Agmt18 Brainfuse, Inc. - Laserfiche WebLink

Browse Search

12.1 Data Ownership. City will own all right, title and interest in its data that is related to the Services provided under this Agreement except for data that is owned by Participating Students. Consultant shall not access City user accounts or City Data, except (1) as necessary to provide the Services, (2) in response to service or technical issues, (3) as required by the express terms of this Agreement or (4) at City's written request. 12.2 Data Protection. Protection of personal privacy and data shall be an integral part of the business activities of Consultant to ensure there is no inappropriate or unauthorized use of City's data at any time. To this end, Consultant shall safeguard the confidentiality, integrity, and availability of City information and City Data and comply with the following conditions: 12.2.1 Consultant shall implement and maintain appropriate administrative, technical and organizational security measures to safeguard against unauthorized access, disclosure or theft of Personal Data and Non -Public Data. Such security measures shall be in accordance with recognized industry practice and not less stringent than the measures Consultant applies to its own Personal Data and Non -Public Data of similar kind. 12.2.2 All data obtained by Consultant in the performance of this Agreement shall become and remain the property of the City. 12.2.3 All Personal Data and Non -Public Data shall be encrypted at rest and in transit with controlled access. Unless otherwise stipulated, Consultant is responsible for encryption of the Personal Data and Non - Public Data. Any stipulation of responsibilities will identify specific roles and responsibilities and shall be included in a service level agreement signed by Consultant and City. 12.2.4 Consultant warrants and represents that it is PCI -DSS SAQ-D compliant and that any data transmitted by the Services will be sent via industry -standard PCI -compliant means. For data at rest, Consultant shall ensure hard drive encryption consistent with validated cryptography standards as referenced in FIPS 140-2, Security Requirements for Cryptographic Modules for all Personal Data. 12.2.5 At no time shall any data or processes — that either belong to or are intended for the use of City or its officers, agents or employees — be copied, disclosed or retained by Consultant or any party related to Consultant for subsequent use in any transaction that does not include the City. REV: 01-10-18 JS Page 6 of 18 ATTY/AGR.2018.007/Brainfuse 2018