1011-00008 · Firm and Meridian Consumer Brands LLC · Transaction Documents

msa-near-final-draft-2023-10-06.docx DOCUMENT Antitrust

10 / 12 ← → ✕

NEAR-FINAL DRAFT — October 6, 2023

Prepared by Calderwood & Harkness LLP on behalf of Customer

NOTE TO DRAFTING PARTIES

Sections marked with [BRACKETED TEXT / OPEN ISSUE] reflect provisions that remain subject to agreement by the business principals of the parties. Four (4) open issues remain: (1) Data Security Standards (Section 8); (2) Limitation of Liability (Section 12); (3) Early Termination Fee (Section 14.4); and (4) Audit Rights (Section 15). These sections contain alternative formulations and/or placeholder language pending resolution. All other provisions in this draft have been agreed at the working-group level and are presented in near-final form subject to conforming edits and final legal review by both parties' outside counsel.

MASTER SERVICES AGREEMENT

Document Reference: MSA-PDS-MCB-2023

This Master Services Agreement (this "Agreement"), including all Exhibits, Schedules, Statements of Work, and amendments hereto, is entered into as of __, 2023 (the "Effective Date") (proposed commencement date: November 1, 2023), by and between:

MERIDIAN CONSUMER BRANDS LLC, a Delaware limited liability company, with its principal offices at 680 Fifth Avenue, 22nd Floor, New York, New York 10019 (hereinafter referred to as "Customer" or "MCB");

and

PINECREST DIGITAL SOLUTIONS INC., a Delaware corporation, with its principal offices at 2300 Lakewood Boulevard, Suite 400, Durham, North Carolina 27713 (hereinafter referred to as "Service Provider" or "Provider").

Customer and Service Provider are each referred to herein individually as a "Party" and collectively as the "Parties."

RECITALS

WHEREAS, Customer is a consumer products company that requires comprehensive information technology managed services, including, without limitation, cloud infrastructure management, managed IT services, enterprise application support, and cybersecurity monitoring, to support its ongoing business operations and strategic growth objectives (the "Business Purpose");

WHEREAS, Service Provider is an information technology services company, founded in 2016, that specializes in cloud infrastructure management, managed IT services, enterprise application support (including, without limitation, SAP and Pinnacle Health IT environments), cybersecurity monitoring and incident response, and data analytics platform hosting, and currently employs approximately 1,100 full-time employees across its domestic operations;

WHEREAS, Customer issued its Request for Proposal bearing reference number MCB-IT-RFP-2023-006 on June 12, 2023, soliciting proposals from qualified information technology service providers for the delivery of the managed services described therein, and following a comprehensive evaluation process involving multiple rounds of proposal review, capability assessments, reference checks, and commercial negotiations, Customer selected Service Provider as its preferred vendor on July 10, 2023;

WHEREAS, the Parties desire to enter into this Agreement to set forth the terms and conditions under which Service Provider will provide the Services (as defined below) to Customer in support of Customer's business operations; and

WHEREAS, the Parties have negotiated the terms of this Agreement in good faith and at arm's length, with each Party having had the opportunity to consult with independent legal counsel of its choosing.

NOW, THEREFORE, in consideration of the mutual covenants and agreements set forth herein, and for other good and valuable consideration, the receipt and sufficiency of which are hereby acknowledged, the Parties agree as follows:

ARTICLE 1 — DEFINITIONS

Section 1.1 — Defined Terms

As used in this Agreement, the following terms shall have the meanings set forth below. Capitalized terms used but not defined in this Section 1.1 shall have the meanings ascribed to them elsewhere in this Agreement.

(a) "Affiliate" means, with respect to any Party, any entity that directly or indirectly controls, is controlled by, or is under common control with such Party. For purposes of this definition, "control" means the direct or indirect ownership of fifty percent (50%) or more of the outstanding voting equity interests of the applicable entity, or the power to direct or cause the direction of the management and policies of such entity, whether through the ownership of voting securities, by contract, or otherwise.

(b) "Agreement" means this Master Services Agreement, together with all Exhibits, Schedules, Statements of Work, and any amendments, modifications, or supplements hereto that are executed by both Parties in accordance with Section 19.3.

(c) "Annual Contract Value" or "ACV" means the aggregate annual fees payable by Customer under all Service Components during a given Contract Year, which amount is initially Two Million Nine Hundred Fifty Thousand Dollars ($2,950,000) per Contract Year, as more particularly described in Exhibit A (Fee Schedule), subject to adjustment in accordance with this Agreement.

(d) "Authorized Users" means Customer's employees, contractors, temporary staff, consultants, and other agents who are authorized by Customer to access and use the Services in the ordinary course of Customer's business operations.

(e) "Business Day" means Monday through Friday, excluding any day that is a federal holiday in the State of New York, as recognized by the United States Office of Personnel Management.

(f) "Change of Control" means, with respect to any Party, the occurrence of any of the following events: (i) a merger, consolidation, or reorganization of such Party with or into another entity, whether or not such Party is the surviving or resulting entity; (ii) a sale, transfer, or other disposition of all or substantially all of such Party's assets; (iii) the acquisition by any person, entity, or group (within the meaning of Section 13(d) of the Securities Exchange Act of 1934, as amended) of more than fifty percent (50%) of the outstanding voting securities or equity interests of such Party; or (iv) any other transaction or series of related transactions resulting in a change in the identity of the ultimate controlling person(s) of such Party.

(g) "Confidential Information" means all non-public information disclosed by or on behalf of either Party (the "Disclosing Party") to the other Party (the "Receiving Party"), whether disclosed orally, in writing, electronically, or by any other means, that (i) is designated as "confidential," "proprietary," or with a similar designation at the time of disclosure; (ii) by its nature or the circumstances of its disclosure, would reasonably be understood to be confidential or proprietary; or (iii) is Customer Data. Without limiting the foregoing, Confidential Information specifically includes Customer Data, pricing algorithms, trade promotion data, supply chain analytics, business strategies, financial information, technical specifications, product roadmaps, vendor relationships, and the terms and conditions of this Agreement (including all pricing and fee information).

(h) "Contract Year" means each successive twelve (12) month period beginning on the Effective Date. The first Contract Year shall commence on November 1, 2023 and expire on October 31, 2024, and each subsequent Contract Year shall commence on the next succeeding November 1 and expire on the following October 31 during the Term.

(i) "Customer Data" means all data, information, content, records, files, databases, and materials of any kind or nature, in any form or format, that are (i) provided by or on behalf of Customer to Service Provider; (ii) generated by Customer's use of the Services; (iii) processed, stored, hosted, transmitted, or maintained by Service Provider in connection with the performance of the Services; or (iv) derived from any of the foregoing. Customer Data explicitly includes, without limitation, Customer's proprietary trade promotion data, pricing algorithms, supply chain analytics, customer and consumer data, sales data, marketing data, and any other data that is proprietary to Customer or that Customer is obligated to protect under applicable law or contractual obligation.

(j) "Deliverables" means the work product, custom software, custom configurations, reports, documentation, and other materials produced by Service Provider specifically for Customer under a Statement of Work, as distinguished from Service Provider's Pre-Existing IP and generally available tools, methodologies, and platforms.

(k) "Effective Date" means November 1, 2023 (proposed), or such other date as may be inserted upon execution of this Agreement.

(l) "Force Majeure Event" means any event or circumstance beyond a Party's reasonable control that prevents or materially impairs such Party's ability to perform its obligations under this Agreement, including, without limitation, acts of God, natural disasters (including earthquakes, floods, hurricanes, and wildfires), acts of war (whether declared or undeclared), armed conflict, terrorism, insurrection, riots, civil unrest, epidemics, pandemics, government orders or actions (including quarantines, embargoes, and sanctions), failure of third-party telecommunications or utility services, and cyberattacks of a scope and sophistication that could not have been reasonably anticipated or prevented through compliance with the security obligations set forth in this Agreement. For the avoidance of doubt, a Force Majeure Event does not include economic hardship, changes in market conditions, labor disputes involving solely the affected Party's employees, or the unavailability of Service Provider's personnel due to ordinary attrition.

(m) "Initial Term" means the five (5) year period commencing on the Effective Date and ending on October 31, 2028.

(n) "intellectual Property" or "IP" means all intellectual property rights, including, without limitation, patents, patent applications, copyrights, copyright registrations, trademarks, trademark registrations, service marks, trade names, trade secrets, know-how, inventions (whether or not patentable), moral rights, database rights, domain names, and all other proprietary rights of a similar nature, in each case whether registered or unregistered, and including all applications, renewals, extensions, and reversions of any of the foregoing.

(o) "Key Personnel" means those individuals designated by Service Provider in Exhibit D (Key Personnel) as being critical to the successful delivery of one or more Service Components, whose assignment, retention, and replacement are subject to the provisions of Section 2.5 and Exhibit D.

(p) "Pre-Existing IP" means intellectual Property that is (i) owned or licensed by a Party prior to the Effective Date; or (ii) developed or acquired by a Party independently of and outside the scope of this Agreement and any Statement of Work, without the use of the other Party's Confidential Information or Customer Data.

(q) "Renewal Term" means each successive one (1) year renewal period following the expiration of the Initial Term, as described in Section 3.2.

(r) "Service Components" means the four (4) categories of services to be provided by Service Provider under this Agreement, consisting of: (i) Cloud Infrastructure Management; (ii) Managed IT Services; (iii) Enterprise Application Support; and (iv) Cybersecurity Monitoring & Incident Response, each as more particularly described in Section 2.2 and the applicable Exhibits.

(s) "Service Level Agreement" or "SLA" means the performance standards, uptime commitments, response times, and resolution targets applicable to the Service Components, as set forth in Exhibit B (SLA Schedule).

(t) "Service Level Credits" means the fee credits payable to Customer by Service Provider as set forth in Exhibit B (SLA Schedule) in the event that Service Provider fails to meet the applicable SLAs.

(u) "Severity 1 Incident" means a complete outage, critical failure, or material unavailability of a Service Component that renders such Service Component wholly or substantially unusable by Customer or its Authorized Users, or that results in a material loss of, or corruption of, Customer Data.

(v) "Severity 2 Incident" means a significant degradation in the performance, functionality, or availability of a Service Component that materially impairs Customer's ability to use such Service Component for its intended business purposes, but that does not rise to the level of a Severity 1 Incident.

(w) "SOC 2 Type II Report" means a Service Organization Control 2 Type II report issued by an independent auditing firm in accordance with the standards established by the American Institute of Certified Public Accountants (AICPA), covering the suitability of design and operating effectiveness of the service organization's controls relevant to security, availability, processing integrity, confidentiality, and/or privacy.

(x) "Statement of Work" or "SOW" means any statement of work entered into by the Parties pursuant to and in accordance with Section 2.3 of this Agreement, substantially in the form attached hereto as Exhibit F (Form of Statement of Work).

(y) "Term" means, collectively, the Initial Term and any Renewal Terms, as applicable.

(z) "Total Contract Value" or "TCV" means the aggregate fees payable by Customer over the Initial Term, which amount is initially Fourteen Million Seven Hundred Fifty Thousand Dollars ($14,750,000), calculated as five (5) Contract Years multiplied by the Annual Contract Value of Two Million Nine Hundred Fifty Thousand Dollars ($2,950,000), subject to adjustment in accordance with this Agreement.

ARTICLE 2 — SCOPE OF SERVICES

Section 2.1 — Services Generally

Service Provider shall provide to Customer the services described in this Agreement, each applicable Statement of Work, and the Exhibits attached hereto (collectively, the "Services"). Service Provider shall perform the Services in a professional, workmanlike manner, with the degree of skill, care, and diligence consistent with accepted industry standards and best practices for comparable enterprise information technology managed services. Service Provider shall allocate sufficient resources, including qualified personnel, to ensure the timely and effective delivery of the Services throughout the Term. In performing the Services, Service Provider shall at all times act in a manner consistent with Customer's reasonable instructions, applicable policies communicated to Service Provider in writing, and the terms and conditions of this Agreement.

Section 2.2 — Service Components

The following Service Components are included in the initial scope of Services under this Agreement. Each Service Component is described in further detail in the applicable Exhibit and, where applicable, in the relevant Statement of Work:

(a) Cloud Infrastructure Management. Service Provider shall provide comprehensive cloud infrastructure management services, including provisioning, monitoring, maintenance, performance optimization, capacity planning, patch management, and ongoing administration of Customer's cloud computing environments (including, without limitation, public, private, and hybrid cloud deployments). Service Provider shall ensure that Customer's cloud infrastructure is architected for high availability, scalability, and disaster recovery in accordance with industry best practices. The annual fee for Cloud Infrastructure Management is One Million Two Hundred Thousand Dollars ($1,200,000).

(b) Managed IT Services. Service Provider shall provide managed IT services, including Tier 1, Tier 2, and Tier 3 help desk support, endpoint management (including desktop, laptop, and mobile device support), network monitoring and management, desktop support, asset management, and user provisioning and de-provisioning. Service Provider shall operate a service desk accessible to Authorized Users during the hours and through the channels specified in Exhibit B. The annual fee for Managed IT Services is Eight Hundred Twenty-Five Thousand Dollars ($825,000).

(c) Enterprise Application Support. Service Provider shall provide enterprise application administration, configuration, break-fix support, and enhancement services for Customer's Harborline Software and Pinnacle Health IT environments, including, without limitation, module administration, system integration support, user management, report development, workflow configuration, and minor enhancements and customizations as reasonably requested by Customer. Major development projects and system upgrades shall be procured through individual Statements of Work pursuant to Section 2.3. The annual fee for Enterprise Application Support is Five Hundred Seventy-Five Thousand Dollars ($575,000).

(d) Cybersecurity Monitoring & Incident Response. Service Provider shall provide twenty-four (24) hours per day, seven (7) days per week, three hundred sixty-five (365) days per year security operations center (SOC) monitoring, threat detection and analysis, vulnerability management (including regular vulnerability scanning and remediation tracking), security event log management, and incident response coordination. Service Provider shall maintain a documented incident response plan and shall conduct tabletop exercises with Customer's information security team no less frequently than once per Contract Year. The annual fee for Cybersecurity Monitoring & Incident Response is Three Hundred Fifty Thousand Dollars ($350,000).

The Total Annual Contract Value for all Service Components is Two Million Nine Hundred Fifty Thousand Dollars ($2,950,000), calculated as the sum of the annual fees for each Service Component set forth above ($1,200,000 + $825,000 + $575,000 + $350,000 = $2,950,000).

Section 2.3 — Statements of Work

Additional services, projects, or initiatives not included within the scope of the Service Components described in Section 2.2 may be procured by Customer through individual Statements of Work executed by authorized representatives of both Parties. Each Statement of Work shall be substantially in the form attached hereto as Exhibit F (Form of Statement of Work), shall expressly reference this Agreement, and shall set forth, at a minimum, the following: (i) a detailed description of the services or project scope; (ii) the Deliverables and applicable acceptance criteria; (iii) the timeline and key milestones; (iv) the fees and payment schedule; (v) the Key Personnel assigned to the SOW; and (vi) any Service Level Agreements specific to the SOW, to the extent different from those set forth in Exhibit B. Each executed Statement of Work shall be incorporated into and governed by the terms of this Agreement. In the event of any conflict between the terms of a Statement of Work and the terms of this Agreement, the terms of this Agreement shall control, unless the Statement of Work expressly states that a specific provision is intended to supersede a particular provision of this Agreement and identifies such provision with specificity.

Section 2.4 — Service Locations

Services may be delivered from Service Provider's facilities located at 2300 Lakewood Boulevard, Suite 400, Durham, North Carolina 27713, and from such other domestic locations as may be approved by Customer in writing from time to time. Service Provider shall not relocate any portion of the service delivery operations for the Services to a facility located outside the United States of America without Customer's prior written consent, which consent may be withheld in Customer's sole discretion. Service Provider shall provide Customer with not less than sixty (60) days' prior written notice of any proposed relocation of service delivery operations to a new domestic facility, and such relocation shall be subject to Customer's prior written approval, which shall not be unreasonably withheld, conditioned, or delayed.

Section 2.5 — Key Personnel

Service Provider shall assign the Key Personnel identified in Exhibit D (Key Personnel) to the performance of the Services. Service Provider acknowledges that the identity, qualifications, and continuity of Key Personnel are material to Customer's decision to enter into this Agreement. Service Provider shall not reassign, transfer, or remove any Key Personnel from their roles under this Agreement without providing Customer with at least thirty (30) days' prior written notice and obtaining Customer's consent to such reassignment, transfer, or removal, which consent shall not be unreasonably withheld, conditioned, or delayed. In the event that any Key Personnel voluntarily resign, become permanently unavailable due to disability or other cause, or are terminated by Service Provider for cause, Service Provider shall promptly notify Customer and shall propose a qualified replacement of comparable experience and skill level for Customer's approval within fifteen (15) Business Days. Service Provider shall use commercially reasonable efforts to ensure a reasonable overlap and knowledge transfer period between outgoing and incoming Key Personnel.

Section 2.6 — Subcontractors

Service Provider may engage subcontractors to perform portions of the Services, provided that Service Provider obtains Customer's prior written approval of each proposed subcontractor, which approval shall not be unreasonably withheld, conditioned, or delayed. Service Provider's request for approval shall include the identity of the proposed subcontractor, the scope of services to be subcontracted, the qualifications of the subcontractor, and the location(s) from which the subcontractor will perform services. Service Provider shall remain fully responsible and liable for the acts, omissions, and performance of its subcontractors as if such acts, omissions, and performance were those of Service Provider. Service Provider shall ensure that each subcontractor is bound by written obligations no less restrictive than those imposed on Service Provider under this Agreement, including, without limitation, obligations relating to confidentiality, data security, and intellectual property. Customer's approval of a subcontractor shall not relieve Service Provider of any of its obligations under this Agreement, and Service Provider shall remain the sole point of contact and accountability for Customer with respect to all Services, including those performed by subcontractors.

ARTICLE 3 — TERM AND RENEWAL

Section 3.1 — Initial Term

The initial term of this Agreement (the "Initial Term") shall commence on the Effective Date and shall continue in full force and effect for a period of five (5) years, expiring on October 31, 2028, unless earlier terminated in accordance with the provisions of Article 14.

Section 3.2 — Renewal

Following the expiration of the Initial Term, this Agreement shall automatically renew for successive one (1) year periods (each, a "Renewal Term"), unless either Party provides written notice of non-renewal to the other Party at least one hundred eighty (180) days prior to the expiration of the then-current Term (whether the Initial Term or a Renewal Term). For the avoidance of doubt, the notice of non-renewal must be delivered no later than May 4, 2028 to prevent the first automatic renewal upon expiration of the Initial Term. Each Renewal Term shall be subject to the same terms and conditions as the Initial Term, except as otherwise provided in Section 3.3 with respect to pricing or as otherwise agreed by the Parties in writing.

Section 3.3 — Pricing During Renewal Terms

The fees payable by Customer during any Renewal Term shall be subject to mutual agreement of the Parties, to be negotiated in good faith no later than ninety (90) days prior to the commencement of the applicable Renewal Term. In the event the Parties are unable to agree on revised fees for a Renewal Term within such period, the fees for each Service Component during such Renewal Term shall be adjusted by an amount equal to the percentage increase in the Consumer Price Index for All Urban Consumers (CPI-U), U.S. City Average, All Items, Not Seasonally Adjusted, as published by the Bureau of Labor Statistics of the United States Department of Labor, for the twelve (12) month period ending on the last day of the sixth month preceding the commencement of such Renewal Term, provided that in no event shall such annual increase exceed three percent (3%).

ARTICLE 4 — FEES AND PAYMENT

Section 4.1 — Fees

In consideration of Service Provider's performance of the Services, Customer shall pay Service Provider the fees set forth in Exhibit A (Fee Schedule) for the applicable Service Components. The Annual Contract Value is Two Million Nine Hundred Fifty Thousand Dollars ($2,950,000), payable in quarterly installments in advance in equal amounts of Seven Hundred Thirty-Seven Thousand Five Hundred Dollars ($737,500) per quarter, subject to adjustment only as expressly provided in this Agreement. Fees for any services procured through a Statement of Work shall be as set forth in the applicable SOW and shall be in addition to the ACV unless otherwise specified therein.

Section 4.2 — Invoicing and Payment Terms

Service Provider shall submit invoices to Customer on a quarterly basis, in advance, on or before the first Business Day of each calendar quarter during the Term. The first invoice shall be issued on or promptly following the Effective Date and shall cover the period from November 1, 2023 through January 31, 2024. All undisputed amounts set forth in an invoice shall be due and payable within forty-five (45) days following Customer's receipt of such invoice ("Net 45"). Payments shall be made by electronic funds transfer to the account designated by Service Provider in writing. Late payments on undisputed amounts shall accrue interest at the lesser of (i) one and one-half percent (1.5%) per month (eighteen percent (18%) per annum), compounded monthly, or (ii) the maximum rate permitted by applicable law, in each case calculated from the date such payment was due until the date of actual payment.

Section 4.3 — Taxes

All fees set forth in this Agreement and in each Statement of Work are exclusive of all applicable sales, use, value-added, excise, goods and services, and similar taxes, duties, and governmental charges (collectively, "Taxes"). Customer shall be responsible for the payment of all Taxes arising in connection with the transactions contemplated by this Agreement, excluding, however, any taxes imposed on or measured by Service Provider's net income, franchise taxes, or taxes arising from Service Provider's employment of its own personnel. Service Provider shall separately itemize all applicable Taxes on each invoice. If Customer is required by law to withhold any amounts from payments to Service Provider, Customer shall make such withholdings and remit the withheld amounts to the appropriate taxing authority in accordance with applicable law, and the fees payable to Service Provider shall be reduced accordingly. Each Party shall provide to the other any applicable tax exemption certificates or other documentation reasonably requested by the other Party in connection with its tax obligations.

Section 4.4 — Disputed Amounts

Customer may dispute any invoice or any portion thereof in good faith by providing Service Provider with written notice of such dispute within thirty (30) days of Customer's receipt of the applicable invoice. Such notice shall set forth in reasonable detail the nature and basis of the dispute and the amount in controversy. The undisputed portion of any invoice shall remain payable in accordance with Section 4.2, and Customer's payment of undisputed amounts shall not constitute a waiver of its right to dispute any remaining amounts. The Parties shall negotiate in good faith to resolve any invoice dispute within thirty (30) days following Service Provider's receipt of Customer's notice of dispute. If the Parties are unable to resolve the dispute within such period, either Party may escalate the dispute in accordance with the dispute resolution procedures set forth in Article 18. During the pendency of any bona fide invoice dispute, Service Provider shall not suspend or withhold the performance of any Services.

Section 4.5 — Fee Adjustments for Scope Changes

The fees payable under this Agreement shall be adjusted only in connection with material changes to the scope of the Services, and any such adjustment shall be effective only upon the execution by both Parties of a written amendment to this Agreement or a new Statement of Work, in each case setting forth the revised scope and the corresponding fee adjustment. Neither Party shall be obligated to agree to any scope change or fee adjustment, except as otherwise expressly provided in this Agreement.

ARTICLE 5 — SERVICE LEVELS AND CREDITS

Section 5.1 — Service Level Agreements

Service Provider shall perform the Services in accordance with the service levels set forth in Exhibit B (SLA Schedule) (the "Service Level Agreements" or "SLAs"). The SLAs establish minimum performance standards for each Service Component, including, without limitation, uptime availability targets, incident response times, and incident resolution times. SLA compliance shall be measured using Service Provider's monitoring tools and systems, subject to Customer's right to verify and audit such measurements using Customer's own tools and data, as agreed by the Parties. Service Provider shall configure its monitoring tools to provide real-time dashboards accessible to Customer's designated personnel for the purpose of ongoing SLA monitoring and verification. In the event of any discrepancy between Service Provider's monitoring data and Customer's verification data, the Parties shall cooperate in good faith to investigate and resolve such discrepancy.

Section 5.2 — Service Level Credits

In the event that Service Provider fails to meet an applicable SLA, Customer shall be entitled to receive Service Level Credits as follows:

(a) Severity 1 Incidents. If a Severity 1 Incident results in an outage or material unavailability of an affected Service Component for a period exceeding four (4) consecutive hours, Customer shall be entitled to a Service Level Credit of up to fifteen percent (15%) of the monthly fees attributable to the affected Service Component for the month in which the Severity 1 Incident occurred.

(b) Severity 2 Incidents. If a Severity 2 Incident results in a significant degradation in the performance of an affected Service Component for a period exceeding eight (8) consecutive hours, Customer shall be entitled to a Service Level Credit of up to ten percent (10%) of the monthly fees attributable to the affected Service Component for the month in which the Severity 2 Incident occurred.

For purposes of calculating monthly fees, the monthly fee attributable to a Service Component shall be equal to one-twelfth (1/12th) of the applicable annual fee for such Service Component as set forth in Exhibit A. Service Level Credits shall be applied as credits against the next quarterly invoice following Customer's submission of a credit request, provided that if the Agreement is in the final quarter of the Term, any accrued and unpaid Service Level Credits shall be paid by Service Provider to Customer in cash within thirty (30) days following the effective date of termination or expiration. Service Level Credits are Customer's sole and exclusive remedy for Service Provider's failure to meet the applicable SLAs, without prejudice to Customer's termination rights under Section 5.3 and Article 14 for chronic or persistent SLA failures.

Section 5.3 — Chronic Failures

If Service Provider fails to meet the same Service Level Agreement for three (3) consecutive calendar months or for five (5) or more calendar months in any rolling twelve (12) month period, such failure shall constitute a "Chronic SLA Failure." Upon the occurrence of a Chronic SLA Failure, Customer may, at its election and in its sole discretion, terminate the affected Service Component or the entire Agreement upon thirty (30) days' prior written notice to Service Provider, without payment of any early termination fee or other penalty. The exercise of Customer's termination right under this Section 5.3 shall be without prejudice to Customer's right to receive any Service Level Credits that have accrued prior to the effective date of termination.

Section 5.4 — SLA Reporting

Service Provider shall provide Customer with comprehensive monthly SLA performance reports within ten (10) Business Days following the end of each calendar month. Each such report shall include, at a minimum: (i) a summary of SLA compliance for each Service Component during the preceding month; (ii) identification and root cause analysis of all Severity 1 and Severity 2 Incidents; (iii) the duration and resolution of each such Incident; (iv) any Service Level Credits accrued during the reporting period; (v) trend analysis and identification of recurring issues; and (vi) a summary of corrective and preventive actions taken or planned. Service Provider shall make its operations personnel reasonably available to discuss SLA performance reports with Customer upon request.

ARTICLE 6 — CUSTOMER RESPONSIBILITIES

Section 6.1 — Cooperation

Customer shall provide reasonable cooperation, access to information, and timely responses to Service Provider's requests for input, feedback, and approvals, in each case to the extent reasonably necessary for Service Provider to perform the Services in accordance with the terms of this Agreement. Customer acknowledges that Service Provider's ability to meet certain Service Levels and delivery timelines may depend upon Customer's timely performance of its obligations under this Article 6, and Service Provider shall not be responsible for any failure to meet SLAs or delivery milestones to the extent such failure is directly caused by Customer's failure to perform its obligations under this Article 6, provided that Service Provider promptly notifies Customer in writing of any actual or anticipated delay resulting from Customer's non-performance.

Section 6.2 — Customer Systems

Customer shall be responsible for procuring, maintaining, and supporting its own internal systems, hardware, software, and network connectivity to the extent necessary to access and receive the Services, including, without limitation, maintaining compatible operating environments, ensuring adequate bandwidth and internet connectivity, and implementing reasonable security measures on Customer's own systems. Customer shall ensure that its internal systems and environments meet any minimum technical requirements communicated by Service Provider in writing.

Section 6.3 — Customer Personnel

Customer shall designate a primary point of contact (the "Customer Project Manager") and escalation contacts for each Service Component, who shall be responsible for day-to-day coordination with Service Provider, managing requests for Services, approving Deliverables, and facilitating the resolution of issues. Customer shall provide Service Provider with the names, titles, and contact information of its designated personnel within ten (10) Business Days of the Effective Date, and shall promptly notify Service Provider of any changes to such designations.

ARTICLE 7 — CONFIDENTIALITY

Section 7.1 — Confidential Information

Each Party (as the Receiving Party) agrees to hold the Confidential Information of the other Party (as the Disclosing Party) in strict confidence and to protect such Confidential Information using the same degree of care that the Receiving Party uses to protect its own confidential and proprietary information of like kind, but in no event less than a reasonable degree of care. The Receiving Party shall not use any Confidential Information of the Disclosing Party for any purpose other than to perform its obligations or exercise its rights under this Agreement. The Receiving Party shall limit the disclosure of the Disclosing Party's Confidential Information to those of its employees, officers, directors, contractors, consultants, subcontractors (to the extent approved under Section 2.6), professional advisors, and agents who (i) have a genuine need to know such information in connection with the performance or receipt of the Services under this Agreement, and (ii) are bound by written confidentiality obligations at least as restrictive as those set forth in this Article 7. The Receiving Party shall be responsible for any breach of this Article 7 by any person or entity to whom it has disclosed Confidential Information in accordance with this Section 7.1.

Section 7.2 — Exclusions

The obligations set forth in this Article 7 shall not apply to any information that the Receiving Party can demonstrate: (i) was or becomes generally known to the public through no fault or wrongful act of the Receiving Party; (ii) was independently developed by the Receiving Party without reference to or use of the Disclosing Party's Confidential Information, as evidenced by contemporaneous written records; (iii) was received by the Receiving Party from a third party without restriction on disclosure and without breach of any obligation of confidentiality owed to the Disclosing Party; or (iv) was already known to the Receiving Party at the time of disclosure by the Disclosing Party, as evidenced by the Receiving Party's contemporaneous written records.

Section 7.3 — Enhanced Protections for Customer Data

In addition to the general obligations applicable to all Confidential Information, Customer Data shall be subject to the following enhanced protections:

(a) Service Provider shall implement and maintain appropriate technical and organizational security measures designed to prevent unauthorized access to, use of, disclosure of, alteration of, or destruction of Customer Data, including, without limitation, Customer's proprietary trade promotion data, pricing algorithms, and supply chain analytics, in accordance with the data security requirements set forth in Article 8 and Exhibit C.

(b) Service Provider shall not access, use, process, disclose, sell, license, or otherwise exploit Customer Data except as strictly necessary to perform the Services under this Agreement and as expressly authorized by Customer in writing. Service Provider shall not use Customer Data for benchmarking, product development, marketing, data analytics, or any other purpose unrelated to the performance of the Services.

(c) Service Provider shall not commingle Customer Data with data belonging to any other customer or client of Service Provider, or with data belonging to any Affiliate of Service Provider or any third party, whether in physical or logical storage environments.

(d) Service Provider shall implement and enforce access controls that restrict access to Customer Data to only those Service Provider personnel who require such access to perform their assigned duties in connection with the Services.

Section 7.4 — Compelled Disclosure

If the Receiving Party is required by applicable law, regulation, rule, or legal process (including, without limitation, any subpoena, civil investigative demand, or similar compulsory process) to disclose any Confidential Information of the Disclosing Party, the Receiving Party shall, to the extent legally permissible, provide the Disclosing Party with prompt written notice of such requirement prior to making any disclosure, so that the Disclosing Party may seek a protective order, confidential treatment, or other appropriate remedy. The Receiving Party shall cooperate with the Disclosing Party, at the Disclosing Party's expense, in obtaining any such protective order or remedy. If such protective order or other remedy is not obtained, the Receiving Party shall disclose only that portion of the Confidential Information that it is legally compelled to disclose and shall use commercially reasonable efforts to ensure that confidential treatment is afforded to the disclosed information.

Section 7.5 — Return and Destruction of Confidential Information

Upon the termination or expiration of this Agreement, or upon the written request of the Disclosing Party at any time, the Receiving Party shall promptly return to the Disclosing Party, or, at the Disclosing Party's election, securely destroy, all Confidential Information of the Disclosing Party in the Receiving Party's possession or control, including all copies, extracts, and summaries thereof, regardless of the form or medium in which such Confidential Information is stored. Within thirty (30) days following such return or destruction, the Receiving Party shall provide the Disclosing Party with a written certification, signed by an authorized officer of the Receiving Party, confirming that all such Confidential Information has been returned or destroyed in accordance with this Section 7.5. Notwithstanding the foregoing, the Receiving Party may retain copies of Confidential Information to the extent required by applicable law or regulation or its bona fide document retention policies, provided that such retained copies remain subject to the confidentiality obligations of this Article 7 for the duration of the survival period set forth in Section 7.6.

Section 7.6 — Duration

The confidentiality obligations set forth in this Article 7 shall survive termination or expiration of this Agreement for a period of five (5) years following the effective date of such termination or expiration. Notwithstanding the foregoing, with respect to any Confidential Information that constitutes a trade secret under the Defend Trade Secrets Act of 2016, 18 U.S.C. § 1836 et seq., or under the applicable trade secret law of any state, the confidentiality obligations set forth in this Article 7 shall continue for as long as such information qualifies as a trade secret under applicable law.

ARTICLE 8 — DATA SECURITY

[OPEN ISSUE — DATA SECURITY STANDARDS: The following section contains bracketed alternatives reflecting the parties' divergent positions regarding the scope and stringency of contractual data security obligations. This issue is escalated to the business principals for resolution.]

Section 8.1 — Security Standards

Service Provider shall implement and maintain a comprehensive information security program designed to protect the confidentiality, integrity, and availability of Customer Data and the systems and infrastructure used to deliver the Services. Such program shall comply with the following standards:

[CUSTOMER POSITION:

Service Provider shall at all times during the Term maintain SOC 2 Type II certification (most recent report issued March 15, 2023, covering the period from April 1, 2022 through March 31, 2023) and shall comply with the following frameworks and standards: (i) ISO/IEC 27001:2022 (Information Security Management Systems); (ii) the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF), Version 1.1 or any successor version; and (iii) any industry-specific security frameworks applicable to Customer's consumer products business as may be communicated by Customer to Service Provider in writing from time to time. Service Provider shall undergo independent third-party penetration testing of all systems and infrastructure used to deliver the Services or to process, store, or transmit Customer Data at least once annually, and shall provide Customer with the full, unredacted results of each such penetration test within thirty (30) days of completion. Service Provider shall promptly remediate all critical and high-severity findings identified in any penetration test and shall provide Customer with evidence of such remediation within sixty (60) days of completion of the test.

]

[SERVICE PROVIDER POSITION:

Service Provider shall maintain SOC 2 Type II certification and shall conduct annual penetration testing of its systems and infrastructure relevant to the delivery of the Services. Service Provider shall pursue ISO/IEC 27001 certification and compliance with the NIST Cybersecurity Framework on a commercially reasonable best-efforts basis, but neither ISO 27001 certification nor NIST compliance shall constitute binding contractual obligations of Service Provider under this Agreement. Penetration test results shall be provided to Customer in summary form only, and Service Provider reserves the right to redact information that may compromise the security of Service Provider's systems or the systems of its other customers.

]

Section 8.2 — Data Isolation

Service Provider shall implement logical separation, and, where technically feasible and commercially reasonable, physical separation, of Customer Data from data belonging to other clients, customers, or users of Service Provider. Service Provider shall ensure that its personnel who have access to Customer Data in the course of performing the Services do not simultaneously service direct competitors of Customer (as identified by Customer in writing from time to time) without Customer's prior written consent. For purposes of this Section 8.2, a "direct competitor" means any entity that Customer reasonably designates in writing as being a direct competitor in Customer's primary lines of business.

Section 8.3 — Breach Notification

Service Provider shall notify Customer of any actual or reasonably suspected unauthorized access to, acquisition of, use of, disclosure of, alteration of, or destruction of Customer Data, or any actual or reasonably suspected breach of Service Provider's security systems or infrastructure used in connection with the Services (each, a "Security Incident"), within seventy-two (72) hours of Service Provider's discovery of such Security Incident. Such notification shall include, to the extent then known: (i) a description of the nature and scope of the Security Incident; (ii) the categories and approximate number of data records affected; (iii) the likely consequences of the Security Incident for Customer and any affected data subjects; (iv) the measures taken or proposed to be taken by Service Provider to address the Security Incident, mitigate its effects, and prevent recurrence; and (v) the identity and contact information of the Service Provider personnel designated as the primary point of contact for the Security Incident. Service Provider shall provide updates to Customer as additional information becomes available and shall cooperate fully with Customer's investigation of the Security Incident. Service Provider shall bear all costs and expenses arising from or relating to a Security Incident to the extent caused by Service Provider's breach of its obligations under this Article 8.

Section 8.4 — Security Audits

Customer's rights to audit Service Provider's security practices, systems, and controls shall be as set forth in Section 15 (Audit Rights). [OPEN ISSUE — See Section 15 for bracketed alternatives.]

Section 8.5 — Background Checks

Service Provider shall conduct appropriate background checks, including criminal history checks, on all Service Provider personnel (including employees of subcontractors approved under Section 2.6) who will have access to Customer Data or to Customer's systems or facilities, consistent with applicable law. The scope and nature of such background checks shall be commensurate with the level of access granted to such personnel. Service Provider shall not assign any individual to perform Services involving access to Customer Data if such individual's background check reveals a conviction or pending charge for any offense involving fraud, dishonesty, theft, or unauthorized access to computer systems, unless Service Provider obtains Customer's prior written consent.

Section 8.6 — Data Encryption

Service Provider shall ensure that all Customer Data is encrypted at all times, both in transit and at rest, using industry-standard encryption protocols and algorithms. At a minimum, Customer Data in transit shall be encrypted using Transport Layer Security (TLS) version 1.2 or higher, and Customer Data at rest shall be encrypted using the Advanced Encryption Standard (AES) with a key length of 256 bits (AES-256) or an equivalent or stronger encryption standard. Service Provider shall implement and maintain appropriate key management procedures, including secure key generation, storage, rotation, and destruction practices.

ARTICLE 9 — INTELLECTUAL PROPERTY

Section 9.1 — Customer Data Ownership

All Customer Data is and shall remain the sole and exclusive property of Customer at all times. Nothing in this Agreement shall be construed to transfer, assign, or grant to Service Provider any right, title, or interest in or to Customer Data, except the limited, revocable right to access, process, store, and transmit Customer Data solely to the extent necessary for Service Provider to perform the Services in accordance with the terms of this Agreement. Service Provider acknowledges and agrees that its access to and use of Customer Data is subject to the terms and restrictions set forth in this Agreement, including, without limitation, the confidentiality obligations set forth in Article 7 and the data security obligations set forth in Article 8.

Section 9.2 — Service Provider Pre-Existing IP

Service Provider retains all right, title, and interest in and to its Pre-Existing IP, including, without limitation, all tools, methodologies, processes, techniques, software platforms, frameworks, libraries, templates, and know-how that (i) existed prior to the Effective Date of this Agreement, or (ii) are developed or acquired by Service Provider independently of and outside the scope of any Statement of Work, without the use of Customer Data, Customer Confidential Information, or Customer's resources. Nothing in this Agreement shall be construed as transferring or assigning to Customer any right, title, or interest in Service Provider's Pre-Existing IP, except as expressly set forth in Section 9.4.

Section 9.3 — Deliverables and Custom Work Product

All Deliverables and custom work product developed by Service Provider specifically for Customer under a Statement of Work shall be considered works made for hire to the fullest extent permitted by applicable law, and all right, title, and interest in and to such Deliverables (including all intellectual Property rights therein) shall vest in and be the sole and exclusive property of Customer upon creation. To the extent that any Deliverable or custom work product does not qualify as a work made for hire under applicable law, Service Provider hereby irrevocably assigns, and shall cause each of its employees, contractors, and subcontractors who contributed to the creation of such Deliverable to irrevocably assign, to Customer all right, title, and interest in and to such Deliverable, including all intellectual Property rights therein, without the need for any further action, consideration, or documentation. Service Provider shall execute, and shall cause its employees, contractors, and subcontractors to execute, any and all documents and instruments, and take any and all actions, reasonably requested by Customer to evidence, perfect, register, or enforce Customer's ownership of the Deliverables and the intellectual Property rights therein. This Section 9.3 reflects the IP assignment language as revised and agreed by the Parties following the initial negotiation session.

Section 9.4 — License to Pre-Existing IP Embedded in Deliverables

To the extent that any Deliverable incorporates, embeds, or is dependent upon any Pre-Existing IP of Service Provider, Service Provider hereby grants to Customer a non-exclusive, perpetual, irrevocable, royalty-free, fully paid-up, worldwide license to use, reproduce, modify, prepare derivative works of, distribute, display, and perform such Pre-Existing IP, solely as embedded in or necessary to the use of the applicable Deliverable. Such license shall survive the termination or expiration of this Agreement and shall be freely transferable and sublicensable by Customer in connection with Customer's use, maintenance, and further development of the Deliverable.

Section 9.5 — Residuals

Nothing in this Agreement shall prevent Service Provider from using the general knowledge, skills, experience, ideas, concepts, techniques, and know-how that are retained in the unaided memory of Service Provider's personnel as a result of their participation in the performance of the Services, provided that such use does not: (i) infringe any intellectual Property rights of Customer; (ii) constitute the use, disclosure, or exploitation of Customer Data; (iii) constitute the use or disclosure of Customer's Confidential Information; or (iv) otherwise violate any provision of this Agreement. This Section 9.5 shall not be construed as granting Service Provider any license or right to Customer's intellectual Property, Customer Data, or Confidential Information.

ARTICLE 10 — REPRESENTATIONS AND WARRANTIES

Section 10.1 — Mutual Representations

Each Party represents and warrants to the other Party that, as of the Effective Date:

(a) It is duly organized, validly existing, and in good standing under the laws of the jurisdiction of its formation and is qualified to do business in each jurisdiction where the nature of its business requires such qualification;

(b) It has the full corporate or organizational power and authority to enter into this Agreement and to perform its obligations hereunder;

(c) The execution and delivery of this Agreement by such Party, and the performance by such Party of its obligations hereunder, have been duly authorized by all necessary corporate or organizational action;

(d) This Agreement constitutes a valid and binding obligation of such Party, enforceable against it in accordance with its terms, subject to applicable bankruptcy, insolvency, reorganization, and similar laws affecting creditors' rights generally and to general principles of equity; and

(e) The execution, delivery, and performance of this Agreement by such Party do not and will not (i) violate or conflict with any provision of such Party's organizational documents; (ii) violate or conflict with any applicable law, regulation, rule, judgment, order, or decree; or (iii) violate, conflict with, result in a breach of, or constitute a default under any material agreement, contract, or obligation to which such Party is a party or by which it is bound.

Section 10.2 — Service Provider Representations

In addition to the mutual representations set forth in Section 10.1, Service Provider represents and warrants to Customer that:

(a) The Services shall be performed in a professional, workmanlike manner, with the degree of skill, care, and diligence consistent with accepted industry standards and best practices for comparable enterprise information technology managed services;

(b) Service Provider has and shall maintain throughout the Term all licenses, certifications, permits, and authorizations necessary to perform the Services in accordance with this Agreement and applicable law;

(c) Service Provider's most recent SOC 2 Type II report was issued on March 15, 2023, covering the audit period from April 1, 2022 through March 31, 2023, and as of the Effective Date, Service Provider is not aware of any material deficiency, qualification, or exception identified in or arising since the issuance of that report that would materially impair Service Provider's ability to comply with its obligations under Article 8;

(d) The Services and Deliverables, as provided by Service Provider to Customer under this Agreement, shall not infringe, misappropriate, or otherwise violate any intellectual Property rights of any third party;

(e) Service Provider shall comply with all applicable federal, state, and local laws, rules, and regulations in performing the Services, including, without limitation, all applicable data privacy and data protection laws; and

(f) Service Provider shall not introduce any virus, worm, Trojan horse, malware, or other malicious code into Customer's systems or data environments in the course of performing the Services.

Section 10.3 — Customer Representations

In addition to the mutual representations set forth in Section 10.1, Customer represents and warrants to Service Provider that Customer has all rights, consents, licenses, and authorizations necessary to provide Customer Data to Service Provider for Service Provider's use in performing the Services in accordance with this Agreement, and that the provision of such Customer Data to Service Provider does not and will not violate any applicable law or any rights of any third party.

Section 10.4 — Disclaimer

EXCEPT AS EXPRESSLY SET FORTH IN THIS AGREEMENT, NEITHER PARTY MAKES ANY REPRESENTATIONS OR WARRANTIES OF ANY KIND, WHETHER EXPRESS, IMPLIED, STATUTORY, OR OTHERWISE, AND EACH PARTY SPECIFICALLY DISCLAIMS ALL IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, ANY IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, NON-INFRINGEMENT, AND ANY WARRANTIES ARISING FROM COURSE OF DEALING, USAGE, OR TRADE PRACTICE. SERVICE PROVIDER DOES NOT WARRANT THAT THE SERVICES WILL BE UNINTERRUPTED OR ERROR-FREE, EXCEPT TO THE EXTENT EXPRESSLY SET FORTH IN THE SERVICE LEVEL AGREEMENTS.

ARTICLE 11 — INDEMNIFICATION

Section 11.1 — Service Provider Indemnification

Service Provider shall indemnify, defend, and hold harmless Customer and its Affiliates, and their respective officers, directors, managers, members, employees, agents, successors, and permitted assigns (collectively, the "Customer Indemnified Parties"), from and against all losses, liabilities, damages, judgments, settlements, costs, and expenses (including, without limitation, reasonable attorneys' fees, court costs, and costs of investigation and litigation) (collectively, "Losses") arising from or relating to:

(a) Any material breach by Service Provider of its representations, warranties, covenants, or obligations under this Agreement;

(b) The negligence, recklessness, or willful misconduct of Service Provider or its personnel (including employees of approved subcontractors) in the performance of the Services;

(c) Any claim, action, or proceeding by a third party alleging that the Services, any Deliverable, or any component thereof, as provided by Service Provider to Customer under this Agreement, infringes, misappropriates, or otherwise violates any intellectual Property right of such third party;

(d) Any violation by Service Provider of applicable federal, state, or local law, rule, or regulation in connection with the performance of the Services; or

(e) Any Security Incident that is caused, in whole or in part, by Service Provider's failure to comply with its obligations under Article 8 (Data Security) or Article 7 (Confidentiality).

The indemnification obligations and triggers set forth in this Section 11.1 reflect the provisions as revised and agreed by the Parties following the initial negotiation session.

Section 11.2 — Customer Indemnification

Customer shall indemnify, defend, and hold harmless Service Provider and its Affiliates, and their respective officers, directors, employees, agents, successors, and permitted assigns (collectively, the "Provider Indemnified Parties"), from and against all Losses arising from or relating to:

(a) Any material breach by Customer of its representations, warranties, covenants, or obligations under this Agreement;

(b) The negligence, recklessness, or willful misconduct of Customer in connection with this Agreement; or

(c) Any claim, action, or proceeding by a third party alleging that Customer Data provided by Customer to Service Provider, or Service Provider's use of such Customer Data in accordance with the terms of this Agreement, infringes, misappropriates, or otherwise violates any intellectual Property right or other right of such third party.

Section 11.3 — Indemnification Procedures

The following procedures shall apply to all indemnifi

NEAR-FINAL DRAFT — October 6, 2023
Prepared by Calderwood & Harkness LLP on behalf of Customer
NOTE TO DRAFTING PARTIES
Sections marked with [BRACKETED TEXT / OPEN ISSUE] reflect provisions that remain subject to agreement by the business principals of the parties. Four (4) open issues remain: (1) Data Security Standards (Section 8); (2) Limitation of Liability (Section 12); (3) Early Termination Fee (Section 14.4); and (4) Audit Rights (Section 15). These sections contain alternative formulations and/or placeholder language pending resolution. All other provisions in this draft have been agreed at the working-group level and are presented in near-final form subject to conforming edits and final legal review by both parties' outside counsel.
MASTER SERVICES AGREEMENT
Document Reference: MSA-PDS-MCB-2023
This Master Services Agreement (this "Agreement"), including all Exhibits, Schedules, Statements of Work, and amendments hereto, is entered into as of __, 2023 (the "Effective Date") (proposed commencement date: November 1, 2023), by and between:
MERIDIAN CONSUMER BRANDS LLC, a Delaware limited liability company, with its principal offices at 680 Fifth Avenue, 22nd Floor, New York, New York 10019 (hereinafter referred to as "Customer" or "MCB");
and
PINECREST DIGITAL SOLUTIONS INC., a Delaware corporation, with its principal offices at 2300 Lakewood Boulevard, Suite 400, Durham, North Carolina 27713 (hereinafter referred to as "Service Provider" or "Provider").
Customer and Service Provider are each referred to herein individually as a "Party" and collectively as the "Parties."
RECITALS
WHEREAS, Customer is a consumer products company that requires comprehensive information technology managed services, including, without limitation, cloud infrastructure management, managed IT services, enterprise application support, and cybersecurity monitoring, to support its ongoing business operations and strategic growth objectives (the "Business Purpose");
WHEREAS, Service Provider is an information technology services company, founded in 2016, that specializes in cloud infrastructure management, managed IT services, enterprise application support (including, without limitation, SAP and Pinnacle Health IT environments), cybersecurity monitoring and incident response, and data analytics platform hosting, and currently employs approximately 1,100 full-time employees across its domestic operations;
WHEREAS, Customer issued its Request for Proposal bearing reference number MCB-IT-RFP-2023-006 on June 12, 2023, soliciting proposals from qualified information technology service providers for the delivery of the managed services described therein, and following a comprehensive evaluation process involving multiple rounds of proposal review, capability assessments, reference checks, and commercial negotiations, Customer selected Service Provider as its preferred vendor on July 10, 2023;
WHEREAS, the Parties desire to enter into this Agreement to set forth the terms and conditions under which Service Provider will provide the Services (as defined below) to Customer in support of Customer's business operations; and
WHEREAS, the Parties have negotiated the terms of this Agreement in good faith and at arm's length, with each Party having had the opportunity to consult with independent legal counsel of its choosing.
NOW, THEREFORE, in consideration of the mutual covenants and agreements set forth herein, and for other good and valuable consideration, the receipt and sufficiency of which are hereby acknowledged, the Parties agree as follows:
ARTICLE 1 — DEFINITIONS
Section 1.1 — Defined Terms
As used in this Agreement, the following terms shall have the meanings set forth below. Capitalized terms used but not defined in this Section 1.1 shall have the meanings ascribed to them elsewhere in this Agreement.
(a) "Affiliate" means, with respect to any Party, any entity that directly or indirectly controls, is controlled by, or is under common control with such Party. For purposes of this definition, "control" means the direct or indirect ownership of fifty percent (50%) or more of the outstanding voting equity interests of the applicable entity, or the power to direct or cause the direction of the management and policies of such entity, whether through the ownership of voting securities, by contract, or otherwise.
(b) "Agreement" means this Master Services Agreement, together with all Exhibits, Schedules, Statements of Work, and any amendments, modifications, or supplements hereto that are executed by both Parties in accordance with Section 19.3.
(c) "Annual Contract Value" or "ACV" means the aggregate annual fees payable by Customer under all Service Components during a given Contract Year, which amount is initially Two Million Nine Hundred Fifty Thousand Dollars ($2,950,000) per Contract Year, as more particularly described in Exhibit A (Fee Schedule), subject to adjustment in accordance with this Agreement.
(d) "Authorized Users" means Customer's employees, contractors, temporary staff, consultants, and other agents who are authorized by Customer to access and use the Services in the ordinary course of Customer's business operations.
(e) "Business Day" means Monday through Friday, excluding any day that is a federal holiday in the State of New York, as recognized by the United States Office of Personnel Management.
(f) "Change of Control" means, with respect to any Party, the occurrence of any of the following events: (i) a merger, consolidation, or reorganization of such Party with or into another entity, whether or not such Party is the surviving or resulting entity; (ii) a sale, transfer, or other disposition of all or substantially all of such Party's assets; (iii) the acquisition by any person, entity, or group (within the meaning of Section 13(d) of the Securities Exchange Act of 1934, as amended) of more than fifty percent (50%) of the outstanding voting securities or equity interests of such Party; or (iv) any other transaction or series of related transactions resulting in a change in the identity of the ultimate controlling person(s) of such Party.
(g) "Confidential Information" means all non-public information disclosed by or on behalf of either Party (the "Disclosing Party") to the other Party (the "Receiving Party"), whether disclosed orally, in writing, electronically, or by any other means, that (i) is designated as "confidential," "proprietary," or with a similar designation at the time of disclosure; (ii) by its nature or the circumstances of its disclosure, would reasonably be understood to be confidential or proprietary; or (iii) is Customer Data. Without limiting the foregoing, Confidential Information specifically includes Customer Data, pricing algorithms, trade promotion data, supply chain analytics, business strategies, financial information, technical specifications, product roadmaps, vendor relationships, and the terms and conditions of this Agreement (including all pricing and fee information).
(h) "Contract Year" means each successive twelve (12) month period beginning on the Effective Date. The first Contract Year shall commence on November 1, 2023 and expire on October 31, 2024, and each subsequent Contract Year shall commence on the next succeeding November 1 and expire on the following October 31 during the Term.
(i) "Customer Data" means all data, information, content, records, files, databases, and materials of any kind or nature, in any form or format, that are (i) provided by or on behalf of Customer to Service Provider; (ii) generated by Customer's use of the Services; (iii) processed, stored, hosted, transmitted, or maintained by Service Provider in connection with the performance of the Services; or (iv) derived from any of the foregoing. Customer Data explicitly includes, without limitation, Customer's proprietary trade promotion data, pricing algorithms, supply chain analytics, customer and consumer data, sales data, marketing data, and any other data that is proprietary to Customer or that Customer is obligated to protect under applicable law or contractual obligation.
(j) "Deliverables" means the work product, custom software, custom configurations, reports, documentation, and other materials produced by Service Provider specifically for Customer under a Statement of Work, as distinguished from Service Provider's Pre-Existing IP and generally available tools, methodologies, and platforms.
(k) "Effective Date" means November 1, 2023 (proposed), or such other date as may be inserted upon execution of this Agreement.
(l) "Force Majeure Event" means any event or circumstance beyond a Party's reasonable control that prevents or materially impairs such Party's ability to perform its obligations under this Agreement, including, without limitation, acts of God, natural disasters (including earthquakes, floods, hurricanes, and wildfires), acts of war (whether declared or undeclared), armed conflict, terrorism, insurrection, riots, civil unrest, epidemics, pandemics, government orders or actions (including quarantines, embargoes, and sanctions), failure of third-party telecommunications or utility services, and cyberattacks of a scope and sophistication that could not have been reasonably anticipated or prevented through compliance with the security obligations set forth in this Agreement. For the avoidance of doubt, a Force Majeure Event does not include economic hardship, changes in market conditions, labor disputes involving solely the affected Party's employees, or the unavailability of Service Provider's personnel due to ordinary attrition.
(m) "Initial Term" means the five (5) year period commencing on the Effective Date and ending on October 31, 2028.
(n) "intellectual Property" or "IP" means all intellectual property rights, including, without limitation, patents, patent applications, copyrights, copyright registrations, trademarks, trademark registrations, service marks, trade names, trade secrets, know-how, inventions (whether or not patentable), moral rights, database rights, domain names, and all other proprietary rights of a similar nature, in each case whether registered or unregistered, and including all applications, renewals, extensions, and reversions of any of the foregoing.
(o) "Key Personnel" means those individuals designated by Service Provider in Exhibit D (Key Personnel) as being critical to the successful delivery of one or more Service Components, whose assignment, retention, and replacement are subject to the provisions of Section 2.5 and Exhibit D.
(p) "Pre-Existing IP" means intellectual Property that is (i) owned or licensed by a Party prior to the Effective Date; or (ii) developed or acquired by a Party independently of and outside the scope of this Agreement and any Statement of Work, without the use of the other Party's Confidential Information or Customer Data.
(q) "Renewal Term" means each successive one (1) year renewal period following the expiration of the Initial Term, as described in Section 3.2.
(r) "Service Components" means the four (4) categories of services to be provided by Service Provider under this Agreement, consisting of: (i) Cloud Infrastructure Management; (ii) Managed IT Services; (iii) Enterprise Application Support; and (iv) Cybersecurity Monitoring & Incident Response, each as more particularly described in Section 2.2 and the applicable Exhibits.
(s) "Service Level Agreement" or "SLA" means the performance standards, uptime commitments, response times, and resolution targets applicable to the Service Components, as set forth in Exhibit B (SLA Schedule).
(t) "Service Level Credits" means the fee credits payable to Customer by Service Provider as set forth in Exhibit B (SLA Schedule) in the event that Service Provider fails to meet the applicable SLAs.
(u) "Severity 1 Incident" means a complete outage, critical failure, or material unavailability of a Service Component that renders such Service Component wholly or substantially unusable by Customer or its Authorized Users, or that results in a material loss of, or corruption of, Customer Data.
(v) "Severity 2 Incident" means a significant degradation in the performance, functionality, or availability of a Service Component that materially impairs Customer's ability to use such Service Component for its intended business purposes, but that does not rise to the level of a Severity 1 Incident.
(w) "SOC 2 Type II Report" means a Service Organization Control 2 Type II report issued by an independent auditing firm in accordance with the standards established by the American Institute of Certified Public Accountants (AICPA), covering the suitability of design and operating effectiveness of the service organization's controls relevant to security, availability, processing integrity, confidentiality, and/or privacy.
(x) "Statement of Work" or "SOW" means any statement of work entered into by the Parties pursuant to and in accordance with Section 2.3 of this Agreement, substantially in the form attached hereto as Exhibit F (Form of Statement of Work).
(y) "Term" means, collectively, the Initial Term and any Renewal Terms, as applicable.
(z) "Total Contract Value" or "TCV" means the aggregate fees payable by Customer over the Initial Term, which amount is initially Fourteen Million Seven Hundred Fifty Thousand Dollars ($14,750,000), calculated as five (5) Contract Years multiplied by the Annual Contract Value of Two Million Nine Hundred Fifty Thousand Dollars ($2,950,000), subject to adjustment in accordance with this Agreement.
ARTICLE 2 — SCOPE OF SERVICES
Section 2.1 — Services Generally
Service Provider shall provide to Customer the services described in this Agreement, each applicable Statement of Work, and the Exhibits attached hereto (collectively, the "Services"). Service Provider shall perform the Services in a professional, workmanlike manner, with the degree of skill, care, and diligence consistent with accepted industry standards and best practices for comparable enterprise information technology managed services. Service Provider shall allocate sufficient resources, including qualified personnel, to ensure the timely and effective delivery of the Services throughout the Term. In performing the Services, Service Provider shall at all times act in a manner consistent with Customer's reasonable instructions, applicable policies communicated to Service Provider in writing, and the terms and conditions of this Agreement.
Section 2.2 — Service Components
The following Service Components are included in the initial scope of Services under this Agreement. Each Service Component is described in further detail in the applicable Exhibit and, where applicable, in the relevant Statement of Work:
(a) Cloud Infrastructure Management. Service Provider shall provide comprehensive cloud infrastructure management services, including provisioning, monitoring, maintenance, performance optimization, capacity planning, patch management, and ongoing administration of Customer's cloud computing environments (including, without limitation, public, private, and hybrid cloud deployments). Service Provider shall ensure that Customer's cloud infrastructure is architected for high availability, scalability, and disaster recovery in accordance with industry best practices. The annual fee for Cloud Infrastructure Management is One Million Two Hundred Thousand Dollars ($1,200,000).
(b) Managed IT Services. Service Provider shall provide managed IT services, including Tier 1, Tier 2, and Tier 3 help desk support, endpoint management (including desktop, laptop, and mobile device support), network monitoring and management, desktop support, asset management, and user provisioning and de-provisioning. Service Provider shall operate a service desk accessible to Authorized Users during the hours and through the channels specified in Exhibit B. The annual fee for Managed IT Services is Eight Hundred Twenty-Five Thousand Dollars ($825,000).
(c) Enterprise Application Support. Service Provider shall provide enterprise application administration, configuration, break-fix support, and enhancement services for Customer's Harborline Software and Pinnacle Health IT environments, including, without limitation, module administration, system integration support, user management, report development, workflow configuration, and minor enhancements and customizations as reasonably requested by Customer. Major development projects and system upgrades shall be procured through individual Statements of Work pursuant to Section 2.3. The annual fee for Enterprise Application Support is Five Hundred Seventy-Five Thousand Dollars ($575,000).
(d) Cybersecurity Monitoring & Incident Response. Service Provider shall provide twenty-four (24) hours per day, seven (7) days per week, three hundred sixty-five (365) days per year security operations center (SOC) monitoring, threat detection and analysis, vulnerability management (including regular vulnerability scanning and remediation tracking), security event log management, and incident response coordination. Service Provider shall maintain a documented incident response plan and shall conduct tabletop exercises with Customer's information security team no less frequently than once per Contract Year. The annual fee for Cybersecurity Monitoring & Incident Response is Three Hundred Fifty Thousand Dollars ($350,000).
The Total Annual Contract Value for all Service Components is Two Million Nine Hundred Fifty Thousand Dollars ($2,950,000), calculated as the sum of the annual fees for each Service Component set forth above ($1,200,000 + $825,000 + $575,000 + $350,000 = $2,950,000).
Section 2.3 — Statements of Work
Additional services, projects, or initiatives not included within the scope of the Service Components described in Section 2.2 may be procured by Customer through individual Statements of Work executed by authorized representatives of both Parties. Each Statement of Work shall be substantially in the form attached hereto as Exhibit F (Form of Statement of Work), shall expressly reference this Agreement, and shall set forth, at a minimum, the following: (i) a detailed description of the services or project scope; (ii) the Deliverables and applicable acceptance criteria; (iii) the timeline and key milestones; (iv) the fees and payment schedule; (v) the Key Personnel assigned to the SOW; and (vi) any Service Level Agreements specific to the SOW, to the extent different from those set forth in Exhibit B. Each executed Statement of Work shall be incorporated into and governed by the terms of this Agreement. In the event of any conflict between the terms of a Statement of Work and the terms of this Agreement, the terms of this Agreement shall control, unless the Statement of Work expressly states that a specific provision is intended to supersede a particular provision of this Agreement and identifies such provision with specificity.
Section 2.4 — Service Locations
Services may be delivered from Service Provider's facilities located at 2300 Lakewood Boulevard, Suite 400, Durham, North Carolina 27713, and from such other domestic locations as may be approved by Customer in writing from time to time. Service Provider shall not relocate any portion of the service delivery operations for the Services to a facility located outside the United States of America without Customer's prior written consent, which consent may be withheld in Customer's sole discretion. Service Provider shall provide Customer with not less than sixty (60) days' prior written notice of any proposed relocation of service delivery operations to a new domestic facility, and such relocation shall be subject to Customer's prior written approval, which shall not be unreasonably withheld, conditioned, or delayed.
Section 2.5 — Key Personnel
Service Provider shall assign the Key Personnel identified in Exhibit D (Key Personnel) to the performance of the Services. Service Provider acknowledges that the identity, qualifications, and continuity of Key Personnel are material to Customer's decision to enter into this Agreement. Service Provider shall not reassign, transfer, or remove any Key Personnel from their roles under this Agreement without providing Customer with at least thirty (30) days' prior written notice and obtaining Customer's consent to such reassignment, transfer, or removal, which consent shall not be unreasonably withheld, conditioned, or delayed. In the event that any Key Personnel voluntarily resign, become permanently unavailable due to disability or other cause, or are terminated by Service Provider for cause, Service Provider shall promptly notify Customer and shall propose a qualified replacement of comparable experience and skill level for Customer's approval within fifteen (15) Business Days. Service Provider shall use commercially reasonable efforts to ensure a reasonable overlap and knowledge transfer period between outgoing and incoming Key Personnel.
Section 2.6 — Subcontractors
Service Provider may engage subcontractors to perform portions of the Services, provided that Service Provider obtains Customer's prior written approval of each proposed subcontractor, which approval shall not be unreasonably withheld, conditioned, or delayed. Service Provider's request for approval shall include the identity of the proposed subcontractor, the scope of services to be subcontracted, the qualifications of the subcontractor, and the location(s) from which the subcontractor will perform services. Service Provider shall remain fully responsible and liable for the acts, omissions, and performance of its subcontractors as if such acts, omissions, and performance were those of Service Provider. Service Provider shall ensure that each subcontractor is bound by written obligations no less restrictive than those imposed on Service Provider under this Agreement, including, without limitation, obligations relating to confidentiality, data security, and intellectual property. Customer's approval of a subcontractor shall not relieve Service Provider of any of its obligations under this Agreement, and Service Provider shall remain the sole point of contact and accountability for Customer with respect to all Services, including those performed by subcontractors.
ARTICLE 3 — TERM AND RENEWAL
Section 3.1 — Initial Term
The initial term of this Agreement (the "Initial Term") shall commence on the Effective Date and shall continue in full force and effect for a period of five (5) years, expiring on October 31, 2028, unless earlier terminated in accordance with the provisions of Article 14.
Section 3.2 — Renewal
Following the expiration of the Initial Term, this Agreement shall automatically renew for successive one (1) year periods (each, a "Renewal Term"), unless either Party provides written notice of non-renewal to the other Party at least one hundred eighty (180) days prior to the expiration of the then-current Term (whether the Initial Term or a Renewal Term). For the avoidance of doubt, the notice of non-renewal must be delivered no later than May 4, 2028 to prevent the first automatic renewal upon expiration of the Initial Term. Each Renewal Term shall be subject to the same terms and conditions as the Initial Term, except as otherwise provided in Section 3.3 with respect to pricing or as otherwise agreed by the Parties in writing.
Section 3.3 — Pricing During Renewal Terms
The fees payable by Customer during any Renewal Term shall be subject to mutual agreement of the Parties, to be negotiated in good faith no later than ninety (90) days prior to the commencement of the applicable Renewal Term. In the event the Parties are unable to agree on revised fees for a Renewal Term within such period, the fees for each Service Component during such Renewal Term shall be adjusted by an amount equal to the percentage increase in the Consumer Price Index for All Urban Consumers (CPI-U), U.S. City Average, All Items, Not Seasonally Adjusted, as published by the Bureau of Labor Statistics of the United States Department of Labor, for the twelve (12) month period ending on the last day of the sixth month preceding the commencement of such Renewal Term, provided that in no event shall such annual increase exceed three percent (3%).
ARTICLE 4 — FEES AND PAYMENT
Section 4.1 — Fees
In consideration of Service Provider's performance of the Services, Customer shall pay Service Provider the fees set forth in Exhibit A (Fee Schedule) for the applicable Service Components. The Annual Contract Value is Two Million Nine Hundred Fifty Thousand Dollars ($2,950,000), payable in quarterly installments in advance in equal amounts of Seven Hundred Thirty-Seven Thousand Five Hundred Dollars ($737,500) per quarter, subject to adjustment only as expressly provided in this Agreement. Fees for any services procured through a Statement of Work shall be as set forth in the applicable SOW and shall be in addition to the ACV unless otherwise specified therein.
Section 4.2 — Invoicing and Payment Terms
Service Provider shall submit invoices to Customer on a quarterly basis, in advance, on or before the first Business Day of each calendar quarter during the Term. The first invoice shall be issued on or promptly following the Effective Date and shall cover the period from November 1, 2023 through January 31, 2024. All undisputed amounts set forth in an invoice shall be due and payable within forty-five (45) days following Customer's receipt of such invoice ("Net 45"). Payments shall be made by electronic funds transfer to the account designated by Service Provider in writing. Late payments on undisputed amounts shall accrue interest at the lesser of (i) one and one-half percent (1.5%) per month (eighteen percent (18%) per annum), compounded monthly, or (ii) the maximum rate permitted by applicable law, in each case calculated from the date such payment was due until the date of actual payment.
Section 4.3 — Taxes
All fees set forth in this Agreement and in each Statement of Work are exclusive of all applicable sales, use, value-added, excise, goods and services, and similar taxes, duties, and governmental charges (collectively, "Taxes"). Customer shall be responsible for the payment of all Taxes arising in connection with the transactions contemplated by this Agreement, excluding, however, any taxes imposed on or measured by Service Provider's net income, franchise taxes, or taxes arising from Service Provider's employment of its own personnel. Service Provider shall separately itemize all applicable Taxes on each invoice. If Customer is required by law to withhold any amounts from payments to Service Provider, Customer shall make such withholdings and remit the withheld amounts to the appropriate taxing authority in accordance with applicable law, and the fees payable to Service Provider shall be reduced accordingly. Each Party shall provide to the other any applicable tax exemption certificates or other documentation reasonably requested by the other Party in connection with its tax obligations.
Section 4.4 — Disputed Amounts
Customer may dispute any invoice or any portion thereof in good faith by providing Service Provider with written notice of such dispute within thirty (30) days of Customer's receipt of the applicable invoice. Such notice shall set forth in reasonable detail the nature and basis of the dispute and the amount in controversy. The undisputed portion of any invoice shall remain payable in accordance with Section 4.2, and Customer's payment of undisputed amounts shall not constitute a waiver of its right to dispute any remaining amounts. The Parties shall negotiate in good faith to resolve any invoice dispute within thirty (30) days following Service Provider's receipt of Customer's notice of dispute. If the Parties are unable to resolve the dispute within such period, either Party may escalate the dispute in accordance with the dispute resolution procedures set forth in Article 18. During the pendency of any bona fide invoice dispute, Service Provider shall not suspend or withhold the performance of any Services.
Section 4.5 — Fee Adjustments for Scope Changes
The fees payable under this Agreement shall be adjusted only in connection with material changes to the scope of the Services, and any such adjustment shall be effective only upon the execution by both Parties of a written amendment to this Agreement or a new Statement of Work, in each case setting forth the revised scope and the corresponding fee adjustment. Neither Party shall be obligated to agree to any scope change or fee adjustment, except as otherwise expressly provided in this Agreement.
ARTICLE 5 — SERVICE LEVELS AND CREDITS
Section 5.1 — Service Level Agreements
Service Provider shall perform the Services in accordance with the service levels set forth in Exhibit B (SLA Schedule) (the "Service Level Agreements" or "SLAs"). The SLAs establish minimum performance standards for each Service Component, including, without limitation, uptime availability targets, incident response times, and incident resolution times. SLA compliance shall be measured using Service Provider's monitoring tools and systems, subject to Customer's right to verify and audit such measurements using Customer's own tools and data, as agreed by the Parties. Service Provider shall configure its monitoring tools to provide real-time dashboards accessible to Customer's designated personnel for the purpose of ongoing SLA monitoring and verification. In the event of any discrepancy between Service Provider's monitoring data and Customer's verification data, the Parties shall cooperate in good faith to investigate and resolve such discrepancy.
Section 5.2 — Service Level Credits
In the event that Service Provider fails to meet an applicable SLA, Customer shall be entitled to receive Service Level Credits as follows:
(a) Severity 1 Incidents. If a Severity 1 Incident results in an outage or material unavailability of an affected Service Component for a period exceeding four (4) consecutive hours, Customer shall be entitled to a Service Level Credit of up to fifteen percent (15%) of the monthly fees attributable to the affected Service Component for the month in which the Severity 1 Incident occurred.
(b) Severity 2 Incidents. If a Severity 2 Incident results in a significant degradation in the performance of an affected Service Component for a period exceeding eight (8) consecutive hours, Customer shall be entitled to a Service Level Credit of up to ten percent (10%) of the monthly fees attributable to the affected Service Component for the month in which the Severity 2 Incident occurred.
For purposes of calculating monthly fees, the monthly fee attributable to a Service Component shall be equal to one-twelfth (1/12th) of the applicable annual fee for such Service Component as set forth in Exhibit A. Service Level Credits shall be applied as credits against the next quarterly invoice following Customer's submission of a credit request, provided that if the Agreement is in the final quarter of the Term, any accrued and unpaid Service Level Credits shall be paid by Service Provider to Customer in cash within thirty (30) days following the effective date of termination or expiration. Service Level Credits are Customer's sole and exclusive remedy for Service Provider's failure to meet the applicable SLAs, without prejudice to Customer's termination rights under Section 5.3 and Article 14 for chronic or persistent SLA failures.
Section 5.3 — Chronic Failures
If Service Provider fails to meet the same Service Level Agreement for three (3) consecutive calendar months or for five (5) or more calendar months in any rolling twelve (12) month period, such failure shall constitute a "Chronic SLA Failure." Upon the occurrence of a Chronic SLA Failure, Customer may, at its election and in its sole discretion, terminate the affected Service Component or the entire Agreement upon thirty (30) days' prior written notice to Service Provider, without payment of any early termination fee or other penalty. The exercise of Customer's termination right under this Section 5.3 shall be without prejudice to Customer's right to receive any Service Level Credits that have accrued prior to the effective date of termination.
Section 5.4 — SLA Reporting
Service Provider shall provide Customer with comprehensive monthly SLA performance reports within ten (10) Business Days following the end of each calendar month. Each such report shall include, at a minimum: (i) a summary of SLA compliance for each Service Component during the preceding month; (ii) identification and root cause analysis of all Severity 1 and Severity 2 Incidents; (iii) the duration and resolution of each such Incident; (iv) any Service Level Credits accrued during the reporting period; (v) trend analysis and identification of recurring issues; and (vi) a summary of corrective and preventive actions taken or planned. Service Provider shall make its operations personnel reasonably available to discuss SLA performance reports with Customer upon request.
ARTICLE 6 — CUSTOMER RESPONSIBILITIES
Section 6.1 — Cooperation
Customer shall provide reasonable cooperation, access to information, and timely responses to Service Provider's requests for input, feedback, and approvals, in each case to the extent reasonably necessary for Service Provider to perform the Services in accordance with the terms of this Agreement. Customer acknowledges that Service Provider's ability to meet certain Service Levels and delivery timelines may depend upon Customer's timely performance of its obligations under this Article 6, and Service Provider shall not be responsible for any failure to meet SLAs or delivery milestones to the extent such failure is directly caused by Customer's failure to perform its obligations under this Article 6, provided that Service Provider promptly notifies Customer in writing of any actual or anticipated delay resulting from Customer's non-performance.
Section 6.2 — Customer Systems
Customer shall be responsible for procuring, maintaining, and supporting its own internal systems, hardware, software, and network connectivity to the extent necessary to access and receive the Services, including, without limitation, maintaining compatible operating environments, ensuring adequate bandwidth and internet connectivity, and implementing reasonable security measures on Customer's own systems. Customer shall ensure that its internal systems and environments meet any minimum technical requirements communicated by Service Provider in writing.
Section 6.3 — Customer Personnel
Customer shall designate a primary point of contact (the "Customer Project Manager") and escalation contacts for each Service Component, who shall be responsible for day-to-day coordination with Service Provider, managing requests for Services, approving Deliverables, and facilitating the resolution of issues. Customer shall provide Service Provider with the names, titles, and contact information of its designated personnel within ten (10) Business Days of the Effective Date, and shall promptly notify Service Provider of any changes to such designations.
ARTICLE 7 — CONFIDENTIALITY
Section 7.1 — Confidential Information
Each Party (as the Receiving Party) agrees to hold the Confidential Information of the other Party (as the Disclosing Party) in strict confidence and to protect such Confidential Information using the same degree of care that the Receiving Party uses to protect its own confidential and proprietary information of like kind, but in no event less than a reasonable degree of care. The Receiving Party shall not use any Confidential Information of the Disclosing Party for any purpose other than to perform its obligations or exercise its rights under this Agreement. The Receiving Party shall limit the disclosure of the Disclosing Party's Confidential Information to those of its employees, officers, directors, contractors, consultants, subcontractors (to the extent approved under Section 2.6), professional advisors, and agents who (i) have a genuine need to know such information in connection with the performance or receipt of the Services under this Agreement, and (ii) are bound by written confidentiality obligations at least as restrictive as those set forth in this Article 7. The Receiving Party shall be responsible for any breach of this Article 7 by any person or entity to whom it has disclosed Confidential Information in accordance with this Section 7.1.
Section 7.2 — Exclusions
The obligations set forth in this Article 7 shall not apply to any information that the Receiving Party can demonstrate: (i) was or becomes generally known to the public through no fault or wrongful act of the Receiving Party; (ii) was independently developed by the Receiving Party without reference to or use of the Disclosing Party's Confidential Information, as evidenced by contemporaneous written records; (iii) was received by the Receiving Party from a third party without restriction on disclosure and without breach of any obligation of confidentiality owed to the Disclosing Party; or (iv) was already known to the Receiving Party at the time of disclosure by the Disclosing Party, as evidenced by the Receiving Party's contemporaneous written records.
Section 7.3 — Enhanced Protections for Customer Data
In addition to the general obligations applicable to all Confidential Information, Customer Data shall be subject to the following enhanced protections:
(a) Service Provider shall implement and maintain appropriate technical and organizational security measures designed to prevent unauthorized access to, use of, disclosure of, alteration of, or destruction of Customer Data, including, without limitation, Customer's proprietary trade promotion data, pricing algorithms, and supply chain analytics, in accordance with the data security requirements set forth in Article 8 and Exhibit C.
(b) Service Provider shall not access, use, process, disclose, sell, license, or otherwise exploit Customer Data except as strictly necessary to perform the Services under this Agreement and as expressly authorized by Customer in writing. Service Provider shall not use Customer Data for benchmarking, product development, marketing, data analytics, or any other purpose unrelated to the performance of the Services.
(c) Service Provider shall not commingle Customer Data with data belonging to any other customer or client of Service Provider, or with data belonging to any Affiliate of Service Provider or any third party, whether in physical or logical storage environments.
(d) Service Provider shall implement and enforce access controls that restrict access to Customer Data to only those Service Provider personnel who require such access to perform their assigned duties in connection with the Services.
Section 7.4 — Compelled Disclosure
If the Receiving Party is required by applicable law, regulation, rule, or legal process (including, without limitation, any subpoena, civil investigative demand, or similar compulsory process) to disclose any Confidential Information of the Disclosing Party, the Receiving Party shall, to the extent legally permissible, provide the Disclosing Party with prompt written notice of such requirement prior to making any disclosure, so that the Disclosing Party may seek a protective order, confidential treatment, or other appropriate remedy. The Receiving Party shall cooperate with the Disclosing Party, at the Disclosing Party's expense, in obtaining any such protective order or remedy. If such protective order or other remedy is not obtained, the Receiving Party shall disclose only that portion of the Confidential Information that it is legally compelled to disclose and shall use commercially reasonable efforts to ensure that confidential treatment is afforded to the disclosed information.
Section 7.5 — Return and Destruction of Confidential Information
Upon the termination or expiration of this Agreement, or upon the written request of the Disclosing Party at any time, the Receiving Party shall promptly return to the Disclosing Party, or, at the Disclosing Party's election, securely destroy, all Confidential Information of the Disclosing Party in the Receiving Party's possession or control, including all copies, extracts, and summaries thereof, regardless of the form or medium in which such Confidential Information is stored. Within thirty (30) days following such return or destruction, the Receiving Party shall provide the Disclosing Party with a written certification, signed by an authorized officer of the Receiving Party, confirming that all such Confidential Information has been returned or destroyed in accordance with this Section 7.5. Notwithstanding the foregoing, the Receiving Party may retain copies of Confidential Information to the extent required by applicable law or regulation or its bona fide document retention policies, provided that such retained copies remain subject to the confidentiality obligations of this Article 7 for the duration of the survival period set forth in Section 7.6.
Section 7.6 — Duration
The confidentiality obligations set forth in this Article 7 shall survive termination or expiration of this Agreement for a period of five (5) years following the effective date of such termination or expiration. Notwithstanding the foregoing, with respect to any Confidential Information that constitutes a trade secret under the Defend Trade Secrets Act of 2016, 18 U.S.C. § 1836 et seq., or under the applicable trade secret law of any state, the confidentiality obligations set forth in this Article 7 shall continue for as long as such information qualifies as a trade secret under applicable law.
ARTICLE 8 — DATA SECURITY
[OPEN ISSUE — DATA SECURITY STANDARDS: The following section contains bracketed alternatives reflecting the parties' divergent positions regarding the scope and stringency of contractual data security obligations. This issue is escalated to the business principals for resolution.]
Section 8.1 — Security Standards
Service Provider shall implement and maintain a comprehensive information security program designed to protect the confidentiality, integrity, and availability of Customer Data and the systems and infrastructure used to deliver the Services. Such program shall comply with the following standards:
[CUSTOMER POSITION:
Service Provider shall at all times during the Term maintain SOC 2 Type II certification (most recent report issued March 15, 2023, covering the period from April 1, 2022 through March 31, 2023) and shall comply with the following frameworks and standards: (i) ISO/IEC 27001:2022 (Information Security Management Systems); (ii) the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF), Version 1.1 or any successor version; and (iii) any industry-specific security frameworks applicable to Customer's consumer products business as may be communicated by Customer to Service Provider in writing from time to time. Service Provider shall undergo independent third-party penetration testing of all systems and infrastructure used to deliver the Services or to process, store, or transmit Customer Data at least once annually, and shall provide Customer with the full, unredacted results of each such penetration test within thirty (30) days of completion. Service Provider shall promptly remediate all critical and high-severity findings identified in any penetration test and shall provide Customer with evidence of such remediation within sixty (60) days of completion of the test.
]
[SERVICE PROVIDER POSITION:
Service Provider shall maintain SOC 2 Type II certification and shall conduct annual penetration testing of its systems and infrastructure relevant to the delivery of the Services. Service Provider shall pursue ISO/IEC 27001 certification and compliance with the NIST Cybersecurity Framework on a commercially reasonable best-efforts basis, but neither ISO 27001 certification nor NIST compliance shall constitute binding contractual obligations of Service Provider under this Agreement. Penetration test results shall be provided to Customer in summary form only, and Service Provider reserves the right to redact information that may compromise the security of Service Provider's systems or the systems of its other customers.
]
Section 8.2 — Data Isolation
Service Provider shall implement logical separation, and, where technically feasible and commercially reasonable, physical separation, of Customer Data from data belonging to other clients, customers, or users of Service Provider. Service Provider shall ensure that its personnel who have access to Customer Data in the course of performing the Services do not simultaneously service direct competitors of Customer (as identified by Customer in writing from time to time) without Customer's prior written consent. For purposes of this Section 8.2, a "direct competitor" means any entity that Customer reasonably designates in writing as being a direct competitor in Customer's primary lines of business.
Section 8.3 — Breach Notification
Service Provider shall notify Customer of any actual or reasonably suspected unauthorized access to, acquisition of, use of, disclosure of, alteration of, or destruction of Customer Data, or any actual or reasonably suspected breach of Service Provider's security systems or infrastructure used in connection with the Services (each, a "Security Incident"), within seventy-two (72) hours of Service Provider's discovery of such Security Incident. Such notification shall include, to the extent then known: (i) a description of the nature and scope of the Security Incident; (ii) the categories and approximate number of data records affected; (iii) the likely consequences of the Security Incident for Customer and any affected data subjects; (iv) the measures taken or proposed to be taken by Service Provider to address the Security Incident, mitigate its effects, and prevent recurrence; and (v) the identity and contact information of the Service Provider personnel designated as the primary point of contact for the Security Incident. Service Provider shall provide updates to Customer as additional information becomes available and shall cooperate fully with Customer's investigation of the Security Incident. Service Provider shall bear all costs and expenses arising from or relating to a Security Incident to the extent caused by Service Provider's breach of its obligations under this Article 8.
Section 8.4 — Security Audits
Customer's rights to audit Service Provider's security practices, systems, and controls shall be as set forth in Section 15 (Audit Rights). [OPEN ISSUE — See Section 15 for bracketed alternatives.]
Section 8.5 — Background Checks
Service Provider shall conduct appropriate background checks, including criminal history checks, on all Service Provider personnel (including employees of subcontractors approved under Section 2.6) who will have access to Customer Data or to Customer's systems or facilities, consistent with applicable law. The scope and nature of such background checks shall be commensurate with the level of access granted to such personnel. Service Provider shall not assign any individual to perform Services involving access to Customer Data if such individual's background check reveals a conviction or pending charge for any offense involving fraud, dishonesty, theft, or unauthorized access to computer systems, unless Service Provider obtains Customer's prior written consent.
Section 8.6 — Data Encryption
Service Provider shall ensure that all Customer Data is encrypted at all times, both in transit and at rest, using industry-standard encryption protocols and algorithms. At a minimum, Customer Data in transit shall be encrypted using Transport Layer Security (TLS) version 1.2 or higher, and Customer Data at rest shall be encrypted using the Advanced Encryption Standard (AES) with a key length of 256 bits (AES-256) or an equivalent or stronger encryption standard. Service Provider shall implement and maintain appropriate key management procedures, including secure key generation, storage, rotation, and destruction practices.
ARTICLE 9 — INTELLECTUAL PROPERTY
Section 9.1 — Customer Data Ownership
All Customer Data is and shall remain the sole and exclusive property of Customer at all times. Nothing in this Agreement shall be construed to transfer, assign, or grant to Service Provider any right, title, or interest in or to Customer Data, except the limited, revocable right to access, process, store, and transmit Customer Data solely to the extent necessary for Service Provider to perform the Services in accordance with the terms of this Agreement. Service Provider acknowledges and agrees that its access to and use of Customer Data is subject to the terms and restrictions set forth in this Agreement, including, without limitation, the confidentiality obligations set forth in Article 7 and the data security obligations set forth in Article 8.
Section 9.2 — Service Provider Pre-Existing IP
Service Provider retains all right, title, and interest in and to its Pre-Existing IP, including, without limitation, all tools, methodologies, processes, techniques, software platforms, frameworks, libraries, templates, and know-how that (i) existed prior to the Effective Date of this Agreement, or (ii) are developed or acquired by Service Provider independently of and outside the scope of any Statement of Work, without the use of Customer Data, Customer Confidential Information, or Customer's resources. Nothing in this Agreement shall be construed as transferring or assigning to Customer any right, title, or interest in Service Provider's Pre-Existing IP, except as expressly set forth in Section 9.4.
Section 9.3 — Deliverables and Custom Work Product
All Deliverables and custom work product developed by Service Provider specifically for Customer under a Statement of Work shall be considered works made for hire to the fullest extent permitted by applicable law, and all right, title, and interest in and to such Deliverables (including all intellectual Property rights therein) shall vest in and be the sole and exclusive property of Customer upon creation. To the extent that any Deliverable or custom work product does not qualify as a work made for hire under applicable law, Service Provider hereby irrevocably assigns, and shall cause each of its employees, contractors, and subcontractors who contributed to the creation of such Deliverable to irrevocably assign, to Customer all right, title, and interest in and to such Deliverable, including all intellectual Property rights therein, without the need for any further action, consideration, or documentation. Service Provider shall execute, and shall cause its employees, contractors, and subcontractors to execute, any and all documents and instruments, and take any and all actions, reasonably requested by Customer to evidence, perfect, register, or enforce Customer's ownership of the Deliverables and the intellectual Property rights therein. This Section 9.3 reflects the IP assignment language as revised and agreed by the Parties following the initial negotiation session.
Section 9.4 — License to Pre-Existing IP Embedded in Deliverables
To the extent that any Deliverable incorporates, embeds, or is dependent upon any Pre-Existing IP of Service Provider, Service Provider hereby grants to Customer a non-exclusive, perpetual, irrevocable, royalty-free, fully paid-up, worldwide license to use, reproduce, modify, prepare derivative works of, distribute, display, and perform such Pre-Existing IP, solely as embedded in or necessary to the use of the applicable Deliverable. Such license shall survive the termination or expiration of this Agreement and shall be freely transferable and sublicensable by Customer in connection with Customer's use, maintenance, and further development of the Deliverable.
Section 9.5 — Residuals
Nothing in this Agreement shall prevent Service Provider from using the general knowledge, skills, experience, ideas, concepts, techniques, and know-how that are retained in the unaided memory of Service Provider's personnel as a result of their participation in the performance of the Services, provided that such use does not: (i) infringe any intellectual Property rights of Customer; (ii) constitute the use, disclosure, or exploitation of Customer Data; (iii) constitute the use or disclosure of Customer's Confidential Information; or (iv) otherwise violate any provision of this Agreement. This Section 9.5 shall not be construed as granting Service Provider any license or right to Customer's intellectual Property, Customer Data, or Confidential Information.
ARTICLE 10 — REPRESENTATIONS AND WARRANTIES
Section 10.1 — Mutual Representations
Each Party represents and warrants to the other Party that, as of the Effective Date:
(a) It is duly organized, validly existing, and in good standing under the laws of the jurisdiction of its formation and is qualified to do business in each jurisdiction where the nature of its business requires such qualification;
(b) It has the full corporate or organizational power and authority to enter into this Agreement and to perform its obligations hereunder;
(c) The execution and delivery of this Agreement by such Party, and the performance by such Party of its obligations hereunder, have been duly authorized by all necessary corporate or organizational action;
(d) This Agreement constitutes a valid and binding obligation of such Party, enforceable against it in accordance with its terms, subject to applicable bankruptcy, insolvency, reorganization, and similar laws affecting creditors' rights generally and to general principles of equity; and
(e) The execution, delivery, and performance of this Agreement by such Party do not and will not (i) violate or conflict with any provision of such Party's organizational documents; (ii) violate or conflict with any applicable law, regulation, rule, judgment, order, or decree; or (iii) violate, conflict with, result in a breach of, or constitute a default under any material agreement, contract, or obligation to which such Party is a party or by which it is bound.
Section 10.2 — Service Provider Representations
In addition to the mutual representations set forth in Section 10.1, Service Provider represents and warrants to Customer that:
(a) The Services shall be performed in a professional, workmanlike manner, with the degree of skill, care, and diligence consistent with accepted industry standards and best practices for comparable enterprise information technology managed services;
(b) Service Provider has and shall maintain throughout the Term all licenses, certifications, permits, and authorizations necessary to perform the Services in accordance with this Agreement and applicable law;
(c) Service Provider's most recent SOC 2 Type II report was issued on March 15, 2023, covering the audit period from April 1, 2022 through March 31, 2023, and as of the Effective Date, Service Provider is not aware of any material deficiency, qualification, or exception identified in or arising since the issuance of that report that would materially impair Service Provider's ability to comply with its obligations under Article 8;
(d) The Services and Deliverables, as provided by Service Provider to Customer under this Agreement, shall not infringe, misappropriate, or otherwise violate any intellectual Property rights of any third party;
(e) Service Provider shall comply with all applicable federal, state, and local laws, rules, and regulations in performing the Services, including, without limitation, all applicable data privacy and data protection laws; and
(f) Service Provider shall not introduce any virus, worm, Trojan horse, malware, or other malicious code into Customer's systems or data environments in the course of performing the Services.
Section 10.3 — Customer Representations
In addition to the mutual representations set forth in Section 10.1, Customer represents and warrants to Service Provider that Customer has all rights, consents, licenses, and authorizations necessary to provide Customer Data to Service Provider for Service Provider's use in performing the Services in accordance with this Agreement, and that the provision of such Customer Data to Service Provider does not and will not violate any applicable law or any rights of any third party.
Section 10.4 — Disclaimer
EXCEPT AS EXPRESSLY SET FORTH IN THIS AGREEMENT, NEITHER PARTY MAKES ANY REPRESENTATIONS OR WARRANTIES OF ANY KIND, WHETHER EXPRESS, IMPLIED, STATUTORY, OR OTHERWISE, AND EACH PARTY SPECIFICALLY DISCLAIMS ALL IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, ANY IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, NON-INFRINGEMENT, AND ANY WARRANTIES ARISING FROM COURSE OF DEALING, USAGE, OR TRADE PRACTICE. SERVICE PROVIDER DOES NOT WARRANT THAT THE SERVICES WILL BE UNINTERRUPTED OR ERROR-FREE, EXCEPT TO THE EXTENT EXPRESSLY SET FORTH IN THE SERVICE LEVEL AGREEMENTS.
ARTICLE 11 — INDEMNIFICATION
Section 11.1 — Service Provider Indemnification
Service Provider shall indemnify, defend, and hold harmless Customer and its Affiliates, and their respective officers, directors, managers, members, employees, agents, successors, and permitted assigns (collectively, the "Customer Indemnified Parties"), from and against all losses, liabilities, damages, judgments, settlements, costs, and expenses (including, without limitation, reasonable attorneys' fees, court costs, and costs of investigation and litigation) (collectively, "Losses") arising from or relating to:
(a) Any material breach by Service Provider of its representations, warranties, covenants, or obligations under this Agreement;
(b) The negligence, recklessness, or willful misconduct of Service Provider or its personnel (including employees of approved subcontractors) in the performance of the Services;
(c) Any claim, action, or proceeding by a third party alleging that the Services, any Deliverable, or any component thereof, as provided by Service Provider to Customer under this Agreement, infringes, misappropriates, or otherwise violates any intellectual Property right of such third party;
(d) Any violation by Service Provider of applicable federal, state, or local law, rule, or regulation in connection with the performance of the Services; or
(e) Any Security Incident that is caused, in whole or in part, by Service Provider's failure to comply with its obligations under Article 8 (Data Security) or Article 7 (Confidentiality).
The indemnification obligations and triggers set forth in this Section 11.1 reflect the provisions as revised and agreed by the Parties following the initial negotiation session.
Section 11.2 — Customer Indemnification
Customer shall indemnify, defend, and hold harmless Service Provider and its Affiliates, and their respective officers, directors, employees, agents, successors, and permitted assigns (collectively, the "Provider Indemnified Parties"), from and against all Losses arising from or relating to:
(a) Any material breach by Customer of its representations, warranties, covenants, or obligations under this Agreement;
(b) The negligence, recklessness, or willful misconduct of Customer in connection with this Agreement; or
(c) Any claim, action, or proceeding by a third party alleging that Customer Data provided by Customer to Service Provider, or Service Provider's use of such Customer Data in accordance with the terms of this Agreement, infringes, misappropriates, or otherwise violates any intellectual Property right or other right of such third party.
Section 11.3 — Indemnification Procedures
The following procedures shall apply to all indemnifi

NEAR-FINAL DRAFT — October 6, 2023

NOTE TO DRAFTING PARTIES

MASTER SERVICES AGREEMENT

RECITALS

Record

Parties

Dates

Amounts