AgdaPkt 2020-11-23 Joint SA PFA - Laserfiche WebLink

Browse Search

6.11). - Page 127 of 179 3.3. In the event of or more Errors of Level 3 or higher during any calendar month, City may terminate this Purchase Agreement for material breach, provided City notifies Vendor in writing of termination within 30 days of the end of such calendar month. Data Security 4. Data Security. 4.1. Data Ownership. City will own all right, title and interest in its data that is related to the Services provided under this Purchase Agreement. Vendor shall not access City user accounts or City Data except (1) as necessary to provide the Services, (2) in response to service or technical issues, (3) as required by the express terms of this Purchase Agreement or (4) at City's written request. 4.2. Data Protection. Protection of personal privacy and data shall be an integral part of the business activities of Vendor to ensure there is no inappropriate or unauthorized use of City's data at any time. To this end, Vendor shall safeguard the confidentiality, integrity, and availability of City information and City Data, and comply with the following conditions: 4.2..1. Vendor shall implement and maintain appropriate administrative, technical and organizational security measures to safeguard against unauthorized access, disclosure or theft of Personal Data and Non -Public Data. Such security measures shall be in accordance with recognized industry practice and not less stringent than the measures Vendor applies to its own Personal Data and Non -Public Data of similar kind. 4.2..2. All data obtained by Vendor in the performance of this Purchase Agreement shall become and remain the property of the City, except where such data belongs to a cardholder under applicable law. 4.3. All Personal Data and Non -Public Data shall be encrypted at rest and in transit with controlled access. Unless otherwise stipulated, Vendor is responsible for encryption of the Personal Data and Non -Public Data. Any stipulation of responsibilities will identify specific roles and responsibilities and shall be included in a service level agreement signed by Vendor and City. 4.4. Vendor warrants and represents that it is PCI -DSS SAQ-D compliant and that any data transmitted by the Services will be sent via industry -standard PCI -compliant means. For data at rest, Vendor shall ensure hard drive encryption consistent with validated cryptography standards as referenced in FIPS 140-2, Security Requirements for Cryptographic Modules for all Personal Data. 4.5. At no time shall any data or processes — that either belong to or are intended for the use of City or its officers, agents or employees — be copied, disclosed or retained by Vendor or any party related to Vendor for subsequent use in any transaction that does not include the City. 4.6. Vendor shall not use any information collected in connection with the Services issued from this Purchase Agreement for any purpose other than fulfilling the Services. O7P FORM 40000, 166