PORTERHOUSE SLED, LLC (#2027187)

Porterhouse | City of Pleasanton, California | Professional Services Agreement | Page 9 7.4 No Pending Actions. Porterhouse represents that there is no Action pending or, to its knowledge, threatened that would impair its ability to perform, and shall promptly notify the City if one arises. 7.5 No Harmful Code. Porterhouse warrants that Deliverables will be free of Viruses and of undisclosed disabling, time-out, remote-monitoring, or data-collection features. 7.6 Disclaimer. EXCEPT AS EXPRESSLY STATED IN THE AGREEMENT, EACH PARTY DISCLAIMS ALL OTHER WARRANTIES, EXPRESS OR IMPLIED, INCLUDING MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, AND NONINFRINGEMENT. THE WORKDAY SERVICE IS PROVIDED UNDER THE WORKDAY AGREEMENT, AND PORTERHOUSE MAKES NO WARRANTY ON BEHALF OF WORKDAY, INC. Section 8: City Materials, Systems, and Facilities 8.1 City Materials. Porterhouse shall use City Materials solely to provide the Services. City Materials remain the property of the City; Porterhouse holds only a non-exclusive, royalty-free license to use them for the Services. Porterhouse may use data from which personally identifiable information and indirect identifiers have been irreversibly removed for lawful internal purposes; pseudonymized data does not qualify. Any personally identifiable information within City Materials is handled per the data-protection terms of the applicable SOW and applicable Law. The City is responsible for obtaining any third-party consents required for data it directs Porterhouse to use, and Porterhouse shall contact City vendors only with the City's written authorization. 8.2 Systems Access. Porterhouse shall access City systems only as expressly authorized in writing, only as necessary for the Services, and in strict accordance with the City's access windows, identified-personnel requirements, access controls, and published policies. 8.3 Facilities. While at City facilities, Porterhouse personnel shall comply with the City's posted policies, and Porterhouse is solely responsible for the acts and omissions of its personnel on site. 8.4 Security Incidents. Porterhouse shall notify the City in writing within 72 hours of confirming a Security Incident, describing the incident, the categories of data involved, and, to the extent known, the affected records. Porterhouse shall take reasonable steps to contain, investigate, and remediate the Security Incident and shall provide progress updates. As between the Parties, the City is responsible for notifications to regulators and individuals required by Law. Porterhouse is not liable for incidents to the extent attributable to the City's acts or omissions, to data compromised before Porterhouse received it, to the City's failure to Docusign Envelope ID: 0FE3D53F-485C-88F0-83B1-0E900318BA33