MASTER SERVICES AGREEMENT
Document Reference: MSA-PDS-MCB-2023
Revised Draft — September 15, 2023
Prepared by Calderwood & Harkness LLP on behalf of Meridian Consumer Brands LLC.
REVISED DRAFT — Reflects resolutions from negotiation call of September 8, 2023. 18 issues remain open for further discussion. This draft is provided for negotiation purposes only and does not constitute a binding agreement. All provisions are subject to final approval by the business principals and legal counsel of both Parties. Bracketed language and annotations indicate open issues or provisions requiring further negotiation.
Right-click to update Table of Contents
RECITALS
This Master Services Agreement (this "Agreement") is entered into as of [●], 2023 (the "Effective Date"),
By and Between:
Meridian Consumer Brands LLC, a Delaware limited liability company, with its principal place of business at 680 Fifth Avenue, 22nd Floor, New York, NY 10019 ("Customer" or "MCB"),
and
Pinecrest Digital Solutions Inc., a Delaware corporation, with its principal place of business at 2300 Lakewood Boulevard, Suite 400, Durham, NC 27713 ("Service Provider" or "Pinecrest").
Each of Customer and Service Provider is sometimes referred to herein individually as a "Party" and collectively as the "Parties."
WHEREAS, Customer is a consumer products company engaged in the manufacture, marketing, and distribution of branded consumer goods, and Customer requires information technology infrastructure, managed services, enterprise application support, and cybersecurity monitoring services to support its business operations and technology environment;
WHEREAS, Service Provider is in the business of providing cloud infrastructure management, managed IT services, enterprise application support, cybersecurity monitoring and incident response, and data analytics platform hosting to commercial and enterprise clients;
WHEREAS, Customer issued Request for Proposal MCB-IT-RFP-2023-006 dated June 12, 2023 (the "RFP"), soliciting proposals from qualified vendors for the provision of the foregoing services, and Service Provider submitted a responsive proposal and was selected as the preferred vendor following a competitive evaluation process concluded on July 10, 2023;
WHEREAS, the Parties have engaged in extensive negotiations regarding the terms and conditions under which Service Provider will provide certain information technology and related services to Customer and its Affiliates; and
WHEREAS, the Parties desire to enter into this Agreement to set forth the terms and conditions under which Service Provider will provide certain services to Customer, as more particularly described herein and in the Exhibits and Schedules attached hereto.
NOW, THEREFORE, in consideration of the mutual covenants and agreements set forth herein, and for other good and valuable consideration, the receipt and sufficiency of which are hereby acknowledged, the Parties agree as follows:
ARTICLE 1: DEFINITIONS
Section 1.1 — Defined Terms
As used in this Agreement, the following capitalized terms shall have the meanings set forth below. Other capitalized terms used but not defined in this Section 1.1 shall have the meanings ascribed to them elsewhere in this Agreement.
"Affiliate" means, with respect to any Party, any entity that directly or indirectly controls, is controlled by, or is under common control with such Party. For purposes of this definition, "control" means the direct or indirect ownership of more than fifty percent (50%) of the outstanding voting securities or equity interests of an entity, or the power to direct or cause the direction of the management and policies of such entity, whether through ownership of voting securities, by contract, or otherwise.
"Agreement" means this Master Services Agreement, including all Exhibits, Schedules, Statements of Work, and any amendments or modifications hereto executed by the Parties in accordance with Section 19.4.
"Annual Contract Value" or "ACV" means Two Million Nine Hundred Fifty Thousand Dollars ($2,950,000) per year, as more particularly set forth in Section 6.1.
"Authorized Users" means Customer's employees, contractors, agents, consultants, and other personnel authorized by Customer to access and use the Services in accordance with the terms of this Agreement.
"Change of Control" means, with respect to a Party, any merger, consolidation, acquisition, reorganization, sale of all or substantially all of such Party's assets, or other transaction or series of related transactions resulting in a change in the majority ownership or voting control of such Party. Without limiting the foregoing, a "Change of Control" shall be deemed to have occurred with respect to a Party if, as a result of one or more transactions, any person or group of persons acting in concert (other than a person or group that currently controls such Party as of the Effective Date) acquires, directly or indirectly, more than fifty percent (50%) of the voting securities or equity interests of such Party.
"Confidential Information" means any and all information, in whatever form or medium (whether written, oral, electronic, visual, or otherwise), that is disclosed by or on behalf of one Party (the "Disclosing Party") to the other Party (the "Receiving Party") in connection with this Agreement that is either designated as confidential at the time of disclosure or that a reasonable person would understand to be confidential given the nature of the information and the circumstances of disclosure. Confidential Information includes, without limitation, proprietary data, trade secrets, business plans, financial information, pricing information, pricing algorithms, customer data, customer lists, supply chain analytics, trade promotion data, marketing strategies, product development plans, technical specifications, software code, system architectures, security configurations, and any other non-public information relating to a Party's business, technology, or operations.
"Customer Data" means all data, content, information, and materials provided by or on behalf of Customer or any Authorized User to Service Provider in connection with the Services, or generated, collected, or processed by Service Provider on Customer's behalf in the course of providing the Services. Customer Data includes, without limitation, proprietary trade promotion data, pricing algorithms, supply chain analytics, sales and distribution data, personally identifiable information of Customer's employees, customers, or consumers, and any other data that is owned by or licensed to Customer.
"Deliverables" means all work product, custom configurations, custom software, reports, documentation, analyses, and other materials created, developed, or produced by Service Provider or its personnel specifically for Customer pursuant to this Agreement or any Statement of Work. The term "Deliverables" is used interchangeably with "Work Product" throughout this Agreement.
"Effective Date" means the date first written above in the preamble of this Agreement.
"Force Majeure Event" has the meaning set forth in Section 14.1.
"Initial Term" means the period commencing on November 1, 2023 and ending on October 31, 2028, which is a period of five (5) years.
"intellectual Property" or "IP" means all intellectual property rights of any kind, including without limitation patents, patent applications, copyrights, copyright registrations and applications, trademarks, trademark registrations and applications, service marks, trade dress, trade names, trade secrets, know-how, inventions (whether or not patentable), moral rights, database rights, rights in software, rights in designs, and all other proprietary or intellectual property rights recognized under the laws of any jurisdiction, whether registered or unregistered, and including all applications, renewals, extensions, and restorations of any of the foregoing.
"Pre-Existing IP" means any intellectual Property owned by or licensed to either Party prior to the Effective Date, or developed by or for either Party independently of this Agreement and without use of or reference to the other Party's Confidential Information.
"Renewal Term" means each successive one-year period following the expiration of the Initial Term during which this Agreement remains in effect pursuant to Section 3.2.
"Service Level Agreement" or "SLA" means the service levels, performance standards, and related metrics applicable to the Services as set forth in Exhibit B attached hereto.
"Service Level Credits" means the credits to which Customer is entitled in the event Service Provider fails to meet specified SLA targets, as more particularly set forth in Section 5.3 and Exhibit B.
"Services" means, collectively, the cloud infrastructure management, managed IT services, enterprise application support, and cybersecurity monitoring and incident response services described in this Agreement and in Exhibit A (Scope of Services), together with any additional services agreed upon by the Parties in a Statement of Work executed pursuant to Section 2.6.
"Severity 1 Outage" means a complete service interruption or critical failure rendering one or more core Services materially unavailable to Customer and its Authorized Users, such that Customer's business operations are materially impaired and no commercially reasonable workaround is available.
"Severity 2 Outage" means a partial service degradation that materially impacts Customer's use of the Services but does not constitute a complete outage, including situations in which the Services are available but with significantly reduced performance, functionality, or capacity.
"SOC 2 Type II Report" means the System and Organization Controls 2 Type II report issued by an independent auditor in accordance with the standards established by the American Institute of Certified Public Accountants (AICPA), which evaluates the design and operating effectiveness of an organization's internal controls relevant to security, availability, processing integrity, confidentiality, and/or privacy over a specified period.
"Statement of Work" or "SOW" means any supplemental statement of work executed by the Parties pursuant to Section 2.6, which sets forth the description, scope, pricing, timeline, and other terms applicable to supplemental services to be provided by Service Provider under this Agreement.
"Term" means, collectively, the Initial Term and any Renewal Terms, as applicable.
"Total Contract Value" or "TCV" means Fourteen Million Seven Hundred Fifty Thousand Dollars ($14,750,000) over the Initial Term, calculated as five (5) years multiplied by the Annual Contract Value of $2,950,000 per year.
"Work Product" has the meaning ascribed to "Deliverables" above.
Section 1.2 — Interpretation
The following rules of construction and interpretation shall apply to this Agreement:
(a) The headings and captions contained in this Agreement are inserted for convenience of reference only and shall not affect the meaning or interpretation of any provision of this Agreement.
(b) References to "Sections," "Articles," "Exhibits," and "Schedules" are to the sections, articles, exhibits, and schedules of this Agreement unless otherwise specified.
(c) Words used in the singular shall include the plural, and vice versa, as the context may require. Words used in one gender shall include all genders.
(d) The words "include," "includes," and "including" shall be deemed to be followed by the phrase "without limitation" and shall not be construed to limit any general statement that they follow to the specific or similar items or matters immediately following them.
(e) The words "herein," "hereof," "hereunder," and similar terms shall refer to this Agreement as a whole, including all Exhibits, Schedules, and Statements of Work, and not to any particular provision of this Agreement.
(f) References to "days" shall mean calendar days unless "business days" is expressly specified. "Business days" shall mean days other than Saturdays, Sundays, and federal holidays observed in the State of New York.
(g) References to currency or dollar amounts (e.g., "$") shall refer to United States Dollars unless otherwise specified.
(h) References to any statute, rule, regulation, or law shall be deemed to include any successor statute, rule, regulation, or law, and any regulations promulgated thereunder.
(i) The Parties have participated jointly in the negotiation and drafting of this Agreement. In the event of an ambiguity or question of intent or interpretation, this Agreement shall be construed as if drafted jointly by the Parties, and no presumption or burden of proof shall arise favoring or disfavoring any Party by virtue of the authorship of any provision.
ARTICLE 2: SCOPE OF SERVICES
Section 2.1 — Services Generally
During the Term, Service Provider shall provide to Customer the Services described in this Agreement and in Exhibit A (Scope of Services) attached hereto and incorporated herein by reference. Service Provider shall perform the Services in a professional, workmanlike manner, consistent with industry standards, best practices, and the degree of care, skill, and diligence that would be expected of a qualified and experienced provider of services similar in scope, nature, and complexity to the Services. Service Provider shall allocate sufficient resources, personnel, and attention to the performance of the Services to ensure timely, efficient, and high-quality delivery in accordance with the terms of this Agreement and the applicable Service Level Agreements.
Section 2.2 — Cloud Infrastructure Management
Service Provider shall provide cloud infrastructure management services as more particularly described in Exhibit A, Section A-1. The annual fee for cloud infrastructure management services shall be One Million Two Hundred Thousand Dollars ($1,200,000). Cloud infrastructure management services shall include, without limitation, the following:
(a) Provisioning, configuration, management, monitoring, and optimization of Customer's cloud infrastructure environments, including production, staging, development, and disaster recovery environments;
(b) Hosting of Customer's enterprise applications, data analytics platforms, and related workloads on Service Provider's managed cloud infrastructure;
(c) Capacity planning, resource allocation, and performance optimization to ensure that Customer's infrastructure environments are scaled appropriately to meet Customer's business requirements;
(d) Infrastructure security hardening, including the implementation and maintenance of firewalls, intrusion detection and prevention systems, network segmentation, and other security controls as specified in Exhibit A and in accordance with the data security requirements set forth in Article 7;
(e) Disaster recovery infrastructure maintenance, including the configuration, testing, and ongoing management of disaster recovery environments and failover mechanisms in accordance with Customer's recovery point objectives (RPO) and recovery time objectives (RTO) as specified in Exhibit A; and
(f) Infrastructure change management, including the implementation of infrastructure changes in accordance with documented change management procedures, with appropriate testing, approval, and rollback capabilities.
Section 2.3 — Managed IT Services
Service Provider shall provide managed IT services as more particularly described in Exhibit A, Section A-2. The annual fee for managed IT services shall be Eight Hundred Twenty-Five Thousand Dollars ($825,000). Managed IT services shall include, without limitation, the following:
(a) Help desk support at Tier 1, Tier 2, and Tier 3 levels, including first-call resolution for routine issues, technical troubleshooting and escalation for complex issues, and advanced engineering support for critical or systemic problems;
(b) Endpoint management, including the configuration, deployment, patching, monitoring, and lifecycle management of Customer's desktop and laptop computers, mobile devices, and other endpoint devices;
(c) Network monitoring, including the 24/7 monitoring of Customer's local area networks, wide area networks, wireless networks, and virtual private networks, with proactive alerting and incident response capabilities;
(d) Desktop and mobile device support, including software installation, configuration, and troubleshooting for Customer's standard software applications and operating systems;
(e) Incident ticketing and resolution, including the operation and management of a centralized IT service management (ITSM) platform for tracking, prioritizing, and resolving service requests and incidents; and
(f) Asset management, including the maintenance of an accurate inventory of Customer's IT hardware and software assets, tracking of asset lifecycles, and reporting on asset utilization and disposition.
Section 2.4 — Enterprise Application Support
Service Provider shall provide enterprise application support services as more particularly described in Exhibit A, Section A-3. The annual fee for enterprise application support services shall be Five Hundred Seventy-Five Thousand Dollars ($575,000). Enterprise application support services shall include, without limitation, the following:
(a) Support for Customer's Harborline Software environment, including application monitoring, performance tuning, troubleshooting, and issue resolution;
(b) Support for Customer's Pinnacle Health IT environment, including configuration management, customization support, integration monitoring, and user support;
(c) Application configuration and customization, including the implementation of configuration changes requested by Customer through a documented change request process;
(d) Patch management, including the evaluation, testing, scheduling, and deployment of vendor-released patches, hotfixes, and security updates for supported enterprise applications;
(e) Release management, including the coordination and execution of major and minor application releases, including environment refreshes, regression testing, and deployment activities;
(f) User administration, including the provisioning, deprovisioning, and management of user accounts, roles, and access permissions within supported enterprise applications; and
(g) Integration support between Customer's enterprise applications, including monitoring and maintenance of interfaces, data feeds, APIs, and middleware components connecting Harborline Software, Pinnacle Health IT, and other Customer systems.
Section 2.5 — Cybersecurity Monitoring and Incident Response
Service Provider shall provide cybersecurity monitoring and incident response services as more particularly described in Exhibit A, Section A-4. The annual fee for cybersecurity monitoring and incident response services shall be Three Hundred Fifty Thousand Dollars ($350,000). Cybersecurity monitoring and incident response services shall include, without limitation, the following:
(a) 24/7 security operations center (SOC) monitoring, including continuous monitoring of Customer's network traffic, system logs, security events, and access patterns for indicators of compromise, anomalous activity, and potential security threats;
(b) Threat detection and analysis, including the identification, triage, classification, and investigation of security alerts and events using automated and manual analysis techniques;
(c) Vulnerability scanning, including the conduct of regular automated vulnerability scans of Customer's infrastructure, applications, and endpoints, with reporting and remediation tracking;
(d) Penetration testing coordination, including the coordination and oversight of periodic penetration testing engagements conducted by qualified independent third-party assessors, in accordance with a testing schedule and scope agreed upon by the Parties;
(e) Incident response planning and execution, including the development, maintenance, and testing of incident response plans and playbooks, and the coordination and execution of incident response activities in the event of a confirmed security incident affecting Customer's environments; and
(f) Security information and event management (SIEM) platform management, including the configuration, tuning, maintenance, and operation of the SIEM platform used to aggregate, correlate, and analyze security event data from Customer's environments.
Section 2.6 — Statements of Work
From time to time during the Term, the Parties may execute additional Statements of Work for supplemental services not covered by Exhibit A. Each Statement of Work shall be executed in writing by authorized representatives of both Parties, shall reference this Agreement, and shall be substantially in the form attached hereto as Exhibit E (Form of Statement of Work). Each duly executed Statement of Work shall be incorporated into and form a part of this Agreement.
In the event of any conflict or inconsistency between the terms of a Statement of Work and the terms of this Agreement (including its Exhibits and Schedules), the terms of this Agreement shall control and take precedence, unless the Statement of Work expressly identifies the specific provision of this Agreement from which it deviates and states that the Statement of Work is intended to supersede such provision with respect to the services described in such Statement of Work. No Statement of Work may modify or waive the terms of Articles 7, 8, 9, 11, or 12 of this Agreement.
Section 2.7 — Service Provider Personnel
Service Provider shall assign to the performance of the Services qualified personnel who possess the appropriate skills, experience, training, and certifications necessary to perform the Services in accordance with the standards required by this Agreement. Service Provider shall ensure that all personnel assigned to the Services are properly supervised and managed, and that adequate staffing levels are maintained at all times to meet Service Provider's obligations under this Agreement and the applicable Service Level Agreements.
The key personnel positions and, where applicable, the initial individuals assigned to such positions shall be identified in Exhibit A, Section A-5. Service Provider shall not reassign, remove, or replace any individual identified as key personnel without providing Customer with at least thirty (30) days' prior written notice. Upon receipt of such notice, Customer shall have a reasonable opportunity to review the qualifications of the proposed replacement and to object to the proposed change on reasonable grounds. Service Provider shall give good faith consideration to Customer's objections and shall not proceed with a replacement over Customer's reasonable objection without first engaging in discussions with Customer to identify a mutually acceptable alternative.
[Note: The scope of Customer's right to require replacement of specific Service Provider personnel, including whether Customer may direct removal of personnel for cause and the standards applicable to such removal, remains subject to further negotiation between the Parties. This is one of the 18 remaining open issues.]
Section 2.8 — Subcontracting
Service Provider shall not subcontract, delegate, or otherwise transfer any portion of the Services or any of its obligations under this Agreement to any third party without the prior written consent of Customer, which consent shall not be unreasonably withheld, conditioned, or delayed. Any request for consent to subcontract shall be made in writing and shall identify the proposed subcontractor, the scope of services to be subcontracted, the qualifications of the proposed subcontractor, and the measures Service Provider will implement to ensure the subcontractor's compliance with the terms of this Agreement.
Notwithstanding any subcontracting approved by Customer, Service Provider shall remain fully responsible and liable for the acts, omissions, and performance of all approved subcontractors as if such acts, omissions, and performance were those of Service Provider itself. Service Provider shall ensure that all approved subcontractors are bound by written agreements containing confidentiality, data security, and intellectual property provisions no less restrictive than those set forth in this Agreement.
[Note: The scope of subcontracting restrictions, including whether Customer should have pre-approval rights over specific categories of subcontractors, the process and timeline for Customer's review of subcontracting requests, and the applicability of these restrictions to Service Provider's existing Affiliates, remain open for further discussion. This is one of the 18 remaining open issues.]
ARTICLE 3: TERM AND RENEWAL
Section 3.1 — Initial Term
The initial term of this Agreement shall commence on November 1, 2023 and shall expire on October 31, 2028, unless earlier terminated in accordance with Article 4 (the "Initial Term"). The Initial Term is a period of five (5) years.
Section 3.2 — Renewal
Following the expiration of the Initial Term, this Agreement shall automatically renew for successive one-year periods (each, a "Renewal Term"), unless either Party provides written notice of non-renewal to the other Party at least one hundred eighty (180) days prior to the expiration of the then-current Initial Term or Renewal Term, as applicable. Each Renewal Term shall be subject to the same terms and conditions as set forth in this Agreement, except as otherwise agreed by the Parties in writing. The fees applicable during any Renewal Term shall be as agreed by the Parties in accordance with Section 6.3 or, if Section 6.3 remains open and unagreed at the time of renewal, as mutually agreed in writing by the Parties prior to the commencement of such Renewal Term.
Section 3.3 — Effect of Expiration or Termination
Upon the expiration or termination of this Agreement for any reason, Service Provider shall cooperate fully in the orderly transition of the Services back to Customer or to a successor service provider designated by Customer, as further described in Article 13 (Transition Assistance). All provisions of this Agreement that by their nature should survive expiration or termination shall survive in accordance with Section 4.5.
ARTICLE 4: TERMINATION
Section 4.1 — Termination for Cause
Either Party may terminate this Agreement upon thirty (30) days' prior written notice to the other Party if the other Party materially breaches any provision of this Agreement and fails to cure such material breach within such thirty (30)-day notice period. The written notice of termination for cause shall describe in reasonable detail the nature of the alleged material breach and the actions required to cure such breach.
For purposes of this Section 4.1, "material breach" shall include, without limitation: (a) Service Provider's failure to perform the Services in accordance with the Service Level Agreements set forth in Exhibit B, where such failure constitutes a material deviation from the agreed-upon performance standards; (b) a Party's breach of its confidentiality obligations under Article 8; (c) Service Provider's breach of its data security obligations under Article 7; (d) a Party's failure to maintain the insurance coverages required by Article 15; and (e) a Party's material misrepresentation under Article 10.
Notwithstanding the foregoing, certain breaches shall be deemed incurable and shall be subject to immediate termination upon written notice by the non-breaching Party without any cure period. Such incurable breaches include: (i) a breach of Section 8.1 (Confidentiality Obligations) involving the willful or intentional disclosure of Confidential Information to an unauthorized third party; (ii) a data security breach affecting Customer Data that is caused by Service Provider's gross negligence or willful misconduct; and (iii) any breach of this Agreement that, by its nature, cannot reasonably be cured.
Section 4.2 — Termination for Convenience
Customer may terminate this Agreement at any time, with or without cause, upon one hundred eighty (180) days' prior written notice to Service Provider. Upon any termination by Customer for convenience pursuant to this Section 4.2, Customer shall pay to Service Provider an early termination fee equal to fifty percent (50%) of the remaining Annual Contract Value for the balance of the then-current Term (i.e., the remaining months of the Initial Term or the then-current Renewal Term, as applicable, calculated on a pro rata monthly basis). The early termination fee shall be payable within forty-five (45) days of the effective date of termination.
[Note: The calculation methodology and scope of the early termination fee remain an open issue for escalation to business principals. MCB's position is that the termination fee should be calculated based on a declining schedule over the Initial Term (e.g., 50% in years 1-2, 35% in years 3-4, 20% in year 5) and should not apply during Renewal Terms. Pinecrest's position is that the flat 50% rate should apply throughout the entire Term, including Renewal Terms. This is one of the 18 remaining open issues.]
Section 4.3 — Termination for Insolvency
Either Party may terminate this Agreement immediately upon written notice to the other Party if the other Party: (a) becomes insolvent or admits its inability to pay its debts as they become due; (b) files a voluntary petition in bankruptcy or for reorganization under any applicable bankruptcy or insolvency law; (c) has an involuntary petition in bankruptcy filed against it that is not dismissed within sixty (60) days of filing; (d) has a receiver, trustee, conservator, or similar officer appointed for it or for a substantial part of its assets; (e) makes a general assignment for the benefit of creditors; or (f) is dissolved, liquidated, or wound up (other than in connection with a reorganization, merger, or consolidation that does not constitute a Change of Control).
Section 4.4 — Change of Control
Either Party may terminate this Agreement within thirty (30) days following receipt of notice of a Change of Control event affecting the other Party by providing written notice of termination to the affected Party. For purposes of this Section 4.4, "Change of Control" shall have the meaning set forth in Section 1.1. Each Party shall provide written notice to the other Party of any Change of Control event within ten (10) business days of the closing of the transaction constituting the Change of Control.
Upon termination pursuant to this Section 4.4, no early termination fee shall be payable by either Party, and the provisions of Article 13 (Transition Assistance) shall apply.
Section 4.5 — Effect of Termination
Termination or expiration of this Agreement shall not relieve either Party of any obligations or liabilities that have accrued prior to the effective date of such termination or expiration, including without limitation any payment obligations for Services rendered prior to the effective date of termination. The following provisions shall survive the expiration or termination of this Agreement: Article 1 (Definitions), Article 7 (Data Security and Privacy), Article 8 (Confidentiality), Article 9 (Intellectual Property), Article 11 (Indemnification), Article 12 (Limitation of Liability), Article 13 (Transition Assistance), Article 18 (Governing Law and Dispute Resolution), Sections 4.5 (Effect of Termination), 6.5 (Disputed Invoices), 15.1 (Required Coverages, with respect to the post-termination tail period), 17.1 (Mutual Non-Solicitation), and any other provisions that by their express terms or by their nature are intended to survive termination or expiration.
ARTICLE 5: SERVICE LEVELS AND REMEDIES
Section 5.1 — Service Level Agreement
Service Provider shall perform the Services in accordance with the Service Level Agreements set forth in Exhibit B attached hereto and incorporated herein by reference. The Service Level Agreements establish minimum performance standards for availability, response time, resolution time, and other metrics applicable to each service component. Service Provider acknowledges that Customer's agreement to enter into this Agreement is predicated, in material part, on Service Provider's commitment to meet the performance standards set forth in the SLAs.
Section 5.2 — SLA Measurement Methodology
Revised per negotiation call of September 8, 2023: SLA measurement windows shall be aligned to Customer's fiscal calendar (four-week reporting periods aligned to MCB's 4-4-5 fiscal calendar), rather than standard calendar months, to facilitate Customer's internal performance reporting and financial reconciliation processes. The specific measurement period dates for each fiscal year shall be provided by Customer to Service Provider within thirty (30) days of the commencement of each fiscal year.
Availability shall be calculated on a per-service-component basis — that is, availability shall be measured separately for each of the following service components: (i) Cloud Infrastructure Management; (ii) Managed IT Services; (iii) Enterprise Application Support; and (iv) Cybersecurity Monitoring and Incident Response. Availability for each service component shall be calculated as follows:
Availability % = [(Total Minutes in Measurement Period − Downtime Minutes) / Total Minutes in Measurement Period] × 100
The following events shall be excluded from the calculation of downtime for purposes of measuring SLA compliance:
(a) Scheduled maintenance windows, provided that Service Provider has given Customer at least seventy-two (72) hours' advance written notice of the scheduled maintenance and the maintenance is conducted during the maintenance windows agreed upon by the Parties (which shall generally be between 12:00 a.m. and 6:00 a.m. Eastern Time on Saturdays and Sundays, unless otherwise agreed in writing);
(b) Force Majeure Events, as defined in Section 14.1;
(c) Outages or service degradation caused by Customer's own systems, equipment, or networks, to the extent such outages or degradation are not attributable to Service Provider's actions or inactions; and
(d) Outages or service degradation caused by third-party software or services not managed by Service Provider under this Agreement, to the extent such outages or degradation are outside of Service Provider's reasonable control.
Service Provider shall provide Customer with monthly SLA performance reports within ten (10) business days after the end of each measurement period. Such reports shall include, at a minimum, the availability percentage for each service component, the number and duration of all outages and incidents, a description of each outage or incident, the root cause (if determined), and the corrective actions taken or planned.
Section 5.3 — Service Level Credits
In the event that Service Provider fails to meet the SLA targets set forth in Exhibit B, Customer shall be entitled to Service Level Credits as follows:
(a) Severity 1 Outages: For any Severity 1 Outage that exceeds four (4) hours in duration, Customer shall be entitled to a credit of up to fifteen percent (15%) of the monthly fees attributable to the affected service component for the measurement period in which the outage occurred.
(b) Severity 2 Outages: For any Severity 2 Outage that exceeds eight (8) hours in duration, Customer shall be entitled to a credit of up to ten percent (10%) of the monthly fees attributable to the affected service component for the measurement period in which the outage occurred.
Service Level Credits shall be applied as a credit against the fees payable by Customer in the next billing period following Customer's written request for such credit. Customer must submit a written request for Service Level Credits within thirty (30) days after receipt of the monthly SLA performance report for the applicable measurement period. Service Provider shall review Customer's request and, if the credit is due, shall apply the credit within thirty (30) days of receipt of the request. If Service Provider disputes Customer's entitlement to a Service Level Credit, the Parties shall resolve the dispute in accordance with Section 6.5 (Disputed Invoices).
Subject to Section 5.4 below, Service Level Credits shall be Customer's sole and exclusive remedy for Service Provider's failure to meet the SLA targets set forth in Exhibit B. Nothing in this Section 5.3 shall limit Customer's rights under Section 4.1 (Termination for Cause) or any other provision of this Agreement.
[Note: Whether Service Level Credits should be the sole and exclusive remedy for SLA failures, or whether Customer should also have a termination right upon repeated SLA failures (i.e., chronic failure), remains an open issue. See Section 5.4 below. This is one of the 18 remaining open issues.]
Section 5.4 — Chronic Failure
[Note: The definition of "chronic failure" or "repeated SLA failure" and the remedies available to Customer in the event of chronic failure remain open for further negotiation. This was among the 18 remaining open issues identified following the September 8, 2023 negotiation call. MCB's position is that if Service Provider fails to meet the SLA targets for any service component for three (3) or more consecutive measurement periods, or for five (5) or more measurement periods in any rolling twelve (12)-month period, Customer should have the right to terminate the affected service component or the entire Agreement without payment of any early termination fee. Pinecrest's position is that chronic failure remedies should be limited to a "performance improvement plan" process with escalating consequences short of termination, and that any termination right for chronic failure should be subject to a separate cure period of not less than ninety (90) days. The Parties have agreed to address this issue in the next negotiation session.]
ARTICLE 6: FEES AND PAYMENT
Section 6.1 — Fees
In consideration of Service Provider's performance of the Services during the Term, Customer shall pay to Service Provider fees in the amount of Two Million Nine Hundred Fifty Thousand Dollars ($2,950,000) per year (the "Annual Contract Value" or "ACV"). The Annual Contract Value is allocated among the service components as follows:
The Total Contract Value over the five-year Initial Term is Fourteen Million Seven Hundred Fifty Thousand Dollars ($14,750,000), calculated as five (5) years multiplied by the Annual Contract Value of $2,950,000 per year.
Fees for any additional services provided under a Statement of Work shall be set forth in the applicable Statement of Work and shall be in addition to the fees set forth in this Section 6.1.
Section 6.2 — Payment Terms
Fees shall be payable quarterly in advance. Service Provider shall submit invoices to Customer on or before the first business day of each calendar quarter for the fees due for such quarter. All invoices shall include a reasonably detailed description of the Services provided or to be provided during the applicable quarter, a breakdown of fees by service component, and such other information as Customer may reasonably request.
All undisputed amounts shall be due and payable within forty-five (45) days from the date of the invoice ("Net 45"). Payments shall be made by wire transfer or automated clearing house (ACH) transfer to the account designated by Service Provider in writing.
Section 6.3 — Fee Escalation
[Note: The annual fee escalation mechanism remains open for negotiation and is one of the 18 remaining open issues. MCB's position is that fees should remain fixed during the Initial Term, with any escalation limited to a maximum of the lesser of (a) three percent (3%) per year or (b) the annual increase in the Consumer Price Index for All Urban Consumers (CPI-U), U.S. City Average, as published by the U.S. Bureau of Labor Statistics, applicable only during Renewal Terms. Pinecrest's position is that fees should be subject to an annual escalation of four percent (4%) commencing in Year 2 of the Initial Term, compounding annually. The Parties have agreed to discuss this issue at the next business principals call.]
Section 6.4 — Taxes
All fees set forth in this Agreement are exclusive of any and all applicable sales, use, value-added, goods and services, excise, and other similar taxes, duties, levies, and assessments imposed by any governmental authority (collectively, "Taxes"), other than taxes based on Service Provider's net income, gross receipts (to the extent measured by Service Provider's income), capital, franchise, or similar taxes. Customer shall be responsible for and shall pay all such Taxes applicable to the Services or the fees payable under this Agreement. If Customer is exempt from any such Taxes, Customer shall provide Service Provider with a valid exemption certificate or other documentation reasonably acceptable to the applicable taxing authority. Service Provider shall separately itemize all applicable Taxes on each invoice.
Section 6.5 — Disputed Invoices
Customer may dispute any invoice or any portion thereof in good faith by providing written notice to Service Provider within thirty (30) days of receipt of the disputed invoice. Such written notice shall identify the invoice in question, the amount disputed, and the basis for the dispute in reasonable detail. Customer shall pay all undisputed amounts in accordance with Section 6.2, notwithstanding any pending dispute with respect to a portion of the invoice.
The Parties shall use good faith efforts to resolve any invoice dispute within thirty (30) days following Service Provider's receipt of Customer's written dispute notice. If the Parties are unable to resolve the dispute within such thirty (30)-day period, either Party may escalate the dispute in accordance with Article 18 (Governing Law and Dispute Resolution). If it is ultimately determined that any disputed amount was properly invoiced and payable, Customer shall pay such amount, together with any interest accrued thereon pursuant to Section 6.6, within fifteen (15) days of such determination.
Section 6.6 — Late Payment
Any undisputed amount that is not paid when due shall accrue interest from the date due until the date paid at a rate equal to the lesser of (a) one and one-half percent (1.5%) per month, compounded monthly, or (b) the maximum rate permitted by applicable law. The assessment of late payment interest shall not limit or waive any other rights or remedies available to Service Provider under this Agreement or at law with respect to Customer's failure to pay amounts when due.
ARTICLE 7: DATA SECURITY AND PRIVACY
Section 7.1 — Data Security Obligations
Service Provider shall implement and maintain comprehensive administrative, technical, and physical safeguards designed to protect Customer Data against unauthorized access, use, disclosure, alteration, destruction, or loss, in accordance with industry standards, best practices, and all applicable laws and regulations. Such safeguards shall be no less protective than the measures Service Provider uses to protect its own confidential and proprietary information of a similar nature and sensitivity.
Without limiting the generality of the foregoing, Service Provider shall:
(a) Maintain a SOC 2 Type II certification, with the most recent report having been issued on March 15, 2023, covering the period from April 1, 2022 through March 31, 2023. Service Provider shall continue to undergo annual SOC 2 Type II audits conducted by a qualified independent auditor and shall provide updated SOC 2 Type II reports to Customer within thirty (30) days of issuance;
(b) Conduct annual penetration testing of the systems, networks, and applications used to provide the Services, using a qualified independent third-party assessor approved by Customer (such approval not to be unreasonably withheld). Service Provider shall share the results of such penetration testing with Customer, including any identified vulnerabilities and the remediation actions taken or planned;
(c) Implement and maintain a comprehensive information security program that includes documented policies and procedures for access control, data classification, encryption, incident response, vulnerability management, security awareness training, and business continuity and disaster recovery;
(d) Ensure that all Service Provider personnel with access to Customer Data receive appropriate security awareness training upon hiring and at least annually thereafter; and
(e) Promptly remediate any material security vulnerabilities identified through penetration testing, vulnerability scanning, SOC 2 audits, or other assessments.
[Note: Specific data security standards, including encryption requirements (at rest and in transit), access control specifications (including multi-factor authentication requirements), data segregation architecture, and specific compliance frameworks (e.g., NIST CSF, ISO 27001), remain an open issue for escalation to business principals. MCB requires Service Provider to commit to AES-256 encryption at rest, TLS 1.2 or higher in transit, multi-factor authentication for all privileged access, and compliance with NIST Cybersecurity Framework version 1.1. Pinecrest has indicated willingness to meet these requirements in principle but seeks flexibility in implementation timelines and has objected to committing to specific technical standards in the body of the Agreement. This is one of the 4 final unresolved issues to be escalated to business principals.]
Section 7.2 — Data Isolation
Service Provider shall maintain logical separation of Customer Data from the data of Service Provider's other customers at all times. Where commercially reasonable and technically feasible, Service Provider shall also maintain physical separation of Customer Data from the data of other customers. In no event shall Customer Data be commingled with data belonging to third parties in a manner that could permit unauthorized access to or disclosure of Customer Data.
Access to Customer Data shall be restricted to Service Provider personnel who have a demonstrable need to access such data in order to perform the Services, and who have been appropriately vetted and trained in accordance with Section 7.1. Service Provider shall maintain access control logs and shall make such logs available to Customer upon reasonable request.
Section 7.3 — Breach Notification
Service Provider shall notify Customer of any actual or reasonably suspected security breach, unauthorized access, unauthorized use, or unauthorized disclosure affecting Customer Data (a "Security Incident") within seventy-two (72) hours of Service Provider's discovery of such Security Incident. The initial notification may be made by telephone or email to Customer's designated security contact, followed by a written notification within five (5) business days.
Such notification shall include, to the extent known at the time of notification:
(a) A description of the nature and scope of the Security Incident, including the systems, applications, and environments affected;
(b) The categories and approximate volume of Customer Data affected or reasonably believed to have been affected;
(c) The likely consequences of the Security Incident for Customer and its business operations;
(d) A description of the measures taken or proposed to be taken by Service Provider to address the Security Incident, including measures to contain the Security Incident and to mitigate its potential adverse effects; and
(e) The name and contact information of Service Provider's designated point of contact for purposes of communications regarding the Security Incident.
Service Provider shall cooperate fully with Customer in investigating, mitigating, and remediating any Security Incident, including by providing Customer with access to relevant logs, forensic data, and Service Provider personnel as reasonably requested by Customer. Service Provider shall bear its own costs of investigation and remediation of any Security Incident, and shall not make any public disclosure or notification to affected individuals regarding a Security Incident affecting Customer Data without Customer's prior written consent, except as required by applicable law.
Section 7.4 — Data Privacy Compliance
Service Provider shall comply with all applicable data protection and privacy laws, regulations, and standards in connection with its receipt, processing, storage, and transmission of Customer Data, including without limitation applicable state privacy laws (including the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), and other state privacy laws as applicable), and any other privacy or data protection laws that may become applicable during the Term.
Service Provider shall enter into a Data Processing Addendum with Customer substantially in the form attached hereto as Exhibit D (Data Processing Addendum), which shall govern the processing of personal data by Service Provider on behalf of Customer. In the event of any conflict between the Data Processing Addendum and this Article 7, the more protective provision shall control.
Section 7.5 — Return and Destruction of Customer Data
Upon the expiration or termination of this Agreement for any reason, Service Provider shall, at Customer's election (which election shall be communicated in writing), either: (a) return all Customer Data to Customer in a commercially standard format reasonably requested by Customer; or (b) securely destroy all Customer Data, including all copies, backups, and archives thereof, using methods consistent with industry standards for secure data destruction (e.g., NIST SP 800-88 Rev. 1). Service Provider shall complete the return or destruction of Customer Data within thirty (30) days of the effective date of expiration or termination (or such later date as may be agreed upon by the Parties in connection with transition assistance under Article 13) and shall certify such return or destruction in writing, signed by an authorized officer of Service Provider.
Notwithstanding the foregoing, Service Provider may retain copies of Customer Data to the extent required by applicable law or regulation, provided that Service Provider (i) notifies Customer in writing of the specific legal requirement and the categories of data retained, (ii) continues to protect such retained data in accordance with this Agreement, and (iii) destroys such retained data promptly when the legal requirement expires.
ARTICLE 8: CONFIDENTIALITY
Section 8.1 — Confidentiality Obligations
Each Party (in its capacity as a "Receiving Party") shall hold in strict confidence and shall not disclose, publish, release, or otherwise make available to any third party the Confidential Information of the other Party (in its capacity as a "Disclosing Party"), except as expressly permitted by this Agreement. Each Party shall use at least the same degree of care to protect the Confidential Information of the other Party as it uses to protect its own confidential and proprietary information of a similar nature and sensitivity, but in no event less than a reasonable degree of care. Each Party shall use the Confidential Information of the other Party solely for the purposes of exercising its rights and performing its obligations under this Agreement.
Without limiting the generality of the foregoing, Confidential Information includes, with respect to Customer, Customer's proprietary trade promotion data, pricing algorithms, supply chain analytics, financial information, revenue and margin data, customer and consumer lists, marketing and advertising strategies, product development plans, merger and acquisition plans, and business strategies. With respect to Service Provider, Confidential Information includes Service Provider's proprietary methodologies, software code, system architectures, pricing models, and business strategies.
Confidential Information shall not include information that the Receiving Party can demonstrate by clear and convincing evidence: (a) is or becomes publicly available through no fault or breach of this Agreement by the Receiving Party; (b) was already known to the Receiving Party at the time of disclosure, as evidenced by the Receiving Party's written records predating such disclosure; (c) is independently developed by the Receiving Party without use of or reference to the Disclosing Party's Confidential Information, as evidenced by the Receiving Party's written records; or (d) is rightfully received by the Receiving Party from a third party who is not under any obligation of confidentiality to the Disclosing Party with respect to such information.
Section 8.2 — Permitted Disclosures
Notwithstanding Section 8.1, the Receiving Party may disclose Confidential Information of the Disclosing Party: