Loading...
The URL can be used to link to this page
Your browser does not support the video tag.
Home
My WebLink
About
2021-484-E-Visitor Bureau-Photoshelter- Cloud base digital asset management platform licensing agreement
Revised 06/21 1 [Departmental Use Only] TITLE PhotoShelter Contract FY 2021-2022 NORTH CAROLINA SERVICES AGREEMENT NO RFP/RFQ ORANGE COUNTY This Services Agreement (hereinafter “Agreement”), made and entered into this 25th day of August, 2021, (“Effective Date”) by and between Orange County, North Carolina a political subdivision of the State of North Carolina (hereinafter, the "County") and PhotoShelter Inc., a Delaware Corporation, with offices at 111 Broadway, 19th Floor, New York, New York, 10006, (hereinafter, the "Provider"). WITNESSETH: That the County and Provider, for the consideration herein named, do hereby agree as follows: 1. Services a. Scope of Work. i) This Agreement is for services to be rendered by Provider to County with respect to (insert type of project): Cloud-based digital asset management platform licensing agreement. ii) By executing this Agreement, the Provider represents and agrees that Provider is qualified to perform and fully capable of performing and providing the services required or necessary under this Agreement in a fully competent, professional and timely manner. iii) Time is of the essence with respect to this Agreement. iv) The services to be performed under this Agreement consist of Basic Services, as described and designated in Section 3 hereof. Compensation to the Provider for Basic Services under this Agreement shall be as set forth herein. 2. Responsibilities of the Provider a. Services to be provided. The Provider shall provide the County with all services required in Section 3 to satisfactorily complete the Project within the time limitations set forth herein and in accordance with the highest professional standards. b. Standard of Care. i) The Provider shall exercise reasonable care and diligence in performing services under this Agreement in accordance with the highest generally accepted standards of this type of Provider practice throughout the United States and in accordance with applicable federal, state and local laws and regulations applicable to the DocuSign Envelope ID: 79107112-9BB9-477B-B662-FF2F869640FC Revised 06/21 2 performance of these services. Provider is solely responsible for the professional quality, accuracy and timely completion and submission of all work related to the Basic Services. ii) Provider shall be responsible for all errors or omissions of its agents, contractors, employees, or assigns in the performance of the Agreement. Provider shall correct any and all errors, omissions, discrepancies, ambiguities, mistakes or conflicts at no additional cost to the County. iii) The Provider shall not, except as otherwise provided for in this Agreement, subcontract the performance of any work under this Agreement without prior written permission of the County. No permission for subcontracting shall create, between the County and the subcontractor, any contract or any other relationship. iv) Provider is an independent contractor of County. Any and all employees of the Provider engaged by the Provider in the performance of any work or services required of the Provider under this Agreement, shall be considered employees or agents of the Provider only and not of the County, and any and all claims that may or might arise under any workers compensation or other law or contract on behalf of said employees while so engaged shall be the sole obligation and responsibility of the Provider. v) If activities related to the performance of this Agreement require specific licenses, certifications, or related credentials Provider represents that it or its employees, agents and subcontractors engaged in such activities possess such licenses, certifications, or credentials and that such licenses certifications, or credentials are current, active, and not in a state of suspension or revocation. vi) In determining the Basic Services to be provided, should any documents be referenced in this Agreement, the terms of this Agreement shall have priority in any conflict between the terms of referenced documents and the terms of this Agreement. vii) Should this Agreement involve project designs, the construction or creation of which is to be bid out or fulfilled by other contractors, and bidding or negotiation with contractors produce prices which, when added to the other elements of the approved total project cost, produce a cost that is in excess of the approved total project cost, the Provider shall participate with the County in negotiation and design adjustments to the extent such are necessary to obtain prices within the approved total project cost. All activity of the Provider with respect to these matters shall constitute Basic Services and shall be performed by the Provider without additional compensation. If negotiation and design adjustments fail to bring costs within the total project cost the County may reject all bids and Provider will redesign or reduce portions of the project in an effort to reduce the bid prices to within the total project cost and rebid the project. One such redesign is included within Basic Services. If this second letting for bids does not produce bids that are within the approved total project cost initially or after negotiations with the contractor the cost is not reduced to an amount within the total project cost, the Provider is not obligated to engage in further redesign. DocuSign Envelope ID: 79107112-9BB9-477B-B662-FF2F869640FC Revised 06/21 3 3. Basic Services a. Basic Services. The Services to be rendered pursuant to this Agreement are as follows (fully describe services to be provided): Basic Services shall include those services described in Exhibit 1 except "Auto-Tagging Services," which shall not be part of the Basic Services and are not included in the terms of this Agreement. 4. Duration of Services a. Term. The term of this Agreement shall be from September 20, 2021 to September 19, 2022. b. Scheduling of Services. i) The Provider shall schedule and perform its activities in a timely manner. ii) Should the County determine that the Provider is behind schedule, it may require the Provider to expedite and accelerate its efforts, including providing additional resources and working overtime, as necessary, to perform its services in accordance with the approved project schedule at no additional cost to the County. iii) The Commencement Date for the Provider's Basic Services shall be September 20, 2021. 5. Compensation a. Compensation for Basic Services. Compensation for Basic Services shall include all compensation due the Provider from the County for all services satisfactorily (as determined by the County) performed pursuant to this Agreement. The maximum amount payable for Basic Services shall not exceed Six Thousand Nine Hundred Ninety- Nine Dollars ($6,999.00). Payment for satisfactorily performed Basic Services shall become due and payable within thirty (30) days of Provider properly invoicing County. Payment shall be subject to provisions of Section 5(b). b. Disputes. In the event the amount stated on an invoice is disputed by the County, the County may withhold payment of all or a portion of the amount stated on an invoice until the parties resolve the dispute. Should Provider fail to perform its duties under the terms of this Agreement, County may, without fault or penalty, withhold any payment associated with the work to be performed until such time as said work is completed. c. Additional Services. County shall not be responsible for costs related to any services in addition to the Basic Services performed by Provider unless County requests such additional services in writing and such additional services are evidenced by a written amendment to this Agreement. 6. Responsibilities of the County DocuSign Envelope ID: 79107112-9BB9-477B-B662-FF2F869640FC Revised 06/21 4 a. Cooperation and Coordination. The County has designated (Tina Fuller) to act as the County's representative with respect to the Project who shall have the authority to render decisions within guidelines established by the County Manager or the County Board of Commissioners and who shall be available during working hours as often as may be reasonably required to render decisions and to furnish information. 7. Insurance a. General Requirements. Provider shall obtain, at its sole expense, Commercial General Liability Insurance, Automobile Insurance, Workers’ Compensation Insurance, and any additional insurance as may be required by County’s Risk Manager as such insurance requirements are described in the Orange County Risk Transfer Policy and Orange County Minimum Insurance Coverage Requirements (each document is incorporated herein by reference and may be viewed at http://www.orangecountync.gov/departments/purchasing_division/contracts.php). If County’s Risk Manager determines additional insurance coverage is required such additional insurance shall consist of N/A (if no additional insurance required mark N/A as being not applicable). Provider shall not commence work until such insurance is in effect and certification thereof has been received by the County's Risk Manager. 8. Indemnity a. Indemnity. To the extent authorized by North Carolina law the Provider agrees, without limitation, to defend, indemnify and hold harmless the County from all loss, liability, claims or expense, including attorney's fees, arising out of or related to the Project and arising from property damage or bodily injury including death to any person or persons caused in whole or in part by the negligence or misconduct of the Provider except to the extent same are caused by the negligence or willful misconduct of the County. It is the intent of this provision to require the Provider to indemnify the County to the fullest extent permitted under North Carolina law. 9. Amendments to the Agreement a. Changes in Basic Services. Changes in the Basic Services and entitlement to additional compensation or a change in duration of this Agreement shall be made by a written Amendment to this Agreement executed by the County and the Provider. The Provider shall proceed to perform the Services required by the Amendment only after receiving a fully executed Amendment from the County. 10. Termination a. Termination for Convenience of the County. This Agreement may be terminated without cause by the County and for its convenience upon seven (7) days’ prior written notice to the Provider. b. Other Termination. The Provider may terminate this Agreement based upon the County's material breach of this Agreement; provided, the County has not taken all reasonable actions to remedy the breach. The Provider shall give the County seven (7) days' prior written notice of its intent to terminate this Agreement for cause. Either party may DocuSign Envelope ID: 79107112-9BB9-477B-B662-FF2F869640FC Revised 06/21 5 terminate this Agreement upon notice to the other party that obligations pursuant to this Agreement are made impractical due to declarations of emergency by Orange County or by North Carolina due to events directly impacting Orange County. Both parties shall remain responsible for all payment and performance due up to the receipt of such notice, but shall have no further obligation or responsibility beyond that date provided the terminating party has taken all reasonable steps to complete the performance of its obligations. c. Compensation After Termination. i) In the event of termination, the Provider shall be paid that portion of the fees and expenses that it has earned to the date of termination, less any costs or expenses incurred or anticipated to be incurred by the County due to errors or omissions of the Provider. Upon request of the County, the Provider shall submit to County all relevant documentation, including but not limited to, job cost records, to support its claims for final compensation. ii) Should this Agreement be terminated, the Provider shall deliver to the County within seven (7) days, at no additional cost, all deliverables including any electronic data or files relating to the Project. d. Waiver. The payment of any sums by the County under this Agreement or the failure of the County to require compliance by the Provider with any provisions of this Agreement or the waiver by the County of any breach of this Agreement shall not constitute a waiver of any claim for damages by the County for any breach of this Agreement or a waiver of any other required compliance with this Agreement. e. Suspension. County may suspend the Basic Services and this Agreement at any time for County’s convenience and without penalty to County upon three (3) days’ notice to Provider. Upon any suspension by County, Provider shall discontinue work on the Basic Services and shall not resume the Basic Services until notified to proceed by County. 11. Additional Provisions a. Limitation and Assignment. The County and the Provider each bind themselves, their successors, assigns and legal representatives to the terms of this Agreement. Neither the County nor the Provider shall assign or transfer its interest in this Agreement without the written consent of the other. b. Governing Law. This Agreement and the duties, responsibilities, obligations and rights of respective parties hereunder shall be governed by the laws of the State of North Carolina. By executing this Agreement Provider affirms that Provider and any subcontractors of Provider are and shall remain in compliance with Article 2 of Chapter 64 of the North Carolina General Statutes. By executing this Agreement Provider certifies that Provider has not been identified, and has not utilized the services of any agent or subcontractor identified, on the list created by the State Treasurer pursuant to G.S. 147-86.58. By executing this Agreement Provider certifies that Provider has not been identified, and has not utilized the services of any agent or subcontractor identified, on the list created by the State Treasurer pursuant to G.S. 147-86.81. DocuSign Envelope ID: 79107112-9BB9-477B-B662-FF2F869640FC Revised 06/21 6 c. Non-Discrimination. Provider shall at all times remain in compliance with all applicable local, state, and federal laws, rules, and regulations including but not limited to all state and federal non-discrimination laws, policies, rules, and regulations and the Orange County Non-Discrimination Policy and Orange County Living Wage Policy (each policy is incorporated herein by reference and may be viewed at http://www.orangecountync.gov/departments/purchasing_division/contracts.php.) Any violation of the Orange County Non-Discrimination Policy is a breach of this Agreement and County may immediately terminate this Agreement without further obligation on the part of the County. This paragraph is not intended to limit and does not limit the definition of breach to discrimination. d. Dispute Resolution. Any and all suits or actions to enforce, interpret or seek damages with respect to any provision of, or the performance or non-performance of, this Agreement shall be brought in the General Court of Justice of North Carolina sitting in Orange County, North Carolina. It is agreed by the parties that no other court shall have jurisdiction or venue with respect to such suits or actions. Binding arbitration may not be initiated by either Party, however, the Parties may agree to nonbinding mediation of any dispute prior to the bringing of such suit or action. e. Entire Agreement. This Agreement represents the entire and integrated agreement between the County and the Provider and supersedes all prior negotiations, representations or agreements, either written or oral. This Agreement may be amended only by written instrument signed by both parties. Modifications may be evidenced by facsimile signatures. f. Severability. If any provision of this Agreement is held as a matter of law to be unenforceable, the remainder of this Agreement shall be valid and binding upon the Parties. g. Ownership of Work Product. Should Provider’s performance of this Agreement generate documents, items or things that are specific to this Project such documents, items or things shall become the property of the County and may be used on any other project without additional compensation to the Provider. The use of the documents, items or things by the County or by any person or entity for any purpose other than the Project as set forth in this Agreement shall be at the full risk of the County. h. Non-Appropriation. Provider acknowledges that County is a governmental entity, and the validity of this Agreement is based upon the availability of public funding under the authority of its statutory mandate. In the event that public funds are unavailable or not appropriated for the performance of County’s obligations under this Agreement, then this Agreement shall automatically expire without penalty to County immediately upon written notice to Provider of the unavailability or non-appropriation of public funds. It is expressly agreed that County shall not activate this non-appropriation provision for its convenience or to circumvent the requirements of this Agreement. In the event of a change in the County’s statutory authority, mandate or mandated DocuSign Envelope ID: 79107112-9BB9-477B-B662-FF2F869640FC Revised 06/21 7 functions, by state or federal legislative or regulatory action, which adversely affects County’s authority to continue its obligations under this Agreement, then this Agreement shall automatically terminate without penalty to County upon written notice to Provider of such limitation or change in County’s legal authority. i. Signatures. This Agreement together with any amendments or modifications may be executed electronically. All electronic signatures affixed hereto evidence the consent of the Parties to utilize electronic signatures and the intent of the Parties to comply with Article 11A and Article 40 of North Carolina General Statute Chapter 66. j. Notices. Any notice required by this Agreement shall be in writing and delivered by certified or registered mail, return receipt requested to the following: Orange County Provider’s Name Attention: Tina Fuller Kristin Schordine P.O. Box 8181 111 Broadway, 19th Floor Hillsborough, NC 27278 New York, NY 10006 [SIGNATURE PAGE TO FOLLOW] DocuSign Envelope ID: 79107112-9BB9-477B-B662-FF2F869640FC Revised 06/21 8 IN WITNESS WHEREOF, the Parties, by and through their authorized agents, have hereunder set their hands and seal, all as of the day and year first above written. ORANGE COUNTY: PROVIDER: By: _________________________________ Bonnie Hammersley, County Manager By: __________________________________ Andrew Fingerman, Chief Executive Officer Printed Name and Title DocuSign Envelope ID: 79107112-9BB9-477B-B662-FF2F869640FC Revised 06/21 9 ORANGE COUNTY—DEPARTMENT USE ONLY ______________________________________________________________________________ Party/Vendor Name: Photoshelter Inc. Party/Vendor Contact Person: Kristin Schordine, Customer Success Contact Phone: (212) 206-0808 ext. 3389 Party/Vendor Address: 111 Broadway, 19th Floor City New York State: NY Zip: 10006 Department: Econ. Dev./Visitors Bureau Amount: $6,999 Purpose: Cloud-based digital asset management platform licensing agreement Budget Code(s): 37600520-620000 Vendor # 65804 (N/A if new vendor) Vendor is a BOCC consultant? Yes No Contract Type: (Check one) New Renewal Amendment Effective Date September 20, 2021 Approved by Board Yes No Agenda Date: N/A --- For Section XIV. c. contracts only, Approved by Board in Current FY Budget Yes No This agreement is approved as to technical form and content and I as Department Director affirmatively state work on this project has not been initiated prior to execution of the agreement: Department Director’s Signature ________________________________________ Date: ________ Agreements for emergency services or repair are not subject to the above affirmation. If services related to this agreement have already begun or been completed please briefly describe the nature of the emergency condition that was addressed: Information Technologies (Applicable only to hardware/software purchases or related services) This agreement has been reviewed and is approved as to information technology content and specifications: Office of the Chief Information Officer___________________________________ Date: ________ Risk Management This agreement is approved for sufficiency of insurance standards, specifications, and requirements: Office of the Risk Management Officer___________________________________ Date: _________ Financial Services This instrument has been pre-audited in the manner required by the Local Government Budget and Fiscal Control Act: Office of the Chief Financial Officer ____________________________________ Date: _________ Legal Services This agreement is approved as to legal form and sufficiency: Office of the County Attorney __________________________________________Date: ________ Clerk to the Board Received for record retention: All Docusign contracts must be copied to the Clerk upon completion: occlerkdocs@orangecountync.gov The following signature block is for hard copies only and is not required for Docusign contracts: Office of the Clerk to the Board __________________________________________Date:_________ DocuSign Envelope ID: 79107112-9BB9-477B-B662-FF2F869640FC 9/1/2021 9/2/2021 9/2/2021 9/3/2021 9/3/2021 Exhibit 1 PHOTOSHELTER BRANDS ACCOUNT SERVICE AGREEMENT THIS PHOTOSHELTER BRANDS ACCOUNT SERVICE AGREEMENT (this “Agreement”) is made on 9/20/2021 between Chapel Hill/Orange County Visitors Bureau, with offices at 501 West Franklin Street, Chapel Hill, North Carolina, 27516, United States (“Client”), and PhotoShelter, Inc., a Delaware corporation, with offices at 111 Broadway, 19th Floor New York, New York 10006 (“PhotoShelter”). Capitalized terms not defined herein shall have the meaning set forth on the Order Form which references this Agreement. The parties agree as follows: 1. DEFINITIONS. “PhotoShelter Brands” means the PhotoShelter multi‐user digital asset management software and tools provided by PhotoShelter for purposes such as posting, archiving, editing, managing, organizing, distributing, accessing and/or selling digital copies of Posted Content, and all software, interfaces, tools, utilities, templates, forms, and other technologies (and any related intellectual property) relating thereto, excluding Posted Content. “Posted Content” means photographs or other content provided by Client through the Services. “Site” means PhotoShelter.com. “Services” means the PhotoShelter Brands service and any other services provided by PhotoShelter on the Site or pursuant to any Order Form. “Confidential Information” shall mean information disclosed by either Party to the other Party, including but not limited to the terms and conditions of this Agreement, trade secrets of either Party, any information relating to either Party's product plans, designs, ideas, concepts, costs, prices, finances, marketing plans, business opportunities, personnel, research, development or know‐how and any other technical or business information of either Party. 2. PHOTOSHELTER SERVICES; SITE OPERATION. 2.1. Services. PhotoShelter shall use commercially reasonable efforts to operate the Services for Client in accordance with the applicable Order Form. Subject to the terms and conditions of this Agreement, PhotoShelter grants Client a non‐exclusive, non‐transferable license to use and access the Services solely for (a) Client’s internal business purposes and (b) to display, sell and deliver Client’s images on the Services to Client’s Registered Users (defined below) in accordance with this Agreement. 2.2. Access and Account Setup. Initial registration will be performed manually by a designated PhotoShelter Client Services representative. As part of the implementation process, Client will identify an administrative user name and password that will be used to set up Client’s account for the Services, and Client will need to register one or more individuals as an Account Administrator. Accounts and passwords DocuSign Envelope ID: 79107112-9BB9-477B-B662-FF2F869640FC may be used only in accordance with the terms and conditions of this Agreement. To the extent legally permitted, (a) Client shall be responsible for the acts or omissions of any person who accesses the Services using passwords or access procedures provided to or created by Client and (b) Client hereby releases PhotoShelter from any and all liability concerning such transactions or activity. Client agrees to notify PhotoShelter immediately of any actual or suspected loss, theft or unauthorized use of its or its Registered Users’ (defined above) account or password. 2.3. Availability. PhotoShelter will use commercially reasonable efforts to ensure that PhotoShelter Brands is available 24 hours a day, 7 days a week. PhotoShelter reserves planned outages of the Services, especially those requiring downtime, for purposes such as large scale system upgrades and maintenance. PhotoShelter will notify Client as soon as reasonably practicable of any unplanned outages, and with a minimum of 72 hours before planned outages. 2.4. Site Service and Technical Support. Where needed, PhotoShelter will provide routine phone support to Account Administrators and Editors, but not to Registered Users, in respect of use of the Services during PhotoShelter’s business hours of Monday through Friday 9:00AM ET to 6:00PM ET, excluding public holidays in the United States. Client is solely responsible for providing support to its Registered Users. 2.5. Limitations. PhotoShelter will not be responsible or liable for any failure in the Services resulting from or attributable to (a) Client Posted Content; (b) failures in telecommunications, network or other service or equipment outside of the facilities used to host the Services; (c) Client's or any third party’s products, services, negligence, acts or omissions; (d) any cause beyond PhotoShelter’s reasonable control; or (e) scheduled maintenance in accordance with the terms herein (collectively, “Downtime Exclusions”). 2.6. Modifications. PhotoShelter reserves the right to modify or discontinue any Services (in whole or in part) at any time, provided that PhotoShelter will use commercially reasonable efforts to give thirty (30) days’ prior notice to Client (via email or through the Service) of material changes to the core Services, and further provided that in the event such modification or discontinuance materially reduces the functionality of the Services used by Client in accordance with this Agreement, Client may terminate this Agreement upon at least fifteen (15) days’ prior written notice to PhotoShelter. 2.7. Backups. Although PhotoShelter uses industry standard methods to store and preserve Posted Content, including performing backups of data in near real‐time and by providing geographic server redundancy in multiple locations, including without limitation Client Posted Content, it is always a best practice to backup all important data. Therefore, PhotoShelter strongly encourages Client to perform regular backups of Client’s Posted Content, and Client acknowledges and agrees that PhotoShelter is not responsible or liable in any way for the failure to store, preserve or access Posted Content or other materials that Client transmits, stores, archives or otherwise makes available on or through the Services. 2.8. Content Removal. PhotoShelter has no obligation to screen or monitor any images, information or data for any purpose, including without limitation any Posted Content or any other content provided by users or third parties. However, if PhotoShelter becomes aware of or has reason to believe that Client or any of Client’s Posted Content is violating the terms and conditions contained herein or elsewhere on the DocuSign Envelope ID: 79107112-9BB9-477B-B662-FF2F869640FC Services, PhotoShelter, in its sole discretion, may remove and/or delete the applicable Posted Content, suspend and/or terminate Client’s and/or Client’s Registered Users’ access to the Services, and/or pursue any other remedy or relief available to PhotoShelter under equity or law. 2.9. Copyright. PhotoShelter handles copyright infringement claims in accordance with the Digital Millennium Copyright Act, a copy of which is located at http://lcweb.loc.gov/copyright/legislation/dmca.pdf. 2.10. International Access. Some jurisdictions may prohibit or restrict the download, storage, display or viewing of certain images or content or may otherwise limit use of or access to the internet and web‐ based services, and in such cases, PhotoShelter cannot guarantee that these jurisdictions will permit the use of or access to the Site, Services or any content thereon. Client and all Registered Users are responsible for compliance with the laws of the applicable jurisdiction in which such Client or Registered Users access the Site or Services. To the extent the Site, Services and content can be legally accessed, PhotoShelter uses a global Content Delivery Network (CDN) to ensure they can be accessed and viewed anywhere around the world in accordance with local expectations for internet speed. Furthermore, the Site and the Services are hosted on computer servers in the United States, and therefore, Client’s information may be processed and stored in the United States. Client’s use of the Sites or the Services or Client’s submission of any information, including without limitation any personally identifiable information, to PhotoShelter will constitute Client’s consent to the transfer of Client’s information to PhotoShelter’s servers and the use and disclosure of such information in compliance with United States laws, rules and regulations. 3. LICENSEES AND USER OBLIGATIONS. 3.1. License to Posted Content. Client owns, and as between Client and PhotoShelter, will continue to own, all Posted Content. Client hereby grants and agrees to grant PhotoShelter a non‐exclusive, royalty‐ free, fully paid up, sublicensable, worldwide right and license to use, reproduce, modify, display, perform, distribute, and create derivative works of the Posted Content solely in connection with PhotoShelter's operation of the Services and according to the Client’s specified visibility and access permission controls, as indicated using the features and functionality made available on the Services. This license allows PhotoShelter to take actions such as creating thumbnails and other various sizes of the images that Client posts and lists on the Site or through the Services, presenting images in search results on the Services, allowing Registered Users to browse image collections, or modifying Posted Content so that PhotoShelter’s system can fulfill image download requests in multiple desired sizes to Client’s approved Registered Users. PhotoShelter claims no right to use Posted Content in any manner that goes beyond providing the Services, and PhotoShelter claims no commercial rights to Posted Content. 3.2. Registered Users. Client will use the Services to distribute Posted Content to on ly parties which Client approves (“Registered Users”). Client can choose to grant Registered Users access to Posted Content by: (1) providing each Registered User with a username and password to access the Posted Content; (2) password‐protecting Client’s gallery on the Services that contains the Posted Content and sharing the password with Registered Users to whom Client wishes to grant access or (3) designating the Posted DocuSign Envelope ID: 79107112-9BB9-477B-B662-FF2F869640FC Content as publicly viewable or downloadable by anyone, using the applicable feature on the Services (in both cases any end user who downloads or accesses such Posted Content shall constitute a Registered User). Only Client‐appointed Account Administrators and Editors may set up new Registered Users via the Services for access to Client Posted Content. Client will check and update the Registered User access permissions regularly to ensure such permissions remain accurate and complete. PhotoShelter shall have no responsibility or liability for (a) Client’s failure to maintain or update Registered User authorization or (b) any unauthorized use, sharing, or disclosure of any passwords provided to Registered Users. 4. Provisions for Selling Content via the PhotoShelter Brands Account: 4.1. Selling Content. Client may elect to offer a portion or all of its Posted Content for licensing or sale as prints and products (Client’s "Offered Content"). In order to post Offered Content, Client will need to obtain a merchant account from one of the billing services supported by the Services (each a "Billing Service"), such as PayPal, Stripe, TouchNet or Authorize.net. Please note that the Billing Services supported by the Services may be changed from time to time at the sole discretion of PhotoShelter, provided that PhotoShelter will notify Client if PhotoShelter stops supporting the Billing Service currently in use by Client in connection with the Services. With respect to each image contained in Client’ Offered Content, Client will need to select from a list provided by the Services (a) the category of rights being offered for sale, and (b) the price for each such category of rights. 4.2. Fees. In the event this sales capability is activated, Client agrees to pay PhotoShelter a fee of 8% of all completed purchasing transactions that are initiated through the Services (“Transaction Fee”), which is applied to Client’s monthly invoice. In the event that Client chooses to use one of PhotoShelter’s third party fulfillment partners, Client will also be charged for the wholesale cost of printing and shipping, according to the fee schedule available inside the Client account for the chosen third party fulfillment partner. PhotoShelter reserves the right to change the Transaction Fee at any time, upon prior notice to Client. Wholesale costs for printing and shipping may vary over time, and PhotoShelter will provide the Client with at least 30 days notice when third party prices change. 5. Provisions for Optional AI Auto‐Tagging via the PhotoShelter Brands Account 5.1 Optional Add‐On Feature. Upon Client’s request and as agreed upon by the parties in an Order Form, PhotoShelter shall utilize Third Party Services, or other software, tools and technologies, including automated processing tools and image‐recognition technologies, designed to apply to the Posted Content labels, tags, keywords, or other marks identifying a particular individual, group, location, event, date, time period, subject matter, topic, theme, or other feature or content (the “Auto‐Tagging Services”). 5.2 Fees. The Auto‐Tagging Services can be activated on request through PhotoShelter Customer Success representatives and entering into an Order Form for the Auto‐Tagging Services. In the event the Auto‐ Tagging Services are activated, Client agrees to pay PhotoShelter an additional fee for the Auto‐Tagging Services in the amount specified in the applicable Order Form, which shall be applied to Client’s monthly or annual invoice, as applicable. PhotoShelter reserves the right to change the fees for Auto‐Tagging Services at any time, upon prior notice to Client. If PhotoShelter does not receive a request from Client to DocuSign Envelope ID: 79107112-9BB9-477B-B662-FF2F869640FC deactivate the Auto‐Tagging Services within [30] days of such notice, Client shall be deemed to have accepted such changed fees. Where applicable, a one‐time professional service setup fee for the Auto‐ Tagging Services may be owed by Client in the amount and at the time specified in the applicable Order Form. Setup fees and annual fees for Auto‐Tagging Services are non‐refundable. 5.3 Client Representations and Warranties for Auto‐Tagging Services. Client represents and warrants that Client shall use the Auto‐Tagging Services solely for lawful purposes and in strict compliance with all applicable state, federal or foreign law(s), rule(s) and regulation(s), including without limitation those related to making decisions based solely on automated processing, including profiling. 5.4 Client acknowledges and agrees that: ● PhotoShelter may utilize Third Party Service Providers to perform the Auto‐Tagging Services. ● The labels, tags, keywords, or other marks identifying a particular individual, group, location, event, date, subject, topic, theme, or other feature or content (the “Auto‐Tags”) will not be merged to industry standard IPTC fields and, as such, will only be accessible for Posted Content available and accessed on or through the Services, unless otherwise requested by Client and agreed to by PhotoShelter prior to removal of such Posted Content by Client from the Services. ● PhotoShelter or the applicable Third Party Service Provider may utilize Posted Content that is subject to the Auto‐Tagging Service to create Derived Data. “Derived Data” means data elements derived from Posted Content via mathematical, logical or other types of transformations. Derived Data will be fully anonymized and aggregated, such that it is not possible to identify Client, or the subject(s) of any of the Posted Content. Derived Data will be the property of PhotoShelter or its applicable Third Party Service Provider. PhotoShelter or its Third Party Service Provider may use Derived Data for product improvement, algorithm training and other internal purposes. ● The Auto‐Tagging Services are provided “AS IS” and Client’s use is at its own risk. PhotoShelter does not and cannot guarantee the accuracy or completeness of any Auto‐Tags made available by or to Client in connection with the Auto‐Tagging Services. ● PhotoShelter may discontinue the Auto‐Tagging Services at any time in PhotoShelter’s sole discretion. 6. REPRESENTATIONS AND WARRANTIES. 6.1. General. Each party represents and warrants that (a) it has full power and authority, and has obtained all approvals, permissions and consents necessary, to enter into this Agreement and to perform its obligations hereunder; (b) this Agreement is legally binding upon it and enforceable in accordance with its terms; and (c) the execution, delivery and performance of this Agreement does not and will not conflict with any agreement, instrument, judgment or understanding, oral or written, to which it is a party or by which it may be bound. 6.2. By Client. Client represents and warrants that (a) Client owns all rights, title and interest in and to the Posted Content, or has otherwise secured all necessary rights in the Posted Content as may be necessary to permit the access, use and distribution thereof as contemplated by this Agreement or as otherwise authorized by Client through the Services, including without limitation to Registered Users and (b) the Posted Content does not (i) include any virus, worm, Trojan horse or other harmful, malicious or disabling code or device or that is designed to damage or allow unauthorized access to the Site or Services DocuSign Envelope ID: 79107112-9BB9-477B-B662-FF2F869640FC (“Malware”); (ii) violate, infringe, misappropriate or otherwise interfere with any patent, copyright, trademark, trade secret, right of privacy or publicity, or any other intellectual property, proprietary or any other right of any person or entity; (iii) contain any material which is unlawful, harmful, abusive, hateful, obscene, threatening, libelous or defamatory, false or inaccurate or otherwise objectionable; (iv) harm minors in any way, including, but not limited to, by violating child pornography laws, child sexual exploitation laws or any laws prohibiting the depiction of minors engaged in sexual conduct; or (v) violate any applicable federal, state, local or international law. 6.3 By PhotoShelter PhotoShelter represents and warrants that (a) it will perform the Services in a professional and workmanlike manner; (b) the Services will perform substantially in accordance with any documentation provided by PhotoShelter to Client; (c) it will use industry standard methods to scan the Services and Content for Malware and to eradicate any found Malware and (d) it will perform its obligations in compliance with all applicable laws. In the event of any brea ches of the warranties set forth in this Section 6.3, PhotoShelter’s sole responsibility, and Client’s sole remedy, will be, at PhotoShelter’s discretion, to either (i) re‐perform the Services so that they conform or (ii) refund the Client a pro‐rated portion for any fees paid by Client for the non‐conforming Services. 7. PROPRIETARY RIGHTS 7.1. Client. Except for the limited rights and licenses expressly granted hereunder, no other license is granted, no other use is permitted, and Client (and its licensors) shall retain all rights, title and interest (including all intellectual property and proprietary rights) in and to Posted Content. 7.2. PhotoShelter. Except for the limited rights and licenses expressly granted hereunder, no other license is granted, no other use is permitted, and PhotoShelter (and its licensors) shall retain all rights, title and interest (including all intellectual property and proprietary rights) in and to the Services, the Site and all information, data, materials and content related thereto (excluding Posted Content), and all modifications and derivative works thereof (again, excluding modifications and derivative works of Posted Content), as well as all PhotoShelter trademarks, names, and logos, and all rights to patent, copyright, trade secret and other proprietary or intellectual property rights. 7.3. Restrictions. Except as expressly permitted in this Agreement, Client shall not directly or indirectly (a) use any of PhotoShelter’s Confidential Information (defined above) or proprietary information to create any service, software, documentation or data that is similar to any aspect of the Services; (b) disassemble, decompile, reverse engineer or use any other means to attempt to discover any source code of the Services, or the underlying ideas, algorithms or trade secrets therein; (c) encumber, sublicense, transfer, rent, lease, time‐share or use any portion of the Services in any service bureau arrangement or otherwise for the benefit of any third party; (d) copy, distribute, manufacture, adapt, create derivative works of, translate, localize, port or otherwise modify any aspect of the Services; (e) use or allow the transmission, transfer, export, re‐export or other transfer of any product, technology or information it obtains or learns pursuant to this Agreement (or any direct product thereof) in violation of any export DocuSign Envelope ID: 79107112-9BB9-477B-B662-FF2F869640FC control or other laws and regulations of the United States or any other relevant jurisdiction; or (f) permit any third party to engage in any of the foregoing proscribed acts. 7.4. Feedback. PhotoShelter appreciates all of our users’ interest in improving and expanding the Services. If Client chooses to send to PhotoShelter (through any channel) any content, information, ideas, suggestions or other materials relating to the Site, Services or PhotoShelter’s business (“Feedback”), Client hereby assigns such Feedback to PhotoShelter, and Client agrees that PhotoShelter is free to use any Feedback, for any purposes whatsoever, including, without limitation, developing and marketing products and services, without any liability or payment of any kind to Client. 8. PAYMENT; FEES. Unless otherwise specified in an Order Form, through Client’s account settings or as otherwise agreed to by PhotoShelter in writing, Client shall pay to PhotoShelter the fees as set forth on an Order Form within thirty (30) days of an invoice from PhotoShelter. PhotoShelter reserves the right to immediately suspend and/or terminate access to Client’s account for late payment or nonpayment. Upon making payment, Client access to the account would be promptly restored. PhotoShelter reserves the right to change the fees charged for the Services at any time; provided that if such change applies to the services Client receives from PhotoShelter, PhotoShelter shall provide Client with reasonable prior notice of the change, and Client may terminate any outstanding Order Form applicable to the affected service within fifteen (15) days of receiving such notice from PhotoShelter. Such termination shall be effective upon the earlier of (a) thirty (30) days from the date Client provides notice of termination or (b) the first day upon which the new fee becomes effective. 9. TERM; TERMINATION. 9.1. Term. This Agreement shall commence on the effective date set forth on an applicable Order Form and, unless otherwise indicated on an applicable Order Form, shall continue until terminated by either party in accordance with the provisions set forth herein. 9.2. Termination. Either party may terminate this Agreement (a) for the other party’s material breach of this Agreement if such breach is not cured within fifteen (15) days of the non‐breaching party providing notice to the breaching party or (b) upon thirty (30) days’ written notice to the other party. 9.3. Effect of Termination. Client will remain obligated to pay any fees for any Services or additional resources incurred prior to termination, and in the event of any outstanding unpaid balance, Client shall promptly remit such outstanding amounts to PhotoShelter upon termination. Upon termination, Client may request a copy of all Client Posted Content via CD‐ROM or other storage media which is at such time supported by the Services for a fee of $250 per hour it takes to perform the download and migration of data, for a minimum of 2 hours, and PhotoShelter shall provide such copy if Client (a) has satisfied the entire outstanding balance relating to Client’s account; (b) paid the fees related to creating and distributing such copy of Client’ Posted Content; and (c) is not in violation of any of the terms and conditions contained herein. Upon any expiration or termination of this Agreement, all corresponding rights, obligations and licenses of the parties shall cease, except that (i) all obligations that accrued prior to the effective date of termination (including without limitation, all payment obligations) shall survive DocuSign Envelope ID: 79107112-9BB9-477B-B662-FF2F869640FC and (ii) the provisions of Sections 1 (Definitions), 2.5 (Limitations), 2.9 (Copyright), 2.10 (International Access), 7.1 (Proprietary Rights ‐‐ Client), 7.2 (Proprietary Rights ‐‐PhotoShelter), 7.3 (Restrictions), 7.4 (Feedback), 10 (Third Party Services), 11 (Indemnification), 12 (Disclaimer of Warranties and Limitation on Liability), 13 (Miscellaneous) and this Section 9.3 (Effects of Termination) shall survive. 10. THIRD PARTY SERVICES. The purchase of any services provided by third parties through the Services (“Third Party Services”), including without limitation any fulfillment services for orders of Posted Content, image tracking services, website templates, analytics packages, or ancillary photo editing or processing services, is at Client’s own risk. Client acknowledges and agrees that (a) any transaction with a Third Party Service provider (“Third Party Service Provider”) is solely between Client and the applicable Third Party Service Provider; (b) any content transmitted by Client to any Third Party Service Provider is at Client’s own risk; (c) PhotoShelter does not make any representation or warranty about any Third Party Services or Third Party Service Providers; and (d) PhotoShelter will not be responsible or liable for any aspect of any transaction between Client and any Third Party Service Provider. PhotoShelter will endeavor to provide notification when a service is a Third Party Service. 11. INDEMNIFICATION. To the extent permissible by law, each party agrees to indemnify and hold harmless the other party and each of the other party’s directors, officers, shareholders, employees or members from and against any and all allegations, third party claims, demands, suits, actions or other proceedings and any corresponding liabilities, costs, settlement amounts, expenses (including reasonable attorney’s fees) or other losses paid to third parties arising from or relating to (i) such party’s material breach of any of its representations or warranties set forth herein or (ii) in the case of Client as the indemnifying party, to Client’s or its Registered Users’ use of the Services and/or any material or content, including without limitation Posted Content or content provided by other users or third parties, it or they submit, download, post or transmit through the Services. 12. DISCLAIMER OF WARRANTIES AND LIMITATION ON LIABILITY. 12.1. WARRANTY DISCLAIMER. EXCEPT AS EXPRESSLY SET FORTH HEREIN, , PHOTOSHELTER HEREBY DISCLAIMS ALL OTHER WARRANTIES, ORAL OR WRITTEN, WHETHER EXPRESS, IMPLIED, STATUTORY OR OTHERWISE, RELATING TO THE SITE AND THE SERVICES (INCLUDING ALL CONTENT THEREON) AND CLIENT’S USE THEREOF, INCLUDING WITHOUT LIMITATION ALL IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT, TITLE AND NON‐ INFRINGEMENT. SOME JURISDICTIONS DO NOT ALLOW THE DISCLAIMER OF IMPLIED WARRANTIES. IN SUCH JURISDICTIONS, THE AFOREMENTIONED DISCLAIMERS MAY NOT APPLY TO CLIENT. 12.2. LIMITATION ON LIABILITY. EXCEPT FOR BREACHES OF CONFIDENTIALITY AND INDEMNIFICATION OBLIGATIONS HEREUNDER, TO THE FULLEST EXTENT ALLOWED BY LAW, NEITHER PARTY SHALL BE LIABLE CONCERNING THE SITE, SERVICES OR ANY CONTENT, REGARDLESS OF THE FORM OF ANY CLAIM OR ACTION (WHETHER IN CONTRACT, NEGLIGENCE, STRICT LIABILITY OR OTHERWISE), FOR (A) ANY INDIRECT, SPECIAL, CONSEQUENTIAL, PUNITIVE OR INCIDENTAL DAMAGES; (B) COST OF PROCURING SUBSTITUTE GOODS, SERVICES OR TECHNOLOGY; OR (C) DAMAGES THAT IN THE AGGREGATE EXCEED THE FEES PAID OR PAYABLE OVER THE IMMEDIATELY PREVIOUS SIX MONTH PERIOD. SOME DocuSign Envelope ID: 79107112-9BB9-477B-B662-FF2F869640FC JURISDICTIONS DO NOT ALLOW THE FOREGOING LIMITATIONS OF LIABILITY, SO THE FOREGOING MAY NOT APPLY. 13. MISCELLANEOUS. 13.1. Governing Law. Any disputes arising out of or relating to this Agreement or use of the Services shall be resolved in accordance with the laws of the State of New York, without regard to its conflict of law rules. PhotoShelter and the Client hereby consent to the state and federal courts of New York, New York for all disputes arising from or relating to this Agreement or access to or use of the Site and/or Services. 13.2. Entire Agreement. This Agreement constitutes the entire agreement between Client and PhotoShelter with respect to the subject matter hereof. This Agreement replaces all prior or contemporaneous understandings or agreements, written or oral, regarding the subject matter hereof. 13.3. Assignment. This Agreement and the rights and obligations hereunder may not be assigned, in whole or in part, by either party without the other party's written consent, not to be unreasonably withheld. However, without consent, either party may assign this Agreement to any successor to all or substantially all of its business or assets which concerns this Agreement (whether by sale of assets or equity, merger, consolidation or otherwise). This Agreement shall be binding upon, and inure to the benefit of, the successors, representatives and permitted assigns of the parties hereto. 13.4. Notice. Any notice that is required or permitted by this Agreement shall be in writing and shall be deemed effective upon receipt, when sent by confirmed e‐mail to support@photoshelter.com or when delivered in person by nationally recognized overnight courier or mailed by first class, registered or certified mail, postage prepaid, to, 111 Broadway, 19th Floor New York, New York 10006 (in the case of PhotoShelter) or to the email address or physical address, as applicable, set forth on an applicable Order Form (for Client). 13.5. Modification and Waiver. No change, consent or waiver under this Agreement will be binding on either party unless made in writing and physically signed by an authorized representative of such party. The failure of either party to enforce its rights under this Agreement at any time for any period will not be construed as a waiver of such rights, and the exercise of one right or remedy will not be deemed a waiver of any other right or remedy. 13.6. Interpretation. Headings used in this Agreement are for convenience only and have no legal or contractual significance. 13.7. Severability. If any provision of this Agreement is determined to be illegal or unenforceable, that provision will be limited or eliminated to the minimum extent necessary so that this Agreement will otherwise remain in full force and effect and enforceable. 13.8. Remedies. Except as specifically provided otherwise herein, each right and remedy in this Agreement is in addition to any other right or remedy, at law or in equity. Each party agrees that, in the DocuSign Envelope ID: 79107112-9BB9-477B-B662-FF2F869640FC event of any breach or threatened breach of Section 7 (Proprietary Rights) or the confidentiality obligations contained herein, the non‐breaching party will suffer irreparable damage for which it will have no adequate remedy at law. Accordingly, the non‐breaching part y shall be entitled to injunctive and other equitable remedies to prevent or restrain such breach or threatened breach, without the necessity of posting any bond. 13.9. Counterparts. This Agreement may be executed in one or more counterparts, each of which shall be an original, but taken together constituting one and the same instrument. Execution of a facsimile (e.g., .pdf or electronic signature) copy shall have the same force and effect as execution of an original, and a facsimile signature shall be deemed an original and valid signature. PhotoShelter, Inc.: By: ______________________________ Authorized Signature _________________________________ Name (Print or Type) _________________________________ Title _________________________________ Date Client: By: ______________________________ Authorized Signature _________________________________ Name (Print or Type) _________________________________ Title _________________________________ Date DocuSign Envelope ID: 79107112-9BB9-477B-B662-FF2F869640FC PHOTOSHELTER BRANDS ORDER FORM End of Month Expiration: 09/19/2022 Client Name Address Client Contact Phone Accounts Payable Contact Chapel Hill/Orange County Visitors Bureau 501 West Franklin Street Chapel Hill, North Carolina, 27516, United States Leslie Wilcox 919.245.4328 PhotoShelter Contact Kristin Schordine, Customer Success support@photoshelter.com, (212) 206‐0808 ext. 3389 Term Initial Term (period following the Effective Date): • 12 months The term of this Order Form shall automatically renew for successive terms equivalent to the length of the Initial Term with an increase of 5% unless either party provides written notice of its intent to not renew at least thirty (30) days prior to the end of the then‐current term. Effective Date 09/20/2021 Storage 1 Terabytes User Seats 1 Administrator seat 2 Editor Unlimited Invited Users and Contributors Bandwidth Unlimited Payment Period Annual Payment Method • Invoice Payment Term An invoice will be generated upon commencement of Services and on each anniversary date thereafter. Payment is due within thirty (30) days of an invoice from PhotoShelter. DocuSign Envelope ID: 79107112-9BB9-477B-B662-FF2F869640FC Fees TOTAL FEES: $6,999 annually Included with Packaged Configuration: ● PhotoShelter Account w/ 1 Administrator, 2 Editors ● 1TBs of storage ● unlimited Invited Users ● unlimited upload and download bandwidth ‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐ If Applicable, Sales Transaction Fees: If activated, the sales transaction fee for image sales initiated via the PhotoShelter system is 8%. This fee is billed on a monthly basis to a credit card on file, regardless of the Client’s annual subscription fees. All fees are non‐refundable. Client may terminate their account at any time by notifying PhotoShelter at support@photoshelter.com. In all cases, Client will remain obligated to pay any fees for any Services or additional resources incurred prior to termination. In the event of any outstanding unpaid balance in this account upon such termination, Client shall promptly remit such outstanding amounts to PhotoShelter upon termination. DocuSign Envelope ID: 79107112-9BB9-477B-B662-FF2F869640FC 07/06/2021 Sequoia Benefits & Insurance Services, LLC 1850 Gateway Drive, Suite 700 San Mateo CA 94404 Amy Singh (650) 369-0200 (650) 369-0201 amy.singh@sequoia.com Photoshelter 111 Broadway - 19th Floor New York NY 10006 Travelers Property Casualty of America 25674 Charter Oak Fire Ins Co 25615 Travelers Indemnity Co 25658 HSB Specialty Insurance Company 14438 21-22 LIAB A ZPP-41N41176-21 07/01/2021 07/01/2022 1,000,000 1,000,000 10,000 1,000,000 2,000,000 2,000,000 B BA-3S536049-21 07/01/2021 07/01/2022 1,000,000 C CUP-3S53829A-21 07/01/2021 07/01/2022 2,000,000 2,000,000 D Tech E&O/Cyber 660497002 07/01/2021 07/01/2022 Each Claim Limit $5,000,000 Aggregate Limit $5,000,000 Evidence of Insurance. Evidence of Insurance SHOULD ANY OF THE ABOVE DESCRIBED POLICIES BE CANCELLED BEFORE THE EXPIRATION DATE THEREOF, NOTICE WILL BE DELIVERED IN ACCORDANCE WITH THE POLICY PROVISIONS. INSURER(S) AFFORDING COVERAGE INSURER F : INSURER E : INSURER D : INSURER C : INSURER B : INSURER A : NAIC # NAME:CONTACT (A/C, No):FAX E-MAILADDRESS: PRODUCER (A/C, No, Ext):PHONE INSURED REVISION NUMBER:CERTIFICATE NUMBER:COVERAGES IMPORTANT: If the certificate holder is an ADDITIONAL INSURED, the policy(ies) must have ADDITIONAL INSURED provisions or be endorsed. If SUBROGATION IS WAIVED, subject to the terms and conditions of the policy, certain policies may require an endorsement. A statement on this certificate does not confer rights to the certificate holder in lieu of such endorsement(s). THIS CERTIFICATE IS ISSUED AS A MATTER OF INFORMATION ONLY AND CONFERS NO RIGHTS UPON THE CERTIFICATE HOLDER. THIS CERTIFICATE DOES NOT AFFIRMATIVELY OR NEGATIVELY AMEND, EXTEND OR ALTER THE COVERAGE AFFORDED BY THE POLICIES BELOW. THIS CERTIFICATE OF INSURANCE DOES NOT CONSTITUTE A CONTRACT BETWEEN THE ISSUING INSURER(S), AUTHORIZED REPRESENTATIVE OR PRODUCER, AND THE CERTIFICATE HOLDER. OTHER: (Per accident) (Ea accident) $ $ N / A SUBR WVD ADDL INSD THIS IS TO CERTIFY THAT THE POLICIES OF INSURANCE LISTED BELOW HAVE BEEN ISSUED TO THE INSURED NAMED ABOVE FOR THE POLICY PERIOD INDICATED. NOTWITHSTANDING ANY REQUIREMENT, TERM OR CONDITION OF ANY CONTRACT OR OTHER DOCUMENT WITH RESPECT TO WHICH THIS CERTIFICATE MAY BE ISSUED OR MAY PERTAIN, THE INSURANCE AFFORDED BY THE POLICIES DESCRIBED HEREIN IS SUBJECT TO ALL THE TERMS, EXCLUSIONS AND CONDITIONS OF SUCH POLICIES. LIMITS SHOWN MAY HAVE BEEN REDUCED BY PAID CLAIMS. $ $ $ $PROPERTY DAMAGE BODILY INJURY (Per accident) BODILY INJURY (Per person) COMBINED SINGLE LIMIT AUTOS ONLY AUTOSAUTOS ONLY NON-OWNED SCHEDULEDOWNED ANY AUTO AUTOMOBILE LIABILITY Y / N WORKERS COMPENSATION AND EMPLOYERS' LIABILITY OFFICER/MEMBER EXCLUDED? (Mandatory in NH) DESCRIPTION OF OPERATIONS below If yes, describe under ANY PROPRIETOR/PARTNER/EXECUTIVE $ $ $ E.L. DISEASE - POLICY LIMIT E.L. DISEASE - EA EMPLOYEE E.L. EACH ACCIDENT EROTH-STATUTEPER LIMITS(MM/DD/YYYY)POLICY EXP(MM/DD/YYYY)POLICY EFFPOLICY NUMBERTYPE OF INSURANCELTRINSR DESCRIPTION OF OPERATIONS / LOCATIONS / VEHICLES (ACORD 101, Additional Remarks Schedule, may be attached if more space is required) EXCESS LIAB UMBRELLA LIAB $EACH OCCURRENCE $AGGREGATE $ OCCUR CLAIMS-MADE DED RETENTION $ $PRODUCTS - COMP/OP AGG $GENERAL AGGREGATE $PERSONAL & ADV INJURY $MED EXP (Any one person) $EACH OCCURRENCE DAMAGE TO RENTED $PREMISES (Ea occurrence) COMMERCIAL GENERAL LIABILITY CLAIMS-MADE OCCUR GEN'L AGGREGATE LIMIT APPLIES PER: POLICY PRO-JECT LOC CERTIFICATE OF LIABILITY INSURANCE DATE (MM/DD/YYYY) CANCELLATION AUTHORIZED REPRESENTATIVE ACORD 25 (2016/03) © 1988-2015 ACORD CORPORATION. All rights reserved. CERTIFICATE HOLDER The ACORD name and logo are registered marks of ACORD HIRED AUTOS ONLY DocuSign Envelope ID: 79107112-9BB9-477B-B662-FF2F869640FC Cloud Service Questionnaire This questionnaire is to be used to assess security and legal issues surrounding cloud services under consideration for Orange County. For this questionnaire, cloud services are any services requiring storage of County data outside the County network or provision of computing resources outside of the County network. Vendor under consideration: Libris by Photoshelter - Libris.photoshelter.com Solution under consideration: Photo, video and creative design file storage and sharing Department(s) served: Economic Development/Visitors Bureau 1. Who owns the data created by County personnel using this service? a. Chapel Hill/Orange County Visitors Bureau 2. Does the Cloud contractually allow the County to access and retrieve its data at the County’s discretion? a. Yes If No, Explain: 3. Is the Cloud provider contractually obligated to dispose, return or retrieve data in the event of contract termination? a. Yes If No, Explain: 4. Upon such provision of data, is the Cloud provider obligated to specify data format and all information necessary for data extraction? a. Yes. If No, Explain: 5. Is the Cloud provider obligated to destroy all copies of County data, at the County’s request? a. Yes If No, Explain: 6. What are the Cloud provider’s obligation to the County in the event of confirmed or suspected data breaches? a. In 15+ years, PhotoShelter has never seen a successful DDOS attack or loss of a single bit of data, but in the case that something would happen, PhotoShelter follows the SANS incident response program, and clients notified as soon as a breach would be discovered. DocuSign Envelope ID: 576DD5DB-E4A9-406B-8F7C-CC4EF3C2484FDocuSign Envelope ID: 79107112-9BB9-477B-B662-FF2F869640FC 7. Is the Cloud provider obligated to inform the County of all locations in which the data is stored (including backups) and to continually keep the County informed of any changes to those locations? a. Yes If No, Explain: 8. What are the Cloud provider’s contractual obligations with respect to litigation holds on County data? a. We don’t hold our client data hostage. At any point the County will be able to pull down your files. 9. What are the Cloud provider’s contractual prohibitions on disclosing data to individuals, groups or organizations making record requests, unless so directed by an authorized County official? a. PhotoShelter does not release any client data to anyone outside of the client organization. 10. Does the contract obligate the Cloud provider to allow third-party audits and/or certifications related to infrastructure and security, including penetration testing and vulnerability assessment, as requested by the County? a. No. If No, Explain: Not contractually. Regarding the security of the system, we already employ two separate outside scanning vendors called Comodo and Nessus. These two services scan our system both daily and monthly for vulnerabilities at the OS, Network, and Application levels as well as across our two data centers and corporate environment. PhotoShelter could happily provide a copy of the latest certification. 11. Does the contract obligate the Cloud provider to allow third party onsite inspections of the Cloud provider’s infrastructure and security practices on a specified basis? a. No. If No, Explain: Not contractually. We also would consider this to be a security risk to the infrastructure. The two datacenters - one with Tel’x in the Google Building in New York and one on the West Coast with Layer42 in Santa Clara - have state-- of--the--art security including 24x7 guards, video surveillance, biometric entry systems and servers housed in cages under lock and key. Take a tour of our infrastructure with our VP of Network Operations: https://librisblog.photoshelter.com/behind-the-scenes-with-libris-powering-a- secure-reliable-network/ 12. Does the contract obligate the Cloud provider to provide security documentation upon DocuSign Envelope ID: 576DD5DB-E4A9-406B-8F7C-CC4EF3C2484FDocuSign Envelope ID: 79107112-9BB9-477B-B662-FF2F869640FC request by the County? a. No. If No, Explain: Not contractually, but we’re happy to provide. See here: https://welkerlibris.photoshelter.com/galleries/C0000dA4gktF6a90/G0000VFCK wSHVRM0/IT-InfoSec-Due-Diligence 13. Does the contract obligate the Cloud provider to supply the County with the provider’s performance records, including access to daily and weekly service quality statistics? a. No. If No, Explain: Not Contractually, but we’re very transparent. Real-time stats here: http://photoshelter.status.io/ 14. Explain the contractually obligated service level parameters, minimum levels, specific remedies and penalties for non-compliance for: 1) Uptime: 2) Performance and response time: 3) Error correction time: 4) infrastructure and security: **SEE #15 Below** 15. Does the contractually defined Service Level Agreement define pertinent terms such as downtime, scheduled downtime, etc…? a. No. If No, Explain: At the level of service the County Visitors Bureau is choosing, there is not defined SLA in place. Those guarantees are typically reserved for enterprise clients who are paying us $20,000+ annually. 16. Does the contract specify minimum disaster recovery and business continuity requirements, including penalties for non-compliance, as discovered through onsite inspections, audits or actual disasters? a. No. If No, Explain: Not contractually. But we do employ best of breed technology and practices that address these concerns. 17. Does the contract require the cloud vendor to notify the County of any outsourced functionality and its provider? a. No If No, Explain: Not contractually, but there are no third-party dependencies for storage/hosting. The only third-party integration is with the Adobe Creative Cloud, which the County Visitors Bureau isn’t using. DocuSign Envelope ID: 576DD5DB-E4A9-406B-8F7C-CC4EF3C2484FDocuSign Envelope ID: 79107112-9BB9-477B-B662-FF2F869640FC 18. What are the contractually required notification period for the County or the cloud vendor for termination of the cloud services? a. 30 Days written notice from term date. 19. Describe how the County’s data will be stored, managed and archived. a. PhotoShelter employs the best--of--breed technology platforms at every security layer— from firewalls and access--management to intrusion detection, and is working with industry leaders like Norse Corp on next--generation security platforms. In 12 years of managing our own proprietary cloud--based platform, our system has proven its reliability with a track record of greater than 99.9% uptime with several petabytes of data being managed — which includes multiple replicas of over 285 million images and more than 5 million new professional grade images monthly. We have 100% durability and have not lost a single bit of data in 10 years. Regarding the security of the system, we employ two separate outside scanning vendors called Comodo and Nessus. These two services scan our system both daily and monthly for vulnerabilities at the OS, Network, and Application levels as well as across our two data centers and corporate environment. We have two primary data centers — one with Tel’x in the Google Building in New York and one on the West Coast with Layer42 in Santa Clara. Both facilities have state--of--the--art security including 24x7 guards, video surveillance, biometric entry systems and servers housed in cages under lock and key. The system has built--in redundancy such that replicas of all data/media assets exist on both the East and West Coast, enabling complete fail over to the opposite coast in the event of an emergency. We have passed rigorous security audits from highly scrutinizing clients, including government entities like the New York City Mayor’s Office. Our Chief Scientist is also the founder of a recognized computer security firm, while our VP of Network Operations was the former “Chief Network Paranoid” at Yahoo. 20. Will the County’s data be stored and managed on a storage system with other data? a. Yes If Yes, Explain: The County will not get it’s own dedicated server, but the data of every 1,100 Libris client is partitioned completely separate from each other. Every file uploaded will be duplicated across our datacenters for a total of 4 redundant copies. 21. At what architectural point in the provider’s cloud facility will the County’s data be physically connected to networking equipment with non-County data? a. None 22. What are the cloud provider’s information security policies? a. As a private company, we do not disclose this level of detail for security purposes as this would expose proprietary information and open us to unwarranted risk. Please refer to our Security Overview for additional information : https://welkerlibris.photoshelter.com/galleries/C0000dA4gktF6a90/G0000VFCK DocuSign Envelope ID: 576DD5DB-E4A9-406B-8F7C-CC4EF3C2484FDocuSign Envelope ID: 79107112-9BB9-477B-B662-FF2F869640FC wSHVRM0/I0000A6bVk9GpcTc/Libris-Security-OverviewLibris-Security- Statement-1-pdf 23. What are the cloud provider’s incident management and reporting policies? a. PhotoShelter follows the SANS incident response program, and clients notified as soon as a breach would be discovered. In 15+ years, PhotoShelter has never seen a successful DDOS attack or loss of a single bit of data. 24. What is the process by which the cloud provider updates policies and informs customers? a. PhotoShelter clients are typically notified by email in advance of specific policies taking effect and the date of adoption. 25. What is the basic architecture of the cloud provider’s network security? (overall design, zones, filters, firewalls, VLANs, protocols, standards) a. Please see the data diagram: https://welkerlibris.photoshelter.com/galleries/C0000dA4gktF6a90/G0000VFCK wSHVRM0/I0000jRsNr8hK6Os/Photoshelter-Data-Diagram-pdf 26. What security measures does the cloud provider use in data storage, transit and use? a. Data is fully encrypted via TLS 1.2. 27. What encryption technologies does the cloud provider use in data management? a. Data is fully encrypted via TLS 1.2. 28. How are access rights managed by the cloud provider for their employees, contractors and other persons? a. PhotoShelter has policies in place that once signed on as a client, no one from PhotoShelter accesses client data unless there’s been permission from a member of the client org. Normally, this is in cases of support, training, etc. 29. What methods does the cloud provider use to destroy information, when so authorized? a. Data is permanently wiped from our system 120 days after the end date of a contract. 30. What is the cloud provider’s patch management policy/methods? a. Updates, bug fixes, etc are rolled out in real-time as they are discovered and addressed. 31. How does the cloud provider defend against malware, including but not limited to viruses, bots, spyware, spam, phishing and pharming? a. Regular scans with Malware detection software. In 15+ years, PhotoShelter has never experienced a successful DDOS attack or penetration of our infrastructure. 32. What system hardening strategies are employed by the cloud provider? 33. How does the cloud provider perform security testing, including logging, correlation, DocuSign Envelope ID: 576DD5DB-E4A9-406B-8F7C-CC4EF3C2484FDocuSign Envelope ID: 79107112-9BB9-477B-B662-FF2F869640FC intrusion detection, intrusion prevention, file integrity monitoring, time synchronization, security assessments, penetration testing? a. PhotoShelter employs the best--of--breed technology platforms at every security layer— from firewalls and access--management to intrusion detection, and is working with industry leaders like Norse Corp on next--generation security platforms. In 11 years of managing our own proprietary cloud--based platform, our system has proven its reliability with a track record of greater than 99.9% uptime with several petabytes of data being managed — which includes multiple replicas of over 285 million images and more than 5 million new professional grade images monthly. We have 100% durability and have not lost a single bit of data in 10 years. Regarding the security of the system, we employ two separate outside scanning vendors called Comodo and Nessus. These two services scan our system both daily and monthly for vulnerabilities at the OS, Network, and Application levels as well as across our two data centers and corporate environment. 34. What technologies and methods does the cloud vendor provide for strong authentication? a. We have the ability to implement Single Sign-On should the County decide to go with an alternate authentication method other than email/password within the Libris address book. 35. Provide any other comments and explanations: DocuSign Envelope ID: 576DD5DB-E4A9-406B-8F7C-CC4EF3C2484FDocuSign Envelope ID: 79107112-9BB9-477B-B662-FF2F869640FC