CONTRARY, WORKDAY

SHALL HAVE NO RESPONSIBILITY T O PAY COSTS OF REMEDIATION THAT ARE DUE TO RECKLESS

MISCONDUCT, GROSS NEGLIGENCE, WILLFUL MISCONDUCT AND/OR FRAUD BY CUSTOMER OR ITS EMPLOYEES, AGENTS OR AUTHORIZED PARTIES.

9. Term and Termination.

9.1 Term of Agreement. The Term commences on the Effective Date and continues until the stated term in all Order Forms has expired or has otherwise been terminated, unless otherwise extended pursuant to the written agreement of the parties. Subscriptions to the Service commence on the date, and are for a period, as set forth in the applicable Order Form.

9.2 Termination. Either party may terminate this Agreement: (i) upon thirty (30) days prior written notice to the other party of a material breach by the other party if such breach remains uncured at the expiration of such notice period; or (ii) immediately in the event the other party becomes the subject of a petition in bankruptcy or any other proceeding relating to insolvency, receivership, liquidation or assignment for the benefit of creditors. In the event this Agreement is terminated, all Order Forms are simultaneous ly terminated. Upon any termination by Customer pursuant to this section, Workday shall refund Customer any prepaid fees for the affected Service that were to be provided after the effective date of termination. For clarity, a breach or termination of any Professional Services Agreement, as defined in the DPE, or of any applicable statement of work and/or work order thereunder, shall not be considered a material breach or termination of this Agreement.

9.3 Effect of Termination. Upon any expiration or termination of this Agreement, all Order Forms shall immediately terminate and Customer shall, as of the date of such expiration or termination, immediately cease accessing and otherwise utilizing the applicable Service (except as permitted under the section entitled “Retrieval of Customer Data” and “Transition Period before Final Termination”) and shall also cease accessing Workday Confidential Information.

Termination for any reason shall not relieve Customer of the obligation to pay any fees accrued or due and payable to Workday prior to the effective date of termination. Additionally, termination for any reason other than Workday’s uncured material breach, or the reasons set forth in Section 2.2, shall not relieve Customer of the obligation to pay all future amounts due under all Order Forms.

9.4 Transition Period before Final Termination . If this Agreement is terminated and Customer submits a written request to Workday prior to any such termination for a one-time transition period, Workday will continue to provide the Service for up to three (3) months after the effective date of such termination (the “Transition Period”), subject to the terms and conditions of this Agreement. Monthly fees for the Transition Period will be 1/12 of the immediately preceding twelve- month period plus, only if this Agreement was not terminated by Customer for cause, an additional five percent (5%).

Notwithstanding the foregoing, if Workday is enjoined from performing, or termination of this Agreement was due to 00375627.0- Confidential

MAIN SUBSCRIPTION AGREEMENT

Main Subscription Agreement - City of Santa Maria
©2022 Workday v22.8 Page 8 of 13
Customer’s breach, Workday has no obligation to perform under this section unless it receives (i) payment of all fees not subject to reasonable and good faith dispute, (ii) prepayment of fees for further services, and (iii) certification of ongoing compliance with the terms of this Agreement during the Transition Period.

9.5 Transition Consulting Services . During a Retrieval Period or Transition Period, Workday will provide cooperation and assistance as Customer may reasonably request to support an orderly tr ansition to another provider of similar software, services, or to Customer’s internal operations. Such cooperation and assistance will be limited to consulting regarding the Workday Service and will be subject to a fee based on Workday’s then-current rates for consulting services and such services will be set out in a statement of work to a professional services agreement between the parties. [COMMENT: If a Professional Services Agreement is not already in place between the parties, one will be negotiated at the time Customer requests consulting assistance.] Notwithstanding the foregoing, in the event of termination of this Agreement by Workday for Customer’s breach, Workday may withhold the provision of transition consulting services and condition further performance upon (i) payment of undisputed fees then owed and (ii) prepayment of fees for further services.

9.6 Retrieval of Customer Data. Upon written request by Customer made prior to or upon any expiration or termination of this Agreement (including any Transition Period), Workday will make Customer Data available to Customer through the Service solely to allow Customer to retrieve Customer Data for a period of up to a total of sixty (60) days after such expiration or termination (the “Retrieval Period” ). If Customer utilizes the Transition Period described in Section 9.4 above, it will still receive a total of no more than sixty (60) days of non-cost Retrieval Period. [COMMENT: Workday incurs the full cost of providing the Service during this time. Cus tomers are using the same tools to extract Customer Data that they used throughout their use of the service. Because these are familiar tools, the 60-day post-contract period should be adequate. Please see Section 9. 4, which provides the means for a customer to purchase a short -term extension if it needs to keep the Service available either for longer data retrieval OR to handle a replacement project that is running behind schedule. Please note that this Section pertains solely to retrieval of data. Pl ease see Section 9.4 regarding extension of the Service beyond data retrieval.] After such Retrieval Period, Workday will have no obligation to maintain or provide any Customer Data and shall thereafter, unless legally prohibited, delete all Customer Data by deleting Customer’s Tenant; provided, however, that Workday will not be required to remove copies of the Customer Data from its backup media and servers until such time as the backup copies are scheduled to be deleted, provided further that in all cases Workday will continue to protect the Customer Data in accordance with this Agreement. Customer Data will be made available in a Workday -supported format mutually agreed upon between the parties (for example, CSV, delimited text or Microsoft Excel). The foregoing deletion obligation will be subject to any retention obligations imposed on Workday by Law. Additionally, during the Term of the Agreement, Customers may extract Customer Data using Workday’s standard web services.

9.7 Surviving Provisions. The following provisions of this Agreement shall not survive and will have no further force or effect following any termination or expiration of this Agreement: (i) Section 1.1(i) “Workday Obligations”; (ii) Section 3.2 “Grant of Rights”; and (iii) those provisions granting Customer access to any SKU(s) and services referenced in any applicable Order Form(s). All other provisions of this Agreement shall survive any termination or expiration of this Agreement.

10. General Provisions.

10.1 Relationship of the Parties. The parties are independent contractors. This Agreement does not create nor is it intended to create a partnership, franchise, joint venture, agency, fiduciary or employment relationship between the parties. There are no third-party beneficiaries to this Agreement.

10.2 Insurance. Workday will maintain during the entire Term, at its own expense, the types of insurance coverage specified below, on standard policy forms and with insurance companies with at least an A.M. Best Rating of A -VII at the time of policy inception.

(a) Workers’ Compensation insurance prescribed by applicable local law and Employers Liability insurance with limits not less than $1,000,000 per accident/per employee. This policy shall include a waiver of subrogation against Customer
(b) Business Automobile Liability covering all vehicles that Workday owns, hires or leases with a limit of no less than $1,000,000 (combined single limit for bodily injury and property damage) for each accident. 00375627.0- Confidential

MAIN SUBSCRIPTION AGREEMENT

Main Subscription Agreement - City of Santa Maria
©2022 Workday v22.8 Page 9 of 13
(c) Commercial General Liability insurance including Contractual Liability Coverage, with coverage for products liability, completed operations, property damage and bodily injury, including death, with an aggregate limit of no less than $2,000,000. This policy shall name Customer as an additional insured with respect to the provision of services provided under this Agreement. This policy shall include a waiver of subrogation against Customer. (d) Technology Professional Liability Errors & Omissions policy (which includes Cyber Risk coverage, internet liability, and Computer Security and Privacy Liability coverage) with a limit of no less than $10,000,000 per occurrence and in the aggregate.
(e) Crime policy with a limit of no less than $5,000,000 per occurrence and in the aggregate and naming Customer (as its interests may appear) as a loss payee.
(f) Excess Liability/Umbrella coverage with a limit of no less than $9,000,000 per occurrence and in the aggregate (such limit may be achieved through increase of limits in underlying policies to reach the level of coverage shown here). This policy shall name Customer as an additional insured with respect to the provision of services provided under this Agreement. This policy shall include a waiver of subrogation against Customer.

Upon Customer's request, Workday agrees to deliver to Customer certificates of insurance evidencing the coverage specified in this section. Such certificate(s) will contain a thirty (30) day prior notice of cancellation provision. Workday will be solely responsible for any deductible or self -insurance retentions. Such insurance coverage will be primary and any other valid insurance existing will be in excess of such primary insurance policies. The required insurance coverage and limits of liability set forth above shall not be construed as a limit ation or waiver of any potential liability or satisfaction of any indemnification/hold harmless obligation of Workday.

10.3 Notices. Unless expressly stated otherwise, all notices under this Agreement shall be in writing and shall be deemed to have been given upon: (i) personal delivery; or (ii) the third business day after first class mailing. Notices to Workday shall be sent to the address shown in the Signature Document addressed to the attention of its General Counsel with a copy sent to [email protected]
. Notices to Customer shall be sent to the address shown in the Signature Document addressed to Customer’s General Counsel. Each party may modify its recipient of notices by providing notice pursuant to this Agreement.

10.4 Background Check. Unless prohibited by law, Workday agrees to conduct (or has previously conducted) a criminal background check on personnel employed by Workday (or will require its subcontractors to conduct a background check on their own personnel) who will have access to Customer Data. Such background check shall be in the form generally used by Workday in its initial hiring of employees or contracting for contractors or, as applicable, during the employment-screening process. Workday will not allow any person performing under this Agreement on behalf of Workday to be assigned to have access to Customer Data whose background check revealed a conviction of any violent crime or crime involving theft, dishonesty, moral turpitude, breach of trust, or money laundering.

10.5 Code of Conduct. Workday has a published code of conduct available on its public web site with rules for ethical business conduct which complies with applicable law. Workday uses commercially reasonable efforts to ensure that Workday complies with its code of conduct, including but not limited to periodic training of employees about the code. [COMMENT: It is not practical for Workday to agree to use the codes of conduct created by each Workday customer. Accordingly, Workday has its own code of conduct, available at https://www.workday.com/en- us/company/about-workday/ethics-compliance.html.]

10.6 Waiver and Cumulative Remedies. No failure or delay by either party in exercising any right under this Agreement shall constitute a waiver of that right or any other right. Other than as expressly stated herein, the remedies provided herein are in addition to, and not exclusive of, any other remedies of a party at law or in equity.

10.7 Force Majeure. Neither party shall be liable for any failure or delay in performance under this Agreement for causes beyond that party’s reasonable control and occurring without that party’s fault or negligence, including, but not limited to, acts of God, acts of government, flood, fire, civil unrest, acts of terror, strikes or other labor problems (other than those involving Workday or Customer employees, respectively) (“ Force Majeure”). Dates by which performance obligations are scheduled to be met will be extended for a period of time equal to the time lost due to a ny delay so caused, provided that notice of the Force Majeure event is given in writing within fifteen (15) days after the Force Majeure event begins. Such notice shall identify the nature of the Force Majeure event, its expected duration and the probable 00375627.0- Confidential

MAIN SUBSCRIPTION AGREEMENT

Main Subscription Agreement - City of Santa Maria
©2022 Workday v22.8 Page 10 of 13
impact on the performance of the affected party’s obligations. [COMMENT: Workday intends this language to remain broad and limited to extraordinary things that the parties couldn’t conceivably have control over, or effectively mitigate. It is not realist ic to name all events that might be possible or to include events that are within reasonable control.]

10.8 Assignment. Neither party may assign any of its rights or obligations hereunder, whether by operation of law or otherwise, without the prior written consent of the other party (which consent shall not be unreasonably withheld).

Notwithstanding the foregoing, either party may assign this Agreement in its entirety (including all Order Forms) without consent of the other party in connection with a merger, acquisition, corporate reorganization, or sale of all or substantially all of its assets (an “M&A assignment”) so long as the assignee agrees to be bound by all of the terms of this Agreement in an amendment to this Agreement and all past due fees are paid in full or otherwise accounted for in the amendment. In no event shall Customer have the right to assign this Agr eement to a direct Competitor of Workday. In the event of an M&A assignment, the non-assigning party shall be entitled to request from the assignee information to demonstrate that the assignee has the necessary resources and expertise to provide the Service. Failure to provide such information shall be a material breach of this Agreement. [COMMENT: Workday is publicly traded. It is not realistic to expect that, in a merger/acquisition/reorganization situation, individual customers would be able to “opt out” of that transaction. The successor entity would be bound by the existing contracts and Section 9.2 allows customers to terminate for breach if they do not live up to their obligations. However, in order to address concerns regarding an M&A assignment, Workday has included language which is equivalent to the common law (and UCC right for commercial transactions in goods) right to demand adequate assurances from the successor entity.] Any attempt by a party to assign its rights or obligations under this Agreement other than as permitted by this section shall be void and of no effect. Subject to the foregoing, this Agreement shall bind and inure to the benefit of the parties, their respective successors and permitted assigns.

10.9 Governing Law; Waiver of Jury Trial. This Agreement shall be governed exclusively by the internal laws of the State of New York, [COMMENT: Workday is willing to change to the state law of our public sector and public higher education customers in the United States. However, any statement about jurisdiction or venue must include federal courts because copyright and patent infringement actions would be brought there.] without regard to its conflicts of laws rules. Each party hereby waives any right to jury trial in connection with any action or litigation in any way arising out of or related to this Agreement.

10.10 Export. Each party shall comply with the export laws and regulations of the United States and other applicable jurisdictions in providing and using the Service. Without limiting the generality of the foregoing, Customer shall not make the Service available to any person or entity that: (i) is located in a country that is subject to a U.S. government embargo; (ii) is listed on any U.S. government list of prohibited or restricted parties; or (iii) is engaged in activities directly or indirectly related to the proliferation of weapons of mass destruction, unless authorized by the United States government.

10.11 Workday SLA Service Credits. If, in any rolling six -month period, Wor kday fails to meet the monthly Service Availability or Service Response commitments described in the SLA (a “Failure”), Customer may request the following remedies no later than six months after the applicable Failure occurs: (1) a meeting to discuss possible corrective actions for the first Failure; (2) a 10% Service Credit for a second Failure; (3) a 20% Service Credit for a third Failure; and (4) a 30% Service Credit for a fourth Failure. In this Agreement, “Service Credit” means a credit equal to the stated percentage of the applicable monthly Subscription Fee for the affected Service. Workday shall deduct the highest applicable Service Credit from the next invoice for Subscription Fees or, if there is no subsequent invoice, shall refund the Service Credit to the Customer. The remedies in this section are the Customer’s exclusive remedies for any Failure.

10.12 Federal Government End Use Provisions (if applicable). Workday provides pre-existing, commercial Service, including related software and technology, for federal government end use solely in accordance with the terms and conditions of this Agreement, and Workday provides only the technical data and rights as provided herein. If a government agency has a need for rights not conveyed under these terms, it must negotiate with Workday to determine whether there are acceptable terms for transferring additional rights. A mutually acceptable addendum specifically conveying such rights must be executed by the parties in order to convey such rights beyond those s et forth herein. For avoidance of doubt, Workday does not currently provide the Service for use in furtherance of a federal prime or subcontract. Additionally, the parties agree that the purpose of this Agreement is to provide a sophisticated integrated system solution, principally for the provision of a product, not a service and as such, neither the Service Contract Act nor its related statutes or regulations apply to Workday’s performance hereunder. 00375627.0- Confidential

MAIN SUBSCRIPTION AGREEMENT

10.13 Use by other Entities. [COMMENT: Can be removed if your organization is not public or part of any private purchasing consortium.] The parties agree that other public entities, including state agencies, local governments, courts, and public institutions of higher education may utilize the terms of this Agreement to purchase the Service from Workday for agreements commencing no later than five (5) years after the Effective Date of this Agreement. Workday may extend the availability of this Agreement for such use in its sole and reasonable discretion. The parties understand that pricing is specific to Pricing Metrics and the choice of Workday Service components and other entities will not necessarily pay the same price as Customer. Any such other entity shall be responsible for complying with its relevant procurement rules and regulations. Customer will in no way whatsoever incur any liability to Workday, such entities, or others in relation to specifications, delivery, payment, or any other aspect of actions or omissions by such entities. An entity wishing to utilize this Agreement will have a copy of this Agreement executed in its own name and any Order Forms will be in such entity’s name. The parties agree that Workday can disclose this Agreement, all exhibits, and any applicable Order Forms to an entity seeking to make use of this Section.

10.14 Publicity. [COMMENT: Please visit our website at
http://www.workday.com/customers.php#~/ind=Education/~ to see an example of how we do this. In addition, names of customers appear in our customer community, an online forum limited to Workday, its customers, and in limited situations, deployment service providers.] Except as set forth herein, Workday shall not use Customer's name, logos or trademarks, without the prior written consent of Customer, in any written press releases, advertisements and/or marketing materials. Notwithstanding the foregoing, Workday may use Customer's name and logo in lists of customers and on its website, including, but not limited to, Workday’s community portal; however, such usage shall not be classified as an advertisement but only identification as an entity who receives the Service from Workday. For the avoidance of doubt, this section does not prohibit Workday from referencing Customer's name in a verbal format.

10.15 Miscellaneous. This Agreement, including all exhibits and attachments hereto and all Order Forms, constitutes the entire agreement between the parties with respect t o the subject matter hereof. In the event of a conflict, the provisions of an Order Form shall take precedence over provisions of the body of this Main Subscription Agreement and over any other exhibit or attachment to this Main Subscription Agreement. This Agreement supersedes all prior and contemporaneous agreements, proposals or representations, written or oral, concerning its subject matter and is entered into without reliance on any promise or representation other than those expressly contained in this Agreement. No modification, amendment, or waiver of any provision of this Agreement shall be effective unless in writing and signed by both parties. If any provision of this Agreement is held by a court of competent jurisdiction to be contrary to law, the provision shall be modified by the court and interpreted so as best to accomplish the objectives of the original provision to the fullest extent permitted by law, and the remaining provisions of this Agreement shall remain in effect. Notwithstanding any language to the contrary therein, no terms or conditions stated in a Customer purchase order or in any other non- negotiated Customer order documentation shall be incorporated into or form any part of this Agreement, and all such terms or conditions shall be null and void. This Agreement may be executed in counterparts, which taken together shall form one binding legal instrument. The parties hereby consent to the use of electronic signatures in connection with the execution of this Agreement, and further agree that electronic signatures [COMMENT: Workday primarily uses AdobeSign, which creates an audit stamp for the signatures and “draws” signatures into the signature lines. We have a backup technology which works in much the same way.] to this Agreement shall be legally binding with the same force and effect as manually executed signatures, provided that such signatures must be made using a technology designed for electronic signatures and include appropriate certificates to verify the identity of the signatory. For avoidance of doubt, emails stating consent to an Agreement or action shall not be considered an electronic signature.

11. Definitions.
“Affiliate” [COMMENT: We recognize that this definition may not be a good fit for your organization and are willing to modify as appropriate.] means any entity which directly or indirectly controls, is controlled by, or is under common control by either party. For purposes of the preceding sentence, "control" means direct or indirect owners hip or control of more than 50% of the voting interests of the subject entity.

“Agreement” means this Main Subscription Agreement, including the Signature Document, any exhibits, addenda or attachments hereto, and any fully executed or attached and referenced Order Form(s).

"Authorized Parties" means Customer’s or its authorized Affiliate’s employees, third party providers authorized by Customer, and as appropriate for the applicable Service, students and their parents or guardians, prospective employees, prospective students and their parents or guardians, former students, and/or retirees authorized to access Customer’s 00375627.0- Confidential

MAIN SUBSCRIPTION AGREEMENT

Main Subscription Agreement - City of Santa Maria
©2022 Workday v22.8 Page 12 of 13
Tenants and/or to receive Customer Data (i) in writing, (ii) through the Service’s security designation, or (iii) by system integration or other data exchange process.

“Claim” means any claim, demand, suit, or other legal proceeding made or brought against a party to this Agreement.

"Confidential Information" means (a) any software utilized by Workday in the provision of the Service and its respective source code; (b) Customer Data; (c) each party’s business or technical information, including but not limited to the Documentation, training materials, any information relating to software plans, designs, costs, prices and names, finances, marketing plans, business opportunities, personnel, research, development or know-how that is designated by the disclosing party as "confidential" or "proprietary" or the receiving party knows or should reasonably know is confidential or proprietary; and (d) the terms, conditions and pricing of this Agreement (but not its existence or parties). [COMMENT:

Workday considers its Agreements to be Workday Confidential Information, which is a separate designation from material that may be disclosed pursuant to a given jurisdiction’s open records laws. For clarity, Workday requires notice and the opportunity to challenge disclosure of the Agreement, based on applicable open records laws.]

"Customer Data" means the electronic data or information submitted by Customer or Authorized Parties to the Service.

“Customer Input” means suggestions, enhancement requests, recommendations or other feedback provided by Customer, its Employees or Authorized Parties relating to the operation or functionality of the Service.

“Documentation" means Workday’s electronic Administrator Guide for the Service, which may be updated by Workday from time to time.

"Employee" or “Worker” means employees, consultants, contingent workers, independent contractors, and retirees of Customer and its Affiliates whose business record(s) are or may be managed by the Service and for which a subscription to the Service has been purchased pursuant to an Order Form.

“Improvements” means all improvements, updates, enhancements, error corrections, bug fixes, release notes, upgrades and changes to the Service and Documentation, as developed by Workday and made generally available for Production use without a separate charge to Customers.

“Intellectual Property Rights” means any and all common law, statutory and other intellectual property rights, such as copyright, trademarks, trade secrets, patents and other proprietary rights issued, honored or enf orceable under any applicable laws anywhere in the world, and inclusive of all moral rights related thereto.

“Internal Business Purposes” means use for Customer’s internal operations associated with the functionality of the Service, as opposed to Customer using the products or Service for customers, clients, or prospective customers of the Customer. As illustrative examples: (1) use of recruiting functionality to assist with the recruitment of Customer’s employees is an Internal Business Purpose but a placement firm’s use of recruiting functionality to find employees for its third-party clients is not an Internal Business Purpose; and (2) Workday’s Student Service is clearly designed to assist educational institutions manage the records of students; even though students are technically the “clients” or “customers” of the institution. Nevertheless, use of Workday’s Student Service to manage these student records is still an Internal Business Purpose.

“Law” means any local, state, national and/or foreign law, treaties, and/or regulations applicable to a respective party.

“Losses” means any damages or costs finally awarded or entered into in settlement (including, without limitation, reasonable attorneys' fees).

“Malicious Code” means viruses, worms, time bombs, ransomware, Trojan horses and other malicious code, files, scripts, agents or programs intended to do harm.

"Order Form" means the separate ordering documents under which Customer subscribes to the Service or other services pursuant to this Agreement which are fully executed by the parties.

“Personal Data” has the definition set forth in the Data Processing Exhibit. 00375627.0- Confidential

MAIN SUBSCRIPTION AGREEMENT

“Pricing Metrics” means the specific measure identified on the applicable Order Form used for determining the Subscription Service Fee on that Order Form, such as FSE Worker or FTE Student.

“Production” means the Customer’s or an Employee’s use of or Workday’s written verification of the availability of the Service (i) to administer Employees; (ii) to generate data for Customer’s books/records; or (iii) in any decision support capacity.

“Related Service” means any professional services provided by Workday pursuant to an Order Form subject to this Agreement and related to the Service.

“Security Breach” means (i) any actual or reasonably suspected unauthorized use of, loss of, access to or disclosure of, Customer Data; provided that an incidental disclosure of Customer Data to an Authorized Party or Workday, or incidental access to Customer Data by an Authorized Party or Workday, where no reasonable suspicion exists that such disclosure or access involves theft, or is fraudulent, criminal or malicious in nature, shall not be considered a “Security Breach” for purposes of this definition, unless such incidental disclosure or incidental access triggers a notification obligation under any Law, (ii) any Personal Data Breach as defined in the DPE; and (iii) any security breach (or substantially similar term) as defined by Law affecting Customer Data.

"Service" means Workday’s software-as -a-service applications and Improvements as described in the Docum entation and subscribed to under an Order Form.

“SLA” means the Workday Production Support and Service Level Availability Policy , located at https://www.workday.com/en-us/legal/contract-terms-and-conditions/index/exhibits.html , which may be updated by
Workday from time to time. No update shall materially decrease Workday’s responsibilities under the Workday SLA.

“Subscription Fee” means all amounts invoiced and payable by Customer for the Service.

"Tenant" means a unique instance of the Service, with a separate set of Customer Data held by Workday in a logically separated database (i.e., a database segregated through password-controlled access).

“Tenant Base Name” is a naming convention that will be used in all of the Tenant URLs provided by Workday, as specified in Customer’s initial Order Form subscribing to the Service, and which shall remain constant throughout the Term.

“Term” has the meaning set forth in Section 9.1.

Confidential Information

MASTER SERVICES AGREEMENT
This Master Services Agreement (this “Agreement”), dated as of __________, 20__, is made by and between ________________________________, a ____________ corporation with its principal office located at _______________________________________ (“Client”), and Cognizant Worldwide Limited, a United Kingdom limited liability company with its principal office located at 1 Kingdom Street, Paddington Central, London, United Kingdom W2 6BD (“Cognizant”). In addition, Cognizant Technology Solutions U.S. Corporation (“ CTS US”) shall execute this Agreement solely for the purpose of enabling and authorizing CTS US to enter into Statements of Work (as defined below) together with Cognizant, whereby CTS US shall pr ovide the applicable local Services and Deliverables within the United States of America to Client for Cognizant under such SOWs as provided in Section 1.1. For the purposes of this Agreement, Client and Cognizant may each be referred to as “Party” or, collectively, as the “Parties.” The Parties, intending to be legally bound, hereby agree as follows:

1. SERVICES.

1.1 Services. Cognizant and Client will develop and enter into one or more statements of work incorporating a description of the specific services to be provided (“Services”), each in a form mutually agreed by the Parties (a “Statement of Work” or “SOW”). Each Statement of Work will set forth, among other things, project scope, various project activities and tasks to be performed by the Parties, and roles and responsibilities of the Parties. Cognizant may provide to Client the following types of services as, and to the extent, described in each Statement of Work:
(i) the management of certain business and IT operational services, which may be performed either onsite or from remote locations (“Managed Services”); (ii) certain consulting, development, integration and or other support services provided in addition to the Managed Services (“Professional Services”); and (iii) any other services des cribed as Cognizant’s obligation in a Statement of Work, (collectively the “Services”). In addition, Cognizant will provide to Client certain results or proceeds of the Services that are defined as deliverables in each Statement of Work (collectively, the “Deliverables”). Each Statement of Work shall specifically identify this Agreement and indicate that it is subject to the terms hereof and be executed by Client and Cognizant. Unless otherwise set forth herein or expressly identified in the SOW as a modification to a specified provision of this Agreement, to the extent there are any conflicts or inconsistencies between this Agreement and any Statement of Work, the provisions of this Agreement shall govern and control. Cognizant may engage any Affiliate (as hereinafter defined) of Cognizant to provide Services and Deliverables to Client and any Affiliates of Client for Cognizant under this Agreement. For SOWs executed in connection with work to be performed for Client in the United States of America, and solely to the extent that employees of a U.S.-domiciled Cognizant Affiliate who are foreign skilled workers are required for the provision of Services or Deliverables by Cognizant in connection with such SOW, such Cognizant Affiliate may also execute such SOW solely for the purpose of providing Services and Deliverables to Client for Cognizant. Any Affiliate of Cognizant may itself provide Services directly to Client and any Affiliates of Client under this Agreement by executing SOWs in its own name, exclusive of CWW, and only for the purposes of any such SOW(s), shall be considered “Cognizant” as that term is used in this Agreement. Any Affiliate of Client may enter into SOW(s) with Cognizant or any Affiliate of Cognizant and, only for the purposes of any such SOW(s), shall be considered “Client” as that term is used in this Agreement. As used herein, the term “Affiliate” means any entity that controls or is controlled by or is under common control with Cognizant or Client, as applicable, where “control” mea ns possessing, directly or indirectly, the power to direct or cause the direction of the management,

Confidential Information
2 policies and operations of such entity, whether through ownership of voting securities, by contract or otherwise.

1.2 Deliverables and Acceptance. Deliverables, if any, under this Agreement will be as set forth under any SOW. Each SOW will describe, if applicable, the Deliverables that Cognizant is obligated to furnish to Client hereunder, the acceptance criteria for each of the Deliverables (the “Acceptance Criteria”) and the completion criteria, if any, to signify completion of each phase of a project. Client shall review, evaluate and/or test, as the case may be, each of the Deliverables within the applicable time period set forth in a SOW (with respect to eac h Deliverable, the “Acceptance Period” ) to determine whether or not such Deliverable satisfies the applicable Acceptance Criteria in all material respects. If Client does not furnish a written notice to Cognizant specifying that a Deliverable has failed to satisfy its Acceptance Criteria in all material respects prior to the end of the Acceptance Period therefor and/or if Client commences using the Deliverables commercially or in a production environment , then Client will be deemed to have accepted such Deliverable. If any Deliverable fails to satisfy its Acceptance Criteria in any material respect, then Client will notify Cognizant in writing specifying the respects in which such Deliverable does not conform to the applicable Acceptance Criteria and what mo difications are necessary to make it conform thereto. Thereafter, Cognizant shall use its diligent commercially reasonable efforts to modify such Deliverable to so conform and the Deliverable will be resubmitted for acceptance by Client. If, after repeated attempts, Cognizant is unable to remedy any non-conforming portion of any Deliverable, Client may terminate p ursuant to Section 1 2.2 herein.

2. PROJECT SCHEDULE; CHANGES.

2.1 Project Schedule; Changes. Each Statement of Work will set forth the projected work effort and schedule applicable to the Services. All statements and agreements concerning time are based upon information available and circumstances existing at the time made, and each Statement of Work is subject to equi table adjustment upon any material change in such information or circumstances, the occurrence of an excusable delay (as provided for in Section

2.2 hereof) or upon modification of the scope, timing or level of work to be performed by Cognizant. Either Party will be entitled to propose changes. It is mutually acknowledged that any such change may affect the fees or charges payable to Cognizant and/or the project schedule.

Neither Party shall have any obligation respecting any change until an appropriate change order or amendment to the applicable Statement of Work is executed and delivered by both Parties.

2.2 Excusable Delays and Failures . Cognizant will be excused from delays in performing, or from a failure to perform, hereunder to the extent that such delays or failures result from causes beyond Cognizant’s reasonable control. Without limiting the generality of the foregoing, Client acknowledges that Client ’s failure or delay in furnishing necessary information, equipment or access to facilities, delays or failure by Client in completing tasks required of Client or in otherwise performing Client’s obligations hereunder or under any Statement of Work and any assumption contained in a Statement of Work which is untrue or incorrect will be considered an excusable delay or excusable failure to perform hereunder and may impede or delay completion of the Services. Client further acknowledges that such delays or failures may result in additional charges for the Services.

Confidential Information
3 3. PAYMENT.

3.1 Project Fees and Reimbursable Items. Client shall pay to Cognizant the fees and other compensation set forth in each Statement of Work . Client will also reimburse Cognizant for all reasonable out-of-pocket travel, living and other ancillary expenses paid or incurred by Cognizant in connection with the Services and any other reimbursable items set forth in each Statement of Work. Cognizant will have no obligation to perform any Services when any amount required to be paid by Client remains due and unpaid beyond the date such amount is due. Any suspension of Services by Cognizant as a result of Client’s failure to make payment as required will extend the due dates of Deliverables and other Services to the extent impacted by such suspension or delay.

3.2 Invoices; Payments. Cognizant will invoice Client for all fees, charges and reimbursable items payable to Cognizant on a monthly basis or otherwise in accordance with the schedule set forth in the relevant Statement of Work as such payments are due. Client will pay the invoiced amount in full within thirty (30) days of the date of each invoice, without deduction, setoff, defense or counterclaim for any reason; provided that the Client may withhold amounts disputed in good faith pending resolution of such dispute. Client will pay interest, at a rate equal to the lesser of

1.5% per month (or part thereof) or the maximum legal rate permitted, on the amount shown on any invoice that is paid later than thirty (30) days after the date of the invoice, other than such amounts that are disputed in such g ood faith during the pendency of the relevant dispute . All amounts hereunder will be invoiced and paid in United States Dollars unless otherwise set forth in an applicable SOW.

3.3 Taxes. Client agrees to pay any applicable sales, use, value added, goods and services, services, excise, privilege, or other taxes or assessments relating to the Services or Deliverables provided by Cognizant to Client pursuant to the Agreement hereto, exclusive of taxes based on Cognizant’s net income or net worth. Cognizant will invoice Client for any taxes payable by Client that are required to be collected by Cognizant.

4. OBLIGATIONS OF THE PARTIES.

4.1 Working Environment. For any Services to be provided by Cognizant at any of Client’s sites, Client shall provide Cognizant ’s personnel with (i) a suitable and adequate work environment, including space for work and equipment for performance of the Services; (ii) access to and use of Client ’s facilities and relevant information, including software, hardware and documentation; (iii) provision and maintenance of personal computer (“PC”) workstations for such personnel’s use; (iv) assistance to such personnel in a timely manner by promptly correcting any hardware or software problems that would affect the performance of Services; and ( v) any other items set forth in each Statement of Work.

4.2 Client’s Personnel Commitment. Client will ensure that all Client personnel who may be necessary or appropriate for the successful implementation of the Services will, on reasonable notice, (i) be available to assist Cognizant ’s personnel by answering business, technical and operational questions and providing requested documents, guidelines and procedures in a timely manner; (ii) participate in the Services as outlined in the Statement of Work ; (iii) participate in progress and other Service related meetings; (iv) contribute to software and system testing; and (v) be available to assist Cognizant with any other activities or tasks required to complete the Services in accordance with the Statement of Work.

Confidential Information
4 4.3 Export Control. Client agrees to notify Cognizant of any requirements for Deliverables or any other technology, technical data or information to which Cognizant will have access as a result of the Services that, in any case, will subject the Deliverables or the other technology, technical data or information to control under applicable export regulations under any classification other than EAR99 (or its non- U.S. equivalent) and, in such event, Client will (i) identify to Cognizant the applicable regulations (e.g. the United States Export Administration Regulations (“EAR”) or the International Traffic in Arms Regulations (“ITAR”)) and classifications (e.g. ECCN) and (ii) follow such guidelines as Cognizant may communicate to Client that reasonably are required to avoid violations. Each Party acknowledges and agrees that to the extent that any tangible or intangible technical data provided under this Agreement is subject to US export laws and regulations, such Party will not use, distribute, transfer, or transmit technical data provided by the other Party under this Agreement except in compliance with US export laws and regulations. Notwithstanding the foregoing, C lient agrees that it will not provide C ognizant with any technology, technical data or information that is subject to control under the ITAR. In the event that Client wishes to provide Cognizant with ITAR-controlled technology, technical data or information, Client will notify Cognizant in writing of such intent, and the Parties agree to cooperate to determine the appropriate agreements and controls, if any, required before Client makes such disclosure.

4.4 FCPA. Neither Party shall take any action in connection with the performance of its obligations under this Agreement that violates the Foreign Corrupt Practices Act, as amended, and the rules and regulations thereunder in any manner that has a material adverse impact on the other Party. To the extent that any of the Services or Deliverabl es cannot be performed or provided without violation of any law, regulation, or other control, then Cognizant shall not be obligated to provide the same and the applicable Statement of Work shall be amended accordingly.

4.5 Work Authorization/HR Compliance. In the event that it is necessary for Cognizant to obtain visas or work permits for Cognizant personnel, Client will cooperate with Cognizant by taking all reasonably necessary actions to facilitate Cognizant’s efforts, including, but not limited to, providing , and hereby consents to Cognizant providing to immigration authorities, documentation indicating the nature and location of the work to be performed, the necessity of the work to be performed, and other documentation as may be reasonably required and r elated to this Agreement (including the existence and terms of this Agreement and the identity of the Parties hereto) , and posting such notices as may be legally required (including any legally required notice posting at Client sites from which the parties contemplate services being provided by Cognizant personnel who are foreign skilled workers).

5. OWNERSHIP.

5.1 Ownership of Work Product. Cognizant agrees that, upon Client’s payment in full, the software or other intellectual property developed by Cognizant or its Affiliates as a ‘work-for-hire’ specifically for Client, as set forth in a Statement of Work ( “Work Product”) shall be the property of, and ownership shall vest in, Client. Client’s ownership of Work Product does not include Cognizant Proprietary Intellectual Property (as defined below) or any Third Party Items, or any derivative of the foregoing, that is incorporated into the Work Product. Cognizant agrees to take, at Client’s cost and expense, all actions requested by Client which are reasonably necessary to assure the conveyance to Client of all right, title and interest in and to the Work Product, including copyright.

Confidential Information
5 5.2 Residual Rights. Notwithstanding anything to the contrary herein, Cognizant, Cognizant Affiliates, and their respective employees and agents shall be free to use and employ any Residual Information. “Residual Information” means the general knowledge, ideas, know -how, experience, and techniques that would be retained in the unaided memory of an ordinary person skilled in the art, not intent on appropriating the proprietary information of the disclosing party.

Nothing in this paragraph, however, shall be deemed to grant a license under Client’s registered intellectual property rights.

5.3 Cognizant Proprietary Intellectual Property . Client acknowledges that as part of delivering the Services, Cognizant personnel may utilize proprietary software, methodologies, tools, specifications, drawings, sketches, models, samples, r ecords, documentation, works of authorship, creative works, ideas, know -how, data or other materials which have been or are originated, developed, licensed, purchased, or acquired by Cognizant or its A ffiliates or subcontractors (collectively, “Cognizant Proprietary Intellectual Property ”). Client agrees that Cognizant Proprietary Intellectual Property and Residual Information, any derivatives of Cognizant Proprietary Intellectual Property or Residual Information, is the sole prop erty of Cognizant (or its licensors) and that Cognizant (or its licensors) will retain sole and exclusive title to and ownership thereof. If any Cognizant Proprietary Intellectual Property owned by Cognizant is embedded in Work Product, Cognizant grants to Client a worldwide, royalty free, non-exclusive, transferable, perpetual license to use, execute and perform such Cognizant Proprietary Intellectual Property as a functional element of the applicable Work Product, subject to any additional terms or limitations set forth in the applicable Statement of Work, and provided that no portion of the Cognizant Proprietary Intellectual Property is separated or unbundled from the applicable Work Product or used as a stand- alone product or development tool. Except as expressly provided in the foregoing sentence, nothing contained in this Agreement or otherwise shall be construed to grant to Client any right, title, license or other interest in, to or under any Cognizant Proprietary Intellectual Property (whether by estoppel, implication or otherwise). Any license to Cognizant Proprietary Intellectual Property that is not embedded in Work Product or that is commercially available will be pursuant to a separate license agreement between Client and Cognizant (or its licensor).

5.4 Third Party Items. Cognizant shall obtain Client’s prior written consent before embedding in Work Product or installing in Client’s environment any proprietary third party tools or applications. If any third party tools, applications, utilities and cloud infrastructure are distributed, resold, or provided to Client in connection with this Agreement (collectively, “Third Party Items”), such Third Party Items shall be provided AS -IS and made available to Client under a separate agreement between Client and the licensor of the Third Party Item or may be made available to Client by Cognizant under a separate agreement or pass -through terms set forth in an SOW, which shall apply to the relevant Third Party Item(s) in lieu of any of the terms of this Agreement.

5.5 Installation of Tools. Cognizant may use certain Cognizant owned or licensed Tools (the “Tools”), including those set forth in the applicable SOW in connection with its performance of the Services. The Tools are Cognizant’s confidential information. As between Cognizant and Client, Cognizant is the sole owner of the Tools, together with all modifications, enhanceme nts and changes to the Tools. Client consents to Cognizant’s install ation of the Tools onto Client ’s systems. Only Cognizant may install, configure, control, or grant access to the Tools. Client agrees that Cognizant may uninstall and remove the Tools at any time, and that the consent set forth in this paragraph is not a software license or subscription agreement. Cognizant will use the Tools as installed on Client’s systems solely to perform the Services for Client.

Confidential Information
6 6. CONFIDENTIAL INFORMATION.

6.1 Confidentiality Obligations. For a period of three (3) years from the date of disclosure of the applicable Confidential Information (as hereinafter defined), Client and Cognizant shall each (i) hold the Confidential Information of the other in trust and confidence and avoid the disclosure or release thereof to any other person or entity by using the same degree of care as it uses to avoid unauthorized use, disclosure, or dissemination of its own Confidential Information of a similar nature, but not less than reasonable care, and (ii) not use the Confidential Information of the other Party for any purpose whatsoever except as expressly contemplated under this Agreement or any Statement of Work. Except with the express written consent of the other Party, each Party shall disclose the Confidential Information of the other Party only to those of its and its affiliates’ employees officers, directors, subcontractors, agents or representatives having a legitimate need to know the information for the purposes of this Agreement (“Representatives”) and shall take all reasonable precautions to ensure that such Representatives comply with the provisions of this Section 6.1.

6.2 Definition. The term “Confidential Information” shall mean any and all information or proprietary materials other than Personal Information (as defined in Exhibit A attached hereto) (in every form and media) not generally known in the relevant trade or industry and which has been or is hereafter disclosed or made available by either Party (the “disclosing party”) to the other (the “receiving party”) in connection with the efforts contemplated hereunder, including (i) all trade secrets, (ii) existing or contemplated products, services, designs, technology, processes, technical data, engineering, techniques, methodologies and concepts and any information related thereto, and (iii) information relating to business plans, sales or marketing methods and customer lists or requirements.

6.3 Exceptions. The obligations of either Party under Section 6.1 will not apply to information (other than Personal Information) that (i) was in the receiving party’s possession at the time of disclosure and without restriction as to confidentiality, (ii) at the time of disclosure is generally available to the public or after disclosure becomes generally available to the public through no breach of agreement or other wrongful act by the receiving party, (iii) has been received from a third party without restriction on disclosure and without breach of agreement by the receiving party, or (iv) is independently developed by the receiving party without regard to the Confidential Information of the disclosing party. In addition, the receiving party may disclose Confidential Information as required to comply with binding orders of governmental entities that have jurisdiction over it; provided that the receiving party (a) gives the disclosing party reasonable written notice to allow the disclosing party to seek a protective order or other appropriate remedy, (b) discloses only such Confidential Information as is required by the governmental entity, and (c) uses commercially reasonable efforts to obtain confidential treat ment for any Confidential Information so disclosed.

7. DATA PROTECTION

7.1 Data Protection . If and to the extent that the Services require Cognizant to process Client’s Personal Information, the Parties shall abide by the terms set forth under Exhibit A attached hereto.

Confidential Information
7 8. INDEMNIFICATION.

8.1 Intellectual Property Rights Indemnity . Cognizant and Client (in such case, the “indemnifying party”) each agree to indemnify and hold harmless the other (in such case, the “indemnified party”) from and against any costs and damages awarded against the indemnified party by a court pursuant to a final judgment as a result of, and defend the indemnified party against, claims of infringement of a U.S. patent or registered copyright or misappropriation of any trade secret related to a Deliverable (in the case of indemnification by Cognizant ) or any claim relating to Cognizant’s possession, use or modification of any software, documentation, data or other property provided by Client (in the case of indemnification by Client).

8.2 Intellectual Property Rights Exclusions . Cognizant shall have no obligation under Section 8.1 or other liability for any infringement or misappropriation claim resulting or alleged to result from: (i) modifications made other than by Cognizant, (ii) use of the Deliverables in combination with any equipment, software or material not approved or provided by Cognizant, (iii) Client’s use or incorporation of materials not provided by Cognizant, (iv) the instructions, designs or specifications provided by Client; (v) any software or other materials furnished by any third party; or (vi) Client’s continuing the allegedly infringing activity after being notified thereof or after being informed and provided with modifications that would have avoided the alleged infringement.

8.3 Infringement Remedies. In the event of an infringement or misappropriation claim as described in Section 8.1 above arises, or if Cognizant reasonably believes that a claim is likely to be made, Cognizant, at its option and in lieu of indemnification, may: (i) modify the applicable Deliverables so that they become non- infringing but functionally equivalent; or (ii) replace the applicable Deliverables with material that is non-infringing but functionally equivalent; or (iii) obtain for Client the right to use such Deliverables upon commercially reasonable terms; or (iv) remove the infringing or violative Deliverables and refund to Client the fees received for such Deliverables that are the subject of such a claim based on a five (5) year straight line depreciation. This Section 8 sets forth the exclusive remedy and entire liability and obligation of each Party with respect to intellectual property infringement or misappropriation claims, including patent or copyright infringement claims and trade secret misappropriation.

8.4 Personal Injury and Property Damage Indemnity. Cognizant and Client each agree to indemnify, defend and hold harmless the other from and against any and all claims, actions, damages, liabilities, costs and expenses, including reasonable attorneys ’ fees and expenses, arising out of third party claims for bodily injury or damage to real or tangible personal property, not including software, data, and documentation, to the extent caused directly and proximately by the gross negligence or willful misconduct of the indemnifying party, its employees or agents.

8.5 Indemnification Procedures. The obligations to indemnify, defend and hold harmless set forth above in this Section 8 will not apply to the extent the indemnified party was responsible for giving rise to the matter upon which the claim for indemnification is based and will not apply unless the indemnified party (i) promptly notifies the indemnifying party of any matters in respect of which the indemnity may apply and of which the indemnified party has knowledge; (ii) gives the indemnifying party full opportunity to control the response thereto and the defense thereof, including any agreement relating to the settlement thereof, provided that the indemnifying party shall not settle any such claim or action without the prior written consent of the indemnified party; and (iii) cooperates with the indemnifying party, at the indemnifying party ’s cost and expense in the defense or settlement thereof. The indemnified party may participate, at its own expense, in

Confidential Information
8 such defense and in any settlement discussions directly or through counsel of its choice on a monitoring, non-controlling basis.

9. WARRANTY.

9.1 Limited Warranty. Cognizant warrants the following:

9.1.1 the applicable Services rendered hereunder will be performed by qualified personnel;

9.1.2 the Professional Services performed will substantially conform to any applicable requirements set forth in the Statement of Work for a period of thirty (30) days (the “ Warranty Period”) following performance of such Professional Services; and

9.1.3 during the Warranty Period, the Deliverable(s) will materially conform to the corresponding product specifications set forth in the applicable Statement of Work for such Deliverable.

9.2 Remedies. Cognizant does not warrant that any Deliverable will operate uninterrupted or error-free, provided that Cognizant shall remain obligated pursuant to this Section 9. In the event that any Deliverable or Service fails to conform to the foregoing warranty in any material respect, the sole and exclusive remedy of Client w ill be for Cognizant, at its expense, to promptly use commercially reasonable efforts to cure or correct such failure. The foregoing warranty is expressly conditioned upon (i) Client providing Cognizant with prompt written notice of any claim thereunder prior to the expiration of the applicable Warranty Period , which notice must identify with particularity the non-conformity; (ii) Client’s full cooperation with Cognizant in all reasonable respects relating thereto, including, in the case of modified software, assisting Cognizant to locate and reproduce the non- conformity; and (iii) with respect to any Deliverable, the absence of any alteration or other modification of such Deliverable by any person or entity other than Cognizant.

9.3 Disclaimer. EXCEPT AS EXPRESSLY PROVIDED IN SECTION 9 .1, COGNIZANT

DOES NOT MAKE OR GIVE ANY REPRESENTATION OR WARRANTY OR CONDITION OF

ANY KIND, WHETHER SUCH REPRESENTATION, WARRANTY, OR CONDITION BE

EXPRESS OR IMPLIED, INCLUDING ANY WARRANTY OF MERCHANTABILITY, QUALITY,

OR FITNESS FOR A PARTICULAR PURPOSE OR ANY REPRESENTATION, WARRANTY OR CONDITION FROM COURSE OF DEALING OR USAGE OF TRADE.

9.4 Responsibility of Client. In the event that Client asserts any claim for warranty services hereunder and such claim relates to any matter that i s determined not to be Cognizant’s responsibility hereunder (including any problem with Client’s third party vendors, Client’s computer hardware or software that was not caused by any Services performed by Cognizant ), Client will be responsible to pay Cognizant for all costs incurred for all evaluation, correction or other services performed by Cognizant relating to such claim on a time and materials basis at Cognizant’s then standard billing rates.

10. LIMITATION OF LIABILITY AND REMEDIES.

10.1 Exclusion of Damages. In no event shall either Party be liable to the other Party or any other person or entity for any lost profits, special, exemplary, indirect, incidental, consequential or punitive damages or liabilities, or for any costs (including transition costs) associated with procuring substitute or replacement services, of any kind or nature whatsoever (collectively, “Indirect Damages”), whether in an action based on contract, warranty, strict liability, tort or

Confidential Information
9 otherwise, even if such Party has been informed in advance of the possibility of such Indirect Damages or such Indirect Damages could have been reasonably foreseen by such Party.

10.2 Total Liability. In no event shall Cognizant’s liability to Client or any other person or entity arising out of or in connection with this Agreement or the Services exceed, in the aggregate, the total fees paid by Client to Cognizant for the particular Service or Deliverable with respect to which such liability relates (or in the case of any liability not related to a particular portion of the Services, the total fees paid by Client to Cognizant under the applicable Statement of Work) in the twelve (12) month period preceding the last act or omission giving rise to any such liability, whether such liability is based on an action in contract, warranty, strict liability or tort (including, without limitation, negligence) or otherwise. The limitations specified in this Section 10 will survive and apply even if any limited remedy specified in this Agreement is found to have failed of its essential purpose.

11. EMPLOYEES.

11.1 No Employee Relationship. Neither Party’s personnel shall be deemed to be employees of the other Party. Each Party and its Affiliates shall be solely responsible for the payment of all compensation to its employees, including provisions for employment taxes, workmen’s compensation and any similar taxes associated with employment of its personnel. A Party ’s employees shall not be entitled to any benefits paid or made available by the other Party to its employees.

11.2 Non-Solicitation Obligations. During the term hereof and for a period of twelve (12) months thereafter, neither Party shall, directly or indirectly, solicit for employment or employ, or accept services provided by, (i) any employee of the other Party (including employees of Cognizant’s Affiliates); or (ii) any former employee of the other Party (including former employees of Cognizant’s Affiliates) who performed any work in connection with or related to the Services.

11.3 Subcontractors and Third Party Providers. In addition to the right to engage Affiliates to provide Services as specified hereunder, Cognizant may engage non- Affiliate third parties which will be responsible for providing a portion of the Services that Cognizant provides to Client (such as field services and end user support) where such services are not dependent on a product being provided by such third party (“Subcontractors”), provided that such Subcontractors have executed appropriate confidentiality agreements with Cognizant.

Cognizant may also (i) engage
vendors providing equipment or software (and services in support of such equipment or software) to support the provision of Services and/or (ii) subcontract for third party services or products that are not principally dedicated to performance of Services for the Client, which are not material to a function constituting a part of the Services, do not result in a material change in the way Cognizant conducts its business, or are composed of small scale temporary labor (collectively, “Third Party Providers”). For the avoidance of doubt, Third Party Providers shall not be deemed “Subcontractors” as such term is defined under this Sect ion 11.3. Cognizant may engage such Third Party Providers pursuant to such Third Party Providers’ standard terms and conditions.

Client shall agree in writing to be bound by the Third Party Providers’ standard terms and conditions to the extent necessary , if at all, for Client to (iii) be able to use of the relevant Third Party Provider’s product or services in connection with its receipt of the Services and/or (iv) make use of any of the Services supported by such Third Party Provider’s product/services. No engagement of Subcontractors or Third Party Providers hereunder will relieve Cognizant from any of its obligations under this Agreement.

Confidential Information
10 11.4 Nondiscrimination. To the extent applicable to Services under this Agreement, Cognizant shall abide by the requirements of 41 C .F.R. §§ 60- 1.4(a), 60- 300.5(a) and 60 - 741.5(a). These regulations prohibit discrimination against qualified individuals based on their status as protected veterans or individuals with disabilities, and prohibit discrimination against all individuals based on their race, color, religion, sex, sexual orientation, gender identity or national origin. Moreover, these regulations require that covered prime contractors and subcontractors take affirmative action to employ and advance in employment individuals without regard to race, color, religion, sex, national origin, protected veteran status or disability.

12. TERM AND TERMINATION.

12.1 Term. The Agreement is effective as of the date on the Agreement and shall continue in effect for an initial term ending three years thereafter. The Agreement shall thereafter continue in effect for successive one- year terms, unless not later than sixty (60) days prior to the end of the then-current term, either party shall notify the other that the Agreement shall expire, in which event the Agreement shall expire on the last day of the then-current term (except with respect to any Statement of Work for which the term set forth in such Statement of Work has not yet been completed, which Statement of Work shall continue until expiration or termination).

12.2 Termination or Suspension. This Agreement may be terminated in whole or in part by either Party (the “non-breaching party”) upon written notice to the other Party if any of the following events occur by or with respect to such other Party (the “breaching party”): (i) the breaching party commits a material breach of any of its obligations hereunder and fails to cure such breach within thirty (30) days after receipt of notice of such breach or fails to reach an agreement with the non- breaching party regarding the cure thereof; or (ii) any insolvency of the breaching party, any filing of a petition in bankruptcy by or against the breaching party, any appointment of a receiver for the breaching party, or any assignment for the benefit of the breaching party’s creditors. In addition to any right to terminate as provided in this Agreement, the Parties agree that in connection with any dispute for which Client withholds the payment of charges pursuant to this Agreement, if the total amount being disputed (other than amounts in dispute resulting from clear billing errors of Cognizant), plus any amount that is undisputed but past due and any interest that has accrued thereon, exceeds the amount of fees billed by Cognizant in the then-prior three-month period (the “Disputed Amount Threshold”), Cognizant may, without liability to Client or its Affiliates, with at least 30 days’ prior written notice to Client, suspend the further delivery of Services that are not paid for in advance until all payment disputes are resolved using the dispute resolution process set forth in this Agreement. If Client pays the Disputed Amount, Cognizant shall promptly recommence performance of the Services and all Cognizant timing obligations and delivery commitments under this Agreement and/or each applicable SOW shall be extended by the number of days between the date of suspension and the date Cognizant recommences performance of the relevant Services.

12.3 Payment upon Termination. Upon termination, Cognizant will be entitled to recover payment for all Services rendered through the date of termination (including for work in progress), and in the event of termination of this Agreement, in whole or in part, by Cognizant pursuant to this Section 12 , Cognizant will also be entitled to recover those reasonable costs incurred in anticipation of performance of the Services to the extent they cannot reasonably be eliminated.

12.4 Survival. In the event of termination or upon expiration of this Agreement, Sections 3, 5, 6, 8, 9 (subject to the expiration of any warranty period), 10 , 11, 12, and 13 hereof will survive and continue in full force and effect.

Confidential Information
11 13. MISCELLANEOUS.

13.1 Governing Law. This Agreement will be governed by the laws of the State of New York, without reference to the principles of conflicts of law. The Parties acknowledge and agree that this Agreement relates solely to the performance of services (not the sale of goods) and, accordingly, will not be governed by the Uniform Commercial Code of any State having jurisdiction. In addition, the provisions of the Unif orm Computerized Information Transaction Act and United Nations Convention on Contracts for the International Sale of Goods shall not apply to this Agreement.

13.2 Dispute Resolution.

13.2.1 Informal Negotiations. In the event of any dispute, controversy, or claim of any kind arising out of or relating in any way to this Agreement or the breach thereof (each a “Dispute”), prior to filing a notice of arbitration, the Party claiming a Dispute shall send a written notice to the other Party describing the basis for the Dispute and the requested remedy, and inviting the other Party to have its executive confer with a named executive of the claiming party to attempt to negotiate a resolution. The claiming Party may file the notice of arbitration in accordance with the Rul es (defined below) after the executive conference is completed, if the invitation to confer is declined, or if, within ten (10) business days after the Dispute notice is delivered, there is no response to the invitation or the Parties are unable to schedul e the conference.

13.2.2 Arbitration. Subject only to Section 13.2.4 below, any Dispute that is not settled through the negotiation process required under Section 1 3.2.1, shall be settled by final and binding arbitration administered by the International Centre for Dispute Resolution under the International Dispute Resolution Procedures – International Arbitration Rules (available at WWW.ICDR.ORG) (the “ Rules”). The Parties waive any right to mediate a Dispute and any mediation provisions contained in the Rules shall not apply.

13.2.3 Arbitration Process. In-person hearings or meetings with the arbitrator(s) shall be held in New York, New York and the seat of the arbitration shall be New York, New York. The sole arbitrator, or the presiding arbitrator in the case of a three-arbitrator panel, shall either be a retired judge or a lawyer with at least ten (10) years of experience in information technology matters. Each award shall include written findings of fact and conclusions of law and shall be final and binding, exc ept that if the arbitration is conducted by a single arbitrator and US$10,000,000 or more in damages are awarded against a Party (exclusive of interest, attorneys’ fees, and arbitration fees and costs), that Party may appeal the award to a panel of three arbitrators pursuant to the Optional Appellate Arbitration Rules of the American Arbitration Association. The existence of a Dispute or the content or result of any award shall constitute the Confidential Information of both parties and the parties shall r equire that the arbitrator of any Dispute be bound to maintain the confidentiality of such Confidential Information. All informal and formal negotiations between the Parties regarding a Dispute shall be treated as compromise and settlement negotiations under applicable rules of evidence and no written or oral statements of position or offers of settlement made during the informal or formal Dispute resolution procedures shall be offered into evidence for any purpose, or constitute an admission or waiver of rights by either Party.

13.2.4 Access to Courts. Either Party may at any time apply to a court with appropriate jurisdiction only to (a) seek interim or provisional relief necessary to protect its rights or property

Confidential Information
12 pending the resolution of a Dispute in accordance with these procedures, including inj unctive relief and specific performance, or (b) enter or enforce any final and binding arbitration award.

13.3 Binding Effect and Assignment. Neither Party may assign or otherwise transfer any of its rights, duties or obligations under this Agreement without the prior written consent of the other Party, except either Party may, upon prior written notice to the other Party (but without any obligation to obtain the consent of such other Party ), assign this Agreement or any of its rights hereunder to any Affiliate of such Party, or to any entity who succeeds (by purchase, merger, operation of law or otherwise) to all or substantially all of the capital stock, assets or business of such Party, if such entity agrees in writing to assume and be bound by all of the obli gations of such Party under this Agreement. This Agreement shall be binding upon and inure to the benefit of the Parties hereto and their respective successors and permitted assignees.

13.4 No Third Party Beneficiaries . This Agreement shall not confer any right s or remedies upon any person other than the Parties and their respective successors and permitted assigns.

13.5 Notices. All notices required by this Agreement will be given in writing to the other Party and delivered by registered mail, international air courier, facsimile, or the equivalent. Notices will be effective when received as indicated on the facsimile, registered mail, or other delivery receipt.

All notices will be given by one Party to the other at its address stated on the first page of this Agreement unless a change thereof previously has been given to the Party giving the notice.

13.6 Amendments and Waivers. This A greement may be modified only by a written amendment executed by duly authorized officers or representatives of both Parties. No waiver by either Party of any right or remedy hereunder shall be valid unless the same shall be in writing and signed by the Party giving such waiver. No waiver by either Party with respect to any default, misrepresentation, or breach of warranty or covenant hereunder shall be deemed to extend to any prior or subsequent default, misrepresentation, or breach of warranty or covenant hereunder or affect in any way any rights arising by virtue of any prior or subsequent such occurrence.

13.7 Severability. If any provision in this Agreement is held by a court of competent jurisdiction to be invalid, void, or unenforceable, then such provision shall be severed from this Agreement and the remaining provisions will continue in full force.

13.8 Counterparts. This Agreement and each Statement of Work may be executed in several counterparts and by facsimile signature, each of which will be deemed an original, and all of which taken together will constitute one single agreement between the Parties with the same effect as if all the signatures were upon the same instrument. A telecopy signature shall be as legally effective as an original signature.

13.9 Entire Agreement. This Agreement and all Statements of Work attached hereto constitute the complete and exclusive statement of the agreement between the Parties and supersede all proposals, oral or written, and all other prior or contemporaneous communications between the Parties relating to the subject matter herein.

13.10 Press Releases and Announcements. Either Party may make any public disclosure it believes in good faith is required by applicable law, regulation or stock market rule (in which case the disclosing party shall use reasonable efforts to advise the other Party and provide it with a copy of the proposed disclosure prior to making the disclosure).

Confidential Information
13 13.11 Headings. The section headings contained in this Agreement are inserted for convenience only and shall not affect in any way the meaning or interpretation of this Agreement.

13.12 Consents and Approvals. Except where expressly provided as being in the discretion of a Party, where approval, acceptance, consent or similar action by either Party is required under this Agreement or the applicable Statement of Work , such action shall not be unreasonably withheld or delayed.

IN WITNESS WHEREOF, Cognizant and Client have caused this Agreement to be signed and delivered by their duly authorized officers, all as of the date first herein above written.

COGNIZANT WORLDWIDE LIMITED

Signature:

Print Name:

Title:
[CLIENT]

Signature:

Print Name:

Title: _______________________________

Solely for the purpose of acknowledging that CTS US may perform local services in the United States of America in accordance with Section 1.1:

COGNIZANT TECHNOLOGY SOLUTIONS U.S. CORPORATION

Signature:____________________________
Print Name:____________________________
Title:_________________________________

Confidential Information
14 EXHIBIT A

DATA PROTECTION AGREEMENT

This Data Protection Agreement (this “DPA”), is entered into by and between Cognizant Worldwide Limited (collectively with its Affiliates, “ Cognizant”) and _____________ (“Client”) (each a “Party” and collectively, “Parties”), pursuant to the terms and conditions of the Master Services Agreement (the “Agreement”) effective ______ between the Parties.

General Data Protection Terms

1. Introduction.

1.1. Order of Precedence. This DPA is part of the Agreement, and the terms of this DPA are in addition to, and not in lieu of, the terms in the Agreement. The terms of this DPA shall prevail over any conflicting terms in the Agreement’s other sections.

2. Definitions.

2.1. In this DPA:

a. “Access” or “Accessing” means to access, view, alter, use, process, transfer, store, host, disclose, erase, destroy, or dispose of Protected Data, and includes any operation or set of operations performed upon Protected Data, whether or not by automated means.
b. “Applicable Laws” means the privacy, data security, and data protection laws, directives, regulations, orders, and rules in the jurisdiction(s) applicable to the Cognizant and/or the Services provided under the Agreement. c. “Applicable Standards ” means gover nment standards, industry standards, and commercially reasonable practices related to privacy, data security or data protection that are applicable to Cognizant and the Services provided under the Agreement, or such other standards as otherwise agreed to by the Parties and specifically set forth in an applicable Statement of Work or other written agreement. d. “Authorized Person(s) ” means the individual(s) to whom Client or Cognizant has granted Access to Protected Data.
e. “Employee Personal Data” means the Pers onal Information of the personnel of Cognizant, Cognizant ’s Affiliates, or Cognizant subcontractors or other representatives.
f. “European Data Protection Legislation” means Regulation 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC ("General Data Protection Regulation"), including any applicable delegated acts adopted by the European Com mission and any applicable national legislation made under or otherwise adopted by Member States of the EEA

Confidential Information
15 pursuant to specific rights or powers contained within the General Data Protection Regulation, together with any replacement legislation or any equi valent legislation of any other applicable jurisdiction and all other applicable laws and regulations in any relevant jurisdiction relating to the processing of personal data and privacy. g. “include” or “including” means including but not limited to. h. “Personal Data” means: any information relating to an identified or identifiable natural person; an identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that person. i. “Personal Information” means: (i) information relating to an identified or identifiabl e individual in any form or medium; (ii) information related to an identified or identifiable individual that is protected under Applicable Law (including Personal Data); or (iii) information that is not specifically about an identified or identifiable individual but, when combined with other information, may identify an individual. In the event that the definition of Personal Information in this DPA is inconsistent with a definition of Personal Data, Personal Information, or similar concept under an Applicable Law, then the definition of such concept under the Applicable Law shall prevail solely to the extent of the inconsistency.
j. “Protected Data” means the Personal Information to which Client has granted Cognizant access for the performance of Cognizant’s obligations under the Agreement.
k. “Security Incident” means the unauthorized or unlawful destruction, loss, alteration, or disclosure of Protected Data caused by Cognizant’s breach of this DPA . Security Incidents will not include unsuccessful attempts to Access Protected Information or to interfere with system operations in an information system, such as “scans” or “pings” on a firewall.
l. “Security Standards” has the meaning set forth in Section 5 of this DPA.

2.2. All cap italized terms that are not expressly defined in this DPA will have the meaning given to them in the Agreement. All examples are illustrative and not the sole or exclusive examples of a particular concept.

3. General Obligations.

3.1. Compliance. Cognizant agrees that, during the period in which Cognizant has been given Access to Protected Data, it will comply with its obligations under Applicable Laws.

Cognizant will provide commercially reasonable information, assistance, and cooperation regarding the proc essing of Personal Information as Client may reasonably require to enable Client to comply with Applicable Laws, including (when required by Applicable Laws) assisting Client (at Client’s expense) with its security, notification, communication, recordkeeping, and reporting obligations under Applicable Laws.

Confidential Information
16 3.2. Purpose Limitation. Cognizant agrees that it will Access Protected Data : (i) in accordance with the lawful, written instructions of Client (provided such instructions are reasonable and provided that Client shall be responsible for any material costs incurred by Cognizant in order to comply with such documented instructions) ; (ii) for the proper management and administration of Cognizant or to carry out Cognizant’s legal responsibilities under Applicable Laws; and (iii) to fulfill its obligations under the Agreement and the relevant Statement(s) of Work.

3.3. International Transfers of Personal Information. When applicable, and where required by Applicable Laws, the Parties agree to execute appropriate data transfer agreements to ensure the lawfulness of cross-border transfers of Personal Information.

3.4. Duty of Confidentiality . Cognizant agrees that Authorized Persons to whom Cognizant has granted Access to Protected Information will be subject to a duty of confidentiality (whether such duty is contractual, statutory, or otherwise).

3.5. Individual Rights. Cognizant will reasonably assist the Client to fulfill or resolve an individual’s request for access to his or her Personal Information, including with respect to a request from a data subject to exercise any of his or her rights under Applicable Laws (including the rights of access, correction, blocking, objection, erasure and data portability, as applicable). If Cognizant receives such a request directly from the individual(s), Cognizant will promptly inform Client of the request.

3.6. Prohibited Personal Information. Client will not provide Cognizant with Access to Personal Information that contains any special categories of Personal Data or information related to criminal convictions and offenses that are not expressly disclosed in the relevant SOW(s).

4. Obligations for Special Categories of Personal Information.

4.1. European Data Protection Requirements . If Cognizant or a Cognizant Affiliate: (i) is established within the European Economic Area (“ EEA”), Switzerland, or the UK and processes Personal Data of EEA or UK data subjects on behalf of Client or a Client Affiliate as part of the Services; (ii) processes Personal Data on behalf of a Client Affiliate established in the EEA, Switzerland, or the UK as part of the Services; or (iii) processes the Personal Data of data subjects located in the EEA, Switzerland, or the UK on behalf of the Client or a Client Affiliate as part of the Services , then the Parties will enter into additional EU -specific data privacy terms with respect to the Services that involve processing of such Personal Data.

4.2. HIPAA. If and to the extent Cognizant has Access to Protected Health Information as defined at 45 C.F.R. §160.103 ( “PHI”) subject to the Health Insurance Portability and Accountability Act of 1996 ( “HIPAA”), then the Parties shall enter into a mutually agreeable Business Associate Agreement subject to the provisions of the Agreement.

5. Security Standards.

5.1. Minimum Security Standards . Cognizant agrees to implement and maintain commercially reasonable and appropriate administrative, technical, organizational, and physical controls designed to provide a level of security appropriate to the risk and to

Confidential Information
17 protect the confidentiality, integrity, and availability of Protected Data ( “Security Standards”), including: (i) controls designed to secure facilities, infrastructure, data centers, servers, hard copy files, systems, equipment, applications, and devices used to Access Protected Data, including controls to monitor, prevent, detect, and respond to Security Incidents; (ii) policies and practices limiting Access to Protected Data only to Authorized Persons; and (iii) procedures to regularly assess and evaluate the effectiveness of the Security Standards.

5.2. Training. Cognizant will provide privacy and security training for all Authorized Persons who Access Protected Data.

5.3. Client Responsibility for Employee Personal Data . To the extent that Client has Access to Employee Personal Data, Client shall implement and maintain, in compliance with Applicable laws, a data privacy and security program to protect Employee Personal Data to a standard materially the same as those required of Cognizant hereunder. Client shall collect only the minimum necessary amount of Employee Personal Data to comply with Client’s obligations under Applicable Laws.

6. Return and Disposal of Protected Data. Upon the earlier of Client’s written request or termination or expiration of the Agreement, Cognizant will securely destroy or, at Client’s expense, return the Protected Data in accordance w ith Client’s reasonable written instructions. Cognizant agrees to return or destroy Protected Data within ninety (90) days of receipt of Client’s written request or expiration or termination of the Agreement, as applicable; provided, however, that Cognizant may retain copies of Protected Information that Cognizant is legally required to retain, subject to a continued obligation to hold the same in confidence in accordance with this Agreement.

7. Security Incident Response.

7.1. Security Incident Response Program. Cognizant will maintain an incident response program in compliance with Applicable Laws to respond to Security Incidents.

7.2. Notice, Investigation, and Remediation. In the event of a Security Incident, Cognizant will notify Client without undue dela y (and in no event more than seventy -two (72) hours after confirmation of the Security Incident). This notification will include, to the extent know at the time notice is sent: (i) a description of the Security Incident; (ii) the categories and types of Protected Data affected; and (iii) if applicable, the categories and number of data subjects and individual records affected. Additionally, Cognizant will promptly investigate and remedy the Security Incident, take commercially reasonable steps to mitigate t he effects of the Security Incident and to prevent further Security Incidents, and take other actions required of it by Applicable Laws.

7.3. No Unauthorized Statements . Except as required by Applicable Laws, neither Party will make public statements concerni ng a Security Incident that references or identifies either Party, unless both Parties have provided express written consent for any such statement prior to its release.

8. Change in Law. If an Applicable Law becomes effective after the execution of this DPA and is inconsistent with the terms of this DPA or otherwise requires the Parties to amend this DPA or change the Services, the Parties agree to enter into good faith negotiations to m ake

Confidential Information
18 required changes to the Security Standards, the Serv ices, and/or to amend this DPA or the Agreement.

9. Survival. Cognizant’s obligations under this DPA will survive termination or expiration of the Agreement and/or completion of the Services solely to the extent Cognizant is required to Access Protected Data.

IN WITNESS WHEREOF, Cognizant and Client have caused this DPA to be signed and delivered by their duly authorized officers, all as of the date first herein above written.

COGNIZANT WORLDWIDE LIMITED

Signature:

Print Name:

Title:
[CLIENT]

Signature:

Print Name:

Title: ______________________________

City of Santa Maria
Enterprise Resource Planning (ERP) Software
and Implementation Services
November 14, 2022

Collaborative Solutions, LLC. Proprietary & Confidential 178

Appendix B: Representative Resumes

Page 1 of 3 ends

Santa Maria City CouncilMarch 19, 2024

Santa Maria City Council
March 19, 2024