Master Subscription Agreement
This Master Subscription Agreement, effective as of. , is by and between SpryPoint Services, Inc. (“SpryPoint) a Canadian Corporation with offices at 45 Queen Street, Charlottetown, PE C1A 4A4 and The City of Santa Maria (“Client”) with offices at 110 E. Cook Street, Santa Maria, CA, 93454.
Whereas SpryPoint provides a subscription Service to which Client intends to subscribe, this Agreement establishes the business relationship and allocation of responsibilities regarding the Service and the parties therefore agree as follows.
The exhibits and schedules attached hereto are an integral part of this agreement and are deemed incorporated by reference herein.
SpryPoint agrees to perform the services described below in accordance with the terms and conditions of this Agreement. Should there be a conflict of terms or conditions, this Agreement shall control, and the order of precedence shall be as follows:
1. Master Subscription Agreement
2. Exhibit A – Pricing Schedule
3. Exhibit B – Service Level Agreement
4. Exhibit C – Insurance Requirements
5. Exhibit D – Security Provisions
6. Exhibit E – Data Processing
DEFINITIONS. The following capitalized terms shall have the following meanings whenever used in this Agreement. “Affiliate” means any entity which directly or indirectly controls, is controlled by, or is under common control by either party. For purposes of the preceding sentence, “control” means direct or indirect ownership or control of more than 50% of the voting interests of the subject entity. “Agreement” means this Master Subscription Agreement, including any exhibits or attachments hereto. “Authorized Named User” means an end user of the C lient that has been given access by Client to use the Services.
“Authorized Parties” means Clients’ or an authorized Affiliate’s Employees and third-party providers authorized to access Client’s Tenants and/or to receive Client Data by Client (i) in writing, (ii) through the Service’s security designation, or (iii) by system integration or other data exchange process. “Confidential Information” refers to the following types of material or content one party to this Agreement (“Discloser”) discloses to the other (“Recipient”): (a) any information Discloser marks or designates as “Confidential” at the time of disclosure; and (b) any other non- public, sensitive information disclosed by Discloser including, but not limited to code, inventions, know-how, business, technical, and financial information, or other information which should reasonably be known by the Recipient to be confidential at the time it is disclosed, due to the nature of the information and the circumstances surrounding such disclosure Confidential Information does not include information that: (i) is in Recipient’s possession at the time of disclosure; (ii) is independently developed by Recipient without use of or reference to Confidential Information; (iii) becomes known publicly, before or after disclosure,
ATTACHMENT E
other than as a result of Recipient’s improper action or inaction; or (iv) is rightfully obtained by Recipient from a third party without breach of any confidentiality obligations. “Client Data” means a subset of Confidential Information that is comprised of Client’s data obtained, used in, or stored as the result of the use of the Services. Client Data shall include the following: (a) Data collected, used, processed, stored, or generated by the Client as the result of the use of the Service, including any personal identifiable information (“PII”) and any information related to payment processing, such as credit card numbers and ACH account numbers. Client Data is and shall remain the sole and exclusive property of Client and all right, title, interest in same is reserved to Client. “Client Input” means suggestions, enhancement requests, recommendations or other feedback provided by Client, its employees and Authorized Parties relating to the operation or functionality of the Service. “Competitor” means any entity that may be reasonably construed as offering competitive functionality or the Service offered by SpryPoint. “Documentation” means the Software’s standard user manuals and any other accompanying documents related to the Software delivered to Client during Implementation. “Implementation” means the process for gathering requirements, configuring, testing, training, and integrating the Service for Client’s use, as set forth in a Statement of Work. “Intellectual Property Rights” means any and all common law, statutory and other industrial property rights and intellectual property rights, including copyrights, trademarks, trade secrets, patents and other proprietary rights issued, honored or enforceable under any appliable laws anywhere in the world, and all moral rights related thereto. “Implementation Services” means the services provided by Provider to Client for the integration, implementation, and use of the Service, which may include project management, analysis, configuration, data conversion, training, testing, development and ongoing maintenance & support, as outlined in a Statement of Work. “Malicious Code” means viruses, worms, timebombs, trojan horses and other malicious code, files, scripts, agents or programs. “Messaging Service” means SpryPoint’s alerts, notifications, communications, campaigns & messaging capabilities provided with the Service. “Parties” Collectively refers to SpryPoint and the Client. “Personal Data” means any information that is related to an identified or identifiable individual and has been provided by Client or its Affiliates as Client Data within the SpryPoint Service to enable SpryPoint to process the data on its behalf. “Production Deployment” means once the Client has provided User Acceptance Testing (“UAT”) signoff and the Service has been moved into a production environment. “Security Breach” means (i) any actual or reasonably suspected unauthorized use of, loss of, access to or disclosure of, Client Data; provided that an incidental disclosure of Client Data to an Authorized Party or SpryPoint or incidental access to Client Data by an Authorized Party or SpryPoint, where no reasonable suspicion exists that such disclosure or access involves theft, or is fraudulent, criminal or malicious in nature, shall not be considered a
“Security Breach” for purposes of this definition, unless such incidental disclosure or incidental access triggers a notification obligation under any appliable Law and (ii) any security breach (or substantially similar term) As defined by applicable law. “Service” means the combination of SpryPoint’s software-as-a service applications as described in the Documentation and subscribed to as set forth in Exhibit A - Pricing Schedule or through a Change Order. “Service Level Agreement” (SLA). means SpryPoint’s standard Service Level Availability policy which may be updated from time to time. No update shall materially diminish SpryPoint’s responsibilities under the SLA. “Subscription Service Fee” means the annual amount invoiced and payable for Client’s use of the Service. The Subscription Service Fee does not include the one-time implementation fees for the Services as set forth in a Statement of Work. “Tenant” means a unique instance of the Service, with a separate set of Client data held by SpryPoint in a logically separated database. “Term” means the Initial Term of this Agreement which commences on the Effective Date and will continue for one year. “Updates” means all updates, improvements, enhancements, error corrections, bug fixes, release notes, upgrades and changes to the Service and Documentation as developed by SpryPoint and made generally available for Production use. 1. Provision of Service. 1.1 SpryPoint Obligations. During the Term of this Agreement, SpryPoint shall make the Service and Updates available to Client in accordance with the Documentation, the SLA and pursuant to the terms of this Agreement. SpryPoint shall not use Client Data except to provide the Service, or to prevent or address service or technical problems, verify Service Updates, in accordance with this Agreement and the Documentation, or in accordance with Client’s instructions and shall not disclose Client Data to anyone other than Authorized Parties in accordance with this Agreement. SpryPoint shall comply with Client’s written policies and procedures (“Access Policies”) for accessing Customer’s or its Affiliates’ systems or networks (“Client Systems”) that have been communicated in advance to SpryPoint and shall not attempt to gain access to Client Systems in a manner prohibited by the Access Policies, unless otherwise expressly authorized in writing by Customer. During the term of this agreement, SpryPoint agrees to cooperate and work with Client and Client’s agents regarding implementation and integration of SpryPoint’s Service and Updates with Workday and Client’s other third-party software services that require integration with SpryPoint’s Service and Updates as outlined in an applicable Statement of Work. Any effort required beyond the scope of an applicable Statement of Work or Change Order will be subject to Section 2.7 herein. 1.2 Client Obligations. Client may enable access of the Service for use only by Authorized Parties solely for the internal business purposes of Client and its Affiliates in accordance with the Documentation and not for the benefit of any third parties except for third parties supported and served as part of Customer’s internal business purposes. Client is responsible for all Authorized Party use of the Service and compliance with this Agreement. Client shall: (a) have sole responsibility for the accuracy, quality, and legality of all Client Data and (b) take commercially reasonable efforts to prevent unauthorized access to,
or use of, the Service through login credentials of Authorized Parties, and notify SpryPoint promptly of any such unauthorized access or use. Client shall not: (i) use the Service in violation of applicable Laws; (ii) in connection with the Service, send or store infringing, obscene, threatening or otherwise unlawful or tortious material, including material that violates privacy rights; (iii) send or store Malicious Code in connection with the Service or its related systems or networks in a manner not set forth in the Documentation. Client shall designate a maximum number of named contacts as listed in the applicable Orde form to request and receive support services from SpryPoint. Named support contacts must be trained on the SpryPoint product(s) for which they initiate support requests. Client shall be liable for the acts and omissions of all Authorized Parties and Client Affiliates relating to this Agreement. 1.3 Acceptable Use. Client acknowledges and agrees that SpryPoint does not police the content of communications or data of Client or its users transmitted through the Service, and that SpryPoint shall not be responsible for the content of any such communications or transmissions. Client shall use the Services exclusively for authorized and legal purposes, consistent with all applicable laws and regulations Client is solely responsible (a) for making sure that the disclosure and use of data, content and information provided to SpryPoint does not violate any applicable law or infringe upon the intellectual property rights of any third party and (b) for the appropriate use of any reports and other materials prepared by Client in a manner that will not violate any applicable law or infringe upon the intellectual property rights of any third party. Client agrees not to post or upload any content or data which (a) is libelous, defamatory, obscene, pornographic, abusive, harassing or threatening; (b) violates the rights of others, such as data which infringes on any intellectual property rights or violates any right of privacy or publicity; or (c) otherwise violates any applicable law. SpryPoint may remove any violating content posted or transmitted through the Services, without notice to Client. SpryPoint may suspend or terminate any user’s access to the Service upon notice in the event that SpryPoint reasonably determines that such user has violated the terms and conditions of this Agreement. 2. Fees. 2.1 Invoices & Payment. SpryPoint will invoice Client 30% of first-year subscription fee for the Service upon execution of this agreement, remainder of first-year subscription fee will be invoiced upon project kickoff. All fees are quoted and payable in United States Dollars. All invoiced charges are due net 45 days from the invoice date unless otherwise stated on the invoice. Client is responsible for providing SpryPoint complete and accurate billing and contact information including a valid email address prior to the commencement of your subscription. Upon SpryPoint’s request, Client will make payments via electronic bank transfer. All remittance and invoice inquiries are to be directed to [email protected]. 2.2 Non-Cancelable & Non-Refundable. Except as specifically set forth to the contrary under Section 6 (Warranty) and Section 7 (Indemnification), all payment obligations are non-cancelable, and all payments made are non-refundable. 2.3 Non-Payment and Suspension of Service. If SpryPoint does not receive any invoiced amount by the due date as provided in Section 2.1 herein, then without limiting rights and remedies, the invoiced amount(s) may accrue interest at the rate of 1.5% per month. If any amount owing by Client for SpryPoint’s services under this or any other agreement is net 30 or more days overdue, SpryPoint, without limiting its other rights and remedies reserves the right to suspend the Service until such amounts are paid in full. 2.4 Taxes. All fees invoiced pursuant to this Agreement do not include any applicable taxes. Client shall be solely responsible in the event any authority imposes a duty, tax, levy, or fee (excluding those based on Provider’s net income) directly upon the Client in relation to this Agreement.
2.5 Tax Status. SpryPoint’s fees do not include any Transaction Taxes. Client agrees that it is exempt from all Transaction Taxes, including but not limited to, any local, state, provincial, federal or foreign taxes, levies, duties or similar governmental assessments of any nature, including value - added, goods and services taxes, excise, use or similar taxes. In the event that Client’s tax-exempt status changes such that it is no longer exempt from Transaction Taxes, Client shall become responsible for paying all Transaction Taxes associated with this Agreement. If SpryPoint has a legal obligation to pay or collect Transaction Taxes for which Client is responsible under this section, the appropriate amount shall be invoiced to and paid by Client. If Client itself, as a body entitled to assess taxes or fees, imposes any taxes or fees upon SpryPoint’s provision of the Services, the fees in this Agreement are net of any such taxes or fees and SpryPoint will gross up its invoices to include such taxes or fees. 2.6 Additional Services. The Service includes optional variable services such as SMS messaging services and outbound IVR dialer services (collectively “Additional Services”). All Additional Services shall be invoiced by SpryPoint to Client upon the request of such services by Client at the pricing and rates provided in Exhibit A. (a) For SMS text messaging services, an optional SMS Short Code fee shall be invoiced upon request of a Short Code by Client. SMS short code fees shall be invoiced annually, while in- bound and out-bound text message usage fees shall be invoiced monthly for actual amount used. (b) For Outbound IVR services, usage fees shall be invoiced monthly for the actual amount used upon activation and usage of the outbound IVR services. 2.7 Enhancement Cost. Any enhancements to the Service beyond the initial scope as outlined in a Statement of Work will be performed on a time and material basis at SpryPoint’s then current hourly rates. 2.8 Additional Users. SpryPoint will be automatically notified when new users are added to Client’s Service. If the number of active users, not including archived users, exceeds Clients current subscription, SpryPoint will invoice client for any incremental user additions during the calendar month. Invoice to client will be prorated to align with the remaining months in Client’s subscription period. 3. Proprietary Rights 3.1 SpryPoint Intellectual Property Rights. SpryPoint retains all right, title, and interest in and to the Service, Documentation and other SpryPoint Intellectual Property Rights including any related methodologies, techniques, processes, and instruction developed by SpryPoint and used in the course of delivering the Service. under this Agreement and an applicable Statement of Work. No rights are granted to Client hereunder other than expressly set forth herein. Client shall not (and shall not allow or cause any third party to (i) reverse engineer, modify or copy the Service or Documentation or create any derivative works based on the Service and Documentation; (ii) copy and features, functions, interfaces, integrations or graphics of the Service or Documentation; (iii) access the Service or Documentation in order to build any commercially available product or service. 3.2 Client Rights. SpryPoint hereby grants Client’s Authorized Named Users (and those of Client’s Affiliates and Authorized Parties) a non-exclusive, non-transferable, non-perpetual limited right to use the Service and Documentation, solely for the internal business purposes of Client and Affiliates and solely during the Term, subject to the terms and conditions of this Agreement. 3.3 Ownership of Customer Data. As between SpryPoint and Client, Client owns its Client Data. Subject to the limited rights expressly granted hereunder, Customer reserves all rights, title and interest in and to
the Customer Data, including all related Intellectual Property Rights. No rights are granted to SpryPoint hereunder other than as expressly set forth herein. 3.4 License to Host Client’s Data. Client grants SpryPoint and SpryPoint’s hosting partners a worldwide, limited-term license to host, copy, transmit and display Client’s Data, as necessary for SpryPoint to provide the Service in accordance with this Agreement. As between SpryPoint and Client, SpryPoint acquires no right, title or interest from Client under this Agreement in or to Client’s Data. 3.5 License to use Client’s Feedback. Client grants to SpryPoint and its affiliates a worldwide, perpetual, irrevocable, royalty-free license to use and incorporate into the Service any suggestion, enhancement request, recommendation, correction or other Client feedback relating to the Service. SpryPoint shall have no obligation to make Client Input an Improvement. 3.6 Statistical Information. SpryPoint owns all aggregated and statistical data derived from the operation of the Service, including, without limitation, the number of records in the Service, the number and types of transactions, configurations, and performance results for the Service. SpryPoint may anonymously compile statistical information related to the performance of the Service for purposes of improving the SaaS service, provided that such information does not identify Client’s data or include Client’s name. 4. Confidentiality 4.1 Confidentiality. A party shall not disclose or use any Confidential Information of the other party except as reasonably necessary to perform its obligations or exercise its rights pursuant to this Agreement except with the other party’s prior written permission. 4.2 Nondisclosure. A party shall not use Confidential Information for any purpose other than to facilitate this Agreement. A Recipient: (a) shall not disclose Confidential Information to any employee or contractor unless such person needs access in order to facilitate the Agreement and executes a nondisclosure agreement with Recipient (b) shall not disclose Confidential Information to any third party without Discloser’s prior written consent. 4.3 Protection. Each party shall protect Confidential Information with the same degree of care it uses to protect its own confidential information, but in no event using less than a reasonable standard of care. If either party reasonably believes that there has been unauthorized access, use or disclosure of the other party’s Confidential Information, such party must promptly notify the other party. If the unauthorized access, use or disclosure includes Customer Data, Section 5.2 (Unauthorized Disclosure) shall apply. 4.4 Injunctive Relief. Recipient agrees that breach of Confidentiality would cause irreparable injury, for which monetary damages would be inadequate. If a recipient discloses or uses any Confidential Information of the other party in breach of confidentiality protections hereunder, the other party shall have the right, in addition to any other remedies available, to injunctive relief to enjoin such acts. 4.5 Retention of Rights. This Agreement does not transfer ownership of Confidential Information or grant a license or any other right thereto. Discloser will retain all right, title and interest in and to all Confidential Information. 4.6 Remedies. If a party discloses or uses (or threatens to disclose or use) any Confidential Information of the other party in breach of confidentiality protections hereunder, the other party shall have the right, in addition to any other remedies available, to injunctive relief to enjoin such acts, it being acknowledged
by the parties that any other available remedies are inadequate. This provision, however, will not diminish the right of a party to claim and recover damages or other remedies in addition to equitable relief. 5. Data Privacy & Security 5.1 SpryPoint use of Data. Client hereby grants SpryPoint a limited right to access, process, collect, store, generate, display, and use Client Data for the sole purpose of providing the Service. SpryPoint shall keep and maintain Client Data in strict confidence and shall not allow any third parties to use, disclose, or access Client Data without Client’s prior written consent. Notwithstanding the foregoing, SpryPoint may disclose Client Data as required by applicable law or by proper legal or governmental authority. SpryPoint shall give Client notice of any such legal or governmental demand and reasonably cooperate with Client in any effort to seek a protective order or otherwise contest such required disclosure, at Client’s expense. 5.2 Data Security. Each Party shall be responsible for establishing and maintaining its own data privacy and information security policies for its own information technology infrastructure and environments, including physical, technical, administrative, and organizational safeguards to ensure the security and confidentiality of Client Data; protect against any anticipated threats or hazards to the security of Client data, protect against unauthorized disclosure, access to, or use of Client Data, ensure the proper disposal of Client Data, and ensure that all employees, agents, and subcontractors, if any, comply with the above. 5.3 Unauthorized Disclosure. If either Party believes there has been a Security Breach, such party must notify the other party upon the earlier of forty-eight (48) hours after discovery or any time frame required by applicable law unless legally prohibited from doing so. Each Party will reasonably assist the other Party in mitigating or remediating any potential damage where appropriate. Each party shall bear the costs of such remediation or mitigation to the extent the breach or security incident was caused by it. As soon as reasonably practicable after any such Security Breach, upon Client’s request, Client and SpryPoint will consult in good faith regarding the root cause analysis and any remediation efforts. 5.4 Penetration Testing. On an annual basis, SpryPoint will provide upon Customer’s request an executive summary of SpryPoint’s application penetration test of the Service. If such testing reveals any material security vulnerability in the Service, SpryPoint will take reasonable and prompt action to remedy such vulnerability. 6. Warranties & Disclaimers 6.1 From SpryPoint. a) Function: SpryPoint represents and warrants that, during the Term, the Service will perform materially in accordance with the Documentation. b) Intellectual Property Rights: SpryPoint represents and warrants that it owns the Service and has the power and authority to grant the rights in this Agreement without the further consent of any third party. c) Malicious Code: SpryPoint represents and warrants that to the best of its knowledge, the Service does not contain any Malicious code. SpryPoint further warrants that it will not knowingly introduce any Malicious Code into the Service. 6.2 From Both Parties. Each party represents and warrants that it has the full right and authority to enter into, execute, and perform its obligations under this Agreement and that no pending or threatened claim or litigation know to it would have a material adverse impact on its ability to perform as required hereunder.
6.3 Warranty Remedies. In the event of a breach of the warranty as set forth in Section 6.1, or upon the discovery of Malicious Code in the Service, (a) SpryPoint shall correct the non-conforming Service at no additional charge to Client or (b) in the event SpryPoint is unable to correct such deficiencies after good-faith efforts within a commercially reasonable timeframe based on the Severity Level of the issue as specified in SpryPoint’s SLA, SpryPoint shall refund Client amounts paid that are attributable to the defective Service from the date SpryPoint received such notice through the date of remedy, if any. At no time shall the refund exceed the subscription fees actually paid by Client in consideration for SpryPoint’s service delivery during the immediately preceding twelve (12) month period for the Service. 6.4 Warranty Disclaimer. EXCEPT FOR THE EXPRESS WARRANTIES OUTLINED IN SECTION 6.1 AND 6.2 ABOVE, SPRYPOINT MAKES NO WARRANTIES OF ANY KIND, WHETHER EXPRESS, IMPLIED, STATUTORY OR OTHERWISE, AND SPECIFICALLY DISCLAIMS ALL IMPLIED WARRANTIES, INCLUDING ANY WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE WITH RESPECT TO THE SERVICE AND/OR RELATED DOCUMENTATION. SPRYPOINT DOES NOT WARRANT THAT THE SERVICE WILL PERFORM WITHOUT ERROR OR THAT IT WILL RUN WITHOUT IMMATERIAL INTERRUPTION. THE LIMITED WARRANTIES PROVIDED HEREIN ARE THE SOLE AND EXCLUSIVE WARRANTIES PROVIDED TO CLIENT IN CONNECTION WITH THE PROVISION OF THE SERVICE. 7. Indemnification 7.1 Indemnification. SpryPoint shall protect, defend, hold harmless and indemnify Client harmless against any loss, damage or costs in connection with claims, demands, suits or proceedings (“Indemnified Claims)” made or brought against Client alleging that the use of the Service infringes any third party’s Intellectual Property Rights; provided, however, that Client; (a) promptly gives written notice of the Claim to SpryPoint; (b) gives SpryPoint sole control of the defense and settlement of the Claim; and (c) provides to SpryPoint, at SpryPoint’s cost, all reasonable assistance. SpryPoint’s obligations set forth in this Section do not apply to the extent that an Indemnified Claim arises out of: (a) Client’s breach of this Agreement; (b) revisions to the Service made without SpryPoint’s written consent; (c) Client’s failure to incorporate Upgrades that would have avoided the alleged infringement; (d) Modification of the Service by Client, its Employees, or Authorized Parties in conflict with Client’s obligations (e) Unauthorized use of the service by third parties; or (f) use of the Service in a manner inconsistent with the Documentation. Furthermore, the obligation to indemnify shall not apply if such liability is ultimately adjudicated to have arisen through the sole active negligence or sole willful misconduct of Client. If Client is enjoined from using the Service or SpryPoint reasonably believes it will be enjoined, SpryPoint shall have the right at its sole option, to obtain for Client the right to continue use of the Service or to replace or modify the Service so that it is no longer infringing. If neither of the foregoing options is reasonably available to SpryPoint, then use of the Service may be terminated at either party’s option and SpryPoint’s sole liability shall be to refund any prepaid fees for the Service that were to be provided after the effective date of termination. 8. Limitation of Liability 8.1 Liability Cap. SpryPoint’s liability arising out of or related to this Agreement shall in no event exceed the Subscription Fees paid by Client within the twenty-four (24) months preceding the claim. 8.2 Clarifications & Disclaimer. TO THE MAXIMUM EXTENT PERMITTED BY LAW AND EXCEPT WITH RESPECT TO EITHER PARTY’S INDEMNIFICATION OBLIGATIONS, RECKLESS MISCONDUCT, GROSS NEGLIGENCE, WILLFUL MISCONDUCT AND/OR FRAUD, IN NO EVENT SHALL EITHER PARTY’S AGGREGATE LIABILITY ARISING OUT OF OR RELATED TO THIS AGREEMENT, WHETHER IN CONTRACT, TORT OR OTHERWISE, EXCEED THE SUBSCRIPTION FEES ACTUALLY PAID BY CLIENT IN CONSIDERATION FOR SPRYPOINT’S SERVICE DELIVERY DURING THE IMMEDIATELY PRECEDING
TWELVE (12) MONTH PERIOD FOR THE SERVICE FROM WHICH THE CLAIM AROSE. FOR THE AVOIDANCE OF DOUBT, SPRYPOINT’S LIABILITY LIMITS APPLY TO SPRYPOINT’S AFFILIATES, PROVIDERS, AGENTS, SPONSORS, DIRECTORS, OFFICERS, EMPLOYEES, CONSULTANTS AND OTHER REPRESENTATIVES. 8.3 Exclusion of Damages. EXCEPT WITH RESPECT TO AMOUNTS TO BE PAID BY EITHER PARTY PURSUANT TO A COURT AWARD (OTHER THAN A DEFAULT JUDGMENT) OR SETTLEMENT AS WELL AS THE DEFENSE COSTS UNDER THE INDEMNIFICATION OBLIGATIONS NO MATTER HOW MUCH DAMAGES MAY BE CHARACTERIZED, IN NO EVENT SHALL EITHER PARTY HAVE ANY LIABILITY TO THE OTHER PARTY FOR ANY INDIRECT, SPECIAL, INCIDENTAL, PUNITIVE OR CONSEQUENTIAL DAMAGES, HOWEVER CAUSED, OR FOR ANY LOST PROFITS, LOSS OF US, COST OF DATA RECONSTRUCTION, COST OF PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES, WHETHER IN CONTRACT, TORT OR OTHERWISE, ARISING OUT OF, OR IN ANY WAY CONNECTED WITH THE SERVICE, INCLUDING BUT NOT LIMITED TO THE USE OR INABILITY TO USE THE SERVICE, ANY INTERRUPTION, INACCURACY, ERROR OR OMISSION, EVEN IF THE PARTY FROM WHICH DAMAGES ARE BEING SOUGHT OR SUCH PARTY’S LICENSORS, OR SUBCONTRACTORS HAVE BEEN PREVIOUSLY ADVISED OF THE POSSIBILITY OF SUCH LOSS OR DAMAGES. CLIENT WILL NOT ASSERT THAT ITS PAYMENT OBLIGATIONS ARE EXCLUDED AS SPRYPOINT’S LOST PROFITS. 9. Term & Termination 9.1 Term of Agreement. The Term of this agreement commences on the Effective Date and will continue for one year. 9.2 Annual Renewal. The initial Term shall automatically renew for successive terms of one year unless either party provides the other written notice of termination at least (30) days prior to the expiration of the current term. 9.3 Annual Escalation. The annual Subscription Service Fee for the Service shall be subject to adjustment on each anniversary of the Effective Date at the following rate: a) 4% per year. 9.4 Termination for Convenience. Client shall have the right to terminate this Agreement without cause or penalty, by giving not less than Thirty (30) days’ prior written notice to SpryPoint. Upon termination, Client shall pay SpryPoint all fees due up to the time of termination. 9.5 Termination for Default. Either party may terminate this Agreement upon Thirty (30) days prior written notice in the event of a material breach by the other party if such breach remains uncured at the expiration of such notice period. 9.6 Termination for Non-Appropriation of Funds. Notwithstanding any other provision of this Agreement, if funds for the continued fulfillment of this Agreement are not forthcoming or are insufficient, through the failure of any entity to appropriate funds or otherwise, Client will have the right to terminate at no additional cost or penalty by giving Thirty (30) days written prior notice documenting the lack of funding. 9.7 Effect of Termination. Upon any termination of this Agreement, Client shall, as of the date of such termination, immediately cease accessing and otherwise utilizing the applicable Service. Termination for any reason shall not relive Client of the obligation to pay any fees accrued or due and payable to SpryPoint prior to the effective date of termination.
9.8 Access to Client Data. Upon written request by Client made prior to any expiration or termination of this Agreement, SpryPoint will make Client Data available to Client through the Service solely for purposes of Client retrieving Client Data for a period of up to one hundred and twenty (120) days. After 120 days, SpryPoint will have no obligation to maintain or provide any Client data and shall thereafter, unless legally prohibited, delete all Client Data and will have no further obligation to make it available to Client. 10. Messaging. 10.1 Supplemental Messaging Terms. If Client elects to use SpryPoint’s Alerts, Notifications, Communications, Campaigns & Messaging capabilities (Messaging Service”) provided with the Service the following supplemental terms (“Messaging Terms”) will apply. For avoidance of doubt, Messaging Terms apply to all SpryPoint applications within the service involving automated phone calls, pre-recorded messages, text messages, emails, in-app notifications and any other bulk communications. 10.2 Responsibility & Risk. Client shall be solely responsible for the content of any communications which Client initiates or authorizes in connection with the Messaging Services. SpryPoint shall have no responsibility or liability with respect to messages or communications initiated or authorized by Client. Client assumes all risks associated with use of the Messaging Service 10.3 Messaging Indemnity. Client shall hold harmless, defend and indemnify SpryPoint and its officers, directors, employees, contractors and representatives from and against all claims, damages, losses and expenses including without limitation any statutory damages, penalties and attorney’s fees arising out of or relating to the Messaging Service or any breach by Client of the Agreement including without limitation, these Messaging Terms, except in the event of SpryPoint’s willful misconduct. 10.4 Compliance. SpryPoint is limited to delivering the Messaging Service to the Client as part of the Service, accordingly, compliance with applicable laws is strictly Client’s responsibility with respect to the Messaging Service notwithstanding any provision to the contrary. 11. Miscellaneous 11.1 Independent Contractor. SpryPoint and all persons(s) employed by or contracted with SpryPoint to furnish labor and/or materials under this Agreement are independent contractors and do not act as agent(S) or employee(s) of Client. SpryPoint has full rights to manage its employees in their performance of the Service under this agreement. This agreement does not create nor is it intended to create a partnership, franchise, joint venture, agency, fiduciary or employment relationship between the parties. There are no third-party beneficiaries to this Agreement. 11.2 Insurance. SpryPoint will maintain during the entire Term of this Agreement, at its own expense the insurance coverage as outlined in Attachment D. The policies shall name Client as an additional insured with respect to the provision of services provided under this agreement. 11.3 Governing Law. This Agreement shall be governed exclusively by the internal laws of the State of California. Venue shall be in the Superior Court of the County of Santa Barbara. 11.4 Notices. All notices under this Agreement shall be in writing and shall be deemed to have been given upon the third business day after first class mailing. Notices to the Client shall be sent to:
City of Santa Maria, CA Jeffrey Marecic Chief Information Officer 110 E. Cook Street Santa Maria, CA 93454 Notices to SpryPoint shall be sent to: Nick Stone Chief Financial Officer 45 Queen Street – Suite #401 Charlottetown, PE C1A 4A4 11.5 Waiver. No failure or delay by either party in exercising any right under this agreement shall constitute a waiver of that right or any other right. Neither Client’s review, acceptance nor payments for any of the Service or the Implementation Services shall be constructed to operate as a waiver of any rights under this agreement or of any cause of action arising out of the performance of this Agreement. 11.6 Force Majeure. In no event shall either party be responsible or liable for any failure or delay in the performance of its obligations hereunder arising out of or caused by, directly or indirectly, forces beyond its control, including, without limitation, strikes, work stoppages, accidents, acts of war or terrorism, civil or military disturbances, nuclear or natural catastrophes or acts of God, and interruptions, loss or malfunctions of utilities, communications or computer (software and hardware) services; it being understood that SpryPoint shall use reasonable efforts which are consistent with accepted software industry practices to resume performance as soon as practicable under the circumstances. Dates by which performance obligations are scheduled to be met will be extended for a period of time equal to the time lost due to any delay so caused. 11.7 Conflicts of Interest. SpryPoint certifies that to the best of its knowledge, no Client officer, employee or authorized representative has any financial interest in the business of SpryPoint and that no person associated with SpryPoint r has any interest, direct or indirect, which could conflict with the faithful performance of this Agreement. 11.8 Fair Employment. SpryPoint shall not discriminate against any employee or applicant for employment because of race, sex, color, religion, religious creed, national origin, ancestry, age, gender, marital status, physical disability, mental disability, medical condition, genetic information, sexual orientation, gender expression, gender identity, military and veteran status, or ethnic background, in violation of federal, state or local law. 11.9 Time. Time is of the essence in the performance of this Agreement. 11.10 Assignment. Neither Party may assign this Agreement or any of its rights or obligations hereunder without the prior written consent of the other party (which consent shall not be unreasonably withheld). Except to the extent forbidden herein, this Agreement will be binding upon and inure to the benefit of the parties’ respective successors and assigns. Notwithstanding the foregoing, either party may assign this Agreement in its entirety without consent of the other party in connection with a merger, acquisition, corporate reorganization, or sale of all or substantially all of its assets so long as the assignee agrees to be bound by all of the terms of this Agreement and all past due fees are paid in full. In no event shall
Client have the right to assign this Agreement to a direct Competitor of SpryPoint. Any attempt by a party to assign its rights or obligations under this Agreement other than as permitted by this section shall be void and of no effect. Subject to the foregoing, this Agreement shall bind and inure to the benefit of the parties, their respective successors and permitted assigns. 11.11 Severability. To the extent permitted by the law, the parties waive any provision of law that would render any clause of this Agreement invalid or unenforceable. In the even that a provision herein is held to be invalid or unenforceable, such provision will be interpreted to fulfills its intended purpose to the maximum extent permitted by the law, and the remaining provisions of this Agreement will continue in full force and effect. 11.12 Publicity. Except as set forth herein, SpryPoint shall not use Client’s name, logos, or trademarks in any written press releases, advertisements and/or marketing materials without the prior consent of Client, SpryPoint is authorized to use Client’s name and logo in lists of Clients and on its website, however, such usage shall not be classified as an advertisement but only identification as an entity who receives the Service from SpryPoint. 11.13 Piggyback. It is understood and agreed by Client and SpryPoint that any governmental entity may purchase the services specified herein in accordance with the prices, terms, and conditions of this agreement. It is also understood and agreed that each local entity will establish its own contract with SpryPoint, be invoiced therefrom and make its own payments to SpryPoint in accordance with the terms of the contract established between the new governmental entity and SpryPoint. It is also hereby mutually understood and agreed that Client is not a legally bound party to any contractual agreement made between SpryPoint and any entity other than Customer. 11.14 Amendment. This Agreement may only be amended in writing by authorized representatives of each party. 11.15 Execution in Counterparts: This Agreement may be executed in one or more counterparts. Each counterpart will be an original, but all such counterparts will constitute a single instrument. The City of Santa Maria SpryPoint Services, Inc.
Signature: Signature:
Name: Name: Nick Stone Title: Title: Chief Financial Officer Date Signed: Date Signed:
SpryPoint - Exhibit A - Pricing Schedule - FINAL.docx
45 Queen Street Charlottetown, PE sprypoint.com C1A 4A4, Canada My title Emphasized Subtitle May 4, 2022 Author Exhibit A – Pricing Schedule
SpryPoint - Exhibit A - Pricing Schedule - FINAL.docx
Confidential | Copyright © 2022 SpryPoint Services Inc. All Rights Reserved 1 Statement of Confidentiality The contents of this proposal are confidential and are supplied on the understanding that they will be held confidentially and not disclosed to third parties without the prior written consent of SpryPoint.
SpryPoint - Exhibit A - Pricing Schedule - FINAL.docx
Confidential | Copyright © 2022 SpryPoint Services Inc. All Rights Reserved 2 Table of Contents Statement of Confidentiality ........................................................................................ 1 Table of Contents .......................................................................................................... 2 Introduction .................................................................................................................... 3 SpryPoint SaaS Products and Pricing ......................................................................... 4 SpryPoint SaaS Products ..................................................................................................... 4 SpryCIS - Customer Information System .................................................................................. 4 SpryEngage – Customer Engagement Platform .................................................................... 4 SpryIDM – Interval Data Management ...................................................................................... 5 SpryMobile – Mobile Field Service ............................................................................................ 5 SaaS Pricing Schedule ......................................................................................................... 6 SaaS Software Usage Metrics ..................................................................................................... 6 SaaS Products and Subscription Initial Term .......................................................................... 8 Annual Renewal .............................................................................................................................. 8 Annual Escalation ........................................................................................................................... 8 Initial Implementation Fees ................................................................................................. 9 Billing/Invoicing ..................................................................................................................... 9 Additional Terms ................................................................................................................... 9 Integrated Notification Services: ................................................................................................ 9 SpryPoint - Exhibit A - Pricing Schedule - FINAL.docx
Confidential | Copyright © 2022 SpryPoint Services Inc. All Rights Reserved 3 Introduction This Pricing Schedule is made by and between the Parties identified below on the date indicated as of the execution of the Master Subscription Agreement (“Effective Date”).
SpryPoint Services Inc. City of Santa Maria, CA 45 Queen Street Suite #401 Charlottetown, PE C1A 4A4 110 E. Cook Street Santa Maria, CA, 93454 United States Casey Dowd Director of Sales Xenia Bradford Interim Finance Director 416.737.8451 805.925.0951 [email protected] [email protected] The contents within this document will be governed by the terms and conditions of the Master Agreement between the Parties. This Pricing Schedule is governed by and incorporates the following documents in effect as of the effective date. All documents are listed in order of precedence, and collectively referred to as “The Agreement". Capitalized terms used but not defined herein have the meanings ascribed to them in the Master Agreement. Document 1 Master Subscription Agreement 3 Exhibit A - Pricing Schedule 4 Exhibit B - Service Level Agreement 5 Exhibit C – Security Overview 6 Exhibit D - Insurance Coverage 7 Exhibit E – Data Processing SpryPoint - Exhibit A - Pricing Schedule - FINAL.docx
Confidential | Copyright © 2022 SpryPoint Services Inc. All Rights Reserved 4 SpryPoint SaaS Products and Pricing SpryPoint SaaS Products The business scope of SpryPoint’s software-as-a-service application(s) are defined as follows: SpryCIS - Customer Information System SpryCIS will, at a minimum, provide functions and processes to support customer service and customer account management, meter reading and consumption/usage collection and information, meter equipment/inventory records and location data, other billing related inventory records, field service order requests, rate, fee and tariff storage to be used in mass calculation, billing calculation and production of billing statements, and financial processing to include processing of payments, adjustments, past due collections actions and notifications, unpaid debt processing, and financial reconciliations. Integration as defined within Exhibit A - Implementation Statements of Work and final accepted work product Reporting/Data Access as defined within Exhibit A - Statements of Work and final accepted work product SpryEngage – Customer Engagement Platform SpryEngage will, at a minimum, provide the functions and processes to support Customer Self-Service and Engagement including: Customer Facing • Customer Registration & Login • Mobile Access via responsive web design • Customer Dashboard • Profile Management • Alert Sign-up & delivery • Guest Access • Interactive Consumption Presentation • Bill Display • Electronic Billing • Payment Processing • Electronic Forms Submissions SpryPoint - Exhibit A - Pricing Schedule - FINAL.docx
Confidential | Copyright © 2022 SpryPoint Services Inc. All Rights Reserved 5 Administrative • Administrative Dashboard • Reporting & Analytics • Customer Masquerading SpryIDM – Interval Data Management SpryIDM will at a minimum provide: • Storage and programmatic access to 3 years of interval data. • Access to interval data for meters, service points, and collections of meters. • Ability to standardize and normalize interval data that can be aggregated and analyzed and correlated to other data for presentation of interactive consumption charts of interval data to customers • Ability to automatically send alerts to customers (SMS, Voice, Email) for continuous usage (leaks) or other events. SpryMobile – Mobile Field Service SpryMobile will, at a minimum, provide the functions and processes to support the creation of short cycle work including at a minimum: • Service orders, • Scheduling • Dispatch • Mapping • GIS Layers • MyWork • Notifications • Real-Time Connectivity back to SpryCIS. SpryMobile will provide the ability to accept, process, complete and utilize relevant data from SpryCIS, and allow field users to process updates and notifications in real-time. Integration as defined within Exhibit A - Implementation Statements of Work and final accepted work product Reporting/Data Access as defined within Exhibit A - Implementation Statements of Work and final accepted work product SpryPoint - Exhibit A - Pricing Schedule - FINAL.docx
Confidential | Copyright © 2022 SpryPoint Services Inc. All Rights Reserved 6 SaaS Pricing Schedule The table below provides the details of the SpryPoint Software-as-a-Service products purchased, the usage metrics and amounts, and the annual fees for the initial subscription term. SpryPoint SaaS Application Name/Module Environments Included during implementation* Environments included after go-live* Usage Metric Quantity Subscribed Price per metric Annual Subscription Amount for Initial term SpryCIS – Customer Information System Production (1), Staging (1) Sandbox (1) Production (1) Sandbox (1) Active Accounts 23,000 $3.00 per Active Account in blocks of 500 $65,500
SpryEngage – Customer Engagement Platform Production (1), Staging (1) Production (1) Active Accounts 23,000 $1.00 per Active Account in blocks of 500 $32,775
SpryMobile – Mobile Field Service Production (1), Sandbox (1) Production (1) Full Users Light Users 10 Full Users 10 Light Users $100/per Full users/month $50/per Light user/Month
$17,100
Total Annual Fee $115,375 * Upon mutual agreement between SpryPoint and Client, other environments may be established for specific purposes throughout the implementation (Eg, Test & Train) and will not result in additional cost to Client. If additional dedicated environments are required post go-live there may be additional fees required. SaaS Software Usage Metrics Usage Metric Limitations stated above represent the maximum annual quantity of Usage Metrics over a 12-month period and are for Production Environment only. Client is licensed “up to” the Usage Metric Limitation. Accounts Accounts are defined as "Active Accounts" within the CIS. An account is no longer considered Active when it is ineligible to receive a Statement and is no longer subject to SpryPoint - Exhibit A - Pricing Schedule - FINAL.docx
Confidential | Copyright © 2022 SpryPoint Services Inc. All Rights Reserved 7 ancillary processes such as penalties, collections routines or external communication from SpryCIS. Active accounts are audited based on a variance of +/-500 accounts for the purposes of pricing updates as outlined in the auditing process below. Full Users Full Users are defined as users who can access all SpryMobile’s functionality to create, edit, and share data. Light Users Light Users are defined as users who have read only access to data within SpryMobile. Archived Users Archived Users are defined as user accounts that are no longer active or required. It is the Client’s responsibility to archive users. All records associated with the archived user are maintained within the application for data integrity and activity logging, but archived users are not able to login or access resources within the application. Testable Assembly Testable Assembly is defined as an assembly which is associated with a location and is subject to test notices and test entry submission, regardless of the frequency of notices and entry. Usage Metric Verification Process Client has access to self-service metric usage on demand and within the Service. Client System Administrators can add or remove Accounts and Users as needed. It is the Client’s sole responsibility to archive users in SpryMobile if they are no longer being used. SpryPoint may verify metrics through a quarterly audit and will bill any changes annually. Audit results will be shared with Client. Any use exceeding or decreasing from the usage metrics within scope and defined above will be subject to fee adjustments as indicated above. Fees accrue in the calendar month the excess use began and accordingly fees decrease from the calendar month of decreased use. For example, if in the first subscription year: Annual Subscription Invoicing of 25,000 Active Accounts = $75,000 • Quarter 1 Audit = An average of 24,900 Active Accounts during the quarter = $0.00 increase or decrease.
SpryPoint - Exhibit A - Pricing Schedule - FINAL.docx
Confidential | Copyright © 2022 SpryPoint Services Inc. All Rights Reserved 8 • Quarter 2 Audit indicates an average of 25,300 Active Accounts during the quarter = $1500 increase ($3 per account x block of 500) prorated for the remaining term of the active subscription period (6 months), to be added to the subsequent renewal period. • Quarter 3 Audit indicates an average of 24,443 Active Accounts during the quarter = $1500 decrease ($3 per account x block of 500) prorated for the remaining term of the active subscription period (3 months), to be applied as a credit against the subsequent renewal period. • Quarter 4 Audit indicates an average of 24,900 Active Accounts during the quarter. Next Annual Subscription Invoicing for 25,000 Active Accounts: ($75,000* Renewal Year Escalation Rate of 3%) + (($1500* Previous Year Escalation Rate of 0%) * (2/4)) – (($1500* Previous Year Escalation Rate of 0%) * (1/4)) = $77,625 The average number of active accounts during per quarter is calculated as: (Total Active Accounts during the Quarter/3) SaaS Products and Subscription Initial Term The Initial Term of this agreement shall be for a period of one (1) year. Annual Renewal Unless stated otherwise, the Initial Term and any subsequent renewals will automatically renew for terms of 12 months, unless Client notifies SpryPoint of their intention not to renew. Annual Escalation When the initial term comes to an end, each subsequent renewal will be subject to a pricing adjustment of:
SpryPoint - Exhibit A - Pricing Schedule - FINAL.docx
Confidential | Copyright © 2022 SpryPoint Services Inc. All Rights Reserved 9 a) 4% per year
Initial Implementation Fees The description of the initial Implementation is included within the Cognizant Implementation - Statement of Work (SOW) of the Master Subscription Agreement. All invoicing, fees and payment Milestone schedules associated with the SOW are incorporated within the Cognizant Implementation - Statement of Work (SOW) the Cognizant Implementation - Statement of Work (SOW) Billing/Invoicing Annual SaaS fees are due upon contract execution and will be invoiced in US Dollars at the yearly anniversary each subsequent year including any metric usage updates. Any Statement of Work or Change Order Fees will be billed according to the Payment Schedule determined within the associated Statement of Work. Below is the client contact information for the administration of all audit information, invoicing, and any technical administration: Xenia Bradford Interim Finance Director 206 E. Cook Street [Santa Maria, CA, 93454 [email protected] Additional Terms Integrated Notification Services: The SpryPoint platform includes integrated notification services which can be enabled by Client for the purposes of customer alerts and notifications. SpryPoint's Notification services include: • Inbound & outbound SMS text messaging • Outbound voice messaging • Inbound & outbound email messaging The ongoing usage costs will be invoiced quarterly based on actual usage according to the following table.
SpryPoint - Exhibit A - Pricing Schedule - FINAL.docx
Confidential | Copyright © 2022 SpryPoint Services Inc. All Rights Reserved 10 Service Rate Inbound & Outbound SMS Messaging $0.02 / Message segment Local Outbound Voice Messaging $0.03 per minute Toll-Free Outbound Voice Messaging $0.03 per minute Optional Random Short Code $15,000/year All fees are exclusive of any applicable communications service or telecommunication provider (e.g., carrier) fees or surcharges. Client will pay all communications surcharges associated with your use of the Integrated Notification Services. Communications Surcharges will be shown as a separate line item on an invoice. The character limit for a single SMS message is technically 160 characters. However, most modern phones and networks support message concatenation which means they split large messages into individual SMS messages (called "segments") and then re-create the large message at the receiving end. When Client sends an SMS message containing more than 160 characters, the message will be split into smaller messages for transmission. Large messages are split into 153-character ‘segments’ and sent individually, then re-assembled by the recipient’s device. For example, a 161-character message will be sent as two messages: one with 153 characters and a second with eight characters. SpryPoint will invoice Client for every segment sent.
45 Queen Street Charlottetown, PE C1A 4A4, Canada sprypoint.com
Exhibit B - Service Level Agreement February 2024
SpryPoint Service Level Agreement
Confidential | Copyright © 2022 SpryPoint Solutions Inc. All Rights Reserved 1 1 INTRODUCTION AND OVERVIEW ..................................................................................................... 2 2 DEFINITIONS ...................................................................................................................................... 3 3 SCOPE OF SERVICE/RESPONSIBILITIES ........................................................................................... 4 3.1 ONGOING SUPPORT AND SUBSCRIPTION SERVICES ........................................................................ 4 3.2 BILLABLE SERVICES ...................................................................................................................... 7 3.3 QUOTE PROCESS ......................................................................................................................... 7 3.4 RATE CARD .................................................................................................................................. 8 4 PERFORMANCE MEASUREMENT ...................................................................................................... 8 4.1 SUPPORT LEVEL DEFINITIONS AND RESPONSIBLE PARTIES ............................................................. 8 4.2 ISSUE REPORTING ........................................................................................................................ 9 4.3 ISSUE PRIORITIZATION, DEFINITIONS, RESPONSIBLE PARTIES, AND TARGETS ................................. 10 4.4 TRIAGE ...................................................................................................................................... 12 4.5 RESOLUTION .............................................................................................................................. 12 4.6 SYSTEM MAINTENANCE ............................................................................................................... 12 4.7 DEVICE AND OPERATING SYSTEM SUPPORT ................................................................................. 13 4.8 ISSUE POST-MORTEM PROCESS ................................................................................................... 13 4.9 SUPPORT HOURS ....................................................................................................................... 14 4.10 HOLIDAYS ................................................................................................................................... 14 5 SERVICE LEVEL AGREEMENTS ........................................................................................................ 15 5.1 SERVICE AVAILABILITY ................................................................................................................ 15 5.2 SERVICE CREDITS ....................................................................................................................... 15 6 PERIODIC SERVICE REVIEWS .......................................................................................................... 16 6.1 PERIODIC REVIEW OF OPEN TICKETS AND OUTSTANDING ISSUES .................................................. 16 6.2 PERIODIC REVIEW OF SERVICE LEVEL AGREEMENT PERFORMANCE .............................................. 16 6.3 ESCALATION ............................................................................................................................... 17 7 RELEASE MANAGEMENT ................................................................................................................. 18
SpryPoint Service Level Agreement
Confidential | Copyright © 2022 SpryPoint Solutions Inc. All Rights Reserved 2 Introduction and Overview SpryPoint’s applications are delivered as a service in the cloud. Integrating software development and support is the optimal way to serve customers. SpryPoint’s Customer Success Team works with the product engineers that build, implement, test, and maintain our applications. This Service Agreement defines the general technology as well as the scope of the Ongoing Production Support Services for SpryPoint’s software-as-a-service. At a high level, this includes: ● Application support and maintenance ● Management of updates and enhancements ● Technology infrastructure management ● Backup and recovery ● High availability, disaster recovery, and business continuity ● Database management ● Network configuration and monitoring ● Security ● Operations and service delivery management ● Help desk/support ● Reporting/Performance measurement tools These Services may be supplemented by change requests agreed upon by the parties in writing. This Agreement describes the responsibilities of all parties, the scope, and approach to the delivery of the services specified herein (“the Services”). The transition to the Customer Success team will occur when: ● All severity 1 and 2 issues have been resolved ● All severity 3 issues have a defined plan for resolution ● The Post Go Live Support as defined in the Statement of Work is complete ● A finalized punch-list of any outstanding items has been created and responsibilities assigned. The transition involves: • Formal knowledge transfer between SpryPoint’s Service Delivery and Customer Success Teams • An introductory meeting with the client, SpryPoint’s Project Manager and SpryPoint’s Customer Success Team. This Agreement is specific to SpryPoint’s software-as-a-service applications operating in a production environment as described in the current Pricing Schedule incorporated as part of this Agreement. Any non-production or test environments are expressly excluded from this or any other Service Agreement.
SpryPoint Service Level Agreement
Confidential | Copyright © 2022 SpryPoint Solutions Inc. All Rights Reserved 3 Definitions These terms shall have the following meanings whenever used in this Agreement. “Assist” means the party which may provide input into a task and/or be consulted before a decision or action is performed. “Business Hours” – means 8:00 a.m. – 4:00 p.m. Eastern Time, Monday – Friday (excluding holidays) “Demarcation Point” means the outer most point of connectivity to the Service(s) public or private endpoints such as the data centers, infrastructure, and applications provided by SpryPoint. “Environment” – provides resources and services over the Internet and access through a web browser or client software. • Production Environment – is where the latest version of the SpryPoint application is deployed and available to the intended users. • Staging Environment – an environment, used for testing, that mirrors the production environment as closely as possible. “Impact” – means the influence of an event on the organization or organization’s customers. “Issue” – is a disruption to everyday operations that may or may not have significant consequences. “Lead” means the party with final decision-making authority, accountability, and responsibility for task completion; this party needs to make sure the work gets done. “Outage” means the total minutes the service is unavailable outside the scheduled maintenance window. “Response Time” – means the number of Support Hours in which a member of the SpryPoint team will respond to a new issue. “Resolution Target” – means the number of Business Hours in which an issue should be resolved following the identification of its root cause. “Update Frequency” – means the number of Support Hours in which the SpryPoint team will provide an update to an unresolved issue. “Scheduled Maintenance” means the total minutes of planned maintenance activities per month. Currently, scheduled maintenance is 4 hours for weekly maintenance and 4 hours for monthly maintenance. Maintenance windows are defined further in System Maintenance and are subject to change on 30 days’ notice from SpryPoint. “Severity” – is used to understand the impact of an issue quickly and set priorities for resolution target and is measured by how severely the issue is affecting functionality. “Support Hours” – mean 8:00 a.m. – 8:00 p.m. Eastern Time, Monday – Friday (excluding holidays) “Support Request” – means a request to support the resolution of an issue when further assistance is needed from technical experts. “Tiers” – represents the complexity of the issue reported.
SpryPoint Service Level Agreement
Confidential | Copyright © 2022 SpryPoint Solutions Inc. All Rights Reserved 4 “Total” means the total minutes the service is available less those exceptions listed under Service Availability.
Scope of Service/Responsibilities 1.1 Ongoing Support and Subscription Services Application Support The table below describes the application support functions provided in the service and the responsibility assignment of each item. Item Responsibility SpryPoint Client Provide Tier 1 help desk and application support such as, user password management Assist Lead Attempt to resolve Tier 1 issues using existing knowledge base Assist Lead Maintain and update SpryPoint’s knowledge base and other documentation Lead N/A Make determination to escalate and submit Tier 1 issues to Tier 2 Assist Lead Service Request Management Provide technical and functional troubleshooting for Tier 2 issues Lead Assist Work with Client to determine if an issue is for new system functionality (change) or requires assistance (bug) Lead Assist Provide a web-based system for issue tracking Lead N/A Work with Client to assign proper severity of issue based on definitions Lead Assist Provide issue tracking and reporting Lead N/A Work with client to resolve Tier 2 and Tier 3 issues Lead Assist Monitor, measure, and report on the status of Tier 2 and Tier 3 issues Lead Assist Resolve Tier 2 and Tier 3 issues Lead Assist Provide analysis of recurring issues and establish a resolution or work around for such issues. Lead Assist Work with Client in reporting and resolving unplanned outages of any component or environment. Lead Assist Provide root cause feedback for all Severity Level 1 issues Lead Assist Escalate issues as needed Lead Assist Promptly report outages and service interruptions Lead Assist Application Support Provide application support to the functional process owners Lead Assist Address functional issues and questions involving “how to” raised by end-users Assist Lead Work with departments to leverage software to streamline business processes Assist Lead Assist with system functionality and process flow questions for software and reports Assist Lead Provide functional support for first time processing of critical client business processes Lead Assist Focused functional process support (i.e., end of year processing) Assist Lead Maintain application releases of the current software in the production environment Lead N/A SpryPoint Service Level Agreement
Confidential | Copyright © 2022 SpryPoint Solutions Inc. All Rights Reserved 5 Assist in reporting product issues to software vendor support and obtaining resolution Assist Lead Provide availability management and support Lead N/A Provide maintenance and support for all integrations Lead Assist Provide maintenance and support for all reports Lead Assist Provide maintenance and support for all scheduled jobs Lead Assist Provide functional testing support Assist Lead Deploy required application software Lead N/A Provide post-deployment verification testing of required software Lead Assist Security Administration Provide application security maintenance and administration Lead N/A Conduct user access management and review Assist Lead Maintain and support firewall subsystem software components where applicable (e.g., patches and software upgrades) on Client hardware and software. N/A Lead Monitor virus/security alerts and vulnerabilities from manufacturers and determine appropriate action per procedure. Lead Assist Operational Support The table below describes the operational support functions provided in the service and the responsibility assignment of each item. Item Responsibility SpryPoint Client Hosting Services Provide hosting services Lead N/A Provide for a replicated system architecture Lead N/A Provide disaster recovery services including system and data restoration Lead N/A Conduct periodic testing of the disaster recovery solution Lead N/A High availability and continuity of the service including load balancing to redirect traffic, multi-zone databases, auto-scaling instances based on application and processing load Lead N/A Provide for secure transmission of data being stored and/or archived Lead N/A Provide toll-free support line. Lead N/A Provide hosting services Lead N/A Database Management Perform database administration Lead N/A Perform database monitoring Lead N/A Perform database tuning Lead N/A Perform database security Lead N/A Perform database procedures Lead N/A Perform scheduled maintenance procedures Lead N/A Perform database patching and updates/service packs Lead N/A Communicate patch and update impact analysis Lead N/A Perform database capacity planning Lead N/A Perform database refresh/clones Lead N/A Perform database backup and recovery Lead N/A Perform any data purging or archiving as required. Lead N/A SpryPoint Service Level Agreement
Confidential | Copyright © 2022 SpryPoint Solutions Inc. All Rights Reserved 6 Release Management Assess impacts of new releases to the environment Lead Assist Perform Client-requested periodic refreshes of the non-production environments from the production environment up to twice per calendar month Lead Assist Perform application upgrades Lead Assist Perform maintenance pack installations Lead Assist Perform emergency release updates as needed. Lead Assist Access Management Manage administrative user access to the environments Assist Lead Manage user access at the operating level Assist Lead Manage application users and their access to the various environments Assist Lead Performance Management Monitor system performance Lead N/A Monitor application performance Lead N/A Monitor scheduled job performance Lead Assist Analyze performance related issues to identify factors impacting performance Lead Assist Technology Infrastructure Services The table below describes the technology infrastructure functions provided in the service and the responsibility assignment of each item. Item Responsibility SpryPoint Client Review and resolve technical issues with the system Lead Assist Assist with system debugging and issue resolution Lead Assist Resolve system technical issues with scheduled jobs and reports Lead Assist Answer technical questions for day-to-day maintenance Lead Assist Perform system administration Lead Assist Provide system monitoring and tuning Lead Assist Provide system capacity planning Lead Assist Provide storage capacity planning Lead Assist Provide workload management and support Lead Assist Perform infrastructure maintenance and support Lead Assist Manage the testing of all application and system changes prior to applying to production Lead Assist Perform updates/service packs on application infrastructure Lead N/A Perform system patching and updates/service packs (desktop) N/A Lead Provide change bundling analysis to reduce the frequency and length of time required to apply changes Lead N/A Provide a back-out plan for changes to the various environments Lead N/A Apply code patches for application software Lead N/A Implement minor technology updates Lead N/A Provide system maintenance scheduling and coordination Lead N/A Report system outages and service interruptions Lead Assist SpryPoint Service Level Agreement
Confidential | Copyright © 2022 SpryPoint Solutions Inc. All Rights Reserved 7 Provide infrastructure monitoring and alerting Lead N/A Provide set-up, maintenance, and support for the following environments: Production Lead N/A Staging Lead N/A Sandbox (where applicable) Lead N/A
1.2 Billable Services There will be instances where a client request is beyond the scope of the original contract. Any out-of-scope item is considered an enhancement or a change to the service and should be directed to our Customer Success team through regular support request options. Enhancement requests would include new functionality and features. Change requests would include changes to the services or responsibilities of the service. Examples of billable services that require a quote: ● Requests for new reports ● Requests for changes to current reports ● New configuration/setup ● Rate changes ● Changes to bill print/template ● Changes to forms or letters 1.3 Quote Process The client may request additional services or modifications to the application at any time. All Changes will be documented and approved, regardless of whether there is an associated cost for the change. Requests for changes should be made to SpryPoint’s Customer Success Team. They will review the request and create a quote to include the following: ● A description of the problem that needs to be solved or the issue to be addressed. ● A description of the solution to the problem or issue to be addressed, including the use/business case and/or reason for the Change and suggested solution. ● An estimated delivery time ● If applicable, any fees/cost and expenses associated the Change. The Change process is defined below. The Change must be approved by both SpryPoint and the Client before any work related to a Change is completed. ● Identify the requested Change ● Identify and document the solution and scope of work associated with the Change requested ● Estimate required effort, and any associated costs ● Submit for review and approval by the Client and SpryPoint Management Team ● If not approved, no changes are completed, and the Change request is canceled ● If approved, SpryPoint will work with the client to schedule. ● Monitor and report progress on the Change SpryPoint Service Level Agreement
Confidential | Copyright © 2022 SpryPoint Solutions Inc. All Rights Reserved 8 ● Communicate the Change resolution 1.4 Rate Card Any billable services to the Service beyond go-live will be performed at the then prevailing rate as published by SpryPoint on an annual basis. Any enhancements will be implemented pursuant to the change control process as outlined in the Statement of Work.
Performance Measurement 1.5 Support Level Definitions and Responsible Parties Client agrees to follow escalation procedures and is responsible for Tier 1 support functions before new application or functionality related to SpryPoint services is enabled in production. Client Responsibilities Tier Definition Description/Examples 1 Support performed by Client, who shall be responsible for addressing common user questions and issues ● Provide application navigation tips ● Perform password resets or analyze login issues ● Answer questions regarding basic operation of the application ● Gather information to escalate to Tier 2 support SpryPoint Responsibilities Tier Definition Description/Examples 1 Support performed by Client, who shall be responsible for addressing common user questions and issues Maintain documentation to enable Client to resolve most Tier 1 support issues without requiring escalation to specialized application support. 2 In-depth technical support performed by SpryPoint to address issues outside the scope of Tier 1 issues. SpryPoint’s experienced team are available to: ● Assess issues ● Provide solutions ● Resolve issues Provide Tier 2 support for all SpryPoint applications which includes: ● Advanced technical and system administration responsibilities which may require application log, database access, or other code-related troubleshooting SpryPoint Service Level Agreement
Confidential | Copyright © 2022 SpryPoint Solutions Inc. All Rights Reserved 9 ● Create new features ● Clearly defined points-of-contact, available to receive and appropriately respond to issues from Tier 1 support ● Advice and assistance for the applications and non-programming activities in direct support of users ● Advise Client personnel of estimated time to resolve an issue after root cause diagnosis ● Provide status updates during issue resolution ● Escalate Tier 2 support issues to Tier 3 support at our sole discretion 3 A level of product and service support provided by SpryPoint resources (such as product managers or product team) Provide Tier 3 support for all SpryPoint applications which includes: ● Data fixes ● Code-related troubleshooting ● Bug fixes
1.6 Issue Reporting The Client shall designate one or more power users to request and receive support services from SpryPoint. These users must be trained on the SpryPoint applications for which they initiate support requests. To report an issue, submit a support request by: ● Support widget (must be enabled in-app) ● SpryPoint Helpdesk Portal - support.sprypoint.com ● E-mail – [email protected] ● Phone - 855.TRY.SPRY Issue reporting shall be available twenty-four (24) hours a day, seven (7) days a week, and 365 days a year. Before reporting an issue, Client’s personnel must collect as much of the following information as possible: Criteria Description/Examples Date and Time When did the issue start? Product/Function SpryCIS – Meter Reading General Description Describe the issue you are experiencing as well as the expected results Replication How to replicate the issue Severity Per the severity levels defined in this document Operating System iOS, Android, Windows, MacOS SpryPoint Service Level Agreement
Confidential | Copyright © 2022 SpryPoint Solutions Inc. All Rights Reserved 10 Device iPad, Chromebook, Microsoft Surface, MacBook Browser Chrome, Safari, Edge, Firefox Screenshots Screenshots of the error will help with troubleshooting Support requests are submitted to report issues. Once submitted, Client will receive an automated response indicating the request has been received as well as a ticket number. SpryPoint’s Customer Success Team will address tickets according to the Severity Level. The SpryPoint team will determine the cause of the issue and begin the process for correction and/or remediation. Some possible causes of an issue to be reported are: Bug – an error, flaw, or fault in the application that causes an incorrect or unexpected result or behaviour. Configuration Request – a change or update to the behaviour of an application through a setting in the user interface. New Feature Request – an update to the application to provide new functionality or a new feature. Training Issue/Question – Client does not understand how or why something is behaving the way it is or needs to understand options to change the base behaviour. Performance/Service Issue– generally a high priority, high severity item that includes outages, downtime, and other issues affecting the usability of SpryPoint applications. Additional detail on the ticket submission process may be found in Appendix A. 1.7 Issue Prioritization, Definitions, Responsible Parties, and Targets Severity Level Example Response Target Resolution Target Update Frequency 1 – Urgent Client’s business is not operational due to significant performance issues or outage, creating a substantial impact financially or by the number of customers affected. Critical business function(s) cannot be performed and/or a key component is unavailable or is non-functional. There is no immediate work around. Urgent issues have top priority until resolved Examples of Severity 1 issues includes but are not limited to: ● System is unavailable (outage), 1 hour 4 hours 1 hour
SpryPoint Service Level Agreement
Confidential | Copyright © 2022 SpryPoint Solutions Inc. All Rights Reserved 11 ● Unable to perform a key function such as calculation of bills or billing process, ● A key function is malfunctioning, creating a severe financial/customer impact ● Any event that impacts more than 20% of the customer base. ● Severity Level 1 issues are subject to an Issue Post-mortem by SpryPoint 2 – Critical Client’s business is operational but the ability to perform business functions is severely impacted, A critical business function or functions are partially operational or operating by use of a workaround only sustainable for a short period of time. A critical business function or functions is operating at limited capacity or has a defect which creates errors or atypical results to customer records, transactions, or financials. Examples of Severity 2 issues includes but are not limited to: ● 10%-20% of the customer base are affected by bills which are calculating or rendering incorrectly ● Response times on transactions or screens are 3 times the normal response times (response times must be tracked at go-live for benchmark) ● Processes take 3 times as long to complete or error out (response times must be tracked at go-live for benchmark) 2 hours 16 hours 4 hours
3 – Restricted Use The service is experiencing an issue that can be worked around but is impacting client’s efficient use of the service. The business is operational but with reduced efficiency. Examples of Severity 3 issues includes but are not limited to: ● Single account issue ● Business function has a slight restriction of function of non-critical nature ● A work around is required to maintain normal operations ● Non-performance impacting defect 4 hours 160 hours 40 hours
SpryPoint Service Level Agreement
Confidential | Copyright © 2022 SpryPoint Solutions Inc. All Rights Reserved 12 4 – Not Urgent The service is fully functional but may contain a cosmetic flaw, or misspelling. There is no operational, financial, or customer impact. Examples of Severity 4 issues include, but may not be limited to: ● A button is out of alignment on the user interface ● Question regarding configuration or functionality ● General inquiries 8 hours 200 hours Upon resolution
5 Enhancement request 16 hours As defined in change process noted in the Statement of Work As defined in change process noted in the Statement of Work
1.8 Triage Based on the severity level of the support request, Client can expect a response from the SpryPoint Customer Success Team as indicated in the table above. During this initial contact, the team has several objectives: 1. Confirm and/or clarify our understanding of the support request. Adjust reported severity level if necessary. 2. Document the use case where the issue occurs. 3. Establish a resolution plan and provide an estimated resolution time if possible. 4. If an estimated resolution time cannot be provided during the initial contact, Client will be provided with an estimate on the timeframe. 5. If the support request is Level 5 (enhancement request), Client will be contacted to discuss the use case and scope of the enhancement. An enhancement specification and quotation will be delivered. 6. Resolution 1.9 Resolution Issue Resolution indicates that the issue has been addressed and resolved, pending confirmation from Client’s power user. If for any reason Client is not satisfied with the resolution, Client may request the issue to be re-opened. 1.10 System Maintenance The primary contact for the ongoing maintenance and support of the application is SpryPoint’s Customer Success team. Although rare, SpryPoint may, at its discretion, schedule a system maintenance window, during which time normal production services may not be available.
SpryPoint Service Level Agreement
Confidential | Copyright © 2022 SpryPoint Solutions Inc. All Rights Reserved 13 Planned system maintenance windows are mutually agreed upon with the Client. Whenever possible, SpryPoint will plan Scheduled Maintenance to coincide with Client’s IT system maintenance windows and outside the hours of 8:00 a.m. and 4:00 p.m. Eastern Standard Time. There may be some instances where updates are required immediately or within a short timeframe to maintain the integrity or functionality of SpryPoint applications. In such cases, SpryPoint will notify Client’s designated contact of unplanned system maintenance and work with Client to deploy the necessary changes during the earliest, mutually favorable time. SpryPoint will promptly notify Client’s designated contact of any downtime and provide confirmation once full functionality is restored. In extraordinary circumstances, it may be necessary to take the system offline or otherwise prevent access to applications. This would be the result of an exceptional situation (i.e., a zero-day vulnerability) where SpryPoint would take preventive action to mitigate any potential adverse impact to our clients. 1.11 Device and Operating System Support ● SpryPoint shall use commercially reasonable efforts to identify a root cause and provide technical solutions therein for any reported bugs, defects, issues, etc., provided that the Software or Services are not otherwise impaired at the start of the then-current Service Term and has been properly maintained by Client in accordance with SpryPoint’s policies. SpryPoint is not required to support its applications in the following circumstances: hardware that is no longer supported by its manufacturer. (e.g., iPhone 3G, Samsung Galaxy S Captivate) ● Operating systems or versions of operating systems which are no longer supported or updated by their authors (e.g., Apple, Google, Microsoft, etc.). ● Errors that are a result of product misuse, negligence, or improper utilization of any or all part of the Software or Services. ● Issues that are a result of electrical failure, internet connections problems, and all data issues deemed to be under Client’s exclusive control and responsibility including but not limited to: data input and output are outside the scope of this service level agreement. Maintenance for unsupported operating systems and/or hardware may be available to clients at an additional charge. 1.12 Issue post-mortem process The issue post-mortem process at SpryPoint includes the following: Action Objective Summary of what happened ● Which services and customers were affected? ● How long and severe was the issue? ● Who was involved in the response? ● How was the issue resolved? Root cause analysis ● What were the origins of failure? ● Why do we think this happened? SpryPoint Service Level Agreement
Confidential | Copyright © 2022 SpryPoint Solutions Inc. All Rights Reserved 14 Steps taken to diagnose, assess, and resolve ● What actions were taken? ● Which were effective? ● Which were detrimental? Timeline of significant activity Centralize key activities from monitoring tools, ticket management, issue details as well as internal and external communications. Learning and next steps ● What went well? ● What did not go well? ● How do we prevent this issue from happening again? Summarize findings Circulate summary to affected clients upon request.
1.13 Support Hours SpryPoint business hours are from 8:00 a.m. to 4:00 p.m. Eastern Time, Monday through Friday (excluding holidays). Support is available from 8:00 a.m. - 8:00 p.m., Eastern Time, Monday through Friday (excluding holidays). After-hours, on-call support is available when requested. This provides extra support when migrating, updating, or upgrading integrated line of business applications. After-hours, on-call support rates will be in accordance with the current Rate Card (Section 3.3). 1.14 Holidays Response to requests other than Severity Level 1 may be delayed up to 24 hours during holidays observed by SpryPoint as outlined below: Holiday Date (on or around) New Year’s Day* January 1 Provincial Holiday Third Monday in February Good Friday Late March/Early April Victoria Day Third Monday in May Canada Day* July 1 Civic Holiday First Monday in August Labour Day First Monday in September SpryPoint Service Level Agreement
Confidential | Copyright © 2022 SpryPoint Solutions Inc. All Rights Reserved 15 National Day of Truth and Reconciliation September 30 Thanksgiving (Canadian) Second Monday in October Remembrance Day* November 11 Christmas Day* December 25 Boxing Day* December 26 *If a holiday falls on a weekend, it will be observed the following Monday.
Service Level Agreements Service Level Agreements (SLAs) provide clarity around the commitments to deliver the Service and set expectations for both parties relative to the Client’s business and the impact/role of the Service within the Client’s business. 1.15 Service Availability SpryPoint will use commercially reasonable efforts to make our Services available with an uptime percentage of at least 99.5% within a given calendar month. Exclusions, Exceptions and Limitations This does not apply to any Service performance issues caused by factors; (i) outside of SpryPoint’s reasonable control, including any force majeure event or Internet access or related issues beyond the demarcation point of SpryPoint; (ii) that result from Client’s equipment software or other technology such as metering technology, payment and data processing services, networking technology and/or third-party equipment, software, integration services or other technology (other than third party equipment within our direct control); (iii) that result from any scheduled maintenance as provided for pursuant to this Agreement; or (iv) arising from SpryPoint’s suspension and termination of Customer’s right to use Software. 1.16 Service Credits In the event of a failure by SpryPoint to meet the Service Availability and Issue Resolution Targets as defined in this SLA, as the Client’s sole and exclusive remedy, at Client’s request, SpryPoint will provide Service Credits in accordance with the following: 1. First month of missed service availability or issue resolution target, SpryPoint and Client will meet to discuss possible corrective actions 2. Second consecutive month: 10% of the Subscription Fee paid for the applicable month of the affected SpryPoint application 3. Third consecutive month: 20% of the Subscription Fee paid for the applicable month of the affected SpryPoint application SpryPoint Service Level Agreement
Confidential | Copyright © 2022 SpryPoint Solutions Inc. All Rights Reserved 16
4. Fourth consecutive month: 30% of the Subscription Fee paid for the applicable month of the affected SpryPoint application 5. Fifth consecutive month: 40% of the Subscription Fee paid for the applicable month of the affected SpryPoint application 6. Sixth consecutive month: 50% of the Subscription Fee paid for the applicable month of the affected SpryPoint application 7. More than six consecutive months: Within thirty (30) days of such failure Client shall have the option to terminate the entire Agreement and upon termination Client shall receive a refund of all prepaid subscription fees that are unearned as of the date such termination becomes effective. 8. Service Credits shall be deducted from subsequent invoices for Subscription Fees, or upon the termination or expiration of the Agreement the Service Credits would be paid directly to the Client.
Periodic Service Reviews 1.17 Periodic Review of Open Tickets and Outstanding Issues Such reviews are offered by SpryPoint upon client request and may be held either monthly or quarterly as agreed by both parties. Reviews are led by a member of the SpryPoint Customer Success Team and commonly include: ● Discussion and review of open or recently closed tickets ● Discussion and review of recent or forthcoming product releases 1.18 Periodic Review of Service Level Agreement Performance Such reviews will be held annually (or on a periodic basis as agreed by both parties). Either party may request the review. The review will be led by the Manager of Customer Success and shall include: ● Discussion and resolution of any issues that may arise under an SLA ● Service delivery since last review ● Major deviations from service targets ● Negotiate proposed changes to the SLA ● Resolve concerns about service delivery ● Discuss any staffing changes for SpryPoint or Client The review mechanism shall include an escalation procedure under which any unresolved issues are escalated for immediate resolution. Disagreements shall initially be handled by means of the following escalation provision:
SpryPoint Service Level Agreement
Confidential | Copyright © 2022 SpryPoint Solutions Inc. All Rights Reserved 17
1.19 Escalation In the unlikely event that a customer needs to escalate an issue beyond the Customer Success Analyst in charge, the following is the path of that escalation:
If the Client is unable to get appropriate support from the assigned support analyst or senior support analyst, the client may escalate first to Shelley MacLeod, Manager of Customer Success and then to any Managing Partner at SpryPoint, however Kyle Strang is the Managing Partner responsible for Customer Success-related escalations. Contact information for the Customer Success Management Team: Shelley MacLeod, Manager, Customer Success [email protected] Office: 902.510.1770 Mobile: 902.213.0950 Kyle Strang, Managing Partner [email protected] Office: 617.939.9016 Mobile: 902.476.7930
SpryPoint Service Level Agreement
Confidential | Copyright © 2022 SpryPoint Solutions Inc. All Rights Reserved 18 Release Management We provide application releases on a two-week interval. The Customer Success Team works with the Product Management team to create and distribute Release Notes to our clients. Our releases typically include new features and functionality as well as bug fixes. Product Releases: ● Release Notes are sent to the primary contacts in the organization. However, anyone can be added to the distribution list. ● Release Notes will be provided before deployment to your production environment. ● Releases are deployed after standard business hours and live in the system the next business day. ● New features and functions are disabled by default when deployed. ● Customer Success is available to assist your team in determining if enabling a new feature is right for your organization.
Insurance ExhibitSpryPoint - Exhibit C - Insurance Coverage.docx 45 Queen Street Charlottetown, PE sprypoint.com C1A 4A4, Canada My title Emphasized Subtitle May 4, 2022 Author Exhibit C – Insurance Coverage
Insurance ExhibitSpryPoint - Exhibit C - Insurance Coverage.docx Confidential | Copyright © 2022 SpryPoint Services Inc. All Rights Reserved 1 SpryPoint will maintain during the entire Term of this Agreement, at its own expense, the insurance coverage below which meets or exceeds the coverages and limits as specified in the Client’s RFP. The policies shall include an endorsement naming Client as an additional insured with respect to the provision of services provided under this agreement. Insurance coverage for this agreement will be at a minimum as follows: 1. COMMERCIAL GENERAL LIABILITY INSURANCE SpryPoint shall maintain Commercial General Liability Insurance covering all operations by or on behalf of SpryPoint on a per occurrence basis against claims for personal injury and property damage. Policy limits are subject to review, but shall in no event be less than, the following: $3,000,000 Each Occurrence $6,000,000 General Aggregate $3,000,000 Personal and Advertising Injury $2,000,000 Products/Completed Operations Aggregate $2,000,000 Non-Owned Automobile Coverage Includes: (a) Separation of Insureds, Cross Liability (b) Contractual Liability (c) Products-completed Operations (d) Contingent Employer's Liability 2. COMMERCIAL AUTOMOBILE LIABILITY INSURANCE SpryPoint shall maintain Commercial Automobile Liability Insurance covering liability arising out of the operation of any vehicle (including owned, non-owned and hired vehicles). $2,000,000 Each Occurrence $2,000,000 Annual Aggregate 3. ERRORS AND OMISSIONS AND CYBER INSURANCE SpryPoint shall maintain Errors and Omissions and Cyber Insurance covering liability third party claims and losses with respect to network risks (such as data breaches, transmission of virus/malicious code; unauthorized access or criminal use of third party, ID/data theft) and invasion of privacy regardless of the type of media involved in the loss of private information. $3,000,000 Per Claim SpryPoint - Exhibit C - Insurance Coverage.docx
Confidential | Copyright © 2022 SpryPoint Services Inc. All Rights Reserved 2
4. WORKERS’ COMPENSATION SpryPoint shall maintain Workers Compensation Insurance through the Workers Compensation Board of Prince Edward Island (WCBPEI). The Workers Compensation Board (WCBPEI) is a Provincial Government Organization that is responsible for all Workers Compensation related incidents for employees of companies based on Prince Edward Island. As an employer based in Prince Edward Island, SpryPoint is legally required to maintain Workers Compensation insurance through WCBPEI. If there is a workplace incident related to SpryPoint employees, coverage is provided by the WCBPEI regardless of the location. SpryPoint will provide Client with a copy of the Workers Compensation Clearance letter issued by WCBPEI which confirms SpryPoint’s coverage and that our account is in good standing. 5. ADDITIONAL INSURANCE RELATED PROVISIONS 6.1 SUBCONTRACTORS. SpryPoint agrees to ensure that subcontractors, and any other party involved with the Services who is brought onto or involved in the performance of the Services by SpryPoint, provide the same minimum insurance coverage required of SpryPoint, except as with respect to limits. SpryPoint agrees to monitor and review all such coverage and assumes all responsibility for ensuring that such coverage is provided in conformity with the requirements of this Agreement. SpryPoint agrees that upon request by Client, all agreements with, and insurance compliance documents provided by, such subcontractors and others engaged in the project will be submitted to Client for review. 6.2 EVIDENCE OF COVERAGE. Prior to commencement of any Services under this Agreement, SpryPoint, and each and every subcontractor shall, at its sole cost and expense, provide and maintain not less than the minimum insurance coverage as indicated in this Agreement. Such insurance coverage shall be maintained with insurers, and under forms of policies, satisfactory to the Client and as described in this Agreement. SpryPoint shall file with the Client all certificates and endorsements for the required insurance policies for Client’s approval as to adequacy of the insurance protection. 6.3 TERMINATION. All policies shall contain an endorsement providing that written notice be given to the Client at least thirty (30) calendar days prior to termination, cancellation or reduction in coverage policy. Insurance policies shall remain in force until all work has been completed. If a policy does expire during the life of the Contract, a renewal certificate of the required coverage will be sent to the Client not less than ten (10) workdays prior to expiration date. SpryPoint will maintain during the entire Term of this Agreement, at its own expense, the insurance coverage below which meets or exceeds the coverages and limits as specified in the Client’s RFP. The policies shall include an endorsement naming Client as an SpryPoint - Exhibit C - Insurance Coverage.docx
Confidential | Copyright © 2022 SpryPoint Services Inc. All Rights Reserved 3 additional insured with respect to the provision of services provided under this agreement. Insurance coverage for this agreement will be at a minimum as follows:
Exhibit D – Security Overview
Confidential | Copyright © 2022 SpryPoint Services Inc. All Rights Reserved 1 Table of Contents 1. Overview 2 2. Personnel 2 2.1. Personnel Overview 2 2.2. Security Awareness & Training 2 2.3. End User Devices 3 2.4. Access Control 3 2.5. Physical Security 4 2.6. Monitoring 4 2.7. Control Assessments 4 3. Data Integrity & Privacy 4 3.1. Data 4 3.2. Personally Identifiable Information (PII) 5 3.3. Secure Disposal 5 4. Secure Application & Infrastructure Development 5 4.1. Least Privilege 5 4.2. Peer Code Reviews 5 4.3. Vulnerability Management 5 4.4. Configuration Management 5 4.5. Incident Response Procedures 5 4.6. Contingency Planning 6 Exhibit E – Security Overview
2 Confidential | Copyright © 2022 SpryPoint Services Inc. All Rights Reserved
1. Overview This security document (“Exhibit”) details the security policy, procedures, and technologies used to protect client data. This document applies to SpryPoint’s production software-as-a-service (SaaS) offering (“The Service”), client data stored in the service, and work performed by SpryPoint implementing, maintaining, and supporting the service. SpryPoint has established a comprehensive Written Information Security Program ("WISP") which includes defining, documenting, and supporting the implementation and maintenance of the administrative, technical, and physical safeguards the firm has selected to protect the information it collects, creates, uses, and maintains. This program uses both technologies and business policies to ● Ensure the confidentiality of client’s data from any unauthorized parties; ● Protect the integrity of data; and ● Maintain availability of the service by using scalable hosting with fault tolerance. SpryPoint’s security program is based on the NIST SP 800-53 standard and the concepts of Zero Trust. The program may evolve over time as the standard is revised. These evolutions will never degrade the strength of the program. 2. Personnel 2.1. Personnel Overview 2.1.1. All SpryPoint employees are subject to background screening prior to being employed, and employment agreements cover confidentiality, non-disclosure, and other key protections. 2.1.2. SpryPoint has a dedicated information security officer who is responsible for managing and continuously improving SpryPoint’s security posture. The information security officer can be reached at [email protected]. 2.2. Security Awareness & Training 2.2.1. Employees receive security awareness training during their onboarding, and SpryPoint employees are subject to mandatory ongoing cybersecurity and phish awareness training on a regular basis. All employees are encouraged to attend security conferences where practicable.
Exhibit E – Security Overview
3 Confidential | Copyright © 2022 SpryPoint Services Inc. All Rights Reserved
2.2.2. Employees must read and adhere to the Information Security Policies and must re-certify each year. 2.3. End User Devices Employees agree to the Asset Management Policy with regards to acceptable use. All end user devices provisioned by SpryPoint are hardened and equipped with: ● Mobile Device Management (MDM) software. ● Full Disk Encryption. ● Anti-Malware Software. ● Strong Password policies. ● Secure Password Vault. 2.4. Access Control 2.4.1. To ensure only authenticated users access data they are authorized to access, SpryPoint maintains policies and procedures regarding the following areas: ● Access Control Policy ● Business Continuity and Disaster Recovery Plan ● Cryptography Policy ● Human Resources Security Policy ● Information Security Policy ● Operations Security Policy ● Risk Management Policy ● Third-Party Management Policy ● Asset Management Policy ● Code of Conduct ● Data Management Policy ● Incident Response Plan ● Information Security RACI ● Physical Security Policy ● Secure Development Policy 2.4.2. User accounts on SpryPoint’s Services use role-based security to enable least privilege authorization. Passwords on the service are protected by industry best practices, using industry-standard encryption algorithms. Access to systems can be configured to use Single-Sign-On identity providers such as Azure Active Directory, Okta, or other identity providers.
Exhibit E – Security Overview
4 Confidential | Copyright © 2022 SpryPoint Services Inc. All Rights Reserved
2.4.3. Where possible, services are whitelisted to specific IP ranges rather than the open internet. SpryPoint staff use VPN services to connect to SpryPoint services where appropriate. 2.4.4. Policies cover data classification and protection of classified and restricted data. 2.5. Physical Security The SpryPoint office is alarmed with unique codes per employee, and is protected via electronic key cards & fobs. The SpryPoint office does not provide physical access to production systems from inside the office. 2.6. Monitoring 2.6.1. SpryPoint collects application and infrastructure logs to validate service uptime and operational status, to assist with troubleshooting system issues, and to protect and secure our networks and Client Data. Events are maintained for a period of at least one year. 2.6.2. Logs may include login ID, timestamps, login authorization granted or denied, number of denied login attempts, system load data such as CPU% and free memory, data changes within the system, or other relevant information and activity. 2.7. Control Assessments SpryPoint maintains a documented risk management program that includes an annual risk assessment. 3. Data Integrity & Privacy 3.1. Data 3.1.1. The Service is provided through secure data centers operated by an ISO 27017:2015 certified third party. 3.1.2. Data is encrypted at rest and in transit. 3.1.3. Data backups are performed daily, and tests to restore the data are run regularly 3.1.4. Questions regarding data privacy may be directed to [email protected].
Exhibit E – Security Overview
5 Confidential | Copyright © 2022 SpryPoint Services Inc. All Rights Reserved
3.2. Personally Identifiable Information (PII) Confidential PII is compartmentalized and encrypted with unique record-level keys and an additional level of encryption. 3.3. Secure Disposal SpryPoint policies mandate secure disposal or destruction of personal information, whether in paper or electronic form, when it is no longer to be retained in accordance with applicable laws or defined policies. 4. Secure Application & Infrastructure Development 4.1. Least Privilege Only authorized Personnel with a specific business purpose are allowed access to production and development environments and/or resources. 4.2. Peer Code Reviews All code changes require a code review before allowing a merge. 4.3. Vulnerability Management 4.3.1. SpryPoint uses automated tools to check for vulnerabilities in the software and any framework dependencies. 4.3.2. Vulnerabilities are triaged and remediation timelines are managed as per a Service Level Agreement. 4.4. Configuration Management 4.4.1. SpryPoint has embraced infrastructure as code to ensure repeatability, and to streamline the application of security patches and updates. Deployment is managed via a CI/CD pipeline. 4.4.2. Infrastructure changes are documented and scheduled and contain approval chains and rollback plans. 4.5. Incident Response Procedures SpryPoint's incident response policy includes well-defined procedures to be followed in the event of a breach or threat of any application or system associated with the accessing, processing or storage of data.
Exhibit E – Security Overview
6 Confidential | Copyright © 2022 SpryPoint Services Inc. All Rights Reserved
4.6. Contingency Planning SpryPoint has a program to test and improve disaster recovery run books and business continuity plans. The security and DevOps teams perform BC/DR testing, conduct simulations, and request feedback to improve the plan.
Exhibit E SpryPoint Data Processing Exhibit This Data Processing Exhibit (“DPE”) forms a part of and is subject to the SpryPoint Master Subscription Agreement (“Agreement”), applicable Pricing Schedule or Statement of Work or other written subscription agreement (together with any attachments issued thereunder, the “Agreement”) between SpryPoint Services Inc. (“SpryPoint”) and the Party identified as the “Client” in the Agreement, where Client is using SpryPoint’s Software and Services. This DPE reflects the Parties’ agreement with regards to the applicable Privacy/Data Protection Laws and governs the data processing related obligations of SpryPoint and Client for any applicable Subscription or Statement of Work involving the processing of Client’s Personal Information. In the event of any inconsistency or conflict between this DPE and the Agreement, the terms and conditions of the DPE shall prevail. In delivering the Software or Services under the Agreement, SpryPoint may Process Personal Information/ Personal Data as a Data Processor on behalf of Client, which is the data controller. It is hereby agreed as follows: Definitions Unless otherwise defined below, all capitalized terms have the meaning given to them in the applicable Agreement and/or exhibits thereto. “Covered Data” means (i) Client Data, (ii) Technical Services Data, and (iii) any other electronic data or information submitted by or on behalf of Client to a Covered Service. “Covered Service” means (i) any Service provided that specifically refers to this DPE, and/or, (ii) any Technical Services. “Data Controller” means the entity which, alone or jointly with others, determines the purposes and means of the Processing of Personal Data. “Data Processor” means the entity which Processes Personal Data on behalf of the Data Controller. “Data Protection Laws” means all data protection laws applicable to the Processing of Personal Data under this DPE, including local, state, national and/or foreign laws, treaties, and/or regulations. “Data Subject” means the person to whom the Personal Data relates. “Personal Data” means any Covered Data that relates to an identified or identifiable natural person. “Personal Data Breach” means (i) a ‘personal data breach’ or (ii) any Security Breach affecting Personal Data. “Processing” or “Process” means any operation or set of operations performed on Personal Data or sets of Personal Data, such as collecting, recording, organizing, structuring, storing, adapting or altering, retrieving, consulting, using, disclosing by transmission, disseminating or otherwise making available, aligning or combining, restricting, erasing or destroying. “Subprocessor” means a SpryPoint Affiliate or third-party entity engaged by SpryPoint or a SpryPoint Affiliate as a Data Processor under this DPE. “Subprocessor List” means the subprocessor list identifying the Subprocessors that are authorized to Process Personal Data for the relevant Covered Service. 1. Subject and Scope 1.1. Scope and Role of the Parties. This DPE applies to the Processing of Personal Data by SpryPoint to provide the Covered Service. For the purposes of this DPE, Client and its Affiliates are the Data Controller(s) and SpryPoint is the Data Processor. SpryPoint shall Process Personal Information/ Personal Data under the Agreement(s) only as a processor acting on behalf of Client where Client is the Data Controller, SpryPoint agrees that it will Process Personal Information/ Personal Data for the sole purpose of providing the Services as described in the Agreement(s). 1.2. Purpose. Client discloses Personal Information/ Personal Data to SpryPoint solely for: (i) a valid business purpose; and (ii) SpryPoint to perform the Services. 1.3. Instructions for Processing. SpryPoint shall Process Personal Data in accordance with Client’s documented instructions. Client instructs SpryPoint to Process Personal Data to provide the Covered Service in accordance with the Agreement (including this DPE). Client may provide additional instructions to SpryPoint to Process Personal Data, however SpryPoint shall be obligated to perform such additional instructions only if they are consistent with the terms and scope of the Agreement and this DPE. 1.4. Prohibitions. SpryPoint is prohibited from: (i) selling Personal Information/ Personal Data; (ii) retaining, using, or disclosing Personal Information/ Personal Data for a commercial purpose other than providing the Services; and (iii) retaining, using, or disclosing the Personal Information/ Personal Data outside of the Agreement between SpryPoint and Client. 1.5. Warranty. Client warrants and represents that it is and will at all relevant times remain duly and effectively authorized to give such instruction. 1.6. Sole Responsibility. Client is solely responsible for obtaining all necessary consents, licenses and approvals for the collection and Processing of any Personal Information/ Personal Data. 1.7. Compliance with Laws. SpryPoint shall comply with all Data Protection Laws applicable to SpryPoint in its role as a Data Processor Processing Personal Data. For the avoidance of doubt, SpryPoint is not responsible for complying with Data Protection Laws applicable to Client or Client’s industry such as those not generally applicable to online service providers.
Client shall comply with all Data Protection Laws applicable to Client as a Data Controller and shall obtain all necessary consents, and provide all necessary notifications, to Data Subjects to enable SpryPoint to carry out lawfully the Processing contemplated by this DPE. 2. Technical, Organizational Measures and Security 2.1. Security Measures. SpryPoint implements and maintains appropriate technical and organizational measures to ensure a level of security appropriate to the risk. The parties agree that the security measures are appropriate to protect Personal Information/ Personal Data against a Personal Information/ Personal Data Security Incident, and that these measures ensure a level of security appropriate to the risks presented by the Processing and the nature of the Personal Information/ Personal Data to be protected having regard to the state of the art and the cost of their implementation and the nature, scope, context and purposes of Processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons. 2.2. Confidentiality. SpryPoint shall ensure that any person authorized to Process the Personal Information/ Personal Data is subject to a strict duty of confidentiality and that they Process the Personal Information/ Personal Data only for the purpose of delivering the Services under the Agreement to Client. 2.3. SOC 2 Compliance. Upon request, SpryPoint can provide Client with a copy of its SOC 2 Type I report which attests to the controls at a service organization. SpryPoint is currently undergoing an audit for SOC 2 Type II Compliance. Upon successful completion, at a minimum, SpryPoint agrees to maintain SOC2 Type 2 compliance. SpryPoint may modify its Security Measures from time to time and at any time, provided, however, that it will not materially reduce the level of protection as provided in this DPE. 2.4. Processing Terms. At all times that SpryPoint Processes, and/or has access to Personal Information/ Personal Data, SpryPoint shall (a) Process such Personal Information/ Personal Data only in accordance with Client’s documented instructions (b) not Sell (as defined under CCPA) Personal Information/ Personal Data, or retain, use, or disclose such Personal Information/ Personal Data (i) for any purpose other than for the specific purpose of performing the Services or (ii) outside the direct business relationship between Client and SpryPoint. 2.5. Acknowledgement. Acknowledging that Client (and not SpryPoint): (i) controls the nature and contents of Client Data (including any Personal Information/ Personal Data therein); and (ii) acts as its own system administrator and controls user access to Client Data (including any Personal Information/ Personal Data therein), Client represents and warrants that on the date of this DPE and during the Term: 2.5.1. Personal Information/ Personal Data has been and will be collected and Processed by Client in accordance with applicable Privacy/Data Protection Laws;
2.5.2. Client will take all steps necessary to ensure it achieves the foregoing, including without limitation, by providing Data Subjects with appropriate privacy notices, obtaining any required consent, and ensuring that there is a lawful basis for Contracted Processors to Process Personal Information/ Personal Data. 3. Subprocessors 3.1. Use of Subprocessors. Client hereby agrees and provides a general prior authorization that SpryPoint and SpryPoint Affiliates may engage Subprocessors. SpryPoint or the relevant SpryPoint Affiliate engaging a Subprocessor shall ensure that such Subprocessor has entered into a written agreement that is no less protective than this DPE. SpryPoint shall be liable for the acts and omissions of any Subprocessors to the same extent as if the acts or omissions were performed by SpryPoint. 3.2. Notification of New Subprocessors. SpryPoint shall make available to Client a Subprocessor List and provide Client with a mechanism to obtain notice of any updates to the Subprocessor List. At least thirty (30) days prior to authorizing any new Subprocessor to Process Personal Data, SpryPoint shall provide notice to Client by updating the Subprocessor List. 3.3. Approved SpryPoint’s Sub-Processors Sub-Processor Country Website Service Provided Amazon Web Services United States aws.amazon.com Cloud Infrastructure Freshdesk United States www.freshworks.com Customer Service Heroku United States www.heroku.com Cloud Infrasturcture Twilio United States www.twilio.com SMS Delivery Iservice Twilio Sendgrid United States www.twilio.com/sendgrid/email-api Email Delivery Service Solarwinds Papertrail United States www.papertrail.com Log Management Service Raygun United States www.raygun.com Application Management Service 4. Rights of Data Subjects 4.1. Assistance with Data Subject Requests. SpryPoint will, in a manner consistent with the functionality of the Covered Service and SpryPoint’s role as a Data Processor, provide reasonable support to Client to enable Client to respond to Data Subject requests to exercise their rights under applicable Data Protection Laws (“Data Subject Requests”).
4.2. Handling of Data Subject Requests. For the avoidance of doubt, Client is responsible for responding to Data Subject Requests. If SpryPoint receives a Data Subject Request or other complaint from a Data Subject regarding the Processing of Personal Data, SpryPoint will promptly forward such request or complaint to Client, provided the Data Subject has given sufficient information for SpryPoint to identify Client.
5. Cooperation To the extent SpryPoint is required under Privacy/Data Protection Laws, SpryPoint will assist Client to comply with Privacy/Data Protection Laws; in particular (i) SpryPoint will assist Client in responding to any request from a data subject exercising his or her rights under the Privacy/Data Protection Laws; (ii) it will assist Client in responding to any request from regulatory or judicial bodies relating to the Processing of Personal Information/ Personal Data under the Agreement(s); (iii) it will promptly notify Client if its Processing of Personal Information/ Personal Data is likely to result in a high risk to the privacy rights of data subjects or is unable to comply with Client’s instructions for any reason, (iv) and upon reasonable request, will assist Client to carry out data protection impact assessments. 6. SpryPoint Personnel SpryPoint shall require screening of its personnel who may have access to Personal Data and shall require such personnel (i) to Process Personal Data in accordance with Client’s instructions as set forth in this DPE, (ii) to receive appropriate training on their responsibilities regarding the handling and safeguarding of Personal Data; and (iii) to be subject to confidentiality obligations which shall survive the termination of employment. 7. Personal Data Breach In the event SpryPoint becomes aware of a Personal Data Breach it shall without undue delay notify Client in accordance with the Security Breach provisions of the Master Subscription Agreement. To the extent Client requires additional information from SpryPoint to meet its Personal Data Breach notification obligations under applicable Data Protection Laws, SpryPoint shall provide reasonable assistance to provide such information to Client taking into account the nature of Processing and the information available to SpryPoint. 8. Security Program SpryPoint shall implement appropriate technical and organizational measures designed to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data as set forth in the Security Exhibit. If SpryPoint becomes aware of a security incident or has a reasonable suspicion of a Personal Information/ Personal Data breach in respect of the Personal Information/ Personal Data being Processed under the Agreement(s), it will inform Client without undue delay and will provide reasonable information and cooperation to Client so that Client can fulfill any Personal Information/ Personal Data Security Incident reporting obligations it may have under the applicable Privacy/Data Protection Laws. SpryPoint will take reasonably necessary measures to remedy and mitigate the effects of the Security Incident as set forth in the Security Exhibit.
9. Audit SpryPoint completed SOC2 Type I in 2022. SpryPoint will use external auditors to verify the adequacy of its security measures and controls for the Software and Services provided under the Agreement. The resulting audit will: (i) be performed according to AICPA SOC2 standards or such other alternative standards that are substantially equivalent to AICPA SOC2; (ii) be performed by independent third-party security professionals at SpryPoint’s selection and expense; and (iii) result in the generation of a SOC 2 Type II report (“Audit Report”), which will be SpryPoint’s Confidential Information. The Audit Report can be made available to Client upon written request no more than annually subject to the confidentiality obligations of the Agreement or a mutually agreed non-disclosure agreement covering the Audit Report. For the avoidance of doubt, each Audit Report will only discuss Software and Services in existence at the time the Audit Report was issued. Client agrees that, to the extent applicable, SpryPoint’s then-current SOC 2 audit reports will be used to satisfy any audit or inspection requests by or on behalf of Client. In the event that Client, a regulator, or supervisory authority requires additional information, including information necessary to demonstrate compliance with this DPE, or an audit related to the Covered Service, SpryPoint will (i) make available to Client on request all information necessary to demonstrate compliance with this DPE, and (ii) allow for and contribute to audits, including inspections, by an auditor mandated by Client in relation to the Processing of the Personal Information/ Personal Data by SpryPoint. 10. Return and Deletion of Client Data and Personal Data Upon written request by Client made prior to or upon any expiration or termination of this Agreement, SpryPoint will make Client Data available to Client through the Service solely to allow Client to retrieve Client Data for a period of up to a total of sixty (60) days after such expiration or termination (the “Retrieval Period”). After such Retrieval Period, SpryPoint will have no obligation to maintain or provide any Client Data and shall thereafter, unless legally prohibited, delete all Client Data by deleting Client’s Tenant. provided, however, that SpryPoint will not be required to remove copies of the Client Data from its backup media and servers until such time as the backup copies are scheduled to be deleted, provided further that in all cases SpryPoint will continue to protect the Client Data in accordance with this Agreement. Client Data will be made available in a SpryPoint-supported format mutually agreed upon between the parties (for example, CSV, delimited text or Microsoft Excel). The foregoing deletion obligation will be subject to any retention obligations imposed on SpryPoint by Law. Additionally, during the Term of the Agreement, Clients may extract Client Data using SpryPoint’s standard web services. Upon termination of the Covered Service, SpryPoint shall return and delete Personal Data in accordance with the relevant provisions of the Agreement. 11. General Provisions 11.1. Client Affiliates. Client is responsible for coordinating all communication with SpryPoint on behalf of its Affiliates with regard to this DPE. Client represents that it is authorized to issue instructions as well as make and receive any communications or notifications in relation to this DPE on behalf of its Affiliates.
11.2. Termination. The term of this DPE will end simultaneously and automatically at the later of (i) the termination of the Agreement or, (ii) when all Personal Data is deleted from SpryPoint’s systems. 11.3. Conflict. This DPE is subject to the non-conflicting terms of the Agreement. With regard to the subject matter of this DPE, in the event of inconsistencies between the provisions of this DPE and the Agreement, the provisions of this DPE shall prevail with regard to the parties’ data protection obligations. 11.4. Client Affiliate Enforcement. Client’s Affiliates may enforce the terms of this DPE directly against SpryPoint, subject to the following provisions: 11.4.1. Client will bring any legal action, suit, claim or proceeding which that Affiliate would otherwise have if it were a party to the Agreement (each an “Affiliate Claim”) directly against SpryPoint on behalf of such Affiliate, except where the Data Protection Laws to which the relevant Affiliate is subject require that the Affiliate itself bring or be party to such Affiliate Claim; and 11.4.2. for the purpose of any Affiliate Claim brought directly against SpryPoint by Client on behalf of such Affiliate in accordance with this Section, any losses suffered by the relevant Affiliate may be deemed to be losses suffered by Client. 11.5. Remedies. Client’s remedies (including those of its Affiliates) with respect to any breach by SpryPoint or its Affiliates of the terms of this DPE and the overall aggregate liability of SpryPoint and its Affiliates arising out of, or in connection with the Agreement (including this DPE) will be subject to any aggregate limitation of liability that has been agreed between the parties under the Agreement (the “Liability Cap”). For the avoidance of doubt, the parties intend and agree that the overall aggregate liability of SpryPoint and its Affiliates arising out of, or in connection with the Agreement (including this DPE) shall in no event exceed the Liability Cap. 11.6. Miscellaneous. The section headings contained in this DPE are for reference purposes only and shall not in any way affect the meaning or interpretation of this DPE.