25F - AGMT FOR PD BACKGROUND SOFTWARE

Home Browse Search

INC. addresses, telephone numbers, financial profiles, credit card information, driver's license numbers, medical data, law enforcement records, educational records or other information identifiable to a specific individual that relates to any of these types of information ("Personally Identifiable Information" or "PIP'). 5.9 Exclusions from Confidential Information. Notwithstanding the foregoing, Confidential Information shall not include information the receiving Party can prove by clear and convincing written contemporaneous evidence is: (1) publicly known through no fault or negligence of the receiving Party; (2) rightfully possessed by the receiving Party prior to disclosure by the disclosing Party; (3) rightfully obtained by the receiving Party from a third -party in lawful possession of such Confidential Information without obligation of confidentiality; (4) independently developed by the receiving Party without reference to or use of the disclosing Party's Confidential Information. 5.10 Restrictions on Use and Disclosure. Each party shall not use the other party's Confidential Information for any purpose other than performance of its obligations and exercise of its rights under this Agreement. Furthermore, each party shall not disclose the other party's Confidential Information to any third party except to such party's employees, contractors, and other representatives who (a) have a bona fide need to know such Confidential Inforuation for purposes of performing this Agreement, (b) have been informed of the confidential nature of such information, and (c) have agreed in writing or are otherwise legally bound not to use or further disclose such information except as permitted by this Agreement. 5.11 Disclosure Required by Law. Notwithstanding the foregoing, Confidential Information may be disclosed by a receiving Party to the extent required to be disclosed by public disclosure law or a court order, subpoena, or similar legal requirement; or necessary to disclose to prevent severe physical injury to or loss of life of an individual; provided, however that the receiving Party shall notify the disclosing Party prior to such required disclosure promptly and sufficiently in advance to permit the receiving Party to contest or limit such required disclosure, including without limitation redaction of trade secret information prior disclosure. 5.12 Public Records Request. MMI acknowledges that Client, as a public entity, is at all times subject to the state public records act, as now existing or as amended. If Client receives a public records request for all or any portion of this Agreement, including any documents or materials provided to Client under this Agreement, generally such information will be a public record andmust be disclosed to the public records requester. 5.13 Storage and Encryption. During the Term of this Agreement, MMI will store and maintain Client Data and Applicant Data for use and access by Client and its Authorized Users under the terms of this Agreement and the SLA. MMT will ensure industry standard data encryption methods are in place for storage of Client Data and Applicant Data. The encryption shall meet or exceed HIPAA, and CES standards, as well as any other standards stated in MMI's eSOPH Security Overview documentation. 5.14 Backups. MMI shall record snapshot copies of Client Data hourly during the Term and shall record full backup copies of Client Data once per week. Backup copies are stored on both MMI's production server, to enable a quick restore if necessary, and remotely within Amazon Web Services CrovCloud (US). Backup records that are older than one calendar week are automatically purged from MMPs production server. At least three months of backup copies are stored remotely and are automatically purged after three months. MMI uses proprietary software to monitor the automated tasks of Microsoft SQL. 5.15 Payment Card Data, If Client will request or have access to credit card information, Client represents that it is presently in compliance with, and will remahi in compliance with, an approved version of the Payment Card Industry Data Security Standard, developed and published jointly by American Express, Discover Financial Services, JCB, MasterCard Worldwide and Visa International ("Card Issuers") or the PCI Security Standards Council (the "Council"), as applicable, for protecting individual numbers used to identify credit and debit card accounts and other personally identifiable information relating to the use of such credit and debit card accounts ("Cardholder Information"), as the same may be amended, updated, replaced or augmented by the Card Issuers and the Council (the "PCI Standard"). Client acknowledges that it may, in connection with performing its duties in accordance with this Agreement, have access to, or be provided, Cardholder Information. MASTER SovrwARC LICENSE & SERVICES AGREEMENT PACE 8 Or 20 Version: April 12, 2017 25F-10