VENDOR SERVICES AGREEMENT - · PDF fileConfidential to Kelly Services, Inc. and Vendor 1 VENDOR SERVICES AGREEMENT ... Vendor may terminate this agreement ... certification requirements

R07/13 Confidential to Kelly Services, Inc. and Vendor

1

VENDOR SERVICES AGREEMENT

Agreement entered into this _____ day of _______________, ________ by and between Kelly Services, Inc., having its principal place of business at 999 West Big Beaver Road, Troy, Michigan 48084 ("Kelly"), and ________________________________________, having its principal place of business at __________________________________________________ ("Vendor").

In consideration of the mutual covenants, terms, and conditions herein contained, the parties agree as follows:

DEFINITIONS.

As used herein, the following terms shall have the meanings ascribed to them as set forth below:

1. SERVICES.

The services and other materials provided to Kelly by Vendor (collectively, the “Services”) are described, and must be provided at the times and in the manner set forth in, Exhibit A attached hereto and incorporated herein by this reference.

1.1 SCOPE OF SERVICES. 1.2 ATTACHMENTS TO AGREEMENT

1.2.1 Exhibit A: Description of Services 1.2.2 Exhibit B: Pricing 1.2.3 Exhibit C: Service Level Agreement 1.2.4 Exhibit D: Implementation 1.2.5 Exhibit E: Reporting 1.2.6 Attachment 1: Information Security and Privacy Compliance

2. TERM

This Agreement is binding on the parties upon full signing hereof. The term of the Agreement commences ___________________, ________ (the “Effective Date”) and shall remain in effect remains in effect for _____ years (the “Initial Term”) expiring on ___________________, ________ (the “Expiration Date”).

2.1 Extension of Term.

The term may be extended or renewed for an additional term (“Renewal Term”) only by written agreement of the parties. If the term of the Agreement expires without being formally renewed or extended, both parties may continue to perform as set forth in this Agreement on a month-to-month basis until terminated by either party with thirty (30) days prior written notice.

2.2 Termination for Convenience

Kelly may terminate this agreement, (in whole or in part), without penalty, at any time by giving the vendor notice of the termination at least thirty (30) days prior to the termination date specified in the notice.

2.3 Termination for Cause

2.3.1 Kelly Termination

Kelly may terminate this agreement if Vendor fails to perform any of its material obligations under this agreement and does not cure such failure within thirty (30) days after being given notice

specifying the nature of the failure. Without limiting this Subsection, repeated breaches by Vendor of its duties or obligations under this Agreement, or Vendor’s failure to achieve the Service Levels shall each be deemed a material breach of this agreement.


2

2.3.2 Vendor Termination

Vendor may terminate this agreement by giving notice to Client if Client fails to pay undisputed Fees for a period of three (3) months or more and fails to make such payment within thirty (30) days after being given notice of such failure.

2.4 Sale of Business to Client Competitor

If Vendor enters into an agreement to sell all or substantially all of its business to a direct competitor of Kelly, Vendor must inform Kelly prior to completion of the sale of this transaction. Under this circumstance, Client can immediately terminate the agreement such that any data Kelly deems to be confidential or proprietary can be destroyed before ownership changes hands.

2.5 Discontinuance of Services

Upon receipt of any termination notice, Vendor shall discontinue the Services on the date and to the extent

specified in the notice. Vendor shall be paid for the actual costs incurred during performance hereunder, up to the termination date specified in said notice, any costs not previously reimbursed by Kelly to the extent such costs are actual, necessary, reasonable and verifiable costs which have been incurred by Vendor and which are otherwise reimbursable hereunder. In no event shall such cost include unabsorbed overhead or anticipated profit.

3. GOVERNING LAW AND JURISDICTION

THIS AGREEMENT, AND ALL OTHER ASPECTS OF THE BUSINESS RELATIONSHIP BETWEEN THE PARTIES, IS CONSTRUED, INTERPRETED, AND ENFORCED UNDER AND IN ACCORDANCE WITH THE LAWS OF THE STATE OF MICHIGAN WITHOUT REGARD TO CHOICE OF LAW PROVISIONS. VENDOR AGREES, WITH RESPECT TO ANY LITIGATION ARISING DIRECTLY OR INDIRECTLY OUT OF, OR THAT IN ANY WAY RELATES TO, THIS AGREEMENT, THE BUSINESS RELATIONSHIP OR ANY OTHER TRANSACTION, MATTER, OR ISSUE BETWEEN THE PARTIES, TO COMMENCE IT EXCLUSIVELY IN THE STATE OF MICHIGAN COURTS OF OAKLAND COUNTY, MICHIGAN OR THE UNITED STATES DISTRICT COURT AT DETROIT, MICHIGAN, AND VENDOR BY THIS

AGREEMENT CONSENTS TO THE JURISDICTION OF THESE COURTS.

4. COMPLIANCE WITH LAWS

Vendor shall comply with all applicable national, multi-jurisdictional, federal, state, and local laws, rules, statutes, treaties, regulations and orders, including compliance with Kelly’s current privacy policy and Safe Harbor certification requirements and local data protection and privacy laws.

4.1 FOREIGN CORRUPT PRACTICES ACT (FCPA).

Vendor shall, and shall be responsible for ensuring that its representatives and subcontractors shall, perform all obligations of Vendor under the Agreement in compliance with all laws, rules, regulations and other legal requirements.

Vendor represents and warrants that it is familiar with all applicable domestic and foreign antibribery or anticorruption laws, including those prohibiting Vendor, and, if applicable, its officers, employees, agents

and others working on its behalf, from taking corrupt actions in furtherance of an offer, payment, promise to pay or authorization of the payment of anything of value, including but not limited to cash, checks, wire transfers, tangible and intangible gifts, favors, services, and those entertainment and travel expenses that go beyond what is reasonable and customary and of modest value, to: (i) an executive, official, employee or agent of a governmental department, agency or instrumentality, (ii) a director, officer, employee or agent of a wholly or partially government-owned or -controlled company or business, (iii) a political party or official thereof, or candidate for political office, (iv) an executive, official, employee or agent of a public international organization (e.g., the International Monetary Fund or the World Bank) (“Government Official”) or (v) any executive, officer, employee of agent of a third party; while knowing or having a reasonable belief that all or some portion will be used for the purpose of: (a) influencing any act, decision or failure to act by a Government Official in his or her official capacity, (b) inducing a Government Official to use his or her influence with a government or instrumentality to affect any act or decision of such government or entity, or (c) securing an improper advantage; in order to obtain, retain, or direct business.

Vendor represents and warrants that it and its subcontractors would now be in compliance with all applicable domestic or foreign anti-bribery or anticorruption laws, including those prohibiting the bribery of Government Officials, and will remain in compliance with all applicable laws; that it will not authorize, offer


3

or make payments directly or indirectly to any Government Official; and that no part of the payments received by it will be used for any purpose that could constitute a violation of any applicable laws.

4.2 MASSACHUSETTS STANDARDS FOR THE PROTECTION OF PERSONAL INFORMATION.

Vendor acknowledges that to the extent it maintains or has access to any Personal Information (“PI”) of any individual that resides in the Commonwealth of Massachusetts, Vendor is obligated to comply with the Massachusetts Office of Consumer Affairs and Business Regulation Standards for the Protection of Personal Information, 201 CMR 17.00 (“Massachusetts PI Standards”). PI is described as a Massachusetts resident’s first and last name in combination with one or more of the following: Social Security Number; driver’s license number or state-issued identification card; or financial account number, or credit card number, or debit card number. Vendor represents and warrants that from the Effective Date of this Agreement and for so long as it has PI of Massachusetts residents thereafter, even after termination of this Agreement, (i) Vendor shall be in compliance with the Massachusetts PI Standards and shall remain in compliance with such Standards as amended from time to time and (ii) that Vendor shall notify Kelly Services, Inc. in

writing immediately if it is no longer in compliance with the Massachusetts PI Standards. Failure to notify Kelly of such non-compliance shall be considered a material breach of this Agreement.

If at any time during the term of this Agreement, any part of PI that Vendor obtains from Kelly ceases to be required by Vendor for the performance of its obligations in this Agreement, Vendor shall promptly notify Kelly that such information is no longer required. Vendor shall at Kelly’s option either (i) return to such Kelly PI to Kelly or (ii) destroy all copies of such Kelly PI. Such instructions will include all Kelly PI in the Vendor’s possession or control and Vendor shall certify to Kelly that the same has been completed.

5. DATA PRIVACY AND SECURITY

As a result of this Agreement, Vendor may obtain certain information relating to identified or identifiable individuals (“Personal Data”). Vendor shall, and shall ensure its employees, agents, representatives and Vendors (“Vendor Personnel”) collect, access, maintain, use, process and transfer Personal Data in accordance with the requirements set forth in this section and for the sole purpose of performing Vendor’s obligations under this Agreement.

Protection of Personal Data. Vendor shall at all times comply with Kelly’s instructions regarding Personal Data, as well as all applicable laws, regulations and international accords, treaties, or accords, including without limitation, the EU/US Safe Harbor program (collectively, “Legal Requirements”), and shall refrain from engaging in any behavior which renders or is likely to render Kelly in breach of same. Without limiting the generality of the foregoing, with respect to any data received directly or indirectly from the European Economic Area or from Kelly’s European affiliates, Vendor shall abide by the Safe Harbor Privacy Principles of the U.S. Department of Commerce, located at http://www.export.gov/safeharbor, as may be amended from time to time (the “Safe Harbor Principles”), excluding the Notice, Choice and Enforcement provisions contained within the Safe Harbor Principles.

Vendor shall take all appropriate legal, organizational, and technical measures to ensure the confidentiality of Personal Data, and protect Personal Data against accidental or unlawful destruction or accidental loss, alteration, unauthorized disclosure or access, and against all other unlawful forms of processing, keeping in mind the nature of such data.

Vendor may only disclose Personal Data to third parties (including Vendor Personnel), who have a need to know and have signed agreements that require them to protect Personal Data in the same manner as detailed in this Agreement. Vendor shall hold such third parties with access to Personal Data accountable for violations of this Agreement, including imposing sanctions, and where appropriate, terminating contracts and employment.

Vendor shall take all reasonable steps to ensure that Personal Data is reliable for its intended use, and is accurate, complete and current. Immediately upon Kelly’s request, or as otherwise may be necessary to comply with this Agreement, Vendor shall correct, delete and/or block Personal Data from unauthorized processing and/or use. Vendor shall promptly notify Kelly’s General Counsel if it receives any requests from an individual with respect to Personal Data, including but not limited to “opt-out” specifications, information access requests, information rectification requests and all like requests, and shall not respond to any such requests unless expressly authorized to do so by Kelly. Vendor shall promptly and properly deal with inquiries and requests from Kelly in relation to the processing of Personal Data under this Agreement.

Vendor acknowledges that it shall have no right, title or interest in any Personal Data obtained by it as a result of this Agreement.

http://www.export.gov/


4

Vendor shall provide other reasonable assistance and support, and assist and support Kelly in the event of an investigation by a data protection regulator or similar authority, if and to the extent that such investigation relates to the collection, maintenance, use, processing or transfer of Personal Data under this Agreement. Vendor shall provide to Kelly, its authorized representatives and independent inspection body designated by Kelly, on reasonable notice, (i) access to Vendor's information processing premises and records and (ii) reasonable assistance and cooperation of Vendor's relevant staff for the purpose of auditing Vendor's compliance with its obligations under this Agreement.

In the event that Vendor is unable to comply with the obligations stated in this section 11 (b) (Data Privacy and Security), Vendor shall promptly notify Kelly, and Kelly may take any one or more of the following actions: (i) suspend the transfer of Personal Data to Vendor; (ii) require Vendor to cease processing Personal Data; (iii) demand the return or destruction of Personal Data; or (iv) immediately terminate this Agreement.

Upon termination of this Agreement for any reason, Vendor shall promptly contact Kelly for instructions regarding the return, destruction or other appropriate action with regard to Personal Data.

Security Procedures. Vendor shall maintain reasonable operating standards and security procedures, and shall use its best efforts to secure Personal Data through the use of appropriate physical and logical security measures including, but not limited to, appropriate network security and encryption technologies. Vendor shall use reasonable user identification or password control requirements and other security procedures as may be issued, from time to time by Kelly in relation to the Personal Data. Vendor shall promptly notify Kelly in the event that Vendor learns or has reason to believe that any person or entity has breached or attempted to breach Vendor’s security measures, or gained unauthorized access to Personal Data (“Information Security Breach”). Upon any such discovery, Vendor will (a) investigate, remediate, and mitigate the effects of the Information Security Breach, and (b) provide Kelly with assurances reasonably satisfactory to Kelly that such Information Security Breach will not recur. Additionally, if and to the extent any Information Security Breach or other unauthorized access, acquisition or disclosure of Personal Information occurs as a result of an act or omission of Vendor or Vendor’s Personnel, and if Kelly determines that notices (whether in Kelly’s or Vendor’s name) or other remedial measures (including notice, credit monitoring services, fraud insurance and the establishment of a call center to

respond to customer inquiries) are warranted, Vendor will, at Kelly’s request and at Vendor’s cost and expense, undertake the aforementioned remedial actions.

6. AUDIT

Upon 30 days notice, Kelly or a 3rd party of their choosing, may audit, copy, and inspect the records, transactions, and Vendor processes during the term of this agreement, and a period of at least 3 years after the termination of this agreement, or any Order, whichever occurs last. Vendor will maintain all records pertaining to services rendered or products delivered for the term of this agreement and for the ensuring 3 year period. In addition to record maintenance, Vendor will agree to provide 100% of transactions requested for the period under audit in a database format of either Microsoft Access of Excel. The transactions provided will agree to the total amount invoiced to Kelly for the period requested. Vendor agrees to review findings identified as a result of the audit and provide feedback within 30 days after receipt of the audit findings unless a different timeframe is agreed upon by both parties. Vendor agrees to refund all overcharges identified by Kelly Services or a 3rd party auditor within 2 weeks after Vendor feedback has been provided. Kelly, without waiver or limitation of any

rights, may deduct from any amounts due to Vendor in connection with this agreement, or any other Agreement between Kelly Services and Vendor any audit findings identified during the course of the audit not repaid by Vendor within the 2 week timeframe. At Kelly’s request, Vendor will at no charge provide Kelly with copies of any routine SSAE-16 Type I and II audit reports, or any successor reports (“SSAE-16 Reports”) directly related to the Services provided hereunder.

7. REPRESENTATIONS AND WARRANTIES

Vendor represents and warrants that: (i) its performance under this Agreement will at all times conform to the highest professional and ethical standards; (ii) due care and its best efforts will be utilized by Vendor in the performance of this Agreement; (iii) it is under no obligation or restriction that would conflict with the Services required to be furnished by Vendor and its other obligations under this Agreement, or that otherwise would in any manner prevent the full performance by Vendor of the terms, conditions, and requirements of this Agreement (Vendor must immediately disclose to Kelly any actual or potential conflict of interest that may arise during the Vendor’s performance of this Agreement). In the event Vendor breaches any of the above warranties

in any material respect, Kelly may exercise all rights and remedies available to it under applicable laws and all other rights and remedies under this Agreement.


5

8. LIMITATION OF LIABILITY

Except with respect to damages arising from sections 5, 9, 13, and 14 herein, neither party is liable to the other party for incidental, consequential, punitive, or exemplary damages arising in connection with this Agreement or the performance, omission of performance, or termination hereof including, without limitation, lost sales and profits and other business interruption damages, even if the party has been advised of the possibility of such damages and without regard to the nature of the claim or the underlying theory or cause of action (whether in contract, tort, or otherwise).

9. INDEMNIFICATION

9.1 Vendor’s Obligations

To the fullest extent permitted by law: Vendor must reimburse, indemnify, defend, and hold harmless Kelly, its subsidiaries and affiliates and each of its subsidiary’s and affiliate’s present, former, and future shareholders, employees, officers, and directors from and against all loss, damage, expense (including attorney’s fees and expenses), and penalty, and any claim or action therefore by or on behalf of any person, (collectively, “Loss”) arising out of or in connection with the performance or failure of performance of this Agreement including, without limitation, Loss arising out of or occurring in connection with: (i) any acts or omissions by Vendor or its employees or agents, including, without limitation, personal injury and death claims; (ii) all claims of Vendor's employees, agents, and subcontractors, whether for injury, death, compensation, social security, pension, unemployment compensation, etc.; (iii) the provision, ownership, installation, operation, maintenance, use, or repair of any of the Services; and (iv) all third-party claims alleging that any of the Services infringes any patent, copyright, trademark, or other proprietary right or constitutes a misuse of any trade secret information. Vendor will not be relieved of the foregoing indemnity and related obligations by allegations or any claim that Kelly was negligent; but Vendor is not liable to the extent any injury or damage is finally judicially determined by a court of competent jurisdiction to have been proximately caused by the sole negligence or willful act of Kelly.

9.2 Client’s Obligations

Kelly agrees to timely advise Vendor of any suit, claim, or proceeding, and to reasonably cooperate with Vendor in the defense or settlement of such suit, claim, or proceeding, but Vendor will have sole control thereof. If an injunction is obtained against Kelly's use of any of the Services, in whole or in part, Vendor must promptly at Kelly’s option either: (i) procure right to continue using the Services enjoined from use or replace or modify them so that Vendor’s use or possession is not subject to any such injunction, or (ii) refund to Kelly all amounts paid to Vendor for the Services. If this indemnification provision is construed by a court of competent jurisdiction to require indemnification over and above that permitted by applicable law or public policy, the parties intend that the Agreement be judicially modified to afford Kelly the maximum indemnification allowed.

10. INSURANCE

Vendor will maintain during the term of this Agreement at least the following types and limits of insurance with insurers possessing an A.M. Best Rating of not less than A- and authorized to do business under the laws of the State (s) and/or Country (ies) where work/services are performed:

Workers' Compensation on the Vendor employees, in amounts no less than required by law;

Employer's Liability insurance with a limit of $1,000,000;

Commercial Automobile Liability insurance with a $1,000,000 combined single limit on vehicles owned, leased, or rented by Vendor;

Commercial General Liability insurance, including bodily injury and property damage, contractual liability, and products and completed operations, with a $1,000,000 per occurrence, $2,000,000 aggregate;

Excess/Umbrella Liability with a limit of $5,000,000;

If Vendor is working on Kelly premises and has access to Kelly computer systems, software and/or any related proprietary technology or information, valuable property or equipment, the following insurance coverage is also required: Crime/Fidelity/Commercial Blanket Bond with limits of $3,000,000 per occurrence;

If Vendor is providing professional services, the following insurance coverage is also required: Professional Liability/Errors and Omissions insurance with a limit of $3,000,000; and


6

If Vendor is performing professional information technology services and/or work and has access to Kelly computer systems, software and/or any related proprietary technology/information, the following insurance coverage is also required: Cyber Risk/Network Liability/Privacy insurance with a limit of $3 million.

Kelly Services, Inc. is to be included as an additional insured on Vendor’s Commercial General and Automobile Liability policies. Vendor will provide Kelly with certificates of this insurance coverage evidencing the required coverage upon signing of this Agreement and upon renewal of the policies describes above.

11. INDEPENDENT CONTRACTOR

Vendor is an independent contractor in the performance of this Agreement, and nothing contained in this Agreement may be construed to create or constitute a joint venture, partnership, agency, franchise, lease, or any other arrangement other than as expressly granted in this Agreement. Vendor is responsible for its operation and any subcontracted operations. Vendor must exercise control over its employees, agents, representatives, subcontractors, and suppliers and is solely responsible for the verification of identity and

employment eligibility, for the payment of any wages, salaries, or other remuneration of its employees, agents, representatives, subcontractors, and suppliers, and for the payment of any payroll taxes, contributions for unemployment or workers compensation, social security, pensions, or annuities that are imposed as a result of the employment of Vendor's employees, agents, representatives, subcontractors, and suppliers. Vendor must not pledge credit, incur any obligation or liability, hire any employee, nor purchase any merchandise or services in the name of Kelly or any subsidiary or affiliate thereof. Unless otherwise provided in this Agreement, all costs, charges, and expenses incurred in connection with Vendor’s performance of this Agreement must be borne by Vendor.

12. ASSIGNMENT

Neither party may assign or otherwise transfer its rights, obligations, and/or duties under this Agreement without the prior written consent of the other party, given at the other party's sole option; but Kelly may assign this Agreement to a subsidiary or affiliate upon notice to Vendor. Any prohibited assignment is void.

13. INTELLECTUAL PROPERTY

Vendor hereby assigns, conveys, and transfers all right, title, and interest in and to the Services, which include all related work product of Vendor and its employees, to Kelly. Vendor understands that all Services produced, developed or otherwise created by Vendor or its employees hereunder are the exclusive property of Kelly. Consistent with this understanding, Vendor must not use the Services for the benefit of any party other than Kelly.

If applicable, Vendor warrants that all creators and/or contributors to the Services, including but not limited to, all persons engaged by Vendor to make any contributions to the Services, were, at the time of the Services' creation, bona-fide employees of Vendor who made their contributions to the Services within the scope of their employment as work for hire or that Vendor has obtained and possesses a written assignment of the copyright, title, and interest from all the creators or contributors not otherwise considered bona-fide employees. Vendor must maintain an agreement with each of its employees consistent with the obligations set forth in sections 5, 13, and 14 and is responsible for enforcing such agreements. Vendor must provide a copy of such agreement at the request of Kelly.

14. CONFIDENTIALITY

Both parties acknowledge that they are held to the terms of the mutual nondisclosure agreement signed prior to the execution of this agreement.

15. ENFORCEABILITY

If any provision of this Agreement is held to be void or unenforceable by any judicial or administrative authority, or is unlawful or unenforceable under any applicable law, the remaining provisions are considered to be severable and their enforceability is not to be affected or impaired in any way by reason of such law or holding.

16. INVOICING AND PAYMENT

Vendor will generate a monthly or weekly consolidated invoice for all services set forth in Exhibit A, including any applicable shipping and administrative fees. One complete copy of the invoice is sent to Kelly’s corporate office with a statement of activity for the prior period. Kelly will not pay for any services that are invoiced greater than 90 days following the date services are actually performed. All invoices must include, at a minimum, the following information: (i) Name and address of Vendor; (ii) Invoice number; (iii) Description of Services


7

provided; (iv) Date; and (v) Dollar amount due. Kelly agrees to pay Vendor for Services rendered in the amounts set forth in Exhibit A after the receipt of a correct invoice from Vendor. Kelly will pay all undisputed invoice amounts within 45 days of invoice date. Any disputed invoice amounts will be documented in writing and forwarded to Vendor within 45 days of invoice receipt. Within 45 days of Vendor’s receipt of documentation of disputed amounts, Vendor will have responded to Kelly’s claim. Upon resolution of disputed items in favor of Vendor, payment will be remitted within 10 days. If the resolution of disputed items is in favor of Kelly and not contested, no further action is required.

17. TAXES

Unless otherwise provided for in Exhibit A, or in a Statement of Work, Vendor’s pricing and fees for professional services are exclusive of applicable federal, state, local and foreign taxes, duties, assessments and levies attributable to the provision of Vendor’s services. Vendor is solely liable and shall not be allowed to bill Kelly for any Taxes based on or measured by Vendor’s property, capital, income or receipts.

Any sales, value added, or other tax properly imposed by a jurisdiction in connection with the Vendor’s services (“Taxes”) shall be the responsibility of the Vendor. Any such Taxes required to be collected by the Vendor must be separately stated on the invoice unless Kelly provides Vendor with a valid tax exemption certificate. Vendor will indemnify and hold Kelly harmless from all interest, fines and penalties related to payment of back Taxes that the Vendor failed to collect.

18. GENERAL

18.1 MOST FAVORED NATION

All of the benefits and terms granted by Vendor herein are at least as favorable as the benefits and terms granted by Vendor to any previous buyer of the services described in this Agreement. Should Vendor enter into any subsequent agreement with any other buyer, during the term of this Agreement, which provides for benefits or terms more favorable than those contained in this Agreement, then this Agreement shall be deemed to be modified to provide Kelly with those more favorable benefits and terms.

Vendor shall notify Kelly promptly of the existence of such favorable benefits and terms and Kelly shall immediately have the right to receive the more favorable benefits and terms. If requested in writing by Kelly, Vendor shall amend this Agreement to contain the more favorable terms and conditions.

18.2 PUBLICITY

<DO NOT WANT TO ALLOW> Neither party shall originate any publicity, news release or other public announcement relating to this Agreement nor the existence of an arrangement between the Parties without the prior written approval of the other Party, except as otherwise required by law and upon reasonable notice to the other Party.

<WILLING TO ALLOW> The parties agree that any press release or public announcements describing the services to be provided and the relationship created pursuant to this Agreement shall be acceptable upon mutual agreement by the parties.

18.3 ESCROW OF SOURCE CODE

18.3.1 DEPOSIT

Vendor will place and maintain in escrow with an escrow agent (the “Escrow Agent”) two copies of the most recent version of the Code.

18.3.2 ESCROW AGENT

The Escrow Agent is intended to be _______________.

18.3.3 UPDATES

So long as Client purchases the Services, Vendor will deliver to the Escrow Agent two complete copies of the Source Code at least semi-annually, and within thirty (30) days after any change to the Source Code that materially affects the Services.

18.3.4 RIGHT TO USE SOURCE CODE

The Software shall be released upon the occurrence of any one of the following events (“Release Conditions”): (i) if the Vendor has ceased operating in the normal course of business; or (ii)


8

Bankruptcy of the Vendor; or (iii) if Vendor is acquired by a competitor to Kelly. Subject to the terms and conditions of this Agreement and the Release Conditions set forth in this section, Vendor hereby grants to Client a license to use, copy and create derivative works of the Source Code to operate, maintain and support the Software (in source and object code form) solely within the scope of Services provided under this Agreement.

18.4 NOTICES

Any written notice required or permitted to be given hereunder shall be given by: (i) Registered or certified mail, return receipt requested, postage prepaid; (ii) confirmed facsimile; or (iii) nationally recognized overnight courier service to the other party at the addresses listed on the cover page or to such other address or person as a party may designate in writing. All such notices shall be effective upon receipt.

Kelly Address for Notices:

Kelly Services, Inc. 999 W. Big Beaver Road Troy, MI 48084 Attn: General Counsel

Vendor Address for Notices:

Vendor Name Address City, State Zip Code Attn:

18.5 DIVERSITY

In an effort to promote diverse and minority business growth, Kelly requires that Vendor provide quarterly reports indicating Tier I or Tier II diverse supplier spend as it relates to their business with Kelly. Reports are to be directed to the purchasing department after the end of each quarter.

18.6 FORCE MAJEURE

Neither party shall be responsible for delays or failures in performance resulting from acts of God, acts of civil or military authority, terrorism, fire, flood, strikes, war, epidemics, pandemics, shortage of power, or other acts or causes reasonably beyond the control of that party. The party experiencing the force majeure event agrees to give the other party notice promptly following the occurrence of a force majeure event, and to use diligent efforts to re-commence performance as promptly as commercially practicable.

18.7 NON-SOLICITATION

Neither Party will knowingly, either directly or indirectly, solicit the other party’s employees for employment without written authorization from the other Party.

18.8 CODE OF CONDUCT

Vendor will use commercially reasonable efforts to ensure that its employees or representatives comply with its Code of Business Conduct and Ethics and any other policy in relation to corporate gifts, entertainment, and bribery. Said policies will be made available to Kelly upon request. If either party has reason to believe their employee or representative has committed a violation of their respective code of business conduct with respect to the other party, said party will report the suspected violation of the Code of Business Conduct to the other party in writing.

18.9 AUTHORITY TO CONTRACT

Each person signing below warrants and represents that he/she has full power and authority to execute this Agreement on behalf of the party he/she represents. Upon request, each party must provide a Certified Resolution or Certificate of Authority authorizing the undersigned to enter into and sign this Agreement.

18.10 REPRESENT AND WARRANT

Vendor and Kelly each expressly represent and warrant to the other that each has relied solely and exclusively on its own judgment and the advice of its own attorneys in entering into this Agreement, and that no representative or agent of the other has made any statement or representation to it beyond those in this Agreement that have induced signing of this Agreement.


9

18.11 AGREEMENT FINAL AND COMPLETE

This Agreement is the final and complete agreement between Kelly and Vendor with respect to the subject matter hereof. No representations, inducements, promises, or understandings in relation to the subject matter hereof, whether oral or written, exist unless expressly set forth in this Agreement, and this Agreement supersedes all prior understandings, agreements, contracts, or arrangements between the parties, whether oral or written, unless otherwise expressly incorporated in this Agreement. No agreement or other understanding purporting to add to or to modify the terms and conditions hereof is binding unless agreed to by duly authorized representatives of the parties in writing. Any terms or conditions in any forms of the parties used in the performance of this Agreement that are in conflict with the terms and conditions hereof are void.

18.12 BUSINESS DOWNTURN

In the event Kelly establishes to vendor’s satisfaction that: a) Kelly is unable to meet the Annual Volume Commitment, notwithstanding Kelly’s best efforts to do so; and b) such failure results solely from a business downturn beyond the Kelly’s control, which materially and permanently reduces the size or scope of Kelly’s operations and the volume of Services required by Kelly hereunder. By way of illustration and not by limitation, Business Downturn shall not include a change in Kelly’s usage of Services hereunder resulting from a decision by Kelly to reduce its overall use of services, to alter its architecture, or to transfer portions of its traffic or projected growth to other suppliers.

18.13 ARMS LENGTH TRANSACTION

This is an arms-length transaction and relationship. There exist no implied or otherwise unstated covenants, rights, or obligations by, of or against either party. The parties expressly disclaim the existence of any implied covenant of good faith and/or fair dealing.


10

DESCRIPTION OF SERVICES EXHIBIT A


11

PRICING EXHIBIT B


12

SERVICE LEVEL AGREEMENT EXHIBIT C


13

IMPLEMENTATION EXHIBIT D


14

REPORTING EXHIBIT E


15

INFORMATION SECURITY AND PRIVACY COMPLIANCE ATTACHMENT 1

This Information Protection, Security and Privacy Attachment (“Attachment 1”) sets forth certain duties and obligations of the Supplier (as defined below) with respect to the protection, security and privacy of Kelly Services Information in the course of performance under the Agreement that includes this Attachment. In the event of a conflict between this Exhibit and other parts of this Agreement, the parties agree that this Attachment shall supersede and control.

A. Definitions

“Agreement” means the agreement between the Supplier or other party contracting with Kelly Services that by its terms expressly includes this Exhibit as an attachment.

“Kelly Services Customer” means any third party (including individuals and entities) with a relationship to Kelly Services and/or its business, products or services, including without limitation, actual and prospective business customers.

“Kelly Services Information” means any Kelly Services Records or data of Kelly Services in the possession of, or accessible by, Supplier or its computer or communication system(s), including Personal Data of any kind.

“Kelly Services Personnel” means Kelly Services employees, officers, directors, agents, contract workers and subcontractors, the family members of such persons, applicants for employment at Kelly Services and applicants seeking to work as a Kelly Services contract worker or subcontractor, and also includes all such persons when associated with Kelly Services affiliates.

“Malicious Code” means any computer instructions in Software that are not intended to provide the functionality described in the Software specifications and that interfere with Kelly Services’ right to fully utilize

its license to the Software or interfere with or prevent Kelly Services’ use of the Software as contemplated in this Agreement. Malicious Code includes without limitation such computer instructions commonly known as computer viruses, “Trojan horses,” anomalies, self-destruction mechanisms, copy protection schemes, and any other computer instructions that interfere with or prevent Kelly Services from using the Kelly Services Information or Software as described in its specifications or as contemplated in this Agreement. Malicious Code also includes without limitation any computer instructions that can: (i) disable, destroy, or otherwise alter the Kelly Services Information or any hardware on which the Software executes; or (ii) reveal any data or other information accessed through or processed by the Software to anyone outside of Kelly Services without Kelly Services’ knowledge and prior approval.

“Patches” shall mean software update code provided by specific vendors to correct an identified vulnerability within Software or on Supplier’s system, computer, network, or other equipment.

“Personal Data” means any information relating to a natural identifiable person, whether the person identified is an employee, employee family member, applicant, consumer, customer, supplier, partner,

potential partner, or other individual and expressly includes Kelly Services Customers and Kelly Services Personnel. An identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his physical, physiological, mental, economic, cultural or social identity. Personal Data includes both General Data and Sensitive Data:

a. General Data includes, without limitation, the following types of information: names, dates of birth, Social Security Numbers (SSN's) and related government/national identification numbers (including tax identification numbers), home and business addresses, home and business email addresses, home and business telephone numbers, employee ID numbers (e.g. core ID, Commerce ID, etc), credit card numbers, and passwords.

b. Sensitive Data includes, without limitation, the following types of information: racial or ethnic origin, religious or philosophical beliefs, political affiliations/opinions, trade union membership, medical or health-related Records, sexual orientation, disabilities, and background checks.


16

“Privacy Laws” means all federal, state, and local U.S. or foreign laws, regulations, and/or rules relating to Personal Data and other data privacy and data protection, as they may be enacted, adopted or amended from time to time.

“Processing of Personal Data” means any operation or set of operations that is performed upon Personal Data, and includes, without limitation, the following: access, collection, use, retention, copying, recording, organization, storage, adaptation or alteration, retrieval, transmission, dissemination or otherwise making available, and/or disposal or destruction of Personal Data.

“Record” means any recorded information used by Kelly Services that has value to Kelly Services for conducting its business or meeting its legal obligations. This includes information created or received in any form, including e-mails, paper documents, electronic documents, data base or application information, and other electronic or photographic media.

“Security Incident” means the unauthorized access, use, alteration, destruction, or other Processing of, or other compromise or breach of security (electronic or physical) involving or related to any Kelly Services Information. Security Incidents include, but are not limited to, information system failures and loss of service, denial of service, errors resulting from incomplete or inaccurate business data, and breaches of confidentiality. Security Incidents will be considered confidential and will be treated in accordance with the confidentiality requirements of this Agreement, except notice to Kelly Services Personnel, Kelly Services Customers, or other parties pursuant to Privacy Laws or Kelly Services policy.

“Security Vulnerability” means a weakness at the network services, operating system, or application level, or within associated functions of networks, computer systems, or Software that could allow a Security Incident to occur. Security Vulnerabilities also include physical vulnerabilities to the premises containing or permitting access to Kelly Services Information.

“Software” means computer software and related documentation as defined in this Agreement, or if none, computer programs consisting of a series of instructions, algorithms, lines of code, application program interfaces and statements in object code or source code form, along with any related materials and technical data, and all textual material relating to and necessary for use of such programs, including without limitation, flow charts, operating instructions, user manuals and related technical information and modifications of such documentation.

“Supplier” means such supplier, vendor, or other business partner defined as a party in the Agreement and obligated under this Attachment.

B. Security Requirements

1. Supplier will have full responsibility to implement and maintain reasonable information systems for electronic and other media that are reasonably suitable to protect the security of Kelly Services Information, and to comply with this Exhibit and the Agreement, including without limitation, physical, network, host, web, application, and data security.

2. Supplier will maintain reasonable security precautions consistent with industry best practices and

identify in writing and make available, upon request, to Kelly Services the system security standards and documented processes used to reasonably secure Supplier’s systems. Supplier will meet the minimum security and privacy standards of International Standard ISO 27001 and 27002, and Safe Harbor.

3. Supplier will provide annual, upon request, to Kelly Services, SAS70 Type II or SSAE-16 report that includes, but not limited, to process and technology controls within the scope of services provided to Kelly Services.

4. To the extent Supplier Processes Personal Data, Supplier will meet or exceed the information security requirements set forth in this Exhibit.

5. Supplier will monitor for Security Incidents on the basis of 24 hours per day by 7 days per week by 365 days per year.

6. Supplier will logically and/or physically segregate Kelly Services’ Personal Data from the data of any third party.


17

7. Supplier will encrypt (utilizing strong encryption) Kelly Services’ Personal Data if it is stored on laptops or portable media devices (e.g., USB drives, CD-ROMs, DVDs, backup tapes, etc.).

8. Supplier will, unless a longer retention period is required by law, provide all Kelly Services’ Personal Data to Kelly or upon request by Kelly, destroy all copies thereof in a manner to ensure that no restoration of such data is possible upon the earlier of (i) termination of the Agreement in relation to which the Kelly Services’ Personal Data was used; or, (ii) the purpose for which the Kelly Services’ Personal Data is being used has been completed (and, prior to disposal of any equipment on which Kelly Services Personal Data has been stored or processed, Supplier shall comply with “NIST Guidelines for Media Sanitization (Draft SP 800-88)”.

9. Supplier will have a Security Incident response process in place to manage and to take immediate corrective action for any Security Incident as identified in Section D of this Exhibit.

10. Supplier will implement and provide a copy annually, upon request, of disaster recovery/business continuity plan to protect Kelly Services critical business processes from failing as a result of the effects of any major failure or disaster.

11. Supplier will inform Kelly Services promptly in writing of the occurrence of any unauthorized access, use, violation, compromise or breach of security (electronic or physical), other than incidental events not intended to cause a security breach, involving or related to information of other customers or other third parties (without being obligated to identify third parties by name) involving the computing environment, information or communication systems, facilities or transportation means involved in Processing Kelly Services Information.

12. Supplier will not transfer any Kelly Services’ Information to any 3rd party without the expressed approval in writing from Kelly Services.

13. Supplier will be responsible for all costs incurred by Supplier and Kelly Services for security breach remediation activity, as defined in Section D, for security breaches within the scope of Supplier’s services.

C. Representation and Warranties

1. Supplier represents and warrants that it has taken commercially reasonable actions to ensure that Kelly Services Information is protected against any and all reasonably anticipated Security Incidents and Security Vulnerabilities.

2. Supplier represents and warrants that its systems are monitored for Security Incidents on the basis of 24 hours per day by 7 days per week by 365 days per year.

3. Supplier represents and warrants that it has a Security Incident response process to manage and to

take immediate corrective action for any Security Incident, including Malicious Code.

4. Supplier will provide certification of compliance to this Information Security and Privacy Compliance Exhibit by either obtaining such certification from an independent information security service company or through an annual self-assessment, as approved by Kelly Services.

5. Supplier expressly warrants that its Processing of Kelly Services’ Personal Data will comply with all applicable Privacy Laws.

D. Security Incident Notice

1. Initial Notification of Security Incident:

Supplier shall notify the Kelly Services’ Global Security Department immediately of any security

incidents via the Kelly Services’ 24x7 Security Hotline at: +1 (248)-244-4250 within one (1) hour of Supplier’s becoming aware of a Security Incident. Additionally, within twenty-four (24) hours of Supplier becoming aware of a Security Incident, Supplier shall also notify Kelly Services in writing via email to: [email protected]


18

2. Subsequent Reports and Notifications:

After the initial notification, Supplier shall subsequently notify the Kelly Services’ Global Security Department of any security incidents, as required below, via the 24x7 Security Hotline at: +1 (248)-244-4250. Additionally, as required below, Supplier shall notify Kelly Services via email of all Security Incidents and shall provide all written reports as follows:

3. Security Incident Resolution Times:

In the event of a Security Incident, Supplier shall use continuous efforts to correct the Security Incident immediately and notify Kelly Services’ Security Hotline upon resolution +1 (248)-244-4250.

4. Interim Status Reports

Supplier shall provide Kelly Services with an interim written status report of each Security Incident within 4 hours, and at agreed upon intervals thereafter, based on the agreed upon severity of the incident and such report shall include:

Date of Security Incident Brief description of Security Incident including known or suspected cause Supplier Incident Coordinator Kelly Services Incident Coordinator they are working with Impact of the Security Incident to Kelly Services, including, if applicable, type of information

that was breached Supplier’s Response Plan to this particular Incident

What has been done so far What needs to be done/action items

Current Status Expected timeframe for full service restoration

5. Final Report

Supplier shall provide Kelly Services with a final written report of each Security Incident within (3) business days of resolution or a determination that the problem cannot be satisfactorily resolved within such time period and such report shall include:

Supplier’s Name Supplier’s Incident Coordinator and contact information Kelly Services Incident Coordinator Date Incident Occurred Length of Outage Incident Executive Overview Incident Details:

• List of individuals and other third parties that were involved with any aspect of the incident handling (sometimes various services of an ISP are themselves outsourced to another third-party)

• How/when the incident was initially detected • When/How the incident was initially reported to Kelly Services • Description of what resources/services were impacted • Description of impact of Security Incident to Kelly Services (volume and type where

applicable) • Containment – How was the incident contained • Root Cause - What was the cause for disruption • Corrective Action During the Incident – What steps were taken to reduce exposure during

the incident (in most cases, there are interim steps taken to reduce exposure, e.g., Filtering, rerouting services, etc.).

• Permanent Corrective Action/Preventative measures – What permanent corrective actions

have been put in place as a result of this incident Conclusion


19

E. Post Mortem Reviews Supplier shall coordinate the scheduling of a Post Mortem Review with the Kelly Services Incident Coordinator. This review should be scheduled within seven (7) business days of the resolution of the incident or a determination that the problem cannot be satisfactorily resolved within such time period.

F. Security Vulnerability Security Vulnerability Classification: Supplier shall classify a Security Vulnerability as critical risk, high risk,

medium risk, or low risk, as follows:

Critical Risk Vulnerability A vulnerability that has a high probability of or actively being widely exploited in a manner disruptive to normal business operations based on these factors: the vulnerability can be exploited through the network without human intervention; the vulnerability is easily exploited and takes limited technical knowledge; an exploit of a vulnerability is subject to worms; software code scripts are widely known and easily available to exploit this vulnerability; the vulnerability is popular and well known in the technical and Internet community; the vulnerability could allow broad exposure/compromise of confidential information or a massive denial of service or disruption of service.

High Risk Vulnerability

A vulnerability that has a high probability of being exercised based on these factors: the vulnerability is easily exploited and takes limited technical knowledge; software code scripts are widely known and easily available to exploit this vulnerability; the vulnerability is popular and well known in the technical and Internet community; the vulnerability could allow broad exposure/compromise of confidential information or a massive denial of service or disruption of service.

Medium Risk Vulnerability

A vulnerability that has a lower probability of being exercised based on these factors: the vulnerability is more complex to exploit and takes a higher degree of technical knowledge; the

vulnerability does not have broad popularity in the technical and Internet community; the vulnerability could allow a more limited exposure/compromise of confidential information or a contained and limited denial of service or disruption of service.

Low Risk Vulnerability

A vulnerability that has a low probability of being exercised based on these factors: the vulnerability is very complex to exploit and takes a high degree of technical knowledge; the vulnerability does not have broad popularity in the technical and Internet community; the vulnerability could allow a very limited exposure/compromise of confidential information or a very limited denial of service or disruption of service.

G. Security Vulnerability Correction Completion Times


20

Security Vulnerabilities shall be corrected within the following timeframes. Supplier may use patches and other software update code to correct an identified vulnerability on a system, computer, network, or other computer equipment to correct Security Vulnerabilities.

Vulnerability Correction Completion Times

Critical Risk Immediate correction up to seven (7) calendar days of critical vendor patch release announcement, notification from Kelly Services, or discovered security breach, whichever is earlier.

High Risk within seven (7) calendar days of vendor patch release, or discovered security breach, whichever is earlier

Medium Risk within one (1) month of occurrence

Low Risk within three (3) months of occurrence

H. Suppliers’ Vulnerability and Penetration Testing

1. Supplier shall conduct or arrange for an annual vulnerability assessment and penetration testing of Supplier’s security processes and procedures, including vulnerability assessment and penetration testing of its services and deliverables under the Agreement, in order to identify potential Security Vulnerabilities (“Testing”). Supplier shall conduct or arrange for this Testing on all computers and systems used directly or indirectly in support of Kelly Services business, including those of any subcontractors of Supplier.

2. Supplier shall select an independent, qualified vendor to conduct the Testing, such vendor to be reasonably acceptable to Kelly Services.

3. Supplier shall provide Kelly Services with a written report summarizing:

Results of the Testing Any risks identified during the Testing, including:

• Classification of Security Vulnerability as critical risk, high risk, medium risk, or low risk • Detailed description of any Security Vulnerability • Corrective action taken or plan of action for correction of any identified Security

Vulnerability, including date of final resolution

4. Supplier shall correct any identified Security Vulnerability

5. All Testing conducted by Supplier will be subject to appropriate non-disclosure and confidentiality obligations.

I. Kelly Services’ Security Assessment and Audit Rights

1. Kelly Services reserves the right to request, at any time and upon reasonable notice, a security assessment or audit for verification of Supplier’s security processes and procedures, including vulnerability assessment and penetration testing of its services, deliverables, and protection of Personal Data under the Agreement, as stated in this Exhibit, in order to identify potential security breaches.

2. Kelly Services will request the Supplier to provide a written report summarizing:

Results of the Security Assessment

Any risks identified during the Security Assessment, including: • Classification of any Security Vulnerability as critical risk, high risk, medium risk, or low

risk • Detailed description of any Security Vulnerability


21

• Recommended corrective action for any identified Security Vulnerability.

3. Supplier shall correct any identified Security Vulnerabilities within the timeframe as stated in Section G.

4. All Security Assessments conducted by Kelly Services will be subject to appropriate non-disclosure and confidentiality obligations.

5. If Kelly Services’ Security Assessment reveals that Supplier’s processes and procedures do not meet the minimum standards of ISO 27001 or if the SAS70 Type II/SSAE-16 report shows deficiencies, then Supplier shall promptly take appropriate actions to change its processes and procedures to conform to such standards and will work with Kelly Services to implement such changes in a timely manner. If Supplier does not implement such changes to conform to ISO 27001 standards or rectify deficiencies found in the SAS70 Type II/SSAE-16 report within sixty (60) days, then Kelly Services, at its option, may terminate the Work as defined in the agreement and/or the applicable SOW at no cost to Kelly Services.

J. Incident Logs

1. Supplier shall maintain logs of all Security Incidents and will make the logs available for Kelly

Services’ review, upon request, (including review via electronic access), monthly or such other time period as may be agreed.

K. Malicious Code Protection

1. Supplier shall develop and maintain a documented process for installation and maintenance of Malicious Code protection software for all computer systems used directly or indirectly in support of Kelly Services business. Such process shall include, at a minimum:

a. Active virus detection software installed with real-time protection enabled b. Automated processes to apply latest virus definitions to all computer systems c. Supplier shall ensure itself and its subcontractors at any tier have completed successfully

secure code training based on the Open Web Application Security Project (OWASP) or similar standard. Certification of completion of such training shall be provided to Kelly Services, upon request.

L. Third Parties

Supplier will contractually require all third parties, including subcontractors, with access to

Kelly Services Information to adhere to the security requirements of this Exhibit. At a minimum, third party agreements should contain an acknowledgement that the third party is responsible for protecting Kelly Services Information in its possession, that the Kelly Services Information can only be used for assisting in the completion of the contract objectives and acknowledging that the audit provisions described in this Exhibit fully apply to them, their systems, and their premises beyond the termination of the contract.

M. Special provisioning related to personal data of Kelly Services Personnel and Kelly Services Customers

In the event Supplier has, or in the course of performance under this Agreement, will process Kelly Services Information that includes Personal Data regarding Kelly Services Customers or Kelly Services Personnel, then Supplier and its employees, officers, directors, agents, contract workers and/or others acting on its behalf or under its control may not Process Personal Data except as required for purposes of fulfilling the express purposes of this Agreement. Without limiting the requirements of this Exhibit, the special provisions set forth below will apply to Personal Data regarding Kelly Services Customers and Kelly Services Personnel.


22

1. Privacy Laws - Any Personal Data Processed by the Supplier in the course of performing its Services under this Agreement or as part of any deliverable or other information provided to Kelly Services will be processed and protected in accordance with all applicable Privacy Laws. Supplier expressly warrants that its Processing of Personal Data will comply with all Privacy Laws. Supplier will at all times perform its obligations under this Agreement in such a manner as to not, by its actions, or inaction contrary to this Agreement, cause Kelly Services to be in violation of applicable Privacy Laws.

2. Ownership and Information Integrity - All Personal Data Processed by the Supplier is and will remain the exclusive property of Kelly Services. Supplier will Process Personal Data only for the benefit of Kelly Services, and only to the extent strictly necessary to perform its obligations under this Agreement, or as otherwise required by law. Supplier may not otherwise use or modify the Personal Data, merge it with other data or information, commercially exploit it, disclose it or take any other actions that may in any manner adversely affect the integrity, security or confidentiality of such Personal Data, other than for purposes of performance under this Agreement or as otherwise directed by Kelly Services in writing.

3. Responsibility and Safeguards - Supplier will be fully responsible for any unauthorized Processing of Personal Data in any physical, electronic or other form. Without limitation, Supplier will employ administrative, physical, and electronic safeguards (including safeguards against Malicious Code and other disabling or damaging codes) that (i) prevent the unauthorized Processing of Personal Data of Kelly Services Customers or Kelly Services Personnel, and (ii) meet or exceed industry standards, as set forth in ISO 27001 and 27002 regarding such safeguards. Particular requirements may be substituted or waived by Kelly Services in writing upon consultation with Supplier, referencing this Exhibit. Supplier will ensure, without limitation, the following:

a. Delineation and Identification of Personal Data - Taking all necessary steps and implementing all

appropriate processes to delineate and identify Personal Data for special handling within Supplier’s organization, including supplemental controls over certain types of Personal Data more particularly regulated by Privacy Laws such as the limitation on use of SSN’s and related government/national identification numbers, and, where applicable, the requirement to obtain consent for the disclosure or other Processing of Personal Data.

b. Secure Servers and Maintenance - Ensuring that all physical, network, host, web and data sites in which Personal Data is stored are: (i) maintained in a secure manner that satisfies all the requirements of this Exhibit; and (ii) identified to Kelly Services.

c. Restricted Access - Ensuring that Personal Data will be accessible only by authorized Supplier employees, officers, directors, agents, contract workers and others who have a legitimate business need to access such information, with suitable user authentication, sign-on and access controls that satisfy the requirements of this Exhibit. Kelly Services employees, contractors, and customers must have reasonable access to their own personal information and be able to correct or amend where it is inaccurate.

d. Encryption of Personal Data (Transmission) - When Processing Personal Data, connections to Kelly

Services computing environments and any other transmission via data transmission services or using the Internet will be protected using any of the following cryptographic technologies: IPSec, SSL, SSH/SCP, PGP, or other technologies that provide substantially similar or greater levels of security. Encryption algorithms will be of sufficient strength to protect data to commercially reasonable security levels and will utilize industry recognized hashing functions. Transmission may not use any cryptography algorithms developed internally by or for Supplier. Encryption must be in full compliance with export laws applicable to the Kelly Services Information being transmitted.

e. Encryption of Personal Data (Storage) - Storage, back-up or other retention of Personal Data at rest will be protected using one or more of the encryption technologies approved in this Exhibit for data transmission.

f. Data Segregation (Virtual) - Maintaining capability to segregate and isolate Personal Data and disable functionality of applications using it, so it can be returned upon request by Kelly Services or in the event of a Security Incident.


23

g. Data Segregation (Physical) - Physically and electronically segregating Kelly Services Personal Data by logically isolating it from third party and internal Supplier information, and deploying suitable application controls, firewalls, air-gaps or private circuits so that Personal Data will not be commingled or corrupted by data from other sources.

h. Back-up, Emergency/Disaster Recovery Systems - Applying the requirements to Personal Data stored on back-up media, servers or repositories, transported, or transmitted, stored or recovered as part emergency or disaster recovery systems maintained by or for Supplier.

i. Information Retention and Disposal - (i) Cooperating with Kelly Services in administering its retention requirements concerning Kelly Services Information and employing Record controls required to enable such compliance, and (ii) returning or if authorized by Kelly Services, discarding, destroying and otherwise disposing of Personal Data in a secure manner to prevent unauthorized Processing of Personal Data consistent with Kelly Services’ policies and applicable law.

j. Media in Transit -Not permitting Personal Data to be transmitted, or stored for transfer and then subsequently transported on physical media such as flash memory, computer hard drives, removable disks, tapes, or other media, without encryption and other reasonable security measures restricting access and use as required by this Exhibit.

k. Employee Training - At Supplier’s expense, training its employees, officers, directors, agents and contract workers and others with access to Personal Data regarding the Supplier’s privacy protection and security obligations under this Agreement and generally concerning privacy and Personal Data.

l. Heightened Security Attention for Employees Handling Personal Data – Conducting heightened screening and evaluation processes for Supplier’s employees, officers, directors, agents and contract workers and others with access to Personal Data. Examples may include without

limitation, reference and background checks and adding security responsibilities to position qualifications, performance appraisals and compensation programs.

m. Privacy Assessments - As stated in Section J, upon request from Kelly Services, Supplier will conduct or arrange, at Supplier’s expense, reasonable assessments of Supplier’s information, security and protection practices and capabilities relating to Personal Data, and provide such reports as may be reasonably requested by Kelly Services. Supplier will also assist and cooperate in responding to any privacy assessments Kelly Services may reasonably request relating to the security and protection of Kelly Services Information.

n. Data Transfer to and From Third Parties Outside of Originating Country - Ensuring that no Personal Data is transmitted or permitted to be accessed from outside the country of its origin without determining requirements of and complying with the Privacy Laws in the originating and destination countries.

o. Periodic Adjustment - Supplier shall regularly monitor, evaluate, and adjust, as appropriate, its Security Program in light of any relevant changes in applicable law and regulations, technology, internal or external threats to Kelly Services Data, requests from Kelly Services, and Supplier’s own changing business arrangements, such as mergers and acquisitions, alliances and joint ventures, outsourcing arrangements, and changes to information systems.

p. System Changes - Supplier shall make no system change that may adversely affect the security of

the system or the security of Kelly Services Information.

q. Choice – suppliers will ensure processes and applications within scope of services utilized to support Kelly Services has the flexibility to allow for Kelly Services employees, customers, and contractors can opt out from their personal information from being processed.

r. Notification – supplier shall notify Kelly services employees, customers, and contractors the collection and usage of personal information and allow for the ability to contact for opting out, inquiries, or complaints. This information must be conspicuously displayed in clear language.


24

s. Onward Transfer – supplier shall disclose Kelly Services customer, employee, contractor personal

information to third parties only consistent with the principles of Notification and Choice (section q and r above).

Remedies:

For the avoidance of doubt, failure to comply with the requirements of this Exhibit is a failure to perform under this Agreement and subject to any provisions for breach set forth in this Agreement. In addition to any remedies otherwise available, Supplier, at its sole expense, will be responsible for and redress any damages or costs caused by, and take all reasonable steps to cure, such failure to perform, and will implement all corrective actions reasonably required to prevent such deficiencies and occurrences applicable to Supplier’s further performance under this Agreement.

Documents

VENDOR SERVICES AGREEMENT - · PDF fileConfidential to Kelly Services, Inc. and Vendor 1 VENDOR SERVICES AGREEMENT ... Vendor may terminate this agreement ... certification requirements