Loading...
HomeMy WebLinkAbout25-204 - Contract - General Code - Ordinance Codification Services25-204 Council Approval N/A City of Tukwila • 6200 Southcenter Boulevard, Tukwila WA 98188 •4 CONTRACT FOR SERVICES This Agreement is entered into by and between the City of Tukwila, Washington, a non -charter optional municipal code city hereinafter referred to as "the City," and General Code hereinafter referred to as "the Contractor," whose principal office is located at Rochester, NY 14624 . The City and the Contractor are each individually a "Party" and collectively the "Parties." WHEREAS, the City has determined the need to have certain services performed for its citizens but does not have the manpower or expertise to perform such services; and WHEREAS, the City desires to have the Contractor perform such services pursuant to certain terms and conditions; now, therefore, IN CONSIDERATION OF the mutual benefits and conditions hereinafter contained, the parties hereto agree as follows: 1. Scooe and Schedule of Services _to_be Performed by Contractor, The Contractor shall perform those services described on Exhibit A attached hereto and incorporated herein by this reference as if fully set forth. In performing such services, the Contractor shall at all times comply with all Federal, State, and local statutes, rules and ordinances applicable to the performance of such services and the handling of any funds used in connection therewith. The Contractor shall request and obtain prior written approval from the City if the scope or schedule is to be modified in any way. 2. City Responsibilities. A. City Responsibilities. The City shall be responsible for the correctness and accuracy of the information it supplies to the Consultant ("City Content"). By acquiring an online hosted code, the City hereby requests that City Content be posted online, and the City will be responsible for the presentation, accuracy and completeness of the City Content provided, and the Consultant will be entitled to post that City Content without review or editing. Further, the City is responsible for providing the Consultant with timely decisions and answers to questions raised by the Consultant, for inclusion of sufficient funds in the budget to pay the Consultant for services, and for the prompt payment of invoices. The City shall also be responsible for completing its work in accordance with the "Performance Schedule." Consultant shall not be responsible or liable for any delay or failure of performance caused in whole or in part by City's delay in performing, or failure to perform, any of its obligations under this Agreement, which shall include providing responsive information to Consultant necessary for Consultant's timely performance hereunder. B. City Prima t Contact. The City shall identify, and name, an appropriate individual, with corresponding contact information, including electronic mail address, as the "Primary Contact" with whom the Consultant should communicate matters regarding the online code, such as maintenance notifications, and who has the authority to make requests including release of City data, both internally to the Consultant and to the City, restoration of data, and other configuration changes. General Code Contract, 2025 Page 1 of 11 3. Compensation and Method of Payment. The City shall pay the Contractor for services rendered according to the rate and method set forth on Exhibit B attached hereto and incorporated herein by this reference. The total amount to be paid shall not exceed $17,380.00. 4 Contractor Budget. The Contractor shall apply the funds received under this Agreement within the maximum limits set forth in this Agreement. The Contractor shall request prior approval from the City whenever the Contractor desires to amend its budget in any way. S Duration of Aareement. This Agreement shall be in full force and effect for a period commencing June 1, 2025, and ending May 30, 2028 unless sooner terminated under the provisions hereinafter specified. 6. Independent Contractor. The Contractor and the City agree that the Contractor is an independent contractor with respect to the services provided pursuant to this Agreement. Nothing in this Agreement shall be considered to create the relationship of employer and employee between the parties hereto. Neither the Contractor nor any employee of Contractor shall be entitled to any benefits accorded City employees by virtue of the services provided under this Agreement. The City shall not be responsible for withholding or otherwise deducting federal income tax or social security or contributing to the State Industrial Insurance Program, or otherwise assuming the duties of an employer with respect to the Contractor, or any employee of the Contractor. 7. Warranties and Disclaimer. A The Consultant warrants that the services and any deliverables provided hereunder will be in accordance with the terms and conditions of this Agreement and the "Performance Schedule," and will be free of material defects. The Consultant warrants that the Licensed Program, as defined herein, will perform substantially in accordance with the accompanying written materials for a period of one year from the date of receipt. Regardless of the City's acceptance of completed materials when delivered, the Consultant shall correct errors found either by the City or the Consultant. R The Consultant's warranties contemplated herein do not extend to failures arising out of (i) incorrect or insufficient data, specifications or instructions provided by the City or (ii) work or services performed by others. Except as expressly stated herein, THE CONSULTANT MAKES NO OTHER WARRANTIES, EXPRESS OR IMPLIED, OF ANY KIND, INCLUDING, WITHOUT LIMITATION, MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE, WITH REGARD TO ANY SERVICES, LICENSED PROGRAM AND/OR RELATED MATERIALS TO BE FURNISHED BY THE CONSULTANT. 8. Software License Agreement/Online Hosting Services. A. DEFINITIONS. (i) "Licensed Program" shall mean the Consultant software product eCode360® and any other software product provided to the City by the Consultant or its affiliates or licensors pursuant to the Proposal. (ii) "Update" means a new release of the Licensed Software made available by the Consultant to its customers, containing bug fixes and minor modifications or enhancements, but not a new version containing significant new features, as determined by the Consultant in its sole discretion. (iii) "Use" shall mean accessing, downloading, copying or duplication of any portion of a Licensed Program from the Internet, storage units or media for processing or the General Code Contract, 2025 Page 2 of 11 utilization of the Licensed Program for its intended purpose. B. LICENSE GRANT. The Consultant hereby grants the City a non-exclusive, non -transferable, non -licensable, non - assignable license to Use the Licensed Program. C. PROPRIETARY RIGHTS; RESTRICTIONS. The Licensed Program provided by the Consultant is proprietary and owned by the Consultant and/or its affiliates and licensors. The City acknowledges that the Licensed Program is licensed, not sold, and agrees to respect all proprietary rights associated with it. The City shall use the Licensed Program solely as permitted by this Agreement and shall not decompile, disassemble, reverse engineer, sublicense, sell, distribute, rent, or disclose the Licensed Program in any form without the express written permission of the Consultant. The City shall not use the Licensed Program to infringe on any third party's intellectual property rights or violate any applicable laws or regulations. Furthermore, the City shall not use the Licensed Program for any actions that are defamatory, trade libelous, threatening, harassing, or obscene. Upon the City's request, the Consultant shall promptly deliver all materials related to the Licensed Program, including source code, upgrades, modifications, and other related documents or materials developed solely for and paid for by the City to perform the Work. iii. The City will retain all rights, including copyrights, and title to the text of its municipal code (the "Code") but hereby grants to the Consultant the right and license to use, reproduce, adapt, distribute, display and advertise the Code, and to digitize the Code and to prepare, reproduce, publish, distribute, transmit, perform, display, broadcast, upload, download, communicate to the public, lend or otherwise transfer or make available or store in any medium a copy of the Code whether or not adapted or abridged on its own or in combination with any other work by means of or through any electronic medium, including, digital, optical and magnetic information storage and retrieval platforms or systems, on- line, electronic or other reproduction, transmission or publication, or by any other means whether now known or subsequently developed. iv. All computer software and other intellectual property of the Consultant used in performing its services shall remain the property of the Consultant and/or its affiliates and/or licensors. Model building codes and/or other model codes used by the Consultant in the Licensed Program or otherwise in performing its services shall remain the property of the Consultant and/or its affiliates, and no ownership or other proprietary right in those model codes is conveyed in the City. 9. Indemnification. A. Contractor Indemnification. The Contractor shall indemnify, defend and hold harmless the City its officers, officials, employees, volunteers and permitted successors and assigns harmless from any and all claims, injuries, damages, losses or suits including attorney fees (collectively, "Losses"), in connection with any claims, demands, suits or proceedings (collectively, "Claims") made or alleged against the City by a third party arising out of or resulting from the acts, errors or omissions, or the intentional or negligent performance of the Contractor in performance of this Agreement, except for injuries and damages caused by the sole negligence of the City. General Code Contract, 2025 Page 3 of 11 B. RCW 4.24.115. However, should a court of competent jurisdiction determine that this Agreement is subject to RCW 4.24.115, then, in the event of liability for damages arising out of bodily injury to persons or damages to property caused by or resulting from the concurrent negligence of the Contractor and the City, its officers, officials, employees, and volunteers, Contractor's liability, including the duty and cost to defend, hereunder shall be only to the extent of Contractor's negligence. It is further specifically and expressly understood that the indemnification provided herein constitutes Contractor's waiver of immunity under Industrial Insurance, Title 51 RCW, solely for the purposes of this indemnification. This waiver has been mutually negotiated by the parties. The provisions of this section shall survive the expiration or termination of this Agreement. C. Infringement Indemnification. In addition to Contractor's obligations under Section 6.A., the Contractor shall indemnify, defend, and hold harmless the City and its directors, officers, employees, agents and other representatives against any Losses in connection with Claims made or alleged against the City by a third party that the services, software or deliverables infringes a U.S. patent, copyright or other intellectual property rights of any third party. The foregoing indemnification obligation does not apply to any Claims or Losses arising out of or relating to any: (a) access to or use of the software in combination with any hardware, system, software, network or other materials or service not provided or authorized by this Agreement or otherwise in writing by the Contractor; or (b) modification of the software other than: (i) by or on behalf of the Contractor; or (ii) with the Contractor's written approval or in accordance with Contractor's written specifications. D. Mitigation. If any of the services, software or deliverables are, or in Contractor's opinion are likely to be, claimed to infringe, misappropriate or otherwise violate any third -party intellectual property right, or if the City's or any Authorized User's use of the services, software or deliverables is enjoined or threatened to be enjoined, the Contractor may, at its option and sole cost and expense: i. obtain the right for the City to continue to use the Services, Software and Deliverables materially as contemplated by this Agreement; ii. modify or replace the services, software and deliverables, in whole or in part, to seek to make the services, software and deliverables (as so modified or replaced) non -infringing, while providing materially equivalent features and functionality; or iii. by written notice to the City, terminate this Agreement with respect to all or part of the Services, Software and Deliverables, and require the City to immediately cease any use of the Services, Software and Deliverables or any specified part or feature thereof, provided that if such termination occurs, the Contractor shall refund any prepaid fees to the City and provide transition services free of charge. E. Limitation of Liability. In no event will either party be liable under or in connection with this agreement or its subject matter under any legal or equitable theory, including breach of contract, tort (including negligence), strict liability and otherwise, for any: (i) loss of revenue or profit; or (ii) consequential, incidental, indirect, exemplary, special, or punitive damages, regardless of whether such persons were advised of the possibility of such losses or damages or such losses or damages were otherwise foreseeable, and notwithstanding the failure of any agreed or other remedy of its essential purpose. In no event shall the aggregate liability of either party arising out of or related to this agreement exceed the greater of fees paid to the Consultant under this Agreement; provided however, the limitation of liability set forth in this section shall not apply to Contractor's indemnification obligations solely to the extent finally determined to result from Consultant's willful misconduct or gross negligence. The provisions of this section shall survive the expiration or termination of this agreement. General Code Contract, 2025 Page 4 of 11 10L Insurance. Prior to commencing the Services, the Contractor shall procure and maintain at its sole cost and expense at least the following insurance, covering its obligations under this Agreement. A Insurance Policies. Commercial General Liability: With coverage of not less than $2,000,000 per occurrence, $2,000,000 general aggregate, and $2,000,000 products -completed operations aggregate limit, which shall cover liability arising from premises, operations, independent contractors, products -completed operations, stop gap liability, personal injury and advertising injury, and liability assumed under an insured contract. Commercial General Liability insurance shall be as least at broad as ISO occurrence form CG 00 01 and shall cover liability arising from premises, operations, independent contractors, products -completed operations, stop gap liability, personal injury and advertising injury, and liability assumed under an insured contract. The Commercial General Liability insurance shall be endorsed to provide a per project general aggregate limit using ISO form CG 25 03 05 09 or an equivalent endorsement. There shall be no exclusion for liability arising from explosion, collapse or underground property damage. The City shall be named as an additional insured under the Contractor's Commercial General Liability insurance policy with respect to the work performed for the City using ISO Additional Insured endorsement CG 20 10 10 01 and Additional Insured -Completed Operations endorsement CG 20 37 10 01 or substitute endorsements providing at least as broad coverage. Cyber Liability Insurance: With coverage of not less than $1,000,000 per occurrence and $5,000,000 in the annual aggregate which shall include, but not be limited to, coverage, including defense, for the following losses or services: (1) Breach of City's Data, including but not limited to liability arising from theft, dissemination, and/or use of City's confidential and Personal Information as defined by RCW 42.56.590, including but not limited to, any information about an individual maintained by City, including: (a) any information that can be used to distinguish or trace an individual's identity, such as name, social security number, date and place of birth, mother's maiden name, or biometric records; and (b) any other information that is linked or linkable to an individual, such as medical, educational, financial, and employment information regardless of how or where the information is stored or transmitted. (2) Network security liability arising from: (a) the unauthorized access to, use of, or tampering with computer systems, by an outside party, including hacker attacks or a virus introduced by a third party; or (b) the inability of an authorized third party to gain access to supplier systems and/or City Data, including denial of service, unless caused by a mechanical or electrical failure; (c) introduction of any unauthorized software computer code or virus causing damage to City Data or any other third party data. (3) Event management services and first -party loss expenses for a data breach response including crisis management services, credit monitoring for individuals, public relations, legal service advice, notification of affected parties, independent information security forensics firm, and costs to re -secure, re-create and restore data or systems. iii. Workers' Compensation coverage as required by the Industrial Insurance laws of the State of Washington. iv. Automobile Liability Insurance of a minimum combined single limit for per occurrence for bodily injury and property damage of $1,000,000 per accident, covering all owned, non - General Code Contract, 2025 Page 5 of 11 owned, hired and leased vehicles. Coverage shall be written on Insurance Services Office (ISO) form CA 00 01 or a substitute form providing equivalent liability coverage. If necessary, the policy shall be endorsed to provide contractual liability coverage. V. Professional Liability/Errors and Omissions Insurance (including Technology Errors and Omissions) of at least $1,000,000 per occurrence and $2,000,000 in the annual aggregate. B. Additional Insurance Requirements. If the Contractor maintains higher insurance limits than the minimums shown above, the City shall be insured for the full available limits of Commercial General and Excess or Umbrella liability maintained by the Contractor, irrespective of whether such limits maintained by the Contractor are greater than those required by this Agreement or whether any certificate of insurance furnished to the City evidences limits of liability lower than those maintained by the Contractor. The insurance required in Section 7 shall be in a form and on terms and written by insurers with a current A.M. Best rating of not less than A: VII. The Commercial General Liability, Cyber Liability Insurance and Automobile Liability Insurance shall name the City as an additional insured, and shall contain, or be endorsed to contain, that they shall be primary insurance as respect to the City. Any insurance, self-insurance, or self-insured pool coverage maintained by the City shall be excess of the Contractor's insurance and shall not contribute with it. iii. The Contractor shall provide the City with written notice of any policy cancellation within two business days of the receipt of such notice. Contractor shall obtain replacement insurance policies meeting the requirements of this Section 7. iv. Failure of the Contractor to maintain the insurance as required shall constitute a material breach of this Agreement, upon which the City may, after giving five business days' notice to the Contractor to correct such breach, immediately terminate this Agreement. V. The Contractor's maintenance of insurance, its scope of coverage and limits as required herein shall not be construed to limit the liability of the Contractor to the coverage provided by such insurance, or otherwise limit the City's recourse to any remedy available at law or in equity. vi. Subcontractor's Insurance. The Contractor shall cause each and every subcontractor utilized by the Contractor in connection with the provision of Services ("Subcontractors"), to provide insurance coverage that complies with all applicable requirements of the Contractor -provided insurance as set forth herein, except the Contractor shall have sole responsibility for determining the limits of coverage required to be obtained by Subcontractors. The Contractor shall ensure the City is an additional insured on each and every Subcontractor's Commercial General liability insurance policy, using an endorsement as least as broad as ISO CG 20 10 10 01 for ongoing operations and CG 20 37 10 01 for completed operations. vii. The Contractor shall furnish the City with original certificates and a copy of the amendatory endorsements, including but not necessarily limited to the additional insured endorsements, evidencing the insurance requirements of the Contractor before commencement of the work. Upon request by the City, the Contractor shall furnish certified copies of all required insurance policies, including endorsements, required in this Agreement and evidence of all subcontractors' coverage. 11. Record Keeping and Reporting. General Code Contract, 2025 Page 6 of 11 a. Records Maintenance. The Contractor shall maintain accounts and records, including personnel, property, financial and programmatic records which sufficiently and properly reflect all direct and indirect costs of any nature expended and services performed in the performance of this Agreement and other such records as may be deemed necessary by the City to ensure the performance of this Agreement. b. Retention Period. These records shall be maintained for a period of seven years after termination hereof unless permission to destroy them is granted by the office of the archivist in accordance with RCW Chapter 40.14 and by the City. C. Public Records Requests. The Contractor acknowledges that the City is a public entity and is subject to the Public Records Act under Chapter 42.56 RCW. To the extent permitted by law, the City shall treat as exempt from treatment as a public record, and shall not disclose in response to a request made pursuant to any applicable public records law, any of the Contractor's Confidential Information. If a request is received for records the Contractor has submitted to the City and has identified as Confidential Information, the City will use its best efforts to provide the Contractor with notice of the request in accordance with RCW 42.56.540 and a reasonable time within which the Contractor may seek an injunction to prohibit the City's disclosure of the requested record. The City shall comply with any injunction or court order requested by the Contractor which prohibits the disclosure of any such Confidential Information; however, in the event a higher court overturns such injunction or court order, the Contractor shall reimburse the City for any fines or penalties imposed for failure to disclose such records. Nothing in this section prohibits the City from complying with RCW 42.56, or any other applicable law or court order requiring the release of public records, and the City shall not be liable to the Contractor for compliance with any law or court order requiring the release of public records. D. Compelled Disclosures. If either the Party or any of its Representatives is compelled by applicable law to disclose any Confidential Information then, to the extent permitted by law, that Party shall: (a) promptly, and prior to such disclosure, notify the other Party in writing of such requirement so that they can seek a protective order or other remedy or waive its rights under Section 3; and (b) provide reasonable assistance, at the Disclosing Party's cost, to the Disclosing Party in opposing such disclosure or seeking a protective order or other limitations on disclosure. If the Disclosing Party waives compliance or, after providing the notice and assistance required under this section, the Receiving Party remains required by law to disclose any Confidential Information, the Receiving Party shall disclose only that portion of the Confidential Information that the Receiving Party is legally required to disclose. This Section 8.2 shall not apply to Subscriber's response to a request made under the Public Records Act, Chapter 42.56 RCW. 12 Breach Notification. A. The Contractor shall maintain a data breach plan and shall implement the procedures required under such data breach plan on the occurrence of a data breach, in compliance with the requirements of Washington's data breach notification law codified at RCW 42.56.590. The Contractor shall report, in writing, to the City any data breach involving data maintained by the Contractor on behalf of the City ("City Data") including any reasonable belief that an unauthorized individual has accessed City Data. The report shall identify the nature of the event, a list of the affected individuals and the types of data, and the mitigation and investigation efforts of the Contractor. The Contractor shall make the report to the City immediately upon discovery of the data breach, but in no event more than five business days after discovery of the data breach. The Contractor shall provide investigation updates to the City. General Code Contract, 2025 Page 7 of 11 B. The Contractor shall promptly reimburse the City in full for all costs incurred by the City in any investigation, remediation or litigation resulting from any data breach. The Contractor's duty to reimburse the City includes but is not limited to, reimbursing to the City its cost incurred in doing the following: Notification to third parties whose information may have been or were compromised and to regulatory bodies, law enforcement agencies or other entities as may be required by law or contract; ii. Establishing and monitoring call center(s) and credit monitoring and/or identity restoration services to assist each person impacted by a data breach of a nature that, in the City's sole discretion, could lead to identity theft; and iii. Payment of legal fees and expenses, audit costs, fines and penalties, and other fees imposed upon the City by a regulatory agency, court of law, or contracting partner as a result of the data breach. C. Upon a data breach, the Contractor is not permitted to notify affected individuals without the express written consent of the City. Unless the Contractor is required by law to provide notification to third parties or the affected individuals in a particular manner, the City shall control the time, place, and manner of such notification. la City Data. The Contractor does not claim ownership of, and assumes no responsibility with respect to any City Data defined as information, data, and content, in any form or medium, collected, downloaded, or otherwise received, directly or indirectly from the City, an Authorized Personnel or end-users by or through the Contractor's Services. 14 Audits and Inspections. The records and documents with respect to all matters covered by this Agreement shall be subject at all times to inspection, review or audit by law during the performance of this Agreement. 15L Termination. This Agreement may at any time be terminated by the City giving to the Contractor 30 days written notice of the City's intention to terminate the same. Failure to provide products on schedule may result in contract termination. If the Contractor's insurance coverage is canceled for any reason, the City shall have the right to terminate this Agreement immediately. 16L Effect of Termination or Expiration. On the expiration or earlier termination of this Agreement: A. Each Party shall continue to hold such Confidential Information in confidence pursuant to Section 8; and B. Each Party shall pay to the other all undisputed amounts accrued prior to and through the date of termination of this Agreement; and C. The provisions set forth in the following sections, and any other right or obligation of the parties in this Agreement that, by its nature should survive termination or expiration of this Agreement, will survive any expiration or termination of this Agreement. D. Within 60 days following such expiration or termination, the Contractor shall deliver to the City, in a format as requested by the City, the then most recent version of City Data maintained by the Contractor, provided that the City has at that time paid all undisputed fees then outstanding and any amounts payable after or as a result of such expiration or termination. E. In the event of (i) expiration or earlier termination of this Agreement, or (ii) the City no longer purchasing certain Services from the Contractor, if the City requests assistance in the transfer of City Data to a different vendor's applications ("Deconversion"), the Contractor will provide reasonable assistance. The Parties will negotiate in good faith to establish the relative roles and General Code Contract, 2025 Page 8 of 11 responsibilities of the Parties in effecting Deconversion, as well as the appropriate date for completion. 17. Taxes. The Contractor shall be solely responsible for the payment of any and all applicable taxes related to the Services provided under this Agreement; if such taxes are required to be passed through to the City by law, the same shall be duly itemized on timely billings submitted to the City by the Contractor. 18 Waiver. A waiver of any breach by either Party shall not constitute a waiver of any subsequent breach. 19! Third Party Beneficiaries. This Agreement is solely for the conveniences of the Parties and there are no third -party beneficiaries to this Agreement. 20. Compliance with Laws. The Consultant shall comply with all applicable federal, state, and local laws and regulations in performing this Agreement. 21. Discrimination Prohibited. The Consultant, with regard to the work performed by it under this Agreement, will not discriminate on the grounds of race, religion, creed, color, national origin, age, veteran status, sex, sexual orientation, gender identity, marital status, political affiliation, the presence of any disability, or any other protected class status under state or federal law, in the selection and retention of employees or procurement of materials or supplies. 22- Assianment and Subcontract. The Contractor shall not assign or subcontract any portion of the services contemplated by this Agreement without the written consent of the City; however, Contractor may, without other party's consent and with thirty (30) days written notice, transfer this Agreement and/or any of its rights and obligations under this Agreement, to any of Consultant's affiliated entities, including but not limited to International Code Council, Inc., General Code Enterprises, LLC, or ICC Codification, Inc. 23. Entire Agreement: Modification. This Agreement, together with attachments or addenda, represents the entire and integrated Agreement between the City and the Contractor and supersedes all prior negotiations, representations, or agreements written or oral. No amendment or modification of this Agreement shall be of any force or effect unless it is in writing and signed by the parties. 24L Severability and Survival. If any term, condition or provision of this Agreement is declared void or unenforceable or limited in its application or effect, such event shall not affect any other provisions hereof and all other provisions shall remain fully enforceable. The provisions of this Agreement, which by their sense and context are reasonably intended to survive the completion, expiration or cancellation of this Agreement, shall survive termination of this Agreement. 25. Notices. Notices to the City of Tukwila shall be sent to the following address: Andy Youn-Barnett, City Clerk City of Tukwila 6200 Southcenter Blvd. Tukwila, Washington 98188 Andy.Youn-Barnett(c�TukwilaWA.aov Notices to the Contractor shall be sent to the address provided by the Contractor upon the signature line below. General Code Contract, 2025 Page 9 of 11 26. Applicable Law: Venue: Attorney's Fees. This Agreement shall be governed by and construed in accordance with the laws of the State of Washington. In the event any suit, arbitration, or other proceeding is instituted to enforce any term of this Agreement, the parties specifically understand and agree that venue shall be properly laid in King County, Washington. The prevailing party in any such action shall be entitled to its attorney's fees and costs of suit. 27. Force Majeure. Neither Party shall be responsible for failure to fulfill its obligations hereunder or liable for damages resulting from delay in performance as a result of war, fire, strike, pandemic, riot or insurrection, natural disaster, delay of carriers, governmental order or regulation, complete or partial shutdown of plant, unavailability of equipment, software, or services from suppliers, default of a subcontractor or vendor to the Party if such default arises out of causes beyond the reasonable control of such subcontractor or vendor, the acts or omissions of the other Party, or its officers, directors, employees, agents, contractors, or elected officials, and/or other occurrences beyond the Party's reasonable control ("Excusable Delay" hereunder). In the event of such Excusable Delay, performance shall be extended on a day for day basis or as otherwise reasonably necessary to compensate for such delay. 28. Counterparts. This Agreement may be executed in several counterparts, each of which when so executed shall be deemed to be an original, and such counterparts shall constitute one and the same instrument. This Amendment shall be considered properly executed by a Party if executed by that Party and transmitted by facsimile or other electronic means including, without limitation, SeamlessDocs or other City -approved program, Tagged Image Format Files (TIFF), or Portable Document Format (PDF). 29. Conflict in Terms. In the event of a conflict between the terms of this Agreement and the terms in any other document, including but not limited to all Exhibits hereto, the terms of this Agreement shall prevail. Exhibit A: Scope of Services Exhibit B: Compensation Schedule Exhibit C: Service Level Agreement (SLA) Exhibit D: City of Tukwila Security Requirements Exhibit E: Data Protection and Information Security Exhibit Exhibit F: General Code Authorization & Agreement [signatures to follow] General Code Contract, 2025 Page 10 of 11 CITY OF TUKWILA r—Signed by: Andy Youn-Barnett, City Clerk 6/30/2025 1 4:17 PM PDT Date ATTEST/AUTHENTICATED: Signed by: Jennifer Marshall, Deputy City Clerk APPROVED AS TO FORM: Signed by: 0z Office of the City Attorney CONTRACTOR: By: Printed Name: Title: Address: Date: Cristina LoVerde VP of Client Engagement 781 Elmgrove Rd Rochester, NY 14624 06/30/2025 General Code Contract, 2025 Page 11 of 11 The General Code Recommended Solution and Process Bellow is ain outIline of the process for complIeting your conversion piropect.. ,Iroiject ll�tillid"I General Code will consullt with "Fulkwilla's designated contact 1persoin to ireview the project generally and to c1lairi-l'y any initiall questions for both General Code and the City. T'o begin the project, the City and Genera I Code s1hall coinfirim the source imateriialls foir the propect. F'or amore detaill, see the source irnaterialls Ilisted on page T. Corritiert Colde General Code will conveirt the Code into ouir XIMI pulbIlishing system.. 'Flhis systeirn enablIes the Code to The printed efficientIly., It also provides the foundation for providing the Code on1line in a variety of forimats, Outputs, and sollutions.. I1111111111ditorial Work The -text of the current Code and any additionall imateriialls that imay not alliready The codified will The linput and thoiroughIly 1piroofiread to einsuire complIete accuracy. Whille we will generally match [1he stylle of the Code, Ipllease note it is General Code's 1polliicy not to lindlude the following code enhancements unIless specifically directed to do so by the City Attorney: cross irefeirences; state Ilaw references; and Code comparative tablIes.. III b, I i's li a II ectrhire , O(III Iii iii qe COdle wftli e,C�lode,,360 Once the finall delliveralbIles have been pirelpared, General Code will imalke your eCode360 site availlalblle to the pulbIlic.. eCode360 is a secure, irellialblle on1line p1lat-foirm cireated specifically to house codified laws and municipall documents.. Buillt with a variety of user needs in imiind, eCode360 willll provide T'U kwi Ila's staff, citizens and businesses with unparallelled flexilbillity 'to qUickIly access and search your Code on a variety of deslktop and imolbiille devices.. eCode,360 Il3einsfiits: A ceintirallilzed sollutiloin (laws, iregullatiions and irellated documents are integrated into a dynairnic, centirallized iresouirce Simplie to use .......... eCode360 is easy and intuitive and offers pooieffull time. --saving -features Allways ulp-to-date .......... We will Update your eCode360 site with each SUIpIpIleirneint 'to your Code A trusted, "go -to" iresouirce .......... Empower staff'to answeir questions with c1larity and confidence Allways evollviling .......... We coinsistentIly rellease innovative fUnctionallity (based on communities' ineeds (III IIIIII vali eCode360 Anintial II ,n,n' L",195 New Laws Easy and Fllexiblle Searching TablIe of Contents ErnaR or Share Links Printing Archive View R "Sticky" Table Headers Administrative Tools Google Trandate to 132 Languages eCode360 Search App Public and Private Notes Sample I egisllation (Mullticode Search) Download to Word Down1load to PDF New Laws Indicator Advanced Search Get Updates Public Documents Modulle Foir irnoire Information about eCode360 see page 14.. !I IFlrvide Origdbg ill W''llode Mafiitiei%111� nce "The codification process is inot -truly over w1hein your new Code Is delliiveired.. Youir coinnimunity will change and grow, and ultimately, your Code will evolve with it. llin order to innaiintain youir Code as an accurate and irelliiablle resource, it Is limpoirtaint that the City Ikeelps the Code up to date afteir linitiall Ipublliication.. General Code's supplementation services are designed to make the process easy, -fast and accuirate.. "To select your ongoing suppIlementation schedulle, Ipllease see page 12.. IFoir moire information about General Code's Sulplollenneintation Services, see (page 19.. R ans manumm P !I!I So�t i inii;ie Mil"! terk"! Is General Code will use the following source rnaterialls for the proVect: > A colpy of the City's Code, as updated to Ordinance No.. 2727 This piroposall aind the scope of this project consider oinlly the Ilegiisllatiion Submitted for ireview as listed albove.. T'he processing, review, aind indlusion of any mateirialls not submitted are outside the propect scope as proposed and therefore nnay The subpect to additionall charges.. We request that TuIkWilla set up a process to iroutiinelly seind any inew Ilegiisllatiion upon adoption. "Flhis addiboinall legislIatioin will The indluded in the Code up to the point wheire the editoiriall work Ihas beein coimplleted and will be subject to ain additioinall chairge at the eind of the project. Spiecial Considerations General Code has identified the following specific speciall coins ideratioins that will The addressed lby our staff as the project progresses: Please inote the base pro'ect Ipriice and scope of this piroposall indludes pubIlication of the Code oin1line oinlly and iindludes ino Ipriinrt output.. F9 General Code may need to make noinsubstaintive oirgainizationall oir stiructurall changes to youir Code liin order to convert the Code into ouir XMI pulbIlishing system.. Standardized formatting and structure Ileveirages our tedhinollogy to cireate uniformity and consistency thiroughout the Code, which einablIes the features and functionallity of eCode360 to work as intended and provide you with the best useir experience.. As Ipairt of ouir process for the conversion, General Code will:� Scheme, I�Itviiilberfiig and StrUdMirie Scheme. IndlUde a Iliist of section tides at the beginning of each chalpteir, as a quick... reference outIline of what is in the chapter and to imalke sought.-afteir irnatedall easier to find.. Unnumbered 1pairagiralplhsttexticlhalp-teirs.. o Uninumbeired paragraphs -follllo,,Aiing inumbeired text will The left as is unlIess c1lairity requires -their numbering in the context of the surrounding subsections. c) If the Code has a inuumlbeiriing system that vairies based on Whetheir a section stairts with an unnumbered paragraph oir snot, we will add the first Revell section inumbeir oir Iletteir as appropriate to the unnumbered pairagiralph.. This is necessary for the search and other functions of eCode360 to vvoirlk as intended. o IIf the Code inclludeS Unnumbered chapters in the Appendix, we may add chapter inumbeirs and use those as the start of the section inumbeirs throughout the chapter, consistent with the crest of the Code.. Structure.. "Wyle will cireate uniformity and consistency of structure at these Ilevells: • Chalpteir inuirnbeiriling.. If the Code lindludes dulpIlicate numbered chapters in different lifles (e..g.., "Fide I contains Chapter I and Chapter 2-1 "Fifle 2 contains Chapter I and Chapter 2), we will impose uniforim numbering so that each chapter Ihas a unique number. T'Iherefore, we may reinuirnlbeir as Chapters 1-1, 1 2, 2 1, 2--.2, etc.., incorporating the titIle nuirnbeir into the chapter numbers and theireby reflecting the fide in which they appear. T'Ihese chapter numbers will allso fillter tIhrOUgIh to the section nUInnbeirs if they do snot alliready followthat systeirn.. • Section inuirnbeiriling.. If the Code indludes dupIlicate numbered sections in different chapters (e..g.., Section 1, 2, etc..), we will impose uniform inumbeiring so that each section has a unique inuirnbeir.. T'heire-foire, we imay ireinumlber as Sections 1 2, 2 1, 2--.2, etc.., incoirporabrig the dhapteir number into the section inUinnIbeir and -therelby ireflecting the chapter in which they appear., III If the Code indludes different stylles of point sections (1-1 2A, 1 12A), we will make the stylle consistent throughout the Code.. o Sulbsectiloin inumbeiriling.. OR Structure. If the Code indludes inconsistent subsection designations throughout [e..g.., if one chapter uses Ilevells a.., 1, (a), and another uses Ilevells 1, A, and (1), we vvill appIly consistent subsection designations throughout the Code.. ff. Consecutilve inumbeiriling.. Misnumbered subsection iteirns (e..g.., 1, 2, 3, 3, 5) will The ireinunnbwed as necessary to correct obvious errors,, IC""�imlrmatfing Hilstoirlies.. Wheire histories acre Ilocated at the eind of each section, we imovetheirn uIpto the section titIle for each section so that the base history. for each section appears at the section Ilevell and subsequent arnendiments can The noted off the section oir its subsections as appropriate. > "ll'ablies. Standard formatting will be added to tablIes .......... boldfaced and centered headers, lines, Ilight giray Iheader shading, and indents w1heire ineeded.. BuIlIlets. Bullets may The iretaiined as is unlIess c1lairlity for indexing purposes requires their numbeirling.. Siling1le-colluimin Ilayout.. All Codes will be presented in a sing1le.--collumin format. rym Pagilinatiloin. Each chapter will begin on a new iright.-hand page.. Page numbers will conrellate with the chapter inuirnber.. Attachments. In eCode360, attachments are indluded as IPDF�s at the top of a chapter, and, lin the printed Code boolk, they acre indlUded at the eind of the chapter. Appendlix irnateiriiall to the Code.. If theire acre Appendix Iliists oir otheir tablIes at the end of the Code which weire created lby the prior codifier, we will con-firinn with the City whether such mateiriall is still used and should The retained and maintained through suppIleirneintation, oir if they s1houlld The iremoved.. If eferences. iExcept with pirioir approvall and agreement from the City, we will ireirnove pubIlisheir added footnotes oir section notes such as ciross references, statutory references, and charter reference items; these items acre copyrighted property of the former codifien, di i3lia I General Code will iretaiin the existing Ilegisllatiive text, with the exception of obvioustypos, oir otheir items requiring cllairity:: c1larl-fication of inumbeirs, imissing punctuation, incorrect oirdeir of punctuation, c1haingir ig IFooirman inuinnerall chapter inuinnIbers to Arabic numbers, capitallizing the nairne of the City, and calpitallizing the tides of certain officialls for consistency (e..g.., Mayor, ClIerk, Attorney, etc..).. Spell1l clheclk. A coirnIpIlete spell. --check will The peirfoirmed, and we will correct any obvious tylpos.. Code !'5 o' Code Adolptiloin, !if appIllicalbIle.. If the City and its IMuniicilpall Attorney lbellieve any of the inumbeirling (or other nonsubstaintive foirimat changes) identified Ihere require ireadoption of the Code, General Code will provide a simpIle draft ordlinance/local law for readolption.. RE eCode360's intuitive design, responsive navigation, and robust search functionality drive terformance and user satisfaction. S ai p e lo r 'varyane h�ree ��ntroductary eCode ftblii�nar lar Mwi�6�pWI Sta Our eCode webinar lets you work online with an experienced Training Specialist who can A great resource for municipal employees who want to help their constituents! Register here: hftps://www.generalcode.com/training/#webinars yowr Code bettvr svrve your caii i r�i inliiI y. Give departments and individuals within your municipality the ability to view and use the specific Code information they need—when they need it. With eCode360 Content Export, we export your Code's content to an Excel or CSV file. From there, the file can be imported into systems other departments are already using where information from your Code can be quickly viewed and used. This saves others specially staff who serve the public in the field—the time and effort of searching the entire Code manually to find the section they need. For more information about our Content Export services, please contact us at sales(@(Ieneralcode.com. 14 Pre"mittm eCode360 fC'al fires New Laws Between regular Code supplements, General Code will post PDF copies of new legislation to your online Code Custom Settings for Control the look of your eCode360 by selecting custom colors and Admin Users accents, and uploading a custom banner or photo Easy and Flexible Search by key words, phrases, section numbers and more Searching Electronic Index A comprehensive list of key words and phrases to speed searching Table of Contents Users can find the information they need and see their current location with a table of contents that moves as users browse Email or Share Links Email a link to a specific Code section or share via social media Printing Print with user-friendly functionality and a variety of user options Archive View View a permanent archive of your Code, updated with each supplement "Sticky" Table Table headers remain stationary as you scroll Headers Translate Users can view your Code in more than 100 additional languages eCode360 Search App Use your mobile device to search your Code Public and Private Create personalized links and annotations within the Code Notes Search across multiple Codes by municipality, geographic region, Multicode Search government type or population to find sample legislation or other Code content for zoning use, legal cases or historical research Download to Word Administrative users can download Code text to a Microsoft Word document to edit and track changes when drafting new legislation View Code Analytics See how many views your Code is getting, discover the most commonly searched topics Linked New Laws As new legislation is posted, we will add links from the New Laws section of eCode360 to the affected Code chapters or articles Download to PDF Public users can directly download Code text to a PDF document New Laws Indicators Code Change Indicators help users identify sections of your Code that have been changed and provide links to the new legislation Search across the Code, Public Documents, New Laws and Notes using Advanced Search an intuitive query tool and filtering system to quickly pinpoint the most relevant information Custornizable Titles of Administrative users can add customized titles and comments to your New Laws legislation in New Laws eAlert Public users can sign up to receive notifications of changes in the Code Add Code adjacent documents to your eCode site. They will be PubDocs Module searchable right alongside the Code. Documents can be made available to the public, or remain private to the municipal staff. 15 51`wII" III IIe eCoIde3I60 Sareei'm m� iI/ fiIINYo 0.4. Aprldan Mud4uk'E'SF NS'm�AtM�IltRkortz GvQuic is Uriks Cant t lv'ak'op"1'tta6on ., i, yoYnr... )'� I C,�Mv urie.n+rl W.iJ4@rt nrYr' ;y w„ I,r > '/"J_ld v> P, t P.rtIhGe.e-l:0,di.wcaa.. - garrrrx ,ACCs+iNl r,."u tiar,1 �,�,' No-";a r �,xm mcx 'm mrm��,a Part Ih, General Ordinances f Iii t$nauwm„vmmt C7muia�mm ft rwrody dali49WeA"'lpps _i s7Rirn nnit8a "�P' /.i ,6'taramrwamd� 2M dfl4'J4'1%51d fP;.App fGI .Y4{.YF iT d—_Ew"r. y �, dodo- dremwum.mrewo ftm, inta,� 4lY " �',9i.f,m r Y r7, Sae they. fA F,i a Frr Tr ..d ,1 "tr_C7,_ Y 'di �4mwn alp �cvmr„ I§cccvcny+ New Laws ftmn�rwredp ... Curfm i'R Wry dry) ? (Y µ4 OmI�YRTi Kmr�mmlm CMV, NO, R0P3^17 .IJ+i.t u,1,i1 Y l,. ".1NY) 4 rvq,n„ ci44 � I uMkmtteer�xrod,� (A gw''oc) v�xK4 v6— ,vrttk Enkmr2aunrremrRm 43rd. N. 2=3-IS ,klq„Y�,. ixy C1t 74 "Y 3�I„pwenrm:o- ra.n dEnpkdm v®. Gm ✓vcaw. If (nmmw.rmmd; [, t I ",f} Y n J'fa A10.tif1"I"IS `; ... rl ,'If Paw+rcn7hdcav Csdm aY Ime"rrPa,a— ?9 Al—hiclicBerr—gcg ., s 1 ,.,:. Fl—i 0nm.a,P-6- rwvur 6—Resolutionu Resolution,, � ��hmulluuul11111IIII111111IIIIIIII111II11�III11 —4 / Custom Hoare Page 01-4)44024PC atsud mnz 9.4•�.� 1111111 1 T {,.;� taa x3�.soal4 i-0 aalue eW% 5g,.7d � :: Y CIS rx.ig-xmmakat mwnamr 7m.m4 / cs.� kx ft manVueor 95,95 PUblic and Private Motes 2023f OY.63rSi5Y3 � 3 LuC+ixv. m7 Sm I"rvdd,"fS+Mv;.6� fW2(C`Ge7W.y 'rd kdi / Public Documents Portal ,,^f �7 rp ypx3 iM 5mPub enaSr.35 ,• �.. / ,v .. A inkWa3is I e 8s rya 0 % J o. Multrc..od ° 0 Investment Details and Options CIII verslllan II''IIrc)ject $2,990 SeirVk:es liiuriclluded Wllhllhe co&fica,floiri Ilpircw ect�: Convert the Code, as updated through Ordinance No. 2727, to XML Publishing System Editorial Work > Proofreading �> Shipping �""lirial ddlll4eiraldles iiiriclluded Wthtl[ie c(:)dliiflca,IlJoinIII' i%)Jecl�: > Premium eCode360 eCode360 Search Apo > Comprehensive Index > Disposition List > Customizable Tabs Qptiani11 (,'.arnlpanents $600 Annijal Maintenance$350 (bi'lled with eCode,3601 frue) anrl $250 onetinru(,:�, setijpi f'ele As a new ordinance is codified and added to your code, Trackback automatically embeds links in the related code section so you can easily reference the original ordinance. Simply click the link and the original ordinance is immediately available to view. This service begins with New Ordinances provided to General Code going forward. It does not include any Ordinances going back in time. 0 g o ll n g S e ry c e s �ireirnlkjiau eCo*360 Ariirn,4ll II I'ffrrliiururtermrruree $,I "195 The maintenance fee is an annual recurring flat fee that begins one year from the initial posting of eCode360. Therefore, we recommend that the City budget for this service each year. The fee covers annual licensing, web hosting, posting of new legislation between regular Code supplements and the Pu Docs Module. Please note that this does not include the cost for codifying new legislation. UtUire SeirVices General Code will provide supplementation services at a rate of $24.00 per page for a period of three years from date of publication. Tables Graphics and Charts will be billed at $10.00 per change. Thereafter, fees may be increased annually consistent with the Producer Price Index for Publishing Industries, published by the U.S. Dept. of Labor. To select your ongoing supplementation schedule, please see page 12. For more information about General Code's Supplementation Services, see page 19. Note: Full zoning rewrites are outside of the scope of this contract regarding supplementation rates. Pricing estimates available upon request. 10 u" Ill lllrlllrr°iiu ice and Sd�,wdtf�e reiloirirriaince SdhedUle� it 'I'llifflumm M, ���ayinneint Scdhedd�e: 11 Exhibit D eCode360® Service Level Agreement Provided by General Code for eCode360 (the Product). Last Updated 6/17/2025 Support Availability and Channels Support Type Regular Support Hours Channels Monday - Friday Description Ist General Code Action email: eCodeHeli)2 generalcode.com Standard 8:OOAM - 8:OOPM (Eastern Time Zone) Incident represents phone: 1-800-8336-8834 Incident response process is Excluding Federal Holidays complete unavailability of Technical Support Severity Level Definitions eCode3600 Service Level Agreement Page 1 of 3 Time to Severity Level Description Ist General Code Action Response Incident represents Incident response process is Level 1 complete unavailability of Within 15 initiated upon verification. Work EMERGENCY the Product for all users, Minutes on a resolution begins and no workaround is immediately. available Incident occurs when a Incident response process is major feature of the initiated upon verification. Level product is not working or Within 1.5 Situation is evaluated as to whether SEVERELY fails repeatedly and there Minutes a solution or acceptable work IMPAIRED is no workaround around can be achieved. Work on a available resolution begins once the evaluation is complete. Incident occurs when a Upon verification, issue is logged primary feature of the and work on resolution begins Level 3 Product is not working as Within 1 within 1 business day. If the issue IMPAIRED expected and an Hour is reported after hours, it will not acceptable workaround is be evaluated until the next business available day. Upon verification, issue is logged Incident that has a limited and work on resolution is Level 4 LOW business impact; primary Within 2-4 prioritized based on severity. If the IMPACT functionality is unaffected Hours issue is reported after hours, it will not be evaluated until the next business day. eCode3600 Service Level Agreement Page 1 of 3 Exhibit D General Code shall use commercially reasonable efforts to resolve incidents affecting the Product. Incidents that require debugging of programming code may need to be corrected during the next regular upgrade cycle. Resolution time will be based on the details and severity of an incident. Product Availability Term Definition Ability of a user to access the Product via the internet. General Code uses Availability industry -standard third -party monitoring to measure Availability through URL monitoring (HTTP) Available Hours of Twenty-four hours a day, seven days per week, minus scheduled downtime Operation Maintenance Updates, upgrades, bug fixes, and patches to the Product. Scheduled The period when the Product may be inaccessible to permit General Code to Downtime perform Maintenance services The downtime arising from causes beyond the reasonable direct control of General Code, such as events caused by Client's action or inaction, force Service majeure, interruption or failure of digital transmission links or Disruption telecommunications, certificate expirations, hostile network attacks, issues arising with customer Domain Name Systems (DNS), or Client Web Application Firewall (WAF). Unscheduled Any time after the first five minutes of downtime where the Product is not Downtime Available in any way. General Code will use commercially reasonable efforts to make the Product available 99.9% of the Available Hours of Operation, calculated on a calendar quarter basis, as follows: [(Total time in a quarter - Unscheduled Downtime - Scheduled Downtime - Service Disruption) / (Total time in a quarter - Scheduled Downtime - Service Disruption)] * 100 Reasonable efforts are made to avoid Scheduled Downtime to perform Maintenance. However, in circumstances where Scheduled Downtime is required, it will be scheduled on weekend days during evening hours (Eastern Time Zone). Product notifications for any Unscheduled Downtime or Service Disruption exceeding or estimated to exceed 30 minutes will be posted to generalcode.com and will occur within one (1) hour from the time the issues are first recognized by General Code. Reports of Unscheduled Downtime will be provided upon request up to once per calendar quarter. eCode3600 Service Level Agreement Page 2 of 3 Exhibit D Outage Credit Any credit provided within this Technical Support and Availability document will be referred to as an Outage Credit. Outage Credits are calculated once per calendar quarter upon request. If applicable, Outage Credits are applied as a credit to the customer's following renewal term for the customer's affected Product. Outage Credit is available solely to the extent Unscheduled Downtime created Level 1 EMERGENCY or Level 2 SEVERELY IMPAIRED issues for the Product. Unscheduled Downtime does not include Service Disruption. In no event shall any credit for a calendar quarter exceed the seven (7) days of Outage Credit. General Code shall have the ability to determine at its reasonable discretion whether Unscheduled Downtime has occurred. Outage Credit as follows: Site Outage per Quarter Amount of Outage Credit >99.9% No Outage Credit 99.8-98.0% 1 day credit 97.9-97% 3 days credit 96.9% or less 7 days credit eCode3600 Service Level Agreement Page 3 of 3 Exhibit D City of Tukwila Security Requirements Introduction During the term of this agreement, Contractor shall operate an information security program designed to meet the confidentiality, integrity, and availability requirements of the service or product being supplied. The program shall include at a minimum the following security measures. Governance 1. Information Security Policy: Contractor shall develop, implement, and maintain an information security policy and shall communicate the policy to all staff and contractors. 2. Information Security Accountability. Contractor shall appoint an employee of at least manager level who shall be accountable for the overall information security program. 3. Risk Management: Contractor shall employ a formal risk assessment process to identify security risks which may impact the products or services being supplied, and mitigate risks in a timely manner commensurate with the risk. Asset Management 4. Asset Inventory: Contractor shall maintain an inventory of all hardware and software assets, including asset ownership. 5. Data Classification: Contractor shall develop, implement, and maintain a data classification scheme and process designed to ensure that data is protected according to its confidentiality requirements. Supply Chain Risk Management 6. Supplier Security Assessments: Contractor shall engage in appropriate due diligence assessments of potential suppliers which may impact the security of the services or products being supplied. 7. Security in Supplier Agreements: Contractor shall ensure that agreements with suppliers who may impact the security of the services or products being supplied contain appropriate security requirements. Human Resource Security 8. Information Security Awareness: Contractor shall develop and implement an information security awareness program designed to ensure that all employees and contractors receive security education as relevant to their job function. 9. Background Checks: Contractor shall conduct appropriate background checks on all new employees based on the sensitivity of the role that they are being hired for. Identity Management, Authentication and Access Control 10. Authentication: Contractor shall ensure that all access, by employees or contractors, to its information systems used to provide services or products being supplied shall require appropriate authentication controls that at a minimum will include: TIS EXH—Security Requirements 02-2021 Page 1 of 3 a. Strong passwords or multi -factor authentication for users b. Multi -factor authentication for all remote access 11. Authorization: Contractor shall ensure that all access to its information systems used to provide services or products being supplied shall be approved by management. 12. Privileged Account Management: Contractor shall appropriately manage and control privileged accounts on its information systems that at a minimum will include: a. Use of dedicated accounts for privileged activity b. Maintaining an inventory of privileged accounts 13. Access Termination: Contractor shall develop and maintain a process designed to ensure that user access is revoked upon termination of employment, or contract for contractors. Data Security 14. Encryption: Contractor shall ensure that all laptops, mobile devices, and removable media, including those that are owned by Contractor employees or contractors, which may be used to store, process, or transport organizational data are encrypted at all times. µ� 11 u11'ig d l lou u . I hu w it � uuuir wn uti..ruY7l a iay II it a Cliv .l ul a ul r 1. ,ir a ui '., pectei.J tilt -11 �Iocissess any 1101°uf iiiJe Pial cir s ii islJve orgainlzafioii 4 iiata� 15. Secure Disposal: Contractor shall ensure that all media which may be used to store, process, or transport organizational data is disposed of in a secure manner. .SiCopllirli l i.udeflurrIII�u a uuuu wu u l u�u II a ��°� +.,1 uI _ ala lir u, u l ., Il +.,1I nuuh ii�:�ci iiifide infi l cir urrlifly rgairnli afiio I ,SII � uu�Il ��; int,. System Acquisition, Development and Maintenance 16. Security Requirements: Contractor shall ensure that information security requirements are defined for all new information systems, whether acquired or developed. 17. Separation of Environments: Contractor shall ensure that development and testing environments are separate from their production environment. 18. Data Anonymization: Contractor shall ensure that the City of Tukwila's data will not be used in the development or testing of new systems unless the data is appropriately anonymized. 19. Secure Coding: Contractor shall ensure that all applications are developed with secure coding practices, including OWASP Top 10 Most Critical Web Application Security Risks. Physical and Environmental Security 20. Risk Assessment: Contractor shall use a formal risk assessment methodology to identify physical and environmental threats and shall implement controls to minimize the risks. TIS EXH—Security Requirements 02-2021 Page 2 of 3 Information Protection Processes and Procedure 21. Hardening: Contractor shall develop and implement security configuration baselines for all endpoint and network devices types. 22. Network Segregation: Contractor shall segregate its network into zones based on trust levels, and control the flow of traffic between zones. 23. Anti-Malware: Contractor shall ensure that all information systems that are susceptible to malware are protected by up-to-date anti-malware software. 24. Wireless Access Control: Contractor shall ensure that wireless network access is protected, including at a minimum: a. All wireless network access should be encrypted b. All wireless network access to the production network should be authenticated using multi -factor authentication such as machine certificates c. Wireless network access for personal devices and guest access should be segregated from the production network 25. Patching: Contractor shall evaluate, test, and apply information system patches in a timely fashion according to their risk. 26. Backup and Recovery: Contractor shall implement a backup and recovery process designed to ensure that data can be recovered in the event of unexpected loss. Protective Technology 27. Logging: Contractor shall ensure that security event logging requirements have been defined, and that all information systems are configured to meet logging requirements. 28. Intrusion Detection: Contractor shall deploy intrusion detection or prevention systems at the network perimeter. 29. URL Filtering: Contractor shall deploy tools to limit web browsing activity based on URL categories. 30. Denial of Service Protection: Contractor shall deploy controls to detect and mitigate denial of service attacks. Security Continuous Monitoring 31. Security Monitoring: Contractor shall deploy automated tools to collect, correlate, and analyze security event logs from multiple sources, and monitor them for suspected security incidents. 32. Vulnerability Assessments: Contractor shall conduct vulnerability assessments against all Internet -facing information systems on a regular basis, no less often than quarterly. 33. Penetration Testing: Contractor shall perform penetration tests on all web applications and services, in accordance with standard penetration testing methodologies, on a regular basis, no less often than annually. Information Security Incident Management 34. Incident Response: Contractor shall develop, implement, and maintain an information security incident response process, and will test the process on a regular basis, no less often than annually. TIS EXH—Security Requirements 02-2021 Page 3 of 3 Exhibit E Data Protection and Information Security This Data Protection and Information Security Exhibit ("Exhibit") is an attachment to the Agreement and sets forth the data protection and information security requirements of City of Tukwila. This Exhibit includes by reference the terms and conditions of the Agreement. In the event of any inconsistencies between this Exhibit and the Agreement, the parties agree that the terms and conditions of the Exhibit will prevail. Throughout the term of the Agreement and for as long as Contractor controls, possesses, stores, transmits, or processes Confidential Information as part of the Services provided to City of Tukwila, Contractor will comply with the requirements set forth in this Exhibit. Any breach of this Exhibit will be deemed a material breach under the Agreement. 1. Definitions "Authorized Personnel" for the purposes of this Exhibit, means Contractor's employees or subcontractors who: (i) have a need to receive or access Confidential Information or Personal Information to enable Contractor to perform its obligations under the Agreement; and (ii) are bound in writing with Contractor by confidentiality obligations sufficient for the protection of Confidential Information and Personal Information in accordance with the terms and conditions set forth in the Agreement and this Exhibit. "Common Software Vulnerabilities" (CSV) are application defects and errors that are commonly exploited in software. This includes but is not limited to: (i) The CWE/SANS Top 25 Programming Errors – see http://cwe.mitre.org/top25/ and http://www.sans.org/top25-software-errors/ (ii) The Open Web Application Security Project's (OWASP) "Top Ten Project" – see httr)://www.owasio.org "Confidential Information" means certain non-public proprietary information that has economic value and is protected with reasonable safeguards to maintain its secrecy. Confidential Information may include, but is not limited to any financial data, business and other plans, specifications, equipment designs, electronic configurations, design information, product architecture algorithms, quality assurance plans, inventions (whether or not the subject of pending patent applications), ideas, discoveries, formulae, models, requirements, standards, trade and manufacturing secrets, drawings, samples, devices, demonstrations, technical information, all Personal Information as defined in RCW 42.56.590 that come within the Contractor's possession in the course of performance under this Agreement, as well as any and all intellectual and industrial property rights contained therein or in relation thereto; provided that, Personal Information shall remain Confidential Information even if at the time of disclosure or collection, or later, it is or becomes known to the public. "Industry Standards" mean generally recognized industry standards, best practices, and benchmarks including but not limited to: (i) Payment Card Industry Data Security Standards ("PCI DSS") – see htti3://www.i3cisecuritystandards.org/ (ii) National Institute for Standards and Technology – see http://csrc.nist.gov/ (iii) ISO/ IEC 27000 -series –see httK)://www.iso27001security.com/ TIS EXH—Data Protection and Info Security 02-2021 Page 1 of 10 (iv) COBIT 5 – http://www.isaca.org/cobit/ (v) Cyber Security Framework – see http://www.nist.gov/cyberframework/ (vi) Cloud Security Alliance – see https://cloudsecurityalliance.org/ (vii) Other standards applicable to the services provided by Contractor to City of Tukwila "Information Protection Laws" mean all local, state, federal and international laws, standards, guidelines, policies, regulations and procedures applicable to Contractor or City of Tukwila pertaining to data security, confidentiality, privacy, and breach notification. "Personal Information" also known as Personally Identifiable Information (PII), is defined in RCW 42.56.590 and includes information of City of Tukwila customers, employees and subcontractors or their devices gathered or used by Contractor that can be used on its own or combined with other information to identify, contact, or locate a person, or to identify an individual or his or her device in context. Examples of Personal Information include name, social security number or national identifier, biometric records, driver's license number, device identifier, IP address, MAC address, either alone or when combined with other personal or identifying information which is linked or linkable to a specific individual or device, such as date and place of birth, mother's maiden name, etc. "Security Incident" is any actual or suspected occurrence of: (i) Unauthorized access, use, alteration, disclosure, loss, theft of, or destruction of Confidential Information or the systems / storage media containing Confidential Information (ii) Illicit or malicious code, phishing, spamming, spoofing (iii) Unauthorized use of, or unauthorized access to, Contractor's systems (iv) Inability to access Confidential Information or Contractor systems as a result of a Denial of Service (DOS) or Distributed Denial of Service (DDOS) attack (v) Loss of Confidential Information due to a breach of security "Security Vulnerability" is an application, operating system, or system flaw (including but not limited to associated process, computer, device, network, or software weakness) that can be exploited resulting in a Security Incident. 2. Roles of the Parties and Compliance with Information Protection Laws As between City of Tukwila and Contractor, City of Tukwila shall be the principal and Contractor shall be its agent with respect to the collection, use, processing and disclosure of all Confidential Information. The Parties shall comply with their respective obligations as the principal (e.g., data owner/controller/covered entity) and agent (e.g., data processor/business associate/trading partner) under all Information Protection Laws. The Parties acknowledge that, with respect to all Confidential Information processed by Contractor for the purpose of providing the Services under this Agreement: a. City of Tukwila shall determine the scope, purpose, and manner in which such Confidential Information may be accessed or processed by Contractor, and Contractor shall limit its access to or use of Confidential Information to that which is necessary to TIS EXH—Data Protection and Info Security 02-2021 Page 2 of 10 provide the Services, comply with applicable laws, or as otherwise directed by City of Tukwila, b. Each party shall be responsible for compliance with Information Protection Laws in accordance with their respective roles; and Contractor and City of Tukwila shall implement the technical and organizational measures specified in this Exhibit and any additional procedures agreed upon pursuant to a Statement of Work ("SOW") to protect Confidential Information against unauthorized use, destruction or loss, alteration, disclosure or access. 3. General Security Requirements Contractor will have an information security program that has been developed, implemented and maintained in accordance with Industry Standards. At a minimum, Contractor's information security program will include, but not be limited to, the following elements: 3.1 Information Security Program Management. Contractor will have or assign a qualified member of its workforce or commission a reputable third -party service provider to be responsible for the development, implementation and maintenance of Contractor's enterprise information security program. 3.2 Policies and Standards. To protect City of Tukwila Confidential Information, Contractor will implement and maintain reasonable security that complies with Information Protection Laws and meets data security Industry Standards. a. Security Policies and Standards. Contractor will maintain formal written information security policies and standards that: (i) Define the administrative, physical, and technological controls to protect the confidentiality, integrity, and availability of Confidential Information, City of Tukwila systems, and Contractor systems (including mobile devices) used in providing Services to City of Tukwila Encompasses secure access, retention, and transport of Confidential Information (iii) Provide for disciplinary or legal action in the event of violation of policy by employees or Contractor subcontractors and vendors (iv) Prevent unauthorized access to City of Tukwila data, City of Tukwila systems, and Contractor systems, including access by Contractor's terminated employees and subcontractors (v) Employ the requirements for assessment, monitoring and auditing procedures to ensure Contractor is compliant with the policies (vi) Conduct an annual assessment of the policies, and upon City of Tukwila written request, provide attestation of compliance. b. In the SOW or other document, Contractor will identify to City of Tukwila all third -party vendors (including those providing subcontractors to Contractor) involved in the provision of the Services to City of Tukwila, and will specify those third -party vendors that will have access to Confidential Information. TIS EXH—Data Protection and Info Security 02-2021 Page 3 of 10 3.3 Security and Privacy Training. Contractor, at its expense, will train new and existing employees and subcontractors to comply with the data security and data privacy obligations under this Agreement and this Exhibit. Ongoing training is to be provided at least annually and more frequently as appropriate or requested by City of Tukwila. City of Tukwila may provide specific training material to Contractor to include in its employee/subcontractor training. 3.4 Access Control. Contractor will ensure that City of Tukwila Confidential Information will be accessible only by Authorized Personnel after appropriate user authentication and access controls (including but not limited to two -factor authentication) that satisfy the requirements of this Exhibit. Each Authorized Personnel shall have unique access credentials and shall receive training which includes a prohibition on sharing access credentials with any other person. Contractor should maintain access logs relevant to City of Tukwila Confidential Information for a minimum of six years or other mutually agreed upon duration. 3.5 Data Backup. The parties shall agree in an SOW or other document upon the categories of City of Tukwila Confidential Information that are required to be backed up by Contractor. Unless otherwise agreed to in writing by City of Tukwila, backups of City of Tukwila Confidential Information shall reside solely in the United States. For the orderly and timely recovery of Confidential Information in the event of a service interruption: a. Contractor will store a backup of Confidential Information at a secure offsite facility and maintain a contemporaneous backup of Confidential Information on-site to meet needed data recovery time objectives. b. Contractor will encrypt and isolate all City of Tukwila backup data on portable media from any backup data of Contractor's other customers. 3.6 Business Continuity Planning (BCP) and Disaster Recovery (DR). Contractor will maintain an appropriate business continuity and disaster recovery plan to enable Contractor to adequately respond to, and recover from, business interruptions involving City of Tukwila Confidential Information or services provided by Contractor to City of Tukwila. a. At a minimum, Contractor will test the BCP and DR plan annually, in accordance with Industry Standards, to ensure that the business interruption and disaster objectives set forth in this Exhibit have been met and will promptly remedy any failures. Upon City of Tukwila's request, Contractor will provide City of Tukwila with a written summary of the annual test results. b. In the event of a business interruption that activates the BCP and DR plan affecting the Services or Confidential Information of City of Tukwila, Contractor will notify City of Tukwila's designated Security Contact as soon as possible. c. Contractor will allow City of Tukwila or its authorized third party, upon a minimum of 30 days' notice to Contractor's designated Security Contact, to perform an assessment of Contractor's BCP and DR plan once annually, or more frequently if agreed to in an SOW or other document. Following notice provided by City of Tukwila, the parties will meet to determine the scope and timing of the assessment. TIS EXH—Data Protection and Info Security 02-2021 Page 4 of 10 3.7 Network Security. Contractor agrees to implement and maintain network security controls that conform to Industry Standards including but not limited to the following: a. Firewalls. Contractor will utilize firewalls to manage and restrict inbound, outbound and internal network traffic to only the necessary hosts and network resources. b. Network Architecture. Contractor will appropriately segment its network to only allow authorized hosts and users to traverse areas of the network and access resources that are required for their job responsibilities. c. Demilitarized Zone (DMZ). Contractor will ensure that publicly accessible servers are placed on a separate, isolated network segment typically referred to as the DMZ. d. Wireless Security. Contractor will ensure that its wireless network(s) only utilize strong encryption, such as WPA2. e. Intrusion Detection/Intrusion Prevention (IDS/IPS) System. Contractor will have an IDS and/or IPS in place to detect inappropriate, incorrect, or anomalous activity and determine whether Contractor's computer network and/or server(s) have experienced an unauthorized intrusion. 3.8 Application and Software Security. Contractor, should it provide software applications or Software as a Service (SaaS) to City of Tukwila, agrees that its product(s) will remain secure from Software Vulnerabilities and, at a minimum, incorporate the following: a. Malicious Code Protection. Contractor's software development processes and environment must protect against malicious code being introduced into its product(s) future releases and/or updates. b. Application Level Security. Contractor must use a reputable third party to conduct static/manual application vulnerability scans on the application(s) software provided to City of Tukwila for each major code release or at the time of contract renewal. An internally produced static/manual test from the Contractor will not be accepted. Results of the application testing will be provided to City of Tukwila in a summary report and vulnerabilities categorized as Very High, High or that have been identified as part of the OWASP Top 10 and SANS Top 25 within 10 weeks of identification. c. Vulnerability Management. Contractor agrees at all times to provide, maintain and support its software and subsequent updates, upgrades, and bug fixes such that the software is and remains secure from Common Software Vulnerabilities. d. Logging. Contractor software that controls access to Confidential Information must log and track all access to the information. e. Updates and Patches. Contractor agrees to promptly provide updates and patches to remediate Security Vulnerabilities that are exploitable. Upon City of Tukwila's request, Contractor shall provide information on remediation efforts of known Security Vulnerabilities. 3.9 Data Security. Contractor agrees to preserve the confidentiality, integrity and accessibility of City of Tukwila Confidential Information with administrative, technical and physical measures that conform to Industry Standards that Contractor then applies to its own systems and processing environment. Unless otherwise agreed to in writing by City of Tukwila, Contractor agrees that any and all City of Tukwila Confidential Information will be stored, processed, and maintained solely on designated systems located in the continental United States. Additionally: TIS EXH—Data Protection and Info Security 02-2021 Page 5 of 10 a. Encryption. Contractor agrees that all City of Tukwila Confidential Information and Personal Information will be encrypted with a Federal Information Processing Standard (FIPS) compliant encryption product, also referred to as 140-2 compliant. Symmetric keys will be encrypted with a minimum of 128 -bit key and asymmetric encryption requires a minimum of 1024 bit key length. Encryption will be utilized in the following instances: • City of Tukwila Confidential Information and Personal Information will be stored on any portable computing device or any portable storage medium. • City of Tukwila Confidential Information and Personal Information will be transmitted or exchanged over a public network. b. Data Segregation. Contractor will segregate City of Tukwila Confidential Information and Personal Information from Contractor's data and from the data of Contractor's other customers or third parties. 3.10 Data Re -Use. Contractor agrees that any and all data exchanged shall be used expressly and solely for the purposes enumerated in the Agreement. Data shall not be distributed, repurposed or shared across other applications, environments, or business units of Contractor. Contractor further agrees that no Confidential Information of any kind shall be transmitted, exchanged or otherwise passed to other parties except on a case-by-case basis as specifically agreed to in writing by City of Tukwila. 3.11 Data Destruction and Data Retention. Upon expiration or termination of this Agreement or upon City of Tukwila's written request, Contractor and its Authorized Personnel will promptly return to City of Tukwila all City of Tukwila Confidential Information and/or securely destroy City of Tukwila Confidential Information. At a minimum, destruction of data activity is to be performed according to the standards enumerated by the National Institute of Standards, Guidelines for Media Sanitization – see httr):Hcsrc.nist.gov/. If destroyed, an officer of Contractor must certify to City of Tukwila in writing within 10 business days all destruction of City of Tukwila Confidential Information. If Contractor is required to retain any City of Tukwila Confidential Information or metadata to comply with a legal requirement, Contractor shall provide notice to both the general notice contact in the Agreement as well as City of Tukwila's designated Security Contact. 3.12 Right to Audit. Upon a minimum of 30 days' written notice to Contractor, Contractor agrees to allow City of Tukwila or a mutually agreed upon independent third party under a Non - Disclosure Agreement to perform an audit of Contractor's policies, procedures, software, system(s), and data processing environment at City of Tukwila's expense to confirm compliance with this Exhibit. Prior to commencement of the audit, the parties will discuss the scope of the audit and the schedule. Contractor shall provide reasonable support to the audit team. Upon request Contractor will provide any relevant third party assessment reports such as SOC 2, PCI DSS Report on Compliance, or ISO 27001 certification. Unless critical issues are identified during the audit, such audits will be restricted to once in any 12 month period. If issues are identified, Contractor shall provide a remediation plan to City of Tukwila to remedy such issues at Contractor's expense. TIS EXH—Data Protection and Info Security 02-2021 Page 6 of 10 3.13 Security Testing. Contractor, at its expense, will allow City of Tukwila to conduct static, dynamic, automated, and/or manual security testing on its software products and/or services, hardware, devices, and systems to identify Security Vulnerabilities on an ongoing basis. Should any vulnerabilities be discovered, Contractor agrees to notify City of Tukwila and create a mutually agreed upon remediation plan to resolve all vulnerabilities identified. City of Tukwila has the right to request or conduct additional reasonable security testing throughout the Term of the Agreement. 4. Security Incident / Data Breach 4.1 Security Contact. The individuals identified below shall serve as each party's designated Security Contact for security issues under this Agreement. City of Tukwila Security Contact: Name Bao Trinh Address 6300 Southcenter Blvd Tukwila, WA 98188 Phone 206 396-2741 Email TISDepartment(cD.TukwilaWA.gov Contractor Security Contact: Name Steve Smith 781 Elmgrove Rd Address Rochester, NY 14624 Phone 800.836.8834 Email ssmith2@generalcode.com TIS EXH—Data Protection and Info Security 02-2021 Page 7 of 10 4.2 Requirements. Contractor will take commercially reasonable actions to ensure that City of Tukwila is protected against any and all reasonably anticipated Security Incidents, including but not limited to: (i) Contractor's systems are continually monitored to detect evidence of a Security Incident (ii) Contractor has a Security Incident response process to manage and to take corrective action for any suspected or realized Security Incident (iii) Upon request Contractor will provide City of Tukwila with a copy of its Security Incident policies and procedures. If a Security Incident affecting City of Tukwila occurs, Contractor, at its expense and in accordance with applicable Information Protection Laws, will immediately take action to prevent the continuation of the Security Incident. 4.3 Notification. Within eight hours of Contractor's initial awareness of a Security Incident or other mutually agreed upon time period, Contractor will notify City of Tukwila of the incident by calling by phone the City of Tukwila Security Contact(s) listed above. 4.4 Investigation and Remediation. Upon Contractor's notification to City of Tukwila of a Security Incident, the parties will coordinate to investigate the Security Incident. Contractor shall be responsible for leading the investigation of the Security Incident, but shall cooperate with City of Tukwila to the extent City of Tukwila requires involvement in the investigation. Contractor shall involve law enforcement in the investigation if requested by City of Tukwila. Depending upon the type and scope of the Security Incident, City of Tukwila personnel may participate in: (i) interviews with Contractor's employees and subcontractors involved in the incident; and (ii) review of all relevant records, logs, files, reporting data, systems, Contractor devices, and other materials as otherwise required by City of Tukwila. Contractor will cooperate, at its expense, with City of Tukwila in any litigation or investigation deemed reasonably necessary by City of Tukwila to protect its rights relating to the use, disclosure, protection and maintenance of Confidential Information. Contractor will reimburse City of Tukwila for actual costs incurred by City of Tukwila in responding to, and mitigating damages caused by any Security Incident, including all costs of notice and remediation which City of Tukwila, in its sole discretion, deems necessary to protect such affected individuals in light of the risks posed by the Security Incident. Contractor will, at Contractor's own expense, provide City of Tukwila with all information necessary for City of Tukwila to comply with data breach recordkeeping, reporting and notification requirements pursuant to Information Protection Laws. Contractor will use reasonable efforts to prevent a recurrence of any such Security Incident. Additionally, Contractor will provide (or reimburse City of Tukwila) for at least one year of complimentary access for one credit monitoring service, credit protection service, credit fraud alert and/or similar services, which City of Tukwila deems necessary to protect affected individuals in light of risks posed by a Security Incident. 4.5 Reporting. Contractor will provide City of Tukwila with a final written incident report within five business days after resolution of a Security Incident or upon determination that the Security Incident cannot be sufficiently resolved. TIS EXH—Data Protection and Info Security 02-2021 Page 8 of 10 5. Confidential Information or Personal Information 5.1 Authorized Personnel. Contractor will require all Authorized Personnel to meet Contractor's obligations under the Agreement with respect to Confidential Information or Personal Information. Contractor will screen and evaluate all Authorized Personnel and will provide appropriate privacy and security training, as set forth above, in order to meet Contractor's obligations under the Agreement. Upon City of Tukwila's written request, Contractor will provide City of Tukwila with a list of Authorized Personnel. Contractor will remain fully responsible for any act, error, or omission of its Authorized Personnel. 5.2 Handling of Confidential Information or Personal Information. Contractor will: a. Keep and maintain all Confidential Information and Personal Information in strict confidence in accordance with the terms of the Agreement b. Use and disclose Confidential Information and/or Personal Information solely and exclusively for the purpose for which the Confidential Information or Personal Information is provided pursuant to the terms and conditions of the Agreement. Contractor will not disclose Confidential Information or Personal Information to any person other than to Authorized Personnel without City of Tukwila's prior written consent, unless and to the extent required by applicable law, in which case, Contractor will use best efforts to notify City of Tukwila before any such disclosure or as soon thereafter as reasonably possible. In addition, Contractor will not produce any Confidential Information or Personal Information in response to a non -legally binding request for disclosure of such Personal Information. 5.3 Data and Privacy Protection Laws. Contractor represents and warrants that its collection, access, use, storage, disposal, and disclosure of Personal Information complies with all applicable federal, state, local and foreign data and privacy protection laws, as well as all other applicable regulations and directives. 6. Third Party Security 6.1 Contractor will conduct thorough background checks and due diligence on any third and fourth parties which materially impact Contractor's ability to provide the products and/or Services to City of Tukwila as described in the Agreement. 6.2 Contractor will not outsource any work related to its products or the Services provided to City of Tukwila in countries outside the United States of America, which have not been disclosed in the Agreement or without prior written approval from City of Tukwila Legal and Information Security. If Contractor desires to outsource certain work during the Term of the Agreement, Contractor shall first notify City of Tukwila so that the parties can ensure adequate security protections are in place with respect to the Services provided to City of Tukwila. TIS EXH—Data Protection and Info Security 02-2021 Page 9 of 10 7. Payment Cardholder Data 7.1 If Contractor accesses, collects, processes, uses, stores, transmits, discloses, or disposes of City of Tukwila and/or City of Tukwila customer credit, debit, or other payment cardholder information, Contractor agrees to the following additional requirements: a. Contractor, at its sole expense, will comply with the Payment Card Industry Data Security Standard ("PCI DSS"), as may be amended or changed from time to time, including without limitation, any and all payment card industry validation actions (e.g., third party assessments, self -assessments, security vulnerability scans, or any other actions identified by payment card companies for the purpose of validating Contractor's compliance with the PCI DSS). b. Contractor will maintain a continuous PCI DSS compliance program. Annually, Contractor agrees to provide evidence of PCI DSS compliance in the form of a Qualified Security Assessor ("QSA") Assessment Certificate, a PCI Report on Compliance ("ROC"), or evidence that Contractor is included on the Visa or MasterCard list of PCI DSS Validated Service Providers. c. Contractor will ensure that subcontractors approved by City of Tukwila, in accordance with Section 6.2, comply with and maintain a continuous PCI DSS compliance program if the subcontractor provides any service on behalf of Contractor that falls within PCI DSS scope. The Subcontractor must provide evidence of PCI DSS compliance in the form of a Qualified Security Assessor ("QSA") Assessment Certificate, a PCI Report on Compliance ("ROC"), or evidence that Subcontractor is included on the Visa or MasterCard list of PCI DSS Validated Service Providers. d. Contractor will immediately notify City of Tukwila if Contractor is found to be non- compliant with a PCI DSS requirement or if there is any breach of cardholder data impacting City of Tukwila or its customers. 8. Changes In the event of any change in City of Tukwila's data protection or privacy obligations due to legislative or regulatory actions, industry standards, technology advances, or contractual obligations, Contractor will work in good faith with City of Tukwila to promptly amend this Exhibit accordingly. TIS EXH—Data Protection and Info Security 02-2021 Page 10 of 10 Exhibit F Authorization and Agreement The City of Tukwila, eMigrate, February 11, 2025 Cai'°Hivarsliian II''IIrc)iect II'3Irl e $2,990 TrackBack Ant-tual Matnlenance $350 (t)illed w4h arrrtual eC"ooe,56) dr e) and $250 oneVrre f6e $600 Ill 111 llll 111 �u 111 lii 111SIII ieddk,� SdIectk�)ln Based on our experience of legislative activity, we will use a Quarterly Supplement Schedule for future updates to the Code after this project is complete. If you would prefer a different schedule, please select from the options below: 11 Electronic monthly supplementation (Annual Print) `1�`VUII VIII�nvestI�i ent Including all of the options selected above, the total project price will be: $2,990 The City of Tukwila, Washington, hereby agrees to the procedures outlined above, and to General Code's Codification Terms and Conditions, which are available at uurlrja (attached) City of Tukwila, King County, Washington [ Sig"Id by. By: Title: City Clerk Date: 6/30/2025 1 4:17 PM PDT GENERAL CODE, LLC By: Q PW777 J . . ... ... . . n 773 71") 2 5 1 6 ;1 3 E D`7 Title. VP of Client Engagement Date: 06/30/2025 Sig..d by. Witnessed by: Title: Deputy City Clerk Date: 6/30/2025 1 4:36 PM PDT Witnessed by: La" Eaw..� Title: Proposal Publishing Associate Date: 6/30/2025 Scan and email the completed form to contracts@generalcode.com. You may also return it by mail to General Code, 781 Elmgrove Road, Rochester, NY 14624. 12 TERMS AND CONDITIONS LAW AND ORDINANCE CODIFICATION, SUPPLEMENTATION SERVICES AND ONLINE CODE HOSTING AND UPDATES These Terms and Conditions, together with the Proposal (the "Proposal"), constitute a legally binding agreement (this "Agreement") between the MUNICIPALITY/Licensee (the "Municipality") and General Code, LLC, Quality Code Publishing, LLC or Code Publishing, LLC (collectively, the "Company"). 1. Responsibility of The Company. The Company shall be responsible for the performance of the services provided for in this Agreement in accordance with the "Performance Schedule." The Company shall be responsible for the correctness and accuracy of its work, based upon the material and information supplied by the Municipality, as reflected in the completed codification, supplementation and online hosted code updates delivered to the Municipality. Regardless of the Municipality's acceptance of completed materials when delivered, the Company shall correct errors found either by the Municipality or the Company. See "Warranties; Limitations" for the Company's liability for all services. 2. Responsibility of the Municipality. The Municipality shall be responsible for the correctness and accuracy of the information it supplies to the Company (-Municipality Content"). By acquiring an online hosted code, the Municipality hereby requests that Municipality Content be posted online, and the Municipality will be responsible for the presentation, accuracy and completeness of the Municipality Content provided, and the Company will be entitled to post that Municipality Content without review or editing. Further, the Municipality is responsible for providing the Company with timely decisions and answers to questions raised by the Company, for inclusion of sufficient funds in the budget to pay the Company for services, and for the prompt payment of invoices. The Municipality shall also be responsible for completing its work in accordance with the "Performance Schedule." 3. Responsibility of the Municipality's Counsel. In conjunction with the services rendered by the Company and the work of the Municipality and the Company, any and all questions requiring legal advice or opinion, analysis of legislation for legal sufficiency, interpretation of cases or statute, etc., shall be directed by the Municipality and the Company to the Municipality's counsel. At the request of the Municipality or its counsel, the Company shall make available to the Municipality's counsel information in its possession relating to legal issues or opinions obtained during its work with other municipalities, as well as sample copies of legislation as requested by the Municipality. 4. Protection of Confidential Information. During the time this Agreement is in effect, both the Municipality and the Company may have access to or receive information that is of a confidential nature. This information may include data relating to client information, products, product development, designs, processes, systems, computer software, computer hardware, methods of production, costs, pricing, finances, sales or marketing plans, customers, business partners, vendors, vendor prospects, employees and municipal records and data. All such information, including any materials embodying such information, whether disclosed orally or otherwise and whether or not marked "Confidential" or "Proprietary," will be considered by officials of the Municipality and by the Company and the Company's employees as proprietary and confidential. Both the Municipality and the Company will use reasonable efforts to protect the confidentiality of the other's Confidential Information but in no case less than the same efforts as it uses to protect its own confidential information and will not use any Confidential Information of the other for any purpose other than fulfilling its obligations under this Agreement. 5. Indemnification. The Municipality hereby agrees to indemnify, defend and hold the Company harmless from and against any and all liability, losses, costs, and expenses (including reasonable attorneys' fees) incurred by the Company in connection with any claim arising out of or relating to: Page 1 of 6 Rev date: 03.26.24 A. The Municipality's use of online code; B. The content, the quality, or the performance of Municipality Content; C. The Municipality's violation of this Agreement; or D. The Municipality's violation of the rights of any other person or entity. Subject to the limitations and exclusions set forth in this agreement, General Code shall release, indemnify, defend and hold harmless the Client, its officers, employees, and representatives from and against any and all third -party demands, liabilities, losses, damages, expenses (including reasonable attorney's fees) and judgments for any personal injuries, death, or property damage in any way relating to or arising from the negligent performance of General Code under this Contract. 6. Municipality Primary Contact. The Municipality shall identify, and name, an appropriate individual, with corresponding contact information, including electronic mail address, as the "Primary Contact" with whom the Company should communicate matters regarding the online code, such as maintenance notifications, and who has the authority to make requests including release of Municipality data, both internally to the Company and to the Municipality, restoration of data, and other configuration changes. 7. System Monitoring. The Company will not systematically monitor Municipality Content, but the Company reserves the right to review Municipality Content from time to time at its discretion. The Company reserves the right to (a) disable access to or delete any Municipality Content which it determines in its sole discretion (such discretion to be exercised in good faith) to be illegal, obscene, threatening, defamatory, fraudulent, infringing, harassing, or otherwise offensive, and (b) disable access to or delete any other Municipality Content under justified exigent circumstances, as such circumstances are determined in good faith by the Company. S. Payment Terms. All invoices will be processed in accordance with the Payment Schedule set forth in the Proposal. However, the Municipality may choose to pay in advance of Payment Schedule for products and services provided in this Agreement, if so desired. In such a case, the Company shall hold the funds on account and draw from them in accordance with the Payment Schedule until the Contract is completed, or for up to 12 months, whichever is later. If any funds remain on account after 12 months, or end of Contract, the Company will contact the Municipality regarding disposition of said funds. Unless otherwise specified in the Payment Schedule, all payments shall be made within 30 days of receipt of the invoice/voucher. The Municipality shall not discount nor withhold any portion of the amount for any reason. The Company reserves the right to issue progress billings for services that span several months. 9. Software. A. DEFINITIONS (i) "Licensed Program" shall mean the Company software product eCode36W` and any other software product provided to the Municipality by the Company or its affiliates or licensors pursuant to the Proposal. (ii) "Update" means a new release of the Licensed Software made available by the Company to its customers, containing bug fixes and minor modifications or enhancements, but not a new version containing significant new features, as determined by the Company in its sole discretion. (iii) "Use" shall mean accessing, downloading, copying or duplication of any portion of a Licensed Program from the Internet, storage units or media for processing or the utilization of the Licensed Program for its intended purpose. B. LICENSE GRANT The Company hereby grants the Municipality a non-exclusive, non -transferable, non -licensable, non - assignable license to Use the Licensed Program. Page 2 of 6 Rev date: 03.26.24 C. PROPRIETARY RIGHTS; RESTRICTIONS The Licensed Program is owned by the Company and/or its affiliates and/or licensors and is copyrighted and proprietary in nature. The Licensed Program is being licensed, not sold to the Municipality. The Municipality shall respect such proprietary rights and shall not use such Licensed Program except as permitted by this Agreement and shall not decompile, disassemble or reverse engineer the Licensed Program, and shall not sublicense, sell, distribute, rent, or disclose the Licensed Program, in whole or in part, in whatever form without the express written permission of the Company. The Municipality will not use the Licensed Program to take any actions that (i) infringe on any third party's copyright, patent, trademark, trade secret or other proprietary rights or rights of publicity or privacy; (ii) violate any applicable law, statute, ordinance or regulation (including those regarding export control); or (iii) are defamatory, trade libelous, threatening, harassing, or obscene. D. LIMITED WARRANTY; LIMIT OF LIABILITY (i) Limited Warranty. The Company warrants to the Municipality that the Licensed Program will perform substantially in accordance with the accompanying written materials for a period of one year from the date of receipt. The Company's entire liability and the Municipality's exclusive remedy shall be, at the Company's option, either repair or replacement of the Licensed Program that does meet this Limited Warranty. Claims under this Limited Warranty must be received by the Company during the one year period. Any repaired or replaced Licensed Program shall be warranted for the remainder of the original one year warranty period or 30 days from the date of receipt, whichever is longer. This Limited Warranty applies only to the Municipality and does not apply to failures caused by abuse, misuse or casualty loss, including power outages and surges. (II) NO OTHER WARRANTY. THE COMPANY DOES NOT WARRANT THAT THE LICENSED PROGRAM IS FREE FROM ALL BUGS, ERRORS AND OMISSIONS. EXCEPT FOR THE LIMITED WARRANTY SET FORTH IN SUBSECTION D(I) , THE COMPANY MAKES NO OTHER WARRANTIES, EXPRESS OR IMPLIED, OF ANY KIND, INCLUDING, WITHOUT LIMITATION, MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE, WITH REGARD TO ANY LICENSED PROGRAM AND/OR RELATED MATERIALS TO BE FURNISHED BY THE COMPANY. (iii) Limitation of Liability. In no event shall the Company be liable for any lost profits, revenues, use, opportunities, or data, or any indirect, special, punitive or consequential damages in connection with or arising out of this Agreement or the existence, furnishing, failure to furnish, or use of the Licensed Program and/or related material and/or device. In any case, the Company's total liability shall be limited to the price paid by the Municipality for the Licensed Program. E. MAINTENANCE OF LICENSED PROGRAM (i) Fees for Maintenance. Upon termination of the warranty period specified in subsection D(i), The Company will invoice the Municipality for maintenance services for the twelve (12) months following expiration of the warranty period. If the Municipality pays the annual maintenance fee within thirty (30) days after invoice, the Company shall provide such maintenance services for such twelve (12) month period. If the Municipality does not timely pay the annual maintenance fee, then the Company shall have no further obligation to provide maintenance or support of the Licensed Program to the Municipality. If the Municipality pays the first annual maintenance fee, the Company will thereafter invoice Municipality annually for the maintenance fee for so long as the Municipality pays the annual maintenance fee. If the Municipality timely pays the annual maintenance fee, the Company's maintenance services shall continue for that annual period. If the Municipality does not timely pay the annual maintenance fee, then the Company shall have no further obligation to provide maintenance or support to the Municipality, and the Company may terminate this Agreement pursuant to Section 1213. If the Municipality allows the maintenance services to lapse, it may not reinstate maintenance services unless it first pays all maintenance fees for the lapsed period. Page 3 of 6 Rev date: 03.26.24 (ii) Updates. During any annual period for which the Municipality has paid the annual maintenance fee, the Municipality shall be provided with any Updates produced by the Company at no additional charge. Nothing herein shall convey any rights to the Municipality with respect to any new version of the Licensed Program. F. TRANSFER OF LICENSE The Municipality agrees that it shall not assign or transfer this license granted herein without the prior written consent of The Company. G. GENERAL (i) If the Licensed Program is acquired by an agency or other part of the U.S. Government, the Licensed Program and accompanying written materials are provided with Restricted Rights and use, duplication, or disclosure by the Government is subject to restrictions as set forth in Rights in General Data Alternative III at 48 CFR 52.227.14 or in subparagraphs (c) (1) and (2) of the Commercial Computer Program -Restricted Rights clause at 48 C.F.R. 52.227-19, as applicable. (ii) This Section 9 is a license of software and is not a sale of goods. Neither Article 2 of the Uniform Commercial Code or the U.N. Convention on Contracts for the International Sale of Goods shall be applicable to the Licensed Program. 10. Delivery of Completed Materials. The Company will deliver completed materials via USPS, UPS, motor freight, air freight, FTP or whichever method offers the most efficient delivery at the time. Delivery, handling, packaging, insurance and/or shipping charges will be prepaid by the Company and added to the invoice/voucher for services to be paid by the Municipality. 11. Title; Copyright. A. The Municipality will retain all rights, including copyrights, and title to the text of its municipal code (the "Code") but hereby grants to the Company the right and license to use, reproduce, adapt, distribute, display and advertise the Code, and to digitize the Code and to prepare, reproduce, publish and sell, distribute, transmit, perform, display, broadcast, upload, download, communicate to the public, rent, lend or otherwise transfer or make available or store in any medium a copy of the Code whether or not adapted or abridged on its own or in combination with any other work by means of or through any electronic medium, including, digital, optical and magnetic information storage and retrieval platforms or systems, on-line, electronic or other reproduction, transmission or publication, or by any other means whether now known or subsequently developed. B. All computer software and other intellectual property of the Company used in performing its services shall remain the property of the Company and/or its affiliates and/or licensors. Model building codes and/or other model codes used by the Company in the Licensed Program or otherwise is performing its services shall remain the property of the Company and/or its affiliates, and no ownership or other proprietary right in those model codes is conveyed in the Municipality. 12. Term and Termination. A. Unless otherwise specified in the Proposal, the initial term of this Agreement, unless sooner terminated as hereafter provided, shall be for one year, commencing on the date hereof, and will then be automatically extended for additional successive one-year periods unless either party notifies the other in writing not less than 90 days prior to the end of the initial term or any extension period that this Agreement will not be extended. Services and support provided during any extension period will be provided at the Company's then -current price. B. If the Municipality fails to pay any amount payable to the Company under this Agreement, including maintenance fees, when due, the Company may terminate this Agreement upon 30 days prior written notice to the Municipality. Services and support provided during any extension period will be provided at the Company's then -current price. Page 4 of 6 Rev date: 03.26.24 C. Either party shall have the right to terminate this Agreement with immediate effect if the other party fails to cure to such party's reasonable satisfaction any material breach or violation of this Agreement within 60 days after such party has given the other written notice thereof. D. Upon termination, the Company shall promptly return all materials received from the Municipality, and the Company shall be entitled to receive just and equitable compensation for all services performed prior to the date of termination. E. If this Agreement terminates, the Company may, upon ten -days prior notice to the Municipality, cease hosting on the Company's website the Code and other Municipality Content posted by the Municipality. F. Section 4, 5, 9C, 9D, 9G, 11, 12, 13 and 15 through 24 shall survive any expiration or termination of this Agreement. 13. Warranties; Limitations. A. The Company warrants that the services provided hereunder will be performed by qualified personnel in a good and workmanlike manner and that any deliverables will be free of material defects. The Company's liability and the Municipality's exclusive remedy for failure of any set -vice or deliverable to meet this warranty shall be limited to reperformance, at the Company's cost, of such service or deliverable. The Company's warranty does not extend to failures arising out of (i) incorrect or insufficient data, specifications or instructions provided by the Municipality or (ii) work or services performed by others. B. THE COMPANY DOES NOT WARRANT THAT SOFTWARE WILL BE ERROR FREE OR WILL OPERATE UNINTERRUPTED. THE FOREGOING WARRANTIES ARE IN LIEU OF ALL OTHER WARRANTIES, WHETHER ORAL, WRITTEN, EXPRESS, IMPLIED OR STATUTORY. IMPLIED WARRANTIES OF FITNESS AND MERCHANTABILITY SHALL NOT APPLY. THE COMPANY'S WARRANTY OBLIGATIONS AND THE MUNICIPALITY'S REMEDIES HEREUNDER ARE SOLELY AND EXCLUSIVELY AS STATED HEREIN. C. The limitations and protections against liability afforded the Company, and its licensors herein shall apply to any action or claim in connection with the services, whether based on contract, tort, statute or otherwise (including negligence, warranty and strict liability). The cumulative liability of the Company, and its licensors for all obligations, warranties and guaranties, whether express or implied, with respect to services performed hereunder shall be limited to the amount paid to the Company pursuant to this Agreement. The Company, and its licensors shall not be liable to the Municipality or any other person or entity for lost profits, revenues, use, opportunities, or data, or any indirect, special, incidental, punitive or consequential damages arising from the performance or nonperformance of services or the use or inability to use any software or product, irrespective of whether the claims or actions for such damages are based upon contract, tort, negligence, strict liability, warranty or otherwise. D. No action may be maintained or proceeding commenced by the Municipality or others against the Company or its licensors with respect to the Licensed Program or services unless such action or proceeding is commenced within one year after completion by the Company of the particular services to which such action or proceeding relates. 14. Changes. The Municipality may at any time request changes in the scope of this Agreement. Moreover, the Company may suggest changes. Where changes are agreed to by the parties, the Company shall issue a Change Order for the Municipality's review and signature describing the changes as well as the adjustments in schedule and fees occasioned by the changes in scope. the Company shall not be required to implement any change until the Municipality has signed and returned the Change Order. 15. Notices. All notices and other communications which are required or permitted to be given pursuant to this Agreement shall be in writing and shall be delivered either personally, by facsimile, by reputable overnight courier or by registered or certified mail and shall be deemed effectively received (i) if delivered in person, on the date of such delivery, (ii) if transmitted by facsimile, on the date indicated on the sender's receipt of confirmation, (iii) if delivered by overnight courier, on the next business day following deposit thereof with such overnight courier, or (iv) if sent by mail, upon the third business day following the deposit thereof, postage prepaid. Page 5 of 6 Rev date: 03.26.24 16. Force Majeure. If any performance by any party shall be prevented, hindered or delayed by reason of any cause beyond the reasonable control of such party (such event being hereafter called an "event"), including, without limitation, acts of God, riots, fires, floods, unusually severe weather, curtailment or termination of sources or supplies of energy or power, inability to obtain or delay in obtaining materials or supplies, strikes or other disputes involving such party or its subcontractors or suppliers, acts of war, insurrection, civil unrest, terrorism, elevated risk of terrorism, riot or disorder, acts of governmental authorities, changes in law or regulation, or any other cause beyond the reasonable control of such party, whether similar or dissimilar to those expressed hereinabove, such party shall be excused from performance to the extent that its performance is so prevented, hindered or delayed. Such excuse from performance shall extend so long as the event continues to prevent, hinder or delay the performance by such party. The party whose performance is affected shall give the other parties notice within 15 days of the event specifying the event, the performance affected and the anticipated date, if any, performance can be made. 17. Assignment. The Company may, without the Municipality's consent, transfer this Agreement, or any of its rights and obligations under this Agreement, to any of its affiliated entities, including but not limited to International Code Council, Inc., General Code Enterprises, LLC, and/or TCC Codification, Inc. 18. Disclaimer of Association. This Agreement shall not be construed as creating a partnership, joint venture, agency or any other association which would impose upon one party liability for the acts or omission of the other, and neither party shall have the right to bind the other. 19. No Waiver. Any failure by either party hereto to enforce at any time any term or condition shall not be considered a waiver of that party's right thereafter to enforce each and every term and condition. 20. Severability of Provisions. If any part of this Agreement is found or deemed by a court of competent jurisdiction to be invalid or unenforceable, that part shall be severed from this Agreement and shall be deemed to have never been a part of this Agreement and shall not affect the validity of the remainder of this Agreement. 21. Entire Agreement. This Agreement is the complete and exclusive statement of the mutual understanding of the parties and supersedes and cancels all previous written and oral agreements and communications relating to the subject matter. 22. Dispute Resolution. The parties mutually agree to seek mediation as the preferred alternative of dispute resolution in the event of any disagreement over the terms of this contract. 23. Governing Law; Jurisdiction. This Agreement is governed by the laws of Washington, without regard to its conflict of laws doctrine. Each party consents to the exclusive jurisdiction of the courts sitting in King County, State of Washington with respect to any disputes arising out of this Agreement. In any action or proceeding arising out of this Agreement, the prevailing party shall be entitled to recover its reasonable legal fees and expenses. 24. Counterparts; Signatures. This Agreement may be executed in two or more counterparts, each of which shall, when executed, be deemed to be an original and all of which shall be deemed to be one and the same instrument. The exchange of copies of this Agreement, including executed signature pages, by electronic transmission (including pdf or any electronic signature complying with the U.S. federal ESIGN Act of 2000, e.g., www.docusign.com) will constitute effective execution and delivery of this Agreement for all purposes. Page 6 of 6 Rev date: 03.26.24