Loading...
HomeMy WebLinkAbout25-275 - Contract - Washington State Department of Revenue - Business Licensing ServicesDocusign Envelope ID: 78DE879C-FD61-4052-A9E3-1D924334F4E8 25-275 Council Approval 10/6/25 APPROVED AS TO FORM BY CITY ATTORNEY 8/21/25. APPROVAL ON FILE. State of Washington Page 1 of 12 ESD Contract #K2488 Department of Revenue 'M PDT WASHINGTON STATE DOR Contract #: K2488 C�"I:'�iI�irr���I�tt of i"E"ADEPARTMENT rCA OF REVENUE ��� s'/'�F1P!'1�zC:on St ote and CITY OF TUKWILA Contract Information Contract start date Contract end date Authorization: Date of Mutual Execution December 31, 2030 Chapter 39.34 RCW Purpose Establish a Business Licensing Agreement between the parties in accordance with RCW 35.90.020. Parties: City of Tukwila (Tukwila) Address Mailing address (if different) 6200 Southcenter Blvd jla, WA 98188-2544 Contract Manager: 0.� Telephone: Email Adam Schierenbeck J (206) 431-2179 Adam.Schierenbeck@TukwilaWA.gov Department of Revenue(DOR) Contact address: Department administration: 6400 Linderson Way, SW, Initial Taxpayer Services Contract manager: (Area code) Telephone: Email: Denise Ceja (360) 705-6631 DeniseC@dor.wa.gov Attachments: The following documents are attached and/or incorporated herein. Attachment A— Statements of Work Attachment B - Confidentiality and Data Sharing Agreement Attachment C - User Data Privacy Acknowledgement Affirmation: The terms and conditions of this Contract are an integration and representation of the final, entire, and exclusive understanding between the parties superseding, all previous agreements, writings, and communications, oral or otherwise, regarding the subject matter of this Contract. The parties signing below represent that they have read and understand this Contract and have the authority to execute it on behalf of their respective entity. Tukwila: Date Department of Revenue Date Signed by:`` DocuSigned/b'y�: bN1aS rV�r� 10/7/2025 1 1:58:17 P PDT 10/7/2025 13:07:35 Name Name Thomas McLeod Sherry Cave Title Title Mayor of Tukwila Program Director— Business and Financial Services APPROVED AS TO FORM BY CITY ATTORNEY 8/21/25. APPROVAL ON FILE. State of Washington Page 1 of 12 ESD Contract #K2488 Department of Revenue 'M PDT Docusign Envelope ID: 78DE879C-FD61-4052-A9E3-1 D924334F4E8 This Agreement ("Agreement") is between the Washington State Department of Revenue ("DOR"") and City of Tukwila ("Tukwila"). DOR and Tukwila may be referred to individually as "Party" and collectively as "Parties." The Parties hereby agree as follows: Background Information PURPOSE The purpose of this Agreement is to establish the terms under which the Business Licensing Services (BLS) program of the Department of Revenue will act as Tukwila's agent for the purpose of collecting, processing, and disbursing information, licenses, and fees related to Tukwila's licensing or other regulatory activities, hereafter referred to as Confidential Licensing Information. Tukwila retains all power and authority over its business licensing and other regulatory activities except as expressly delegated to Revenue under this Agreement. Per RCW 35.90.020 (1) "a city that requires a general business license of any person that engages in business activities within that city must partner with the department (Revenue) to have such license issued, and renewed if the city requires renewal, through the business licensing service in accordance with chapter 19.02 RCW." 2. AUTHORIZATION This agreement is authorized under RCW 39.34 RCW — Interlocal Act, and further in accordance with RCW 35. 09.020. TERMS AND CONDITIONS 3. CONTRACT TERM The term of this Agreement is from the date of mutual execution to December 31, 2030. Parties may agree to extend or reduce the term per a mutually executed written amendment. There is no present limit to the number of possible extensions. 4. STATEMENT OF WORK All services performed by each party are set out in Attachment A, Statement of Work. Each party shall minimally provide all services as set forth therein. Both Parties understand that their performance requirement is included in statute and each Party shall perform such activities in a manner that the Party determines appropriate for the objectives, costs, and effectiveness of the overall requirement. 5. COMPENSATION Services identified in this Agreement are provided by Revenue at no charge with the exception of the following: Partner may reimburse Revenue the costs of developing and producing ad hoc informational reports. Ad hoc reports will be created only if requested by the Partner and agreed upon by Revenue. Partner shall reimburse Revenue's expenses for the implementation of changes to the BLS process, if requested by the Partner and agreed upon by Revenue. State of Washington Page 2 of 12 ESD Contract #K2488 Department of Revenue Docusign Envelope ID: 78DE879C-FD61-4052-A9E3-1 D924334F4E8 All project coordination costs, including travel -related expenses, shall be absorbed by the respective parties for their own staff. 6. INVOICING DOR will submit invoices to Tukwila as needed, but in no event more frequently than monthly. Invoices must include Tukwila's contract number in included on the first page of this agreement. Invoices must also provide adequate information to identify the charges being billed. Upon expiration or termination of this Agreement, any claim for payment not already made shall be submitted within ninety (90) calendar days after the expiration/termination date or the end of the fiscal year, whichever is earlier. Tukwila will provide and maintain with Revenue its current billing address and named unit, or named personnel, to whom invoices should be directed. 7. PAYMENT Tukwila shall pay all invoices by warrant or account transfer within thirty (30) calendar days of the invoice issue date. NO ADVANCE PAYMENT: No advance payments shall be made for any services furnished pursuant to this Contract. 8. CONFIDENTIALITY AND DATA SHARING The parties agree to the confidentiality and data sharing provisions set forth in Attachment B. 9. AMENDMENTS The parties are allowed to amend this Agreement to the extent that such amendments do not alter this agreement outside the scope of the Statewide Agreement. Amendments are binding only when made in writing and signed by the authorized signatory who has the authority to bind the respective party. Under no circumstances does DOR's acting contract manager or project manager have the authorization to sign an amendment. 10. CHANGE IN STATUTORY REQUIREMENTS The provisions of this Agreement shall be deemed to change in a manner that is consistent with any changes to any directly applicable statutory authority, provided that the change is consistent with the manifest intent of this Agreement and does not conflict with any of its express provisions. Any such change to this Agreement shall be effective on the effective date of the change in authority. 11. DISPUTE RESOLUTION When a dispute arises and cannot be resolved by direct negotiation, the parties agree to participate in non-binding mediation in good faith. The mediator shall be chosen by the parties. If the parties cannot agree on a mediator, the parties shall use a mediation service that selects the mediator for the parties. Nothing in this contract shall be construed to limit the parties' choice of a mutually acceptable alternative resolution method such as a disputes hearing, or a Dispute Resolution Board. Either of the parties may also request intervention by the Governor, as provided by RCW 43.17.330, in which event the Governor's process will control. State of Washington Page 3 of 12 ESD Contract #K2488 Department of Revenue Docusign Envelope ID: 78DE879C-FD61-4052-A9E3-1 D924334F4E8 12. GOVERNANCE This Contract shall be construed and interpreted in accordance with the laws of the state of Washington and the venue hereunder will be in the Superior Court for Thurston County. In the event of an inconsistency in this Contract, unless otherwise provided, the inconsistency is resolved by giving precedence in the following order: a) Applicable Washington State Statutes and Regulations. b) All terms and conditions of this Agreement. c) All terms and conditions set forth in attachments. 13. RECORDS RETENTION AND AUDIT RECORDs RETENTION. Each party shall maintain books, records, documents, and other evidence pertaining to this Contract to the extent and in such detail as shall adequately reflect performance and administration of payments and fees. Each Party shall retain the same for in accordance with their own retention schedules. 14. SEVERABILITY If any term or condition of this Contract is held invalid, the remainder of the Contract remains valid and in full force and effect. 15. SUBCONTRACTORS Tukwila may use subcontractors to carry work performances under this agreement. Tukwila's use of subcontractors does not reduce or release the Tukwila from its liability for any breach of the Tukwila's or subcontractor's duties herein. Additional Data Privacy Conditions for Subcontractors: Before a subcontractor used by Tukwila may gain access to DOR confidential information, Tukwila must: 1. Compel against the subcontractor in writing all data sharing safeguards and restrictions as set forth in Attachment B to this agreement. Tukwila must maintain a copy of the compelling document on file, and must be made available to DOR at DOR's request. 2. Require each subcontractor personnel who may gain access to DOR confidential data to execute a copy of the acknowledgement similar to the one attached hereto as Attachment C. All user acknowledgements must be kept on file by Tukwila, and must be made available to DOR at DOR's request. 16. SURVIVORSHIP Notwithstanding the expiration of the initial term of this Contract or any extension thereof, the terms, conditions and warranties contained in this Contract that by their sense and context are intended to survive the completion of the performance, cancellation or termination of this Contract shall so survive. This shall minimally include, without limitation, all matters concerning the permissible use and safeguarding of confidential information and matters pertaining to record preservation and subsequent disposition. 17. TERMINATION Termination for Convenience: Either party, may terminate this Agreement, in whole or in part for convenience at any time upon providing ninety (90) days' notice to the other. If this Contract is so terminated, DOR will be liable only for payment in accordance with the terms of this Contract for services rendered prior to the effective date of State of Washington Page 4 of 12 ESD Contract #K2488 Department of Revenue Docusign Envelope ID: 78DE879C-FD61-4052-A9E3-1 D924334F4E8 termination. No penalty will accrue to DOR in the event the termination option in this section is exercised 18. WAIVER Any omission by either party to exercise its rights under this Contract does not preclude that party from subsequent exercising of such rights and does not constitute a waiver of any rights. A waiver of rights must be stated in a writing signed by an authorized representative with signature authority on behalf of the party. State of Washington Page 5 of 12 ESD Contract #K2488 Department of Revenue Docusign Envelope ID: 78DE879C-FD61-4052-A9E3-1 D924334F4E8 Attachment A — Statement of Work Each parry shall perform as set forth below, and shall use best efforts as determined by them to be in good faith and appropriate, when considering the objectives, costs, and effectiveness of the overall engagement. Revenue services. • Distribute and process initial and renewal internet and/or paper-based applications for Partner's business licensing and/or other regulatory activities. • Collect and process license fees and licensing information received from applicants and licensees. Disburse collected fees as directed by Partner. • Issue Business License with Partner's license endorsement as authorized by Partner. • Provide routine reports on Partner's business licenses as requested by Partner, which may include daily lists of new business applications and renewals, fees processed each day, weekly list of pending accounts, and lists of businesses for which fees have been transferred. • Maintain electronic or microfilm images of all paper documents and electronic representations of electronic filings received by Revenue from applicants and provide copies as requested. • Maintain a database containing information received from applicants and licensees . • Provide technical assistance to establish and configure appropriate licensing system access and secure access for Partner staff. • Provide initial training to Partner staff in the use of the licensing system, and ongoing training to address changes to the BLS database/access protocols or in Partner staff. Training will occur at Partner's location, over the telephone, or online, as agreed upon by the parties. • Effect reasonable modifications in the BLS system, database, process, or forms to accommodate Partner's licensing or other regulatory requirements. Revenue will consult with Partner in evaluating alternatives and determining the most feasible and timely means of achieving Partner objectives. • Timely notify Partner of other modifications to the BLS system, database, process, or forms, including modifications accommodating other BLS partners. City of Tukwila Services: • Timely provide Revenue with all information requested to implement Partner's participation in the BLS program. • Follow all requirements identified by Revenue as necessary for participation in the BLS program, including using: o The Business License Application and other forms and processes established by Revenue. o The Business License document for proof of licensure under Partner's licensing or regulatory program. o The Unified Business Identifier (UBI) number to identify licensees and license accounts in all communications with Revenue. • Obtain and maintain at its own cost, all necessary equipment and online services required at Partner's business location(s) to support Partner's access into and use of the BLS Database. End-to-end testing will take place until such time as Revenue is satisfied. • Ensure Partner Licensing and Information Technology staff are available to respond promptly to Revenue. Partner staff will be knowledgeable of Partner operations and/or technology and be able to assist Revenue staff with process improvements and/or troubleshooting. • Provide timely advance notice to Revenue of potential changes to Partner business licensing requirements, fees or processes. • Upon request by Revenue, provide statistical data associated with the BLS Partner Partnership Agreement such as Full Time Equivalent (FTE) savings, change in number of Partner licensees, and change in revenue flow. State of Washington Page 6 of 12 ESD Contract #K2488 Department of Revenue Docusign Envelope ID: 78DE879C-FD61-4052-A9E3-1 D924334F4E8 Attachment B CONFIDENTIALITY AND DATA SHARING AGREEMENT I. Purpose and Scope The following provisions establish the terms under which the Department of Revenue ("Revenue") and Partner will share confidential data pursuant to the Business Licensing Services Agreement (the "Agreement"). II. Definitions A. "Confidential Licensing Information" (CLI) has the same meaning as "Licensing Information" under Revised Code of Washington (RCW) 19.02.115(1)(b). CLI is classified as at least Category 3 data under Washington's Standard for Securing Information Technology Assets, Office of the Chief Information Officer (OCIO) Standard No. 141.10. B "Confidential Tax Information" (CTI) has the same meaning as "Return," "Tax Information," and "Taxpayer Identity" under RCW 82.32.330(b), (c), & (e). CTI is classified as at least Category 3 data under Washington's Standard for Securing Information Technology Assets, OCIO Standard No. 141.10. C. "Confidential" refers to data classified as at least Category 3 data under Washington's Standard for Securing Information Technology Assets, OCIO Standard No. 141.10. D. "Portable Devices" refers to small portable computing devices. Examples of portable devices include, but are not limited to handhelds/PDAs, Ultramobile PCs, flash memory devices (e.g., USB flash drives, personal media players), portable hard disks, and laptop/notebook computers. E. "Portable Media" refers to small portable digital storage media. Examples of portable media include, but are not limited to optical media (e.g., CDs, DVDs, Blu-Rays), magnetic media (e.g., floppy disks, tape, Zip or Jaz disks), or flash media (e.g., CompactFlash, SD, MMC). F. "Data" refers to individual pieces of information. G. "Cloud" refers to a non -Partner data center(s) offering infrastructure, operating system platform, or software services. A more complete definition of "cloud" can be found in the National Institute of Standards (NIST) Special Publication 800-145. H. "Encryption" refers to enciphering data with a NIST -approved algorithm or cryptographic module using a NIST -approved key length. I. "Complex Password" or "Complex Passphrase" refers to a secret phrase, string of characters, numbers, or symbols used for authentication that is not easily guessable and meets an established industry guideline for complexity and length, such as NIST Special Publication 800- 118. III. Data Classification, Authorized Use, Access, and Disclosure A. Data Classification: Data shared under this Agreement is considered confidential and classified as at least Category 3 data under Washington's Standard for Securing Information Technology Assets, OCIO Standard No. 141.10. B. Permitted Uses: Business licensing information may be used for official purposes only. C. Permitted Access: Business licensing information may be accessed only by Partner's employees and agents that have a bona fide need to access such information in carrying out their official duties. Page 7 of 12 Docusign Envelope ID: 78DE879C-FD61-4052-A9E3-1 D924334F4E8 D. Permitted Disclosure: Business licensing information received under the Agreement must not be disclosed to non-parties unless the disclosure is: 1) Ordered under any judicial or administrative proceeding; or 2) Otherwise expressly authorized by Revenue in writing. IV. Confidentiality Partner and Revenue each agree to keep confidential and secure from unauthorized use, access, or disclosure all confidential data received under the Agreement. A. Ensuring Security: Partner shall establish and implement physical, electronic, and managerial policies, procedures, and safeguards to ensure that all confidential data exchanged under this Agreement is secure from unauthorized use, access, or disclosure. B. Proof of Security. Revenue reserves the right to monitor, audit, or investigate Partner's security policies, procedures, and safeguards for confidential data. Partner agrees to provide information or proof of its security policies, procedures, and safeguards as reasonably requested by Revenue. V. Statutory Prohibition Against Disclosure; Confidentiality Agreement A. Criminal Sanctions. RCW 19.02.115(2) prohibits the disclosure of Confidential Licensing Information, except as expressly authorized under RCW 19.02.115(3). RCW 82.32.330(2) prohibits the disclosure of Confidential Tax Information except as expressly authorized under RCW 82.32.330(3). It is a misdemeanor for any person acquiring Confidential Licensing Information or Confidential Tax Information under this Agreement to disclose such information in violation of the disclosure limitations stated in RCW 19.02.115 and RCW 82.32.330. Partner will require employees with access to Confidential Licensing Information and/or Confidential Tax Information to sign a copy of the confidentiality agreement attached at Exhibit C. VI. Breach of Confidentiality In the event of any use, access, or disclosure of confidential data by Partner, or its employees or agents in material violation of the terms of this Agreement: A. Partner shall notify Revenue in writing as soon as practicable, but no later than three working days, after determining that a violation has occurred. B. Revenue may immediately terminate this Agreement and require the certified return or destruction of all records containing confidential data received under the Agreement. VIII. Data Security Confidential data provided by Revenue shall be stored in a secure physical location and on Partner - owned devices with access limited to the least number of staff needed to complete the purpose of this Agreement. A. Partner agrees to store data only on one or more of the following media and protect the data as described: 1) Workstation hard disk drives a) Access to the data stored on local workstation hard disk drives will be restricted to authorized users by requiring logon to the local workstation using a unique user ID and complex password, passphrase, or other authentication mechanisms which provide equal or greater security, such as biometrics or smart cards. Page 8 of 12 Docusign Envelope ID: 78DE879C-FD61-4052-A9E3-1 D924334F4E8 b) If the workstation is not located in a secure physical location, hard drive must be encrypted. c) Workstations must be maintained with current anti-malware or anti-virus software. d) Software and operating system security patches on workstations must be kept current. 2) Network servers a) Access to data stored on hard disks mounted on network servers and made available through shared folders will be restricted to authorized users through the use of access control lists, which will grant access only after the authorized user has authenticated to the network using a unique user ID and complex password, passphrase, or other authentication mechanisms that provide equal or greater security, such as biometrics or smart cards. b) Data on disks mounted to such servers must be located in a secure physical location. c) Servers must be maintained with current anti-malware or anti-virus software. d) Software and operating system security patches on servers must be kept current. 3) Backup tapes or backup media a) Partner may archive Revenue data for disaster recovery (DR) or data recovery purposes. b) Backup devices, tapes, or media must be kept in a secure physical location. c) Backup tapes and media must be encrypted. d) When being transported outside of a secure physical location, tapes or media must be under the physical control of Partner staff with authorization to access the data or under the physical control of a secure courier contracted by Partner for transportation purposes. 4) Cloud Storage a) Revenue will meet cloud and data requirements in Washington's Standard for Securing Information Technology Assets, OCIO Standard 141.10. b) Revenue and Partner will, at a minimum, meet the following requirements: i. Encrypt the data at rest and in transit. ii. Control access to the cloud environment with a unique user ID and complex password, passphrase, or stronger authentication method such as a physical token or biometrics. iii. Cloud provider data center(s) and systems must be Service Organization Control (SOC) 2 Type II certified. 5) All data provided by Revenue shall be stored on a secure environment by city staff. The City will implement these policies to ensure this security: a) Staff will not store or place any Revenue material on any portable devices or portable media (USB devices, CD/DVD, etc.). b) Staff will not email information provided by Revenue to anyone outside of City staff. c) Staff shall only access Revenue information on a City network computer. d) Staff will not save any Revenue reports or data on the hard drive of any City computer. It shall only be stored on a City network. B. Protection of Data in Transit Partner agrees that any retransmission of Revenue data over a network, other than the Partner's internal business network will be encrypted. IX. Data Segregation Revenue data must be segregated or otherwise distinguishable from non -Revenue data. This is to ensure that if the data is breached through unauthorized access, it can be reported to Revenue and when the data is no longer needed by Partner, all Revenue data can be identified for return or destruction. X. Data Breach Notification Page 9 of 12 Docusign Envelope ID: 78DE879C-FD61-4052-A9E3-1 D924334F4E8 If Partner or its agents detect a compromise or potential compromise in the data security for Revenue data such that data may have been accessed or disclosed without proper authorization, Partner shall give notice to Revenue within one (1) business day of discovering the compromise or potential compromise. Partner shall take corrective action as soon as practicable to eliminate the cause of the breach and shall be responsible for ensuring that appropriate notice is made to those individuals whose personal information may have been improperly accessed or disclosed. At a minimum, notification to Revenue will include: A. The date and time of the event. B. A description of the Revenue data involved in the event; and C. Corrective actions the Partner is taking to prevent further compromise of data. XI. Disposition of Data A. Records furnished to the Partner in any medium remain the property of Revenue. B. Revenue data no longer needed by the Partner must be disposed of following the data destruction procedures in this Agreement. C. Upon the destruction of Revenue data, the partner shall complete a Certification of Data Disposition (attached to this Agreement as Exhibit B), and submit it to the Contract Manager within 15 days of the date of disposal. XII. Data Destruction Procedures The following are acceptable destruction methods for various types of media. At least one method defined under the various types of media must be used to destroy Revenue data for that media type. A. Optical discs 1) Incinerate the disc(s); or 2) Shred the discs. B. Magnetic tape(s) 1) Degauss. 2) Incinerate; or 3) Crosscut shredding C. Digital files on serer or workstation hard drives or similar media 1) For mechanical hard drives, use a "wipe" utility which will overwrite the data at least 3 times using either random or single character data. 2) For solid state hard drives, use a "secure erase" utility that resets all cells to zero. 3) Degauss sufficiently to ensure that the data cannot be reconstructed; or 4) Physically destroy disk(s) D. Portable media 1) For mechanical hard drives, use a "wipe" utility which will overwrite the data at least three times using either random or single character data. 2) For solid state hard drives and devices, use a "secure erase" utility that resets all cells to zero. 3) Degauss sufficiently to ensure that the data cannot be reconstructed. 4) Physically destroying disk(s) or devices. 5) For SmartPhones and similar small portable devices use one of the following: Page 10 of 12 Docusign Envelope ID: 78DE879C-FD61-4052-A9E3-1 D924334F4E8 a) If the devices are encrypted and secured with a complex password, the data is considered destroyed. Before disposal or reissuance of the device, make sure the data is encrypted and then reset the device to original or new condition; or b) If a Mobile Device Management (MDM) solution for the device exists, enable the remote wipe command to destroy the data. E. Cloud Storage Use the cloud provider's procedures to permanently delete the files and folders. ****end***** Page 11 of 12 Docusign Envelope ID: 78DE879C-FD61-4052-A9E3-1 D924334F4E8 Attachment C Individual Acknowledgement of Data Privacy and Data Security Safeguards Re: Subcontracting work for City of Tukwila, Data Security: Contract K2488 ("Agreement") between City of Tukwila and Department of Revenue I, the undersigned, hereby acknowledge my understanding and agreement as follows: 1. 1 will be performing work on behalf of the City of Tukwila, which includes work that is covered by the "Agreement." 2. As part of this work, I may receive access to confidential information as that term is defined in the "Agreement.". 3. 1 have been afforded the opportunity to review and inquire about all data security safeguards and requirements set forth in the "Agreement.". 4. 1 further understand that by working on behalf of the City of Tukwila, I too have the duty to follow all noted data security safeguards and requirements set forth in the "Agreement." 5. 1 fully understand the data security safeguards and requirements and shall fully comply with them. Signature: Typed/Print Name Name of company (if applicable.) Page 12 of 12 Date: