Contract No. 10599 (CCS)
FIRST MODIFICATION TO CONTRACTUALSERVICES AGREEMENT
This First Modification to Contractual Services Agreement ("First Modification"), en:
tered into as of k cuvd:x,r 2, I _, 20 / 1-, by and between the City of Santa Monica, a municipal corporation ("City") (Customer ID: 57111), and PAYMENT EXPRESS INC. (PX) is made with reference to the following:
RECITALS
A. On or about September 13, 2017, the City and PAYMENT EXPRESS INC. (PX) entered into Contractual Services Agreement, Contract Number 4387, for credit card processing services within the Parking Access and Revenue Control System in the City of Santa Monica ("Original Agreement").
B. The City and PAYMENT EXPRESS INC. (PX) desire to modify the Original Agreement to extend the contract term; include additional services to be performed by PAYMENT EXPRESS INC. (PX); and to increase the contract price to pay for those additional services.
TERMS AND CONDITIONS
Now, therefore, the undersigned parties do hereby mutually agree to modify the Original Agreement as follows:
1. Section 1 of the Original Agreement entitled "Term" shall be deleted in its entirety and replaced with the following paragraph:
Term. This Agreement begins on the Execution Date and terminates on December 31, 2023, unless terminated earlier as set forth in the Original Agreement or extended by the parties in writing.
I.I Two (2) Additional One-Year Options. The City in its sole and absolute discretion has the right and option to extend the Agreement for two (2) additional one-year options under the same terms and conditions as set forth herein. The City shall notify PAYMENT EXPRESS INC. (PX) of its intention to exercise each of the one-year options ("Option Notice") at least 90 days prior to the expiration of this Agreement and at least 90 days prior to the expiration of the first option year, assuming that first option is exercised. Notwithstanding the foregoing, nothing herein shall limit the ability of either party to terminate this Agreement pursuant to Section 14 of this Agreement.
2. Section 2 of the Original Agreement shall be deleted in its entirety and replaced with the following paragraph:
1 December 2017
PAYMENT EXPRESS, INC. (PX) will perform all of the services ("Services") described in Exhibit Al, Scope of Services. PAYMENT EXPRESS, INC. (PX) will complete the Services in accordance with Exhibit B, Budget, through December 31, 2017. After December 31, 2017, PAYMENT EXPRESS, INC. (PX) will complete the Services in accordance with Exhibit B-1, Budget.
3. Section 4 of the Original Agreement entitled "Compensation" shall be modified by adding the following paragraph:
Compensation. The City will compensate PAYMENT EXPRESS INC. (PX) for the Additional Services described in Exhibit A 1 in an amount not to exceed ONE MILLION AND FIFTY THOUSAND DOLIARS
AND NO CENTS ($1,050,000), as set forth in Exhibit B-1. The total contract price for services pursuant to the Original Agreement and this First Modification shall not exceed ONE MILLION AND SEVENTY THOUSAND DOLLARS AND NO CENTS ($1,070,000).
4. The following Section 26 entitled "Compliance with Data Security Requirements" shall be added to the Original Agreement, as follows:
26.1. Requirements. Without limiting or reducing the scope of PAYMENT EXPRESS INC. (PX) warranty obligations to the City pursuant to Section 7 .1 of Exhibit D of the Original Agreement, PAYMENT EXPRESS INC. (PX) warrants and represents that the Services, as delivered by PAYMENT EXPRESS INC. (PX) to the City, shall comply with all applicable (i) Laws regarding consumer protection and security of personally identifiable information (collectively, the "Data Security Laws") including, without limitation, the Fair and Accurate Credit Transactions Act of 2003 ("FACT A"), and (ii) standards regarding the storing, processing and/ or transmitting of payment and cardholder data, or impacting the security of the cardholder data environment (collectively, the 'Data Security Standards") including, without limitation, mandatory standards such as the Data Security Standard (the "PCI-DSS"), the PIN Transaction Security (the "PCI-PTS") requirements and the Point-to-Point Encryption ("PCI-P2PE") solutions. The Data Security Laws and Data Security Standards are collectively referred to as the "Data Security Requirements" as they currently exist or may be updated from time to time during the term of this Agreement. PAYMENT EXPRESS INC. (PX) shall upon written request provide applicable PCI compliance certifications, the current expiration date for the Solution. PAYMENT EXPRESS INC. (PX) shall use reasonable endeavors to com2 December 2017 ply with the Data Security Requirements in effect as of the date that the Equipment and Software are delivered to the City and provide a secure environment for all data in its possession or processed by the Solution.
26.2. Data Ownership. All customer, vehicle, transaction and cardholder data collected or processed by and all new datasets and databases created, updated and analyzed through the Services, regardless of where the Services is hosted, is and shall at all times remain the sole and exclusive property of the City. For at least thirty (30) days following expiration or termination of this Agreement, PAYMENT EXPRESS INC. (PX) shall make available to the City for download a file of all such data in comma-separated values (.csv) format along with attachments in their native format. PAYMENT EXPRESS INC. (PX) is not permitted to use any such data for any purpose except as necessary to provide and operate the Solution for the City under this Agreement.
PAYMENT EXPRESS INC. (PX) shall not use such data for its own purposes or disclose, share, sell or license it to third parties. PAYMENT EXPRESS INC. (PX) shall destroy copies of such data within forty-five (45) days of expiration or termination of this Agreement. PAYMENT EXPRESS INC. (PX) will provide a perpetual, non-exclusive, irrevocable right and license to the City to use any database formats and data sets created by PAYMENT EXPRESS INC. (PX) out of such data. Notwithstanding the terms of this clause 26.2, and for the avoidance of doubt,-this clause 26.2 and this Amendment will not be interpreted to compel PAYMENT EXPRESS INC. (PX) to decrypt any Tokenized Data.
26.3. Patches. During such time that the City has a warranty and service agreement, if any Software is part of the PAYMENT EXPRESS INC. (PX) provided Services, PAYMENT EXPRESS INC. (PX) agrees that the Software will be adequately patched to have the latest vendor-supplied security patches installed, including operating system and application patches, on the operational start date of the Equipment and Software. PAYMENT EXPRESS INC. (PX) is responsible for having all patches tested before being installed on the Equipment and Software. PAYMENT EXPRESS INC. (PX) is also responsible for providing the City with notice of applicable security patches issued by the Software vendor after the operational start date of the Services. After the date of installation·of Software provided by PAYMENT EXPRESS INC. (PX), PAYMENT EXPRESS INC. (PX) shall be responsible for ensuring that all such patches, of which PAYMENT EXPRESS INC. (PX) provides notice, are properly updated as necessary within the current operating systems.
26.4. Antivirus Software. PAYMENT EXPRESS INC. (PX) shall not install any malicious software or computer contaminants including, without limita3 December 2017 tion, viruses, worms, time bombs, Trojan horses, ransomware, spyware, scareware or any other hostile or intrusive code, files, scripts or programs.
PAYMENT EXPRESS INC. (PX) shall be responsible for ensuring that all necessary antivirus software is properly maintained and updated as necessary.
26.5. Network Access. If PAYMENT EXPRESS INC. (PX) has access to any passwords or log-in information of the City in connection with the Services, PAYMENT EXPRESS INC. (PX) shall ensure that proper user authentication and password management for all non-consumer users and administrators is installed, or configured, on all Solution components and use its best efforts to make sure the password and log-in information is secure. PAYMENT EXPRESS INC. (PX) shall comply with the City's minimum standards.
5. Exhibit A-1 and Exhibit B-1 are attached hereto and incorporated herein by this reference.
6. Except as expressly modified by this First Modification, all other terms and conditions of the Original Agreement shall be and remain in full force and effect.
IN WITNESS WHEREOF, the parties have executed this First Modification as of the date and year first written above.
ATTEST:
/-c7R. '
~~-iJ~/li)
DENISE ANDERSON-WARREN
City Clerk
APPROVEDAS TO FORM:
LANE DILG
City Attorney
4 CITY OFSANTA MONICA,
a municipj?~pora' n
By: __ h-,---~---------- ~ ICKCOLE
City Manager
PAYMENT EXPRESS INC. (PX)
By: __ ~---,.---+'----- Name: 8JL.,;,;/ ~,.Jp ;J ~-~ ----------- Title: U/£1\1{;:_:V .. ~- LQvl'\,_$.~l.., ___;:::;;...:..;:::;..;___.:='-----=-=--..:;..._ ___ _ December 2017
ExhibitA-1
Scope of Services
A. PAYMENT EXPRESS INC. (PX) offers attended and unattended solutions to provide PCI grade security for merchants accepting physical cards and NFC payments at self service outlets like Parking Payment Terminals. PAYMENT EXPRESS INC. (PX) gateway authorizes payments and encrypt sensitive information, such as credit card numbers, to ensure that information passes securely between the customer and the merchant.
B. PAYMENT EXPRESS INC. (PX) will be the gate way provider for all credit card transactions that emanate for the City of Santa Monica Parking and Revenue Control System (SKIDATA) for the following Parking Facilities:
i. Parking Structure 1-9
ii. Ken Edwards Parking Structure
iii. Civic Lot and Civic Structure Parking Facilities
iv. Pier Deck Parking Lot
v. Main Library Parking Structure
For the New SKIDATA Implementation taking card payments requires 3 parties:
The SKIDATA Parking Logic, Point of Sale software, which is integrated with PAYMENT EXPRESS INC. (PX) equipment and security software and tells PAYMENT EXPRESS INC. (PX) gateway what to charge.
The payment gateway (PAYMENT EXPRESS INC. (PX): Is a level 1 PCI compliant payment gateway. All of the customer credit card information is on PAYMENT EXPRESS INC. (PX) gateway and fully encrypted. PAYMENT EXPRESS INC. (PX) is responsible for securely processing a customer's card transaction. PAYMENT EXPRESS INC. (PX) will send it on to the City of Santa Monica preferred merchant provider or banking institution. The credit card authorization information is sent with each transaction record.
The acquiring bank: Responsible for settling the processed transactions into your chosen business bank account(s). PAYMENT EXPRESS INC. (PX) will need a Merchant ID from an acquiring bank. PAYMENT EXPRESS INC. (PX) usually request 2-3 business days to test and activate the account.
Summary of Benefits:
• End to end encryption of all data (EMV).
• Reduces Merchant from PCI scope.
• No single point of failure and almost unlimited layers of redundancy including EOV which enables payments to be taken offline. If the internet is down instead 5 December 2017
of opening the gate and letting cars just leave without processing payment, you will still have limited capability to process payments, when service is restored the files are then uploaded. The amount and size of transactions may be determined by the processing bank, and we can configure our terminals accordingly; • Designed to combat skimming attacks
• Rapid transaction processing time
• PAYMENT EXPRESS INC. (PX) has its own configurable EMV kernel ensuring EMV upgrades are able to be achieved easily with a very low cost. • Software updates and new features are deployed remotely, removing cost and lead time for an onsite technician. This will become more important moving forward as Banks issues a range of Chip cards.
Service access package covers terminal management, support, software updates (delivered over the net), bug fixes, compliance updates, and enhancements, etc. 6 December 2017
Fees
Exhibit B-1
Budget
A. Establishment Fee: $100
B. Fees will be charged based on a transaction Based Model. The fee will be $0.05 per transaction regardless of the amount per transaction. The fee per transaction will be fixed, and will not be altered during the term of this Agreement in the absence of written agreement between the parties. If the City's combined charges for transactions, plus costs and fees subject to this Agreement and Amendment, exceeds $1,070,000, and a further amendment to the Agreement is not executed between the parties, PAYMENT EXPRESS INC. (PX) may ter· minate services to the City immediately.
C. Additional Fees: Additional users to the payment manager can be set up, but will incur a one-time fee of $30.00 plus applicable taxes. If PAYMENT EXPRESS INC. (PX) needs to configure or change additional electronic mer- " chant number on the PAYMENT EXPRESS INC. (PX) Host, there is a fee of $100.00 plus tax per merchant account. In addition, $5.00 per calendar month per connected card reader for SCR200 and IPP350 devices.
D. Optional Risk Management Fees
a. Implementation of 1 to 5 applied rules will be charged at $100.00 plus applicable taxes per calendar month.
b. Implementation of 6 to 10 applied rules will be charged at $17 5.00 plus applicable taxes per calendar month.
E. Development Fee (if requested by Customer); $125.00 plus applicable tax per hour per person for testing and $175.00 plus applicable tax per hour per person for a senior developer.
F. Total amount not to exceed $1,070,000.
Payment Terms
• See section 5
7 December 2017