Loading...
HomeMy WebLinkAboutTechnologyBox, Inc. 900 Jefferson Ave Redwood City, CA 94063 Executed Order must be received by: September 30, 2024 Service Order Q-00306782 This Box Box, Inc. ("Box") and CITY OF RENTON ("Customer") as of the Service Start Date and is governed by the Box Service Agreement ("Agreement") and other applicable agreements (collectively, "Agreement") as per the link below, or as attached to this Order. Order Details CITY OF RENTON Billing Terms 1055 S Grady Way Service Start Date1: September 30, 2024 Renton Service Renewal Date: September 30, 2025 WA Payment Frequency: Annual 98057 Payment Method: ACH United States Payment Terms: Net 30 Quote Number: Q-00306782 Enterprise ID: TBD Bill To2: Sold To: Name: Brett Tietjen Name: Brett Tietjen Email: btietjen@rentonwa.gov Email: btietjen@rentonwa.gov Phone: 425-430-6873 Phone: 425-430-6873 Products Product Name Price Type Unit Price Quantity Amount Per Payment Frequency Total Price Enterprise Plus (US (Box Service Providers) - default) Recurring $510.24 10 $5,102.40 $5,102.40 Total One Time Charges: $ 0.00 USD Total Recurring Amount Per Payment Frequency: $ 5,102.40 USD Total Order Amount: $ 5,102.40 USD Additional Terms The Enterprise Plus product entitles Customer to 10 Managed Users for the applicable products and features described in the Feature Matrix found at the following link: https://cloud.box.com/s/mznm291s3jaxjk5abt1obf21kthg3x4l , which is hereby incorporated into this Order. For the first consecutive renewal of this Order, as long as the amount of recurring product types identified as Recurring Charge Types as per ct term are equal to or greater than the number of Recurring Products and the duration of the contract term previously purchased, the Parties agree that the fee per unit for each TAG-24-008 Box, Inc. 900 Jefferson Ave Redwood City, CA 94063 Executed Order must be received by: September 30, 2024 Service Order Q-00306782 Recurring Product will not increase by more than 5%. If the Initial Subscription Period is longer than one year, the base price for the per unit rate will be the highest rate applicable in the final 12 months of the subscription period. Recurring Products purchased under this paragraph are solely for use by Customer. Signature IN WITNESS WHEREOF, Customer has authorized this Order as of the Date of signature below. Customer CITY OF RENTON \si1\ [[s|0]] \na1\ [[t|0]] \t1\ [[t|0]] \dt1\ [[d|0]] Agreement can be found at the following link: https://legal.box.com/v/BOSAv09252024USPS Enhanced Services Level: Priority Priority Services datasheet can be found at the following link: https://cloud.box.com/v/EntPlusPriorityServices Redeem your Box guidance services credits here: https://box.my.site.com/redeemcredits The Box Data Processing Addendum (DPA) is made available for business enterprises that process and transfer data from the European Economic Area and the United Kingdom to ensure compliance with EU and UK data protection laws. Further information regarding our DPA and data privacy may be found here: https://www.box.com/gdpr. 1 If this order is executed by Customer or received by Box after the Service Start Date above, Box may adjust the Service Start Date based on the date Box provisions the products listed. 2 Please note: All future invoices and billing inquiries will be emailed to this contact. Unless otherwise set forth in this Order, during the Subscription Period Box will periodically assess Customer's usage of the products purchased herein. In the er for the number of additional products utilized by the Customer to be purchased by Customer on a prospective basis. Customer will either agree to said purchase or cease use of the additional products. Unless Premier Support is purchased under this order, SLC credits are not provided. Prices shown above do not include any taxes that may apply. Any such taxes are the responsibility of the Customer. This is an Order not an invoice. Notwithstanding anything to the contrary in the underlying agreement between the parties, any terms and conditions in any purchase order or similar documents issued by Customer shall be null and void. Box, Inc. 900 Jefferson Ave Redwood City, CA 94063 Executed Order must be received by: September 30, 2024 Service Order Q-00306782 Page 1 of 23 Box ServiceAgreement Public Sector BOX SERVICE AGREEMENT (v11092023USPS-C AKPZM) represents the terms and conditions enabling Box Reseller to provide the Box Service to a Customer that is a U.S. Government entity, state or local government entity, or higher education entity, and is entered into by and between Manufacturer Box Client Customer Party Parties This Agreement is effective and Customer agrees to be bound by its terms either upon execution by both Parties or Agreement Effective Date If Client is a US Government entity, the terms and conditions herein are hereby incorporated by reference to Law (e.g., the Anti- Deficiency Act (31 U.S.C. § 1341(a) (1) (B)), the Contracts Disputes Act of 1978 (41 U.S.C. § 601- 613), the Prompt Payment Act, the Anti-Assignment statutes (31 U.S.C. § 3727 and 41 § U.S.C. 15), 28 U.S.C. § 516 (Conduct of Litigation Reserved to Department of Justice (DOJ), and 28 U.S.C. § 1498 (Patent and copyright cases)). If Client is a state or local government or higher education institution, the terms and conditions herein are hereby incorporated by reference If Customer is not a part of the US Federal government, state or local government, or higher education institution, -current standard Box Service Agreement will govern the relationship between both Parties. If Customer is a U.S. Government entity, certain sections of this Agreement will rely on alternative clauses as enumerated in Section 15.13 below. Forgoodandvaluableconsideration, thereceiptandsufficiency ofwhich areherebyacknowledged, thePartiesagree as follows: Section 1. Definitions Capitalized terms not otherwise defined elsewhere in this Agreement shall have the following meaning: means the account(s) created by (a) a User for itself or (b) Customer on behalf of its Users, to access and/or use the Box Service. means a User designated by Customer with the authority to utilize the Administrative Console(s) to configure and manage the Box Instance, including the ability to create and manage Accounts associated with Customer. means the functionality within the Box Service that allows Customer to configure and manage the Box Instance, including User access, security settings, and other administrative functionality. means this BoxService Agreement (includingits Exhibits)together with all Orders and addenda which are entered into between Box and Customer. meanstheapplication-programminginterfacesusedbyCustomertoaccesscertainfunctionalityasprovidedby Box. means the virtual environment managed by Administrator which constitutes part oftheBox Service. BoxPersonnel means employees, agents, consultants, contractors and Subprocessors. Platform meanscertainfeaturesofthePlatformProducts thatpermitaPlatformServiceAccount,aUser, or Platform Application User to view, annotate and comment on Content using the Platform Products. means an entity that has entered into an agreement with Box or another Box Reseller that, among other things, authorizes the entity to resell any Box offering and, if applicable, provide certain services. Page 2 of 23 Box ServiceAgreement Public Sector means the cloud-based content collaboration software-as-a-service application provided by Box (including any Box Software) and subscribed to under an Order. from the or software, hardwareor other device(s) that allows a User to use certain functionality in connection with features of the Box Service. Box Zones -Multi) that enables specific Location(s) to be selected by Customer for in-region Content storage as provided by a Subprocessor. means the electronic file objects (excluding, for the avoidance of doubt, system data and metadata) means any and all domains (e.g. @acmeco.com) registered, owned or controlled by either Data Protection Legislation Economic Area and/or their member states, Switzerland and/or United Kingdom applicable to the Processing of Customer Personal Data under this Agreement, including the General Data Protection Regulation 2016/679. means a person who is permitted to access, store, retrieve or manage Content, using an email address that is not associated with a Customer Domain. Location(s) applicable order for Box Zones or (b) as otherwise made available to Customer. means viruses, worms, time bombs, Trojan horses and other malicious code, files, scripts, agents or programs. means a person whoispermitted to access, store, retrieveormanage Content, andisaCustomer employee or otherwise has been given access to, custody of, or control over an email address associated with a Customer Domain. or means a Platform Application User by or for whom, at least once in a calendar month, an application uses the Box Service to access a Platform means the total number of all API calls made by a Platform Application to the Box Service within a monthly calendar period on behalf of: (a) a Platform Application User; (b) a User; or (c) a Platform Service Account. means the separate document(s), including any Statement of Work, under which Customer purchases any Box offering pursuant to this Agreement and which has been agreed to in writing by the Parties or has been agreed to between Customer and Box Reseller. Personal Data means any information relating to an identified or identifiable individual. means any application used by or on behalf of Customer that uses API calls for the purposes of access to the Box Service or to access certain functionality as provided by Box. means a User (excluding Managed Users) with a unique identifier that is created and provisioned by Customer and whose access to Content in the Box Service is governed through an external-facing Platform Application. means the Box APIs that provide programmatic access to the Box Service from a Platform Application and any additional Platform Product features and functionalities as set forth in the applicable Order (e.g. Box Platform View and Platform Resources). a Platform Application, and usage resources, as may be specified in the applicable Order, including but not limited to Monthly Platform API Calls and Monthly Active Users. Page 3 of 23 Box ServiceAgreement Public Sector means a backend system-to-system connection with a unique identifier that is created and provisioned by or on behalf of Customer and its access to Content in the Box Service is governed through a Platform Application. means the total amount of Content stored by or on behalf of all Platform Application Users, Platform Service Accounts and any other users of Platform Products that may be released by Box from time to time. Platform Storage does not include the storage of Content by Managed Users. means, as may be specified in the applicable Order (or in accordance with the applicable subscription level set forth in the Order and subject to the product feature matrix): (i) Monthly Platform API Calls, number of Monthly Active Users; and (ii) any other usage limits or restrictions set forth in the Agreement, Box fair use policies, or applicable Order. Process(ing)meansanyoperationorsetofoperations whichisperformed upon information,including Content and Customer Personal Data, whether or not by automatic means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure, transmission, dissemination,encryption,decryption,orotherwisemakingavailable, alignmentorcombination, restriction,erasure or destruction. Level means the service level commitments set forth in ExhibitA. Subprocessor including Content, for the purposes of providing the Box Service and any associated services to Customer and its Users. means the duration of subscription to the Box Service commencing on the service start date of the Order and continuing for the period up to the service renewal date or end date as specified in the applicable Order. has themeaning set forth in Exhibit A. hasthemeaningsetforth inSection11.1. means, collectively, any Administrator, Managed User or External User. -current published document specifying the functionality of the Box Service that is made generally available by Box to its customers or its users. Section 2. Accessand Useofthe BoxService 2.1 Access Grants. 2.1(a) Box Service Subscriptions.Subject to the terms and conditions of this Agreement Box shall: (i) make the Box Service available to Customer during the applicable Subscription Period; (ii) allow Administrator(s) to access and use the Administrative Console to create and administer Accounts; and (iii) allow Users to store, retrieve, collaborate and share Content through the Box Service. Customer may only use the Box Service in accordance with the usage limits which may be found in either theOrder or the product feature matrix and correspond to the subscription level plan. Accounts for Managed Users even ifnot managed by an Administrator and any External User Accounts (sometimes referred to as account licenses or seats). Bo or deploy additional Accounts in excess of the usage limits. 2.1(b) API Access.Subject to the terms and conditions of this Agreement and fair use policy, Customer shall have a non-exclusive right during the applicable Subscription Period to incorporate the API into any Platform Application or application used by or on behalf of Customer for the sole purpose of accessing the Box Service or accessing certain functionality ofthe Box Service, provided thatsuch access islimited to theamount provided with Section 2.2 below. Page 4 of 23 Box ServiceAgreement Public Sector 2.1(c) Overages.Except as noted in Section 15.13, during the Subscription Period, Boxmay provideCustomer with areport identifyingthenumber of Users (or API calls, bandwidth orothertolled usage, if applicable) that, at any time, Expansion Service Order any event within fourteen (14) days of receiving such report) either: (i) execute the Expansion Service Order; or (ii) increase the usage limit through an alternate purchase method provided by Box (e.g. the function in the Administrative Console, if available to Customer);or (iii) permanently delete the excess Accounts or other applicable activity. 2.1(d) Feature Changes. Except as noted in Section 15.13, Box may add, remove, or modify the functionality or features ofthe BoxServiceor Box Softwarefromtime to time. Box will provideCustomer with at least as muchnotice of any material change to the Box Service or the Box Software as Box generally provides to its other commercial or enterprise customers. If, during the Term, Box generally provides such new or enhanced features or functionality in the Box Service at an extra charge, Box will make commercially reasonable efforts to promptly inform Customer of the availability of such features or functionality for purchase. 2.2 Acceptable Use of the Box Service.use of the Box Service shall conform with the allocations and amounts and the features and functionality of the Box Service plan subscribed to in the applicable Order (and as set otherwise commercialize any use of the Box Service. Customer agrees that it is solely responsible for Users and Content, andshallpromptly upon written noticefromBox provide reasonablesupport and timely removal of Content that Box reasonably believes includes a virus, malware or harmful code, is otherwise harmful or illegal, or for which Box has received a valid legal request to remove. Customer agrees not to use or permit the use of the Box Service: (a) to communicate any message or material that is defamatory, harassing, libelous, threatening, or obscene; (b) in a way that violates or infringes upon the intellectual property rights or the privacy or publicity rights of any person or entity; (c) in any manner that may be unlawful or give rise to civil or criminal liability, including but not limited to license to use Third Party Products (as defined below); (d) in any manner that is likely to damage, disable, overburden, orimpairtheBoxService,or interfereinanyway withtheuseorenjoymentoftheBoxServicebyothers; (e) to introduce any Malware or other malicious activity; (f) to modify, alter, tamper with, repair or otherwise create derivative works of the API or Box Software; (g) to reverse engineer, disassemble, decompile, or attempt to discover orrecreatethesourcecodeforanyAPIorsoftwareprovidedbyBox; (h)todisseminate fraudulentmaterials including but not limited to spam, junk mail, chain letters, pyramid schemes, spyware, adware, viruses, worms, or any other malicious code; (i) in violation of any applicable export law or regulation; or (j) to access or use the Box Service in a way intended to avoid incurring fees or hiding usage that exceeds usage limits or quotas if any. 2.3 Suspension of User Access to Service.Box may temporarily suspend any Account or remove or disable any Content which Box reasonably and in good faith believes is in violation of this Agreement or any applicable laws or regulations. For the avoidance of doubt, and unless otherwise provided for in the Agreement,to suspend anyAccount or remove or disable access to Content is on aUser-basis and does not extend to entire User base. BoxagreestoprovideCustomerwithreasonablenoticeofanysuchremoval,suspension,ordisablementbefore its implementation unless immediate removal, suspension, or disablement is necessary to comply with legal process, law, regulation, or in order to prevent imminent harm to the Box Service or any third party, in which case Box will notify Customer to the extent allowed by applicable law of such removal, suspension, or disablement, as soon as reasonably practicable thereafter. 2.4 Platform Resources. Customer shallhave the non-exclusive right during the applicable Subscription Period to utilize the Platform Products subscribed to by Customer under the applicable Order. Customer will ensure that its usage of the Platform Products is at all times in conformance with the applicable Order (including but not limited to any Platform Use Limit), the Agreement and applicable law. Except as otherwise set forth in the applicable Order, excluded from Monthly Platform API Calls are API calls made on behalf of: (i) third party software application integrations explicitly identified in the applicable Order; (ii) Box provided applications (e.g., the Box Web App, Box Desktop); or (iii) Box provided services (e.g. Box Shuttle), if applicable. Section 3. Non-Box Applications and Services. Customer or Users may choose to use optional third-party applications,servicesorproducts,whicharelicensedbytheirprovidertoCustomerorUsers,Third-PartyProducts Page 5 of 23 Box ServiceAgreement Public Sector in connection with the Box Service. Customer acknowledges that if Customer or Users choose to use any Third-Party Products in connection with the Box Service, Box will give effect to such instruction as needed and as it relates to the use of such Third-Party Products. Use of any Third-Party Products and any exchange of any information between Customer or User and a third-party provider of a Third-Party Product is solely between Customer and the applicable third- -Party Products. Section 4. Content Security; Data Privacy 4.1 Security. During the Term of this Agreement, Box will implement and maintain commercially reasonable administrative, physical and technical safeguards and measures to protect against unauthorized access to Content. Boxwillprovideacurrentdescriptionofsuchsafeguards upon writtenrequest.ServiceOrganization Control1 SOC1 and ServiceOrganization Control2 SOC2 TypeIIaudit reports (orsubstantiallysimilarindustry- Audit Reports will maintain the Audit Reports during the Term and will provide a copy to Customer once per year upon written request.Duringthe Term, Box will not materially diminish theoverall protection provided bythecontrols and the recent Audit Reports in effect as of the Agreement Effective Date. Box has no liability to Customer or any third party for any reason as a result of any unauthorized disclosure or access to Account or Content as a result 4.2 Content Storage Location.The Box Service is provided from the United States and Content is stored in the United States. Notwithstanding the foregoing, Customer understands that nothing herein prohibits: (a) Users from accessing the Box Service, including Content, outside of the United States (subject to applicable law); and (b) Processing information outside of the United States by Box. 4.3 Data Protection and Onward Transfer of Data.In the course of providing the Box Service, Box may Process Customer Personal Data instructs Box to Process Customer Personal Data: (a) to provide the Box Service (in accordance with the features and functionality of the Box Service); (b) to enable User initiated actions on the Box Service; (c) as set forth in the Agreement or applicable Order; and (d) as further documented by a mutually agreed upon written instruction given by Customer and accepted by Box. The Parties agree to comply with the applicable Data Protection Legislation (as defined below) for onward transfer of Customer Personal Data. Box will maintain, during the Subscription Period, a legally recognized method for onward transfer of Customer Personal Data such as Binding Corporate Rules for Processors, (each as defined under Data Protection Legislation) or other substantially similar mechanism as may be required by applicable law. 4.4 In-Region Data Storage and Processing.Subject to the purchase ofBox Zones or other required Box products as applicable, Box agrees to applicable Order. Customer understands and agrees that:(i)designated Locations supersedeSection 4.2 above; and (ii) whileContent will be stored and may be partially processed in the Location(s), some Processing and metadata storage and provisioningofBoxZoneswillbestoredintheLocation(s)specified in theapplicable Order.Content generatedbefore the Location(s) specified in the applicable Order. The certifications ofthe subprocessor(s) used to provide Box Zones may vary based on selected Location(s). It Administrator(s) may designate and manage, at any time during the Subscription Period, the Location for each properly utilize the Box Service and Box Zones to address its obligations related to data types and compliance obligations. To the extent there are multiple Locations, Customer must ensure that each Managed User and Administrator is mapped to a Location at all times during the Subscription Period. For avoidance of doubt and notwithstanding the foregoing, Content storage locations follow the ownership of the folder in which Content is stored in the Box Instance. Page 6 of 23 Box ServiceAgreement Public Sector Section 5. Customer Responsibilities 5.1 Establishment ofAccounts.Customer willpromptly appoint an Administrator andsuch Administratorshall beresponsiblefor: (a) configuring thesettingsofthe BoxService, (b) managinganyCustomerdevices and systems, (c) assigning and managing Accounts, (d) reviewing service notifications that Box provides through the Administrative Console, and (e) enforcing and managing User access controls and permissions in accordance with own policies and applicable law and regulations.For the avoidance ofdoubt, Accounts can beprovided Customer will ensure that Managed Users do not share their password with any other person or permit any other person to log on as such Managed User. Customer is advised to implement multi-factor authentication on its Accounts and encryption keys as applicable. Customer shall ensure that each of its Users has an Account and may not create shared accounts or user accounts tied to generic email addresses unless all Users with access to those accounts also have their own respective Accounts. Customer may provision Accounts for Users that are not Customer employees in compliance with the terms ofthe Agreement; however, ifan Account is associated with an email address controlled by another Box customer, then Box may require the migration of the Account (excluding 5.2 Content.Customer will: (a) be solely responsible for the nature, quality and accuracy of the Content; (b)ensure that the Content complies with the terms of this Agreement and all applicable laws and regulations; (c)promptly handle and resolve any notices and claims relating to the Content (e.g. take-down notices pursuant to the Digital Millennium Copyright Act); and (d) ensure that it has the rights to the Content in order to grant Box the rights contemplated by this Agreement. Notwithstanding anything to the contrary, Box has no liability to Customer or any third party for any reason as a result of: (i) any unauthorized disclosure or access to an Account or Content except to the extent resulting from negligence or willful misconduct; (ii) any deletion, destruction, damage or loss of Content caused by or at the direction of Customer or a User; or (iii) any failure of Customer to maintain adequate security or virus controls in any devices used to access the Box Service. 5.3 Notification of Unauthorized Use.Customer will promptly notify Box in writingofany unauthorized use of anyAccount, ContentortheBox Servicethat comesto attention. Intheeventofanysuchunauthorized use by a third party that obtains access to the Box Service directly or indirectly through Customer or any User, Customer will take all steps within control as reasonably necessary to terminate such unauthorized use and will provide Box with such cooperation and assistance related to any such unauthorized use as Box may reasonably request. 5.4 Platform Application Restrictions. If Customer utilizes a Platform Application with the Box Service, then Customer will not, and will ensure that any Platform Application does not, promote, constitute or contain (nor will Customer use or permit use of the Platform Application to transmit) any Content in violation of Section 2.2. Customer will not, and will ensure that the Platform Application does not (nor will Customer permit use of the Platform Application to): i.Install software: (i) to perform hidden activities without Platform Application User consent, (ii) that as a hidden component of other software or otherwise without express Platform Application User consent; ii.Impersonate, or misrepresent an affiliation with, any person or entity; iii.UseinanymannernotauthorizedbyaPlatformApplication User, iv.Except as otherwise authorized by a Platform Application User with respect to such Platform Application Content, mine or analyze any Content transmitted to, retrieved from or stored in the Platform Products/Box Service (including, but not limited to, through spiders, robots, crawlers, data mining tools, scrapers, or other automated means, or services employing any such means); v.Circumvent any security measures or content filtering devices; vi.Engage in any activity or conduct that is deceptive, unfair or harmful or that violates therights ofBox or any third party; Page 7 of 23 Box ServiceAgreement Public Sector vii.Useor affect the Platform Products in any manner that could damage, disable, overburden or impair the Platform Products or its functionality or negatively affect or interfere with users use and enjoyment of the Platform Products or disrupt the normal flow of traffic any Box website (including, but not limited to, floodingthePlatformProducts with an excessiveamount ofdata or content);and viii.Violate any law, rule or regulation or generally accepted industry standards or guidelines, including but not limited to laws pertaining to intellectual property rights, privacy and publicity. 5.5 Customer Encryption. i. Customer shall: (a) comply with the then-current technical documentation applicable to KeySafe KMS; and (b) provide Box with information sufficient to enable setup and support for KeySafe KMS, which information includes, but is not limited to encryption key ID, access key and secret access key. ii.Customer understands and agrees that the functionality of KeySafe KMS requires Customer to contractwith a third-party data hostingpartner In order forCustomer touse KeySafeKMS, priorto implementation, Customer mustseparatelypurchasea licensesubscription dedicated solely to KeySafe KMS from a Box approved third party Hosting Partner. Box is not products or services. termsforsuchsubscriptionasagreeduponbytheCustomer andtheHostingPartner.Intheevent Customer wishes to discontinue its use ofKeySafe KMS but maintain access to Content in the Box Service, Customer understands and acknowledges that it will need to maintain an active account of KeySafe KMS and any applicable subscriptions with Hosting Partner and Box until all Content has been re-keyed (i.e., the process for changing one encryption key to another) to no longer require a Customer-controlled encryption key. iii.During the Subscription Period, Customer shall ensure ithas appropriatetechnical resources with KeySafe KMS experience Customer such that Customer can provide a 24/7 technical liaison with Box with respect to KeySafe KMS. Customer shall provide Box with the contact information including email and phone number of its Technical Customer Contact(s) and ensure Box is notified immediately should such information change. iv.Customer understands and agrees that deploying KeySafe KMS requires detailed process design, planning, governance, support and additional training and requires the separate purchase of professional and training services from Box. v.Customer represents and warrants to Box that Customer has proper rights, access methods, support and permission to any application that will be integrated with the Box Service to enable KeySafe KMS, including but not limited to the Hosting Partner. vi.Customer understands and acknowledges that certain functionality of the Box Service may be limited as a result of implementation of KeySafe KMS as described in the KeySafe KMS technical documentation. For the avoidance of doubt, Hosting Partners and their provision of products or services (as applicable) constitute Third-Party Products under this Agreement. 5.6 Box Sign.In the Box Sign will be solely responsible for determining whether (a) the features of Box Sign as specified in the User Guide are apply to use of Box Sign for the category of documents and transactions intended for such use; and (c) configuration and useofBoxSign (includingthe useofany defaultdisclosures)complies withsuch laws, regulations, or other requirements. Signed agreements and signature logs are created during the Box Sign process after a final recipient's successful completion ofa signature request. Customer has thesoleresponsibility to ensure its signed agreements and signature logs are maintained appropriately. Page 8 of 23 Box ServiceAgreement Public Sector 5.7 BoxAI. i.Customer is solely responsible for the production and retention of outputs using Box AI in compliance with the Agreement, the then-current Box AI Acceptable Use Policy & Guiding Principles,andallapplicablelaws.AlloutputgeneratedbyBoxAIiscreatedatthe direction and is stored in Content at the sole discretion. Box AI outputs are not human generated or filtered by humans and cannot be represented by Customer as human work product. Box is not responsible for the accuracy or biases of the output or reliance on Box AI output. Box ii.A User direction to process a Box AI query qualifies as Customer consent for the modification, aggregation, deidentification or other Processing of Confidential Information for purposes of generating output. Notwithstanding the above, Box does not include queries or outputs in its system logs and will not train Box AI using Customer queries or outputs. iii.To the extent Users enter personal data or other sensitive information subject to regulatory oversight in BoxAIqueries, Customer and not Box has sole responsibility for providinganylegally adequate privacy notices and obtaining any necessary consents for such Processing. Section 6. SupportandServiceLevelCommitments.ForCustomerswhohavepurchasedasubscriptionplan for the Box Service that includes additional support entitlements (e.g. Enterprise Plus), the Support Services and Service Level Commitments for the Box Service during the Subscription Period are identified in the Order. For all other Customers, or if the Order does not include a reference to Support Services, Exhibit A to this Agreement sets forth the Support Services and the Service Level Commitments for the Box Service during the Subscription Period. Customer will be responsible for supporting any Platform Application that Customer chooses to deploy and shall provide such support directly to Platform Application Users, Box will not provide Support Services to Platform Application Users, and Box is not responsible for any Downtime, Issues or other performance issues to the extent attributable to a Platform Application. Section 7. Warranty and Disclaimer 7.1 Box Service Warranty.Box warrants that, during the Subscription Period, the Box Service purchased under the applicable Order will perform substantially in accordance with the functions specified in the User Guide when used in a manner that conforms to the terms and conditions of this Agreement and the User Guide. Subject to the entire liability for a breach of this warranty shall be for Box to use commercially reasonable efforts to modify the Box Service to substantially perform the functions specified in the User Guide. If Box is unable to restore such material functionality, subject to the notice and cure provisions of Section 11.3 (Termination for Cause), Customer shall be entitled to terminate the applicable Order and receive a pro-rated refund of the fees pre-paid by Customer for the corresponding unused portion of the Subscription Period. The warranties set forth herein are made to and for the benefit of Customer only. 7.2 Additional and Mutual Warranties.Box will comply with all laws and regulations applicable to the provision of the Box Service. Customer will comply with all laws and regulations applicable to its use of the Box Service and to Content.EachPartyrepresentsandwarrantstotheotherthat:(a)thisAgreementhasbeendulyauthorized,executed and delivered and constitutes a valid and binding agreement enforceable against such Party in accordance with its delivery or performance of this Agreement; and (c) the execution, delivery and performance of this Agreement does not violate the terms or conditions of any other agreement to which it is a party or by which it is otherwise bound. 7.3 DisclaimerofWarranties. EXCEPTASPROVIDEDINTHIS SECTION 7ANDSECTION 9.3(CONSULTINGSERVICES WARRANTY), AND TO THE EXTENT NOT PROHIBITED BY APPLICABLE LAW, NEITHER PARTY MAKES ANY (AND EACH PARTY SPECIFICALLY DISCLAIMS ALL) REPRESENTATIONS, WARRANTIES OR CONDITIONS OF ANY KIND, WHETHER EXPRESS, IMPLIED, STATUTORY OR OTHERWISE, INCLUDING, WITHOUT LIMITATION, REPRESENTATIONS, WARRANTIESORCONDITIONS:(A)ARISINGOUTOFANYCOURSE OFPERFORMANCE, COURSE OFDEALINGOR USAGE OF TRADE; (B) OF: (I) SATISFACTORY QUALITY; (II) FITNESS FOR A PARTICULAR PURPOSE; (III) NON-INFRINGEMENT; OR (IV) INTEROPERABILITY WITH THIRD-PARTY PRODUCTS OR SERVICES; (C) THAT THE BOX SERVICE WILL BE Page 9 of 23 Box ServiceAgreement Public Sector UNINTERRUPTED, ERROR-FREE OR FREE OF HARMFUL COMPONENTS; AND (D) THAT THE CONTENT WILL BE SECURE OR NOT OTHERWISE LOST OR DAMAGED. SOME JURISDICTIONS DO NOT ALLOW THE EXCLUSION OF IMPLIED WARRANTIES. IN SUCH AN EVENT, THE ABOVE EXCLUSION WILL NOT APPLY SOLELY TO THE EXTENT PROHIBITED BY LAW. Section 8. ProprietaryRights 8.1 ContentOwnershipbyCustomer.Asbetween Customer andBox,Customeroritslicensors own allright, title and interest in and totheContent. Customer hereby grants Box theright to Process Content solely to providetheBox Service to Customer or any User or pursuant to this Agreement. 8.2 Ownership of Box Service by Box.As between Box and Customer, Box or its licensors own and reserve all right,titleand interest in and to, includinganyimprovements orderivatives,theBoxService, theBox marks andother items used to provide the Box Service, other than the access rights expressly granted to Customer in Section 2.1 (Access Grant). No titleto or ownership ofanyproprietary rights related totheBox Service istransferred to Customer or any User pursuant to this Agreement. All rights not expressly granted to Customer are reserved by Box. Box reserves theright, in its reasonable discretion and with notice to Customer, to change or require Customer to change its Box Service user ID and any custom or vanity URLs, custom links, or vanity domains Customer may obtain through the Box Service. In the event that Customer makes suggestions regarding any features, functionality or performance that Box adopts for any of its products including the Box Service (expressly excluding Customer Confidential Information), such features, functionality and performance shall be deemed to be automatically assigned under this Agreement to Box, and shall become the sole and exclusive property of Box. Customer may not use any Box trademarks, logos, or other Box marks in connection with its use or deployment of the Box Service without the prior written consent of Box. Section 9. Trainingor ConsultingServices 9.1 GeneralTerms.Customer may wish to receive certain services of a professional, educational, operational or Consulting Services), as further described in a mutually agreed upon Statement of Work SOW orasotherwiseoutlinedintheapplicableOrder.EachSOWwillinclude,ataminimum:(a)adescription ofthe ConsultingServices and any Box Materials (as defined below) to be provided to Customer; and (b) the scopeof the Consulting Services. 9.2 Box Materials.Box shall own all rights, title and interest in and to the documentation, templates, training Box Materials to Customer as part of the Consulting Services (including any intellectual property rights therein, but excluding any Customer Confidential Customer Property Property solely for the purpose of providing the Consulting Services to Customer as set forth in the SOW. During the Term of the Agreement, Box hereby provides Customer with a royalty free, limited, non-exclusive, non-sublicensable, non-transferable and terminable license to s authorized use of the Box Service. For the avoidance of doubt, Box shall own all intellectual property rights in the proprietary tools, libraries, know-Box Tools Nothing herein shall be construed to assign or transfer any intellectual property rights in the Box Tools used by Box to develop the Box Materials, and to the extent such Box Tools are delivered with or as part of the Box Materials, they are licensed, not assigned, to Customer, on the same terms as the Box Materials. 9.3 Consulting Services Warranty.In regard to Consulting Services only, Box warrants that: (a) Box and any Box Personnel,thatprovidesandperformsConsultingServiceshereunder hasthenecessaryknowledge,skills,experience, qualifications, and resources to provide and perform the Consulting Services; and (b) the Consulting Services will be performed for and delivered to Customer in a professional and workmanlike manner. If through no fault or delay of Customer the Consulting Services do not conform to the foregoing warranty, and Customer notifies Box in writing within seven (7)days of delivery ofthe Consulting Services, Box will re-perform the non-conforming portions of the Consulting Services at no cost to Customer. 9.4 PlatformConsultingHours.IfCustomerorders BoxPlatform ConsultingHours thefollowingterms apply and take precedence over the Datasheet or SOW which describes the BPCH: Page 10 of 23 Box ServiceAgreement Public Sector i.BoxandCustomer will workjointly todetermine howBPCH willbeallocated. BPCH areconsumed as used and can apply to any activity related to topics at hand including, without limitation, research, guidance, meetings, phonecalls, emails, and development. Box reserves the right in its sole discretion to reject any request for work if Box reasonably believes such work is outside of thetypesofservices customarily provided by Box.Withoutlimitation, BPCH maybeconsumed by Box in preparing for meetings, conducting research, working on offline configurations and other action items. ii.Any project hour allocations are not commitments to provide specific results. Any projects listed in an Order, SOW, Rider or other applicable document may not have been fully scoped and there is no assurance that work identified by Customer for Box to complete will be completed with the BPCH purchased (or even that such work can be completed at all). If any work requested by Customer exceeds its available BPCH, Customer will purchase additional BPCH before work can continue or is completed. The cost of additional BPCH, if required, may not be at the same rate as in the Order. iii.To the extent Box is providing any object code or source code to Customer as part of the BPCH (e.g.scripts, customAPIs,or othersolutions), suchmaterials (collectively,areproprietary to Box. Box retains all ownership and intellectual property rights to Code. Any BPCH allocated for Code shall be used exclusively for the development, editing, and managing of the project contemplated by the Parties at the time of Order. Any additional use must be mutually agreed to in writing by and between the Parties (email to be sufficient). iv.Customer may not modify the Code, including but not limited to any use of Box marks or notice of proprietary rights.Customer maynot maketheCodeavailablein anymanner to anythird permit reverse engineering (unless required by law for interoperability), disassembly or decompilation of the Code. Customer may not disclose results of any use of Code, including but consent. v.Box provides Code on an as-is basis and makes no representations or warranties or conditions, whether express or implied (e.g. merchantability, quality, fitness for a particular purpose, interoperability, and non-infringement), regarding the Code or the performance of the Code in any way. Box does not guarantee that the Code will perform error-free or uninterrupted. vi.Any services acquired from Box are purchased separately from the use of Code, and no services acquired from Box require the use of Code. Section 10. Feesand Payment 10.1 Fees.CustomeragreestopayallfeessetforthonallOrders (andtotheextentCustomerisaninstrumentalityof the United States, in accordance with the GSA Schedule Pricelist unless otherwise indicated in an agreement between Customer and Box Reseller)and as otherwise required under this Agreement. Any additional Order(s) for User subscriptions or products will be coterminous with the existing Subscription Period. Unless otherwise specified in an Order, all fees and other amounts are payable in United States Dollars. 10.2 Non-refundable and No Cancellation.If Customer is an instrumentality of the United States government, Section 10.2 does not apply. If Customer is not an instrumentality of the United States government, except as specifically set forth in this Agreement, all payment obligations under all Orders are non-cancelable and all payments made are non-refundable. 10.3 Invoicing and Payment Terms.Unless otherwise specified in the applicable Order, Customer will pay all fees within thirty (30)days ofthedatetheapplicableinvoice is received by Customer. Inthe event Customer disputes any invoiced fees, Customer should provide written notice of the disputed amount within fifteen (15) days after the date of such invoice and timely pay any undisputed portion of such invoice. The Parties will cooperate in good faith to resolve any disputed invoice or portion thereof within fifteen (15) days of notice of dispute. All amounts payable by Customer under this Agreement will be made without setoff and without any deduction orwithholding. Page 11 of 23 Box ServiceAgreement Public Sector amounts may accrue a late fee equal to the interest rate established by the Secretary of the Treasury as provided in 41 U.S.C. 7109, which isapplicabletotheperiod in whichtheamount becomes due,and then attherate applicablefor eachsix-monthperiodas fixedbytheSecretaryuntil theamountispaid. 10.4 Taxes.When the Customer is an instrumentality of the United States government, Box shall state separately on invoices taxes excluded from the fees, and the Customer agrees either to pay the amount of the taxes (based on the current valueof the equipment) or provide evidence necessary to sustain an exemption, in accordance with 552.212- 4(k). 10.4.1 If Customer is not an instrumentality of the United States government, to the extent consistent with GSA Schedule Contract Clause 552.212-4(k), 52.229-1, 552.229-70 and, 552.238-101, all Orders pursuant to this Agreement do not include any transaction taxes, which may include local, state, provincial, federal or foreign taxes, levies, duties or similar governmental assessments of any nature, including, but not limited to, value-added taxes VAT General Taxes Taxes with fees due pursuant to this Agreement and Orders, excluding income taxes imposed on Box. If Box has a legal obligation to pay or collect Taxes (expressly excluding Box income tax) for which Customer is responsible under this A and Customer confirms that Box can rely on the sold-to name and address set forth in theOrder(s) as being the place of supply for sales tax purposes. Such Taxes will be invoiced to and paid by Customer. If Customer is legally entitled to an exemption from the payment of any Taxes, Customer will promptly provide Box with legally sufficient tax exemption certificates for each taxing jurisdiction for which it claims exemption. Unless otherwise prohibited by law, Box will apply the benefits of any requested tax exemption to charges incurred by Customer after the date Box receives and reasonably processes such tax exemption certificates. 10.5 Non-Payment. If Customer is an instrumentality of the United States government, pursuant to the requirements of FAR 52.233-1, Box shall submit any claims to the contracting officer if it believes the Government to be in breach of its payment obligations and continue performance during the pendency of the claim. 10.5.1 If Customer is not an instrumentality of the United States government, and any invoices are more than sixty (60)days pastdue(except withrespecttochargessubjecttoareasonableandgoodfaithdisputeassetforthinSection 10.3(InvoicingandPaymentTerms)),in addition to any other rights or remedies it may haveunder this Agreement or by applicable law, Box reserves the right to suspend access to the Box Service upon written notice, without liability to Customer, until such past due amounts are paid in full. 10.6 Purchases Through Box Resellers.If Customer places an Order for the Box Service from a Box Reseller, any terms hereinrelatedtoordering, invoicing,refunds,or credits donotapply.Customermustestablish suchterms with Box Reseller. For the avoidance of doubt, nothing herein affects suspension rights or deactivation rights for Box or a Box Reseller provided for in this Agreement. Section 11. TermandTermination 11.1 Term of Agreement.This Agreement will commence on the Agreement Effective Date and will remain in effect for as long as there is an Order in Term unless otherwise terminated as provided for in Section 11.3 (Termination for Cause) and Section 11.4 (Termination for Insolvency) below. 11.2 Term of Order and Renewal.Except as noted in Section 15.13, each Order placed under this Agreement will be in effect for a period of one (1) year from the service start date of theOrder unless otherwise agreed in the Order. Thereafter,unlesstheAgreementisterminatedas providedherein, theOrder(s) mayberenewed forthesameperiod of timeasthe SubscriptionPeriodof thepriorOrder byexecutingawritten orderforthe successiverenewalterm.If theinitial Subscription period is longer than one (1) year, the usage limit and pricingfor the renewal subscription period will be the same as in the last year of the Subscription Period, excluding any provisions in the Order (e.g. overage grants) applicable to the initial Subscription Period only. 11.3 Termination forCause.WhentheCustomerisan instrumentality oftheUnitedStates government, recourse Page 12 of 23 Box ServiceAgreement Public Sector against the United States for any alleged breach of this Agreement must be brought as a dispute under the contract Disputes Clause (Contract Disputes Act). During any dispute under the Disputes Clause, Box shall proceed diligently with performanceofthis Agreement, pendingfinal resolution ofany request for relief, claim, appeal, or action arising under the Agreement, and comply with any decision of the Contracting Officer. 11.3.1 If Customer is not an instrumentality of the United States government, to the extent consistent with GSA Schedule Contract Clause GSA Schedule Contract Clause 552.238-114 Use of Federal Supply Schedule Contracts by Non-Federal Entities, either Party may te the other Party of a material breach of this Agreement if such breach remains uncured after the expiration of such period. 11.4 Reserved. 11.5 Termination for Non-Appropriation. The Agreement may depend upon the continued availability of appropriated funds and expenditure authority from a legislature for this purpose. If, for any reason, the legislature fails to appropriate or grant expenditure authority or funds become unavailable by operation of law or federal funds -the Agreement may be terminated by Customer. Customer shall provide as much advance notice as possible to Box of any Non-Appropriation. As of the Effective Date of each Order, Customer (i) has confirmed it has sufficient expenditure authority to enter into any Order referencing this Addendum, (ii) shall not terminate the Agreement under this section in order to purchase a substitute for the Box Service, and (iii) does not have reason to anticipate any such Non-Appropriation. 11.6 Post-Termination Obligations.Upon the termination or expiration of this Agreement for any reason, Customer will have no further rights to access the Box Service hereunder except as set forth in this Section 11.5. For thirty (30) prior written request, Box will allow Customer limited access to retrieve any Content remaining on the Box Service. After such thirty (30) day period, Customer will have no further rights to access the Box Service. 11.7 Surviving Provisions.Upon any expiration or termination ofthis Agreement, the following sections will survive: Sections 1 (Definitions), 5.2 (Content), 7.3 (Disclaimer of Warranties), 8 (Proprietary Rights), 10 (Fees and Payments), 11.5 (Post Termination Obligations), 11.6 (Surviving Provisions), 12 (Indemnification), 13 (Limitation of Liability), 14 (Confidentiality) and 15 (Miscellaneous). Section 12. Indemnification 12.1 IndemnificationbyBox. Box will havetherighttointervenetodefend Customer against any third-party claim that the Box Service infringes a registered patent, registered trademark, or copyright of a third party, or misappropriates Claim Against Customer awardedagainstCustomer to suchthirdpartybyacourtofcompetentjurisdictionoragreedtoinsettlement. Boxwill have no liability to Customer under this Section 12.1 for any Claim Against Customer that arises out of: (a) any unauthorized use, reproduction, or distribution of the Box Service by Customer; (b) use of the Box Service in combination with any other products, technology, process, software or equipment not supplied by Box nor explicitly supported in theUser Guide if such Claim Against Customer would have been avoided without such combination; or approval of Box. In the event of and expense): (i) obtain for Customer the right to continue using the Box Service; (ii) modify the Box Service to make it non-infringing; or (iii) if subsections (i) and (ii) are not commercially viable (as determined by Box in its sole discretion), terminate this Agreement, in which case Customer will be entitled to a pro-rated refund of any fees pre- paid by Customer for the corresponding unused period of the applicable Subscription Period. Nothing contained hereinshallbeconstruedinderogationoftheU.S.Department of rightto defendanyclaimoractionbrought against the U.S., pursuant to its jurisdictional statute 28 U.S.C. §516. 12.2 Indemnification byCustomer.When the Customer is an instrumentality of the United States government, Section 12.2 of this Agreement does not apply. 12.2.1 If Customer is not an instrumentality of the United States government, Customer willdefend Boxagainst any Page 13 of 23 Box ServiceAgreement Public Sector third-party claim that use of the Box Service is (a) in breach of Section 2.2 (Acceptable Use of the Box Service) of this Agreement; or (b) infringes a registered patent, registered trademark, or copyright, or misappropriates a trade secret (to the extent that such infringement or misappropriation is not the result of actions). Customerwill,withrespecttoanyclaimagainstBoxthatissubject tothisSection 12.2,indemnify Boxforthe resulting costs and damages finally awarded against Box to such third party by a court of competent jurisdiction or agreed to in settlement. 12.3 Indemnification Process.As a condition of receiving an indemnification under this Agreement, the Party seeking Indemnified Party Indemnifying Party prompt written notice of the claim, provided, however, that the failure to give such notice shall not relieve the Indemnifying obligations hereunder except to theextent that theIndemnifying Party is prejudiced bysuch failure; (b) except as noted in Section 15.13 or otherwise as prohibited by applicable, complete control over the defense and priorwritten permission ifthe settlement fails to unconditionally releasetheIndemnified Party fromallliability pertaining to such claim, such permission not to be unreasonably withheld, delayed or conditioned);and (c) such assistance in connection with the defense and settlement of the claim, at expense,as the Indemnifying Party may reasonably request. 12.4 Exclusive Remedy. Indemnifying sole liability to, the other Party for any type ofclaim under this Section 12. Notwithstanding the foregoing, each Party will have the right to terminate this Agreement pursuant to Section 11.3 (Termination for Cause), to the extent the event giving rise to indemnification constitutes a material breach of this Agreement. Section 13. Limitation of Liability 13.1 Limitation of Liability.TO THE EXTENT NOT PROHIBITED BY LAW, THIS AGREEMENT EXCEED THE TOTAL FEES PAID BY CUSTOMER TO BOX (OR TO A BOX DISTRIBUTOR OR BOX RESELLER, IF APPLICABLE) FOR THE BOX SERVICE IN THE TWELVE (12) MONTHS PRECEDING THE DATE OF THE FIRST EVENT WHICH GIVES RISE TO LIABILITY UNDER THIS AGREEMENT. THE FOREGOING LIMITATION DOES NOT LIMIT OR EXCLUDE ANY LIABILITY FOR DEATH OR PERSONAL INJURY CAUSED BY NEGLIGENCE, OR FRAUD. 13.2 Disclaimer of Consequential and Related Damages.IN NO EVENT WILL EITHER PARTY BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, PUNITIVE, COVER, LOSS OF PROFITS OR REVENUE, OR CONSEQUENTIAL DAMAGES (INCLUDING, WITHOUT LIMITATION, LOSS OF GOODWILL OR LOSS OR USE OF DATA) HOWEVER CAUSED, WHETHER BASED IN CONTRACT, TORT, WARRANTY, NEGLIGENCE OR ANY OTHER THEORY OF LIABILITY, EVEN IF SUCH PARTY HAS BEEN ADVISED AS TO THE POSSIBILITY OF SUCH DAMAGES. SOME JURISDICTIONS DO NOT ALLOW THE EXCLUSION OF INCIDENTAL, CONSEQUENTIAL OR OTHER DAMAGES. IN SUCH AN EVENT THIS EXCLUSION WILL NOT APPLY TO THE EXTENT THE EXCLUSION IS PROHIBITED BY LAW. Section 14. Confidentiality 14.1 Definition.Either Party may disclose Confidential Information to the other Party during the Term of this Agreement.ConfidentialInformation meansallinformation disclosedbyoneParty DisclosingParty totheother Receiving Party understood to be confidential given the nature of the information and the circumstances of the disclosure. The following information will be considered Confidential Information whether or not marked or identified as such: (a) product designs and architecture, technology and technical information, security processes, security audit reviews, business and marketing plans, and business processes. Confidential Information will not include information that as disclosure by the Disclosing Party; (ii) was disclosed to the Receiving Party by a third party who had the right to make such disclosure without any confidentiality restrictions; (iii) is, or through no fault of the Receiving Party has become, generally a Confidential Information. 14.2 Protection.The Receiving Party will use no less than a reasonable standard of care to safeguard the Confidential Information received from the Disclosing Party. The Receiving Party will only use the Confidential Page 14 of 23 Box ServiceAgreement Public Sector Information of the Disclosing Party: (a) to exercise its rights and perform its obligations under this Agreement; or (b) as otherwise required by law. Box Personnel with access to Customer Confidential Information shall at all times be subject to confidentiality obligations no less restrictive than those in this Agreement. 14.3 Permitted Disclosure.Neither Party will disclose Confidential Information in violation of the terms and conditionsofthisAgreementtoanythirdpartywithouttheprior writtenconsentoftheotherParty. Notwithstanding theforegoing, each Party may discloseConfidentialInformation withouttheprior written consentoftheotherParty: (a) as compelled by law provided that, to the extent legally permissible, the ReceivingParty gives the DisclosingParty Party seeks to contest such disclosure; (b) in confidence to its legal counsel; (c) in connection with the enforcement of rights or performance of obligations under this Agreement; or (d) to respond to an emergency which Box believes in the good faith requires Box to disclose information to assist in preventing the death or serious bodily injury of any person.Notwithstandingtheforegoing,theReceivingPartymaydiscloseConfidentialInformationexpresslyexcluding Content (x) in confidence to its accountants, banks and financing sources, partners, providers and their advisors; and(y) in confidence, in connection with an actual or proposed merger, acquisition, or similar transaction. Customer -current S Customer provides the Box SOC2 Type II report to its customers for the solepurpose of evaluating the security of the a written agreement in place with its customerswithwhichitissharing SOC2TypeIIreportsufficienttorequiresuchcustomerstoprotect SOC2 Type II report as confidential terms that are no less restrictive than those in this Agreement; and (iii) Customer 14.4 Open Records Requests. Any provisions herein that require the Customer to keep certain information confidential are subject to the Freedom of Information Act, 5 U.S.C. § 552, or as applicable, functionally equivalent legislationatthestatelevel, andanyapplicableorderbya UnitedStatesFederalCourtorstatecourtwithappropriate jurisdiction. To the extent permitted by law, and as applicable, the Parties acknowledge that such obligations shall be discharged under Section 14.3 (Permitted Disclosure) of the Agreement, and Customer shall provide Box an opportunity to provide Customer with a redacted version of any Confidential Information including but not limited to this Agreement that is redacted in a manner that comports with applicable disclosure requirements. Customer will request such redacted version when compelled to produce Confidential Information and provide such redacted reversion to any third-party requester unless otherwise required by applicable law. Section 15. Miscellaneous 15.1 Contractual Relationship.The Parties are entering into this Agreement as independent contracting parties. Neither Party will have, or hold itself out as having, any right or authority to incur any obligation on behalf of the other Party. This Agreement will not be construed to create an association, jointventure or partnership between the Parties or to impose any partnership liability upon any Party. 15.2 Anti-Bribery.Customer agreesthatithasnotreceived orbeenoffered anyillegalor improperbribe,kickback, payment, gift, or thing of value from any of Box Personnel in connection with this Agreement. Customer will use reasonable efforts to promptly notify Box at legalops@box.com should Customer learn of any violation of this restriction. 15.3 References. Except as provided in Section 15.13, during the Term of the Agreement, Box may reference CustomerasaBoxcustomerinsalesandmarketingmaterialsandpublicstatements, subjectto trademark and logo usage guidelines as provided to Box. Customer may send Box an email to stories@box.com if it does not wish to be used as a reference. 15.4 Ambiguities.Each Party has participated in the review of this Agreement. Any rule of construction to the effect that ambiguities are to be resolved against the drafting party shall not apply in interpreting this Agreement. The language in this Agreement shall be interpreted as to its fair meaning and not strictly for or against any party. 15.5 Notices. Any notice or other communication under this Agreement given by any Party to any other Party will beinwritingandwillbeeffectiveupondeliveryasfollows:(a) iftoCustomer, whensentviaemailtotheemailaddress specified in an Order or otherwise on record for Customer; and (b) if to Box, when sent via email to legalops@box.com. Any such notice, in either case, must specifically reference that it is a notice given under this Agreement. The Parties agree that only versions of this Agreement and notices provided in the English language are Page 15 of 23 Box ServiceAgreement Public Sector validand control.Any documents providedinlanguages other than English maybeusedforeaseofreferenceonly. 15.6 Nonwaiver.The failure of either Party to insist upon or enforce strict performanceof any of the provisions of this Agreement or to exercise any rights or remedies under this Agreement will not be construed as a waiver or relinquishment to any extent ofsuch right to assertor rely upon anysuchprovision, right or remedy in that or any other instance; rather, the same will remain in full force and effect. 15.7 Assignment.Except as noted in Section 15.13 below, Customer will not, directly, indirectly, by operation of law or otherwise, assign or transfer all or any part of this Agreement or its rights hereunder without the prior written consent of Box. Any attempted assignment or transfer by Customer without such consent shall be void and of no effect.Notwithstandingtheforegoing, either Party may assign this Agreement (or Order) without obtainingtheother sale of all or substantially all of the assets of the Party. Subject to the foregoing restrictions, this Agreement will be fullybindingupon, inuretothebenefit ofandbeenforceableby theParties andtheirrespectivepermittedsuccessors and assigns. 15.8 Integration; Order of Precedence.This Agreement constitutes the entire agreement between the Parties and supersedes any and all prior agreements or communications between the Parties with regard to the subject matter hereof. This Agreement may not beamended or modified except by a signed Order, the mutual signed agreement of the Parties hereto, or as noted in Section 15.14 below. The terms of this Agreement shall supersedeand control over any conflicting or additional terms and conditions of any purchase order, acknowledgement, confirmation or other document issued by Customer. Notwithstanding the foregoing, in the event of a conflict between terms of this Agreement and an Order, the terms of the Order shall prevail. This Agreement or any exhibits or addenda, may be executed and delivered, either physically or by electronic means and in counterparts, each of which shall constitute an original and all of which together shall constitute one and the same instrument. 15.9 Severability.Notwithstanding the language in Section 15.13 below, in the event that any provision of this Agreement, or the application thereof, becomes or is declared by a court of competent jurisdiction to be illegal, void or unenforceable, the remainder of this Agreement will continue in full force and effect and the application of such provision willbeinterpreted so as reasonablytoaffecttheintent oftheParties.TheParties willpromptly replacesuch void or unenforceable provision with a valid and enforceable provision that will achieve, to the extent possible, the economic, business and other purposes of such void or unenforceable provision. 15.10 Applicable Law; Dispute Resolution.Except as notedin Section 15.13 below, this Agreement will be construed located, without reference to its choice of law rules, and any dispute, controversy, or claim arising under, out of, or relating to this Agreement will be finally determined by courts of competent jurisdiction in the state in which ng good faith efforts by the Parties to negotiate a resolution. The Parties hereby submit to the sole and exclusive jurisdiction of such courts, waiving the objection to the propriety or convenience ofsuch venues. Except as noted in Section 15.13 below, the foregoing does not limit or restrict either Party from seeking injunctive or other equitable relief from a court of competent jurisdiction. 15.11 Third-Party Beneficiaries.Nothing in this Agreement shall confer, or is intended to confer, on any third party any benefit or the right to enforce any term of this Agreement. 15.12 Force Majeure.Except as noted in Section 15.13, in accordance with GSAR Clause 552.212-4(f), in the event that a Party is prevented or restricted from performing, is unable to perform, or is delayed in performing any of its obligations under this Agreement due to any cause beyond the reasonable control of such Party (including, without limitation, war, terrorism, fire, earthquake, flood, hurricane, riots, acts of God, epidemics/pandemics, extraordinary governmental action, labor union strikes, internet service provider failures or delays, denial of Force Majeure Event excused and the time for performance will be extended for the period of delay or inability to perform due to such Force Majeure Event. A Force Majeure Event does not relieve a Party from its payment obligations under the Agreement. The affected Party agrees to use commercially reasonable efforts to address and mitigate the impact of such Force Majeure Event and continue performance to the extent reasonably possible under the circumstances. For the avoidance of doubt, Customer understands that the Box Service may not be provided in Service may be restricted in such countries and such prohibitions shall not constitute a Force Majeure Event. Page 16 of 23 Box ServiceAgreement Public Sector 15.13 U.S. Government Users.If Customer is a U.S. government entity or if this Agreement otherwise becomes subject to the Federal Acquisition Regulations (FAR), Customer acknowledges that elements of the Box Service constitute softwareand documentation and areprovided as as defined at 48 C.F.R. 2.101, and are being licensed to U.S. government User as commercial computer software subject to the restricted rights described in 48 C.F.R. 2.101 and 12.212. Moreover, to the extent Customer is a U.S. government entity or if this Agreement otherwise becomes subject to the FAR and the terms and conditions in this Agreement are inconsistent with the Federal Law (See FAR 12.212(a)), they shall be deemed deleted and unenforceable under any resultant orders, including but not limited to the following: (a)Contracting Parties. entity authorized toorder under Government contracts asset forth in Government Order 4800.2H ADM, as may be revised from time to time. The Licensee cannot be an individual because any implication of individual licensing triggers the requirements for legal review by Federal Employee unions. Conversely, because of competition rules, the contractor mustbedefined asa singleentity even ifthecontractor is partofa corporate group.TheGovernmentcannotcontract with the group, or in the alternative with a set ofcontracting parties. (b)Changes to Work and Delays. Subject to General Services Administration Acquisition Regulation (GSAR) 552.238-81 Modifications (Federal Supply Schedule) (APR 2014) (Alternate I APR2014) and GSAR552.212 -4 (f) Contract Terms and Conditions Commercial Items, Excusable Delays (MAY 2015) (Alternate II JUL 2009) (FAR Deviation JUL 2015) (Tailored) regarding which of the GSAR and the FAR provisions shall take precedence. (c)Contract Formation. Subject to FAR Sections 1.601(a) and 43.102, the Government Order must be signed by a duly warranted contracting officer, in writing. The same requirement applies to contract modifications affectingthe rights ofthe parties. All terms and conditions intended to bind the Government must beincluded within the contract signed by the Government. (d)Audit.During the term ofthis CSA: (a)IfOrderingActivity's security requirements included in the Order are met,ManufactureroritsdesignatedagentmayauditOrderingActivity'sfacilitiesandrecordstoverifyOrdering Activity's compliance with this CSA. Any such audit will take place only during Ordering Activity's normal business hours contingent upon prior written notice and adherence to any security measures the Ordering Activitydeemsappropriate, includinganyrequirements for personnelto beclearedpriortoaccessingsensitive facilities. Carahsoft on behalf of the Manufacturer will give Ordering Activity written notice of any non- compliance, including the number ofunderreported Units of Softwareor Services ("Notice"); or (b) IfOrdering securityrequirements arenot metanduponManufacturer's request, Ordering Activitywillruna self- assessment with toolsprovided byand at thedirection ofManufacturer -to verify Ordering (e)Termination.Termination shall be governed by the GSAR 552.212-4 and the Contract Disputes Act, 41 U.S.C. §§ 601-613; however, Carahsoft may request termination of this Agreement on behalf of Box if such remedy is granted to it after conclusion of the Contracts Disputes Act dispute resolutions process or if such remedy is otherwise ordered by a United States Federal Court. (f)Consent to Government Law / Consent to Jurisdiction. Subject to the Contracts Disputes Act of 1978 (41. U.S.C §§ 7101-7109) and Federal Tort Claims Act (28 U.S.C. §1346(b)). The validity, interpretation and enforcement of this Rider and the CSA will be governed by and construed in accordance with the laws of the UnitedStates.Allclausesinthe CSAreferencingequitableremedies aredeemednotapplicable to the Government order and are therefore deemed to be deleted. (g)Assignment. All clauses regarding Assignment are subject to FAR Clause 52.232-23, Assignment of Claims (MAY 2014) and FAR 42.12 Novation and Change-of-Name Agreements, and all clauses governing Assignment (h)CustomerIndemnities.Allofthe CSAclauses referencingCustomerIndemnitiesarehereby deemed to be deleted except for any indemnities by the U.S. Government that are expressly authorized by statute and specifically authorized under applicable U.S. Government agency regulations and procedures, or that would not otherwise violate theAnti-Deficiency Act (31 U.S. C. §1341, 41 U.S.C. § 11). (i)Box Indemnities.All of the CSA clauses that (1) violate right (28 U.S.C. 516) to Page 17 of 23 Box ServiceAgreement Public Sector represent the Government in any case and/or (2) require that the Government give sole control over the litigation and/or settlement, are hereby deemed to be deleted. (j)AutomaticRenewals.All ofthe CSA clauses thatviolatethe Anti-Deficiency Act (31 U.S.C. §1341,41U.S.C.§11)banonautomaticrenewalarehereby deemed to bedeleted. (k)FutureFeesorPenalties.AlloftheManufacturer CSA clauses thatviolatetheAnti-DeficiencyAct (31 U.S.C. § 1341, 41 U.S.C. § 11), which prohibits the U.S. Government from paying any fees or penalties beyond the contract amount, unless specifically authorized by existing statutes, such as the Prompt Payment Act or Equal Access To Justice Act (31 U.S.C. § 3901, 5 U.S.C. § 504), are hereby deemed to be deleted. (l)Taxes.All of CSAclauses regarding Taxes are subject to FAR 52.212-4(k), Taxes (NOV 2023). (m)Third Party Terms.If any third party software or services are required for Manufacturer to provide the brought into the negotiation with Manufacturer and the Ordering Activity, or the third party software and services will be acquired separately by the U.S. Government. (n)Installation and Use of the Software.Installation and use of the Manufacturer software shall be in accordancewith thisManufacturer CSA, unlessanOrdering Activitydeterminesthatitrequiresdifferentterms of use and Manufacturer expressly agrees in writing to such terms in a valid task order placed under the Government Contract. (o)Dispute Resolution and Venue. Any disputes relating to the Manufacturer CSA shall be resolved in accordancewithFAR52.212-4(d),Disputes(NOV2023),and theContractDisputesAct,41 U.S.C. §§7101-7109. Any term in the Manufacturer CSA permitting Box to suspend accounts or requiring dispute resolution in a specificforumorvenue,orprescribingatimeperiodforbringinganactionthatisdifferentfromthatprescribed by applicable Federal law, is hereby deleted. In the event of a claim or dispute arising under or relating to the Manufacturer CSA: (a) binding arbitration shall not be used unless specifically authorized by Ordering Activity guidance; and (b) equitable or injunctive relief, including the award of attorney fees, costs, or interest, may be awarded against the U.S. Government only when explicitly provided by statute (e.g., Prompt Payment Act or Equal Access to Justice Act). (p)Limitation of Liability.In addition to any limitation of liability provision in the Manufacturer CSA, Manufacturer and Ordering Activity shall not be liable for any indirect, incidental, special, or consequential damages, or any loss of profits, revenue, data, or data use. Further, Manufacturer and Ordering Activity shall not beliablefor punitivedamages, except to the extent that this limitation is prohibited by applicablelaw. This d or crimes arising out of or related to the order placed under the Government Contract under any federal fraud statute, including the False Claims Act, 31 U.S.C. §§ 3729-3733. (q)Advertisements and Endorsements.Unless specifically authorized by an Ordering Activity in writing, use of the name or logo of any U.S. Government entity is prohibited. (r)Public Access to Information.Manufacturer agrees that the Manufacturer CSA contain no confidential or proprietary information and acknowledges the Manufacturer CSA will be available to the public. (s)Warranties. Agreement replace the Warranty clause at FAR 52.212-4(o). 15.14 Required Updates. Except as noted in Section 15.13, In the event of a change of law applicable to the provisioning oftheBox Service(includingbut notlimited to regulatory and policychanges, standards and/or caselaw) or a change or addition of a new Box feature or offering that may be provided subject to additional terms, Box may make updates to this Agreement as required upon at least thirty (30)prior notice delivered by e-mail or via the Admin Console. Customer may object to these changes before the end of the notice period, and Box and Customer will negotiate in good faith to amend this Agreement to permit them to continue their contractual relationship in compliance with any such amended requirements. However, if Box and Customer are not able, after negotiating in good faith, to reach agreement on a required amendment, Customer may be precluded from using any such feature or offering of the Box Service subject to the additional terms, and Box may terminate the Agreement in whole or in Page 18 of 23 Box ServiceAgreement Public Sector part by givingnoticeat least ninety (90)days prior to thetermination datespecified in such notice. Page 19 of 23 Box ServiceAgreement Public Sector EXHIBIT A Support Services and Service Level Commitments The following terms and conditions apply unless an Order indicates the purchase of Enhanced Services and incorporates a separate data sheet describing what Support Services are included with the Enhanced Services. Section 1.Definitions. Capitalized terms not otherwise defined elsewhere in this Agreement shall have the following meaning: Response means the credit that may be available to a Customer that has subscribed to the Business Services under the applicable Order and as specified Response Times below. means any period during which the Customer is unable to access the Box Service, as measured at the accessing Content, expressly excluding Scheduled Downtime. means a single, reproducible issue or problem affecting the functionality of the Box Service for Customer. means the credit that may be available to a Customer that has subscribed to one of the Enhanced Support Services under the applicable Order and as specified under Response Times below. Enhanced Support Services under the applicable Order and as specified under Service Level Commitments below. means telephone, email or web-based assistance in the resolution of Issues reported by Customer to Box. Available Support Services are: which is included the purchaseofthe Box Service; Business Services which is purchased by theCustomer and identified under the applicableOrder; or or (together, ) which are purchased by the Customer and identified under the applicable Order. For the avoidance of doubt, Enhanced Support Services are separate from Enhanced Services as may be included in the Order. means a scheduled time period in which the Box Service is unavailable for use, and upon notice to Customer where practical. Uptime Percentage" means the total number of minutes in a calendar month minus the number of minutes of Downtime experienced in such calendar month, divided by the total number of minutes in such calendar month. Section 2. Support Services. 2.1 Support Services. During the Subscription Period, Box will provide to Customer the applicable Support Services. If Customer has not purchased Business Services or one of the Enhanced Support Services, then Standard Support Services will be provided. Support Services do not include: (a) physical installation or removal of the Box Service, including, without limitation, any custom development, data modeling, code review and application architecture/infrastructure design; (d) training; or (e) the set-up, configuration and use of the Box Service. Box'sobligationsdonotextend to anyongoingtestor traininginstancesoftheBoxServiceprovided to Customeror Downtime, Issues or errors that are caused by: (i)Third-party hardware or software; (ii)UseoftheBoxServicein violation ofthetermsoftheAgreement; (iii)UseoftheBoxServiceotherthaninaccordancewithany UserGuideortheexpressinstructionsofBox; Page 20 of 23 Box ServiceAgreement Public Sector (iv)AForceMajeureEventasdefinedintheAgreement;or (v)For users of Box KeySafe, failure to adhere to one or more of the requirements set forth in the then- current technical documentation applicable to KeySafe KMS, including required software updates, or any service degradation or downtime (scheduled or unscheduled) experienced by Hosting Partner. 2.2 Case Prioritization. When contacting Box for support, Customer will assign a priority to the Issue in accordance with the table below. Box will provide an acknowledgement of a reported Issue to Customer and a support agent will provide a response within the target timeframes specified for the applicable support level (). Upon review of the Issue, and following response to the Customer, Box may change the case prioritizations in accordance with the following descriptions: Level 1 Urgent: An IssuethatrenderstheBox Servicecompletely inoperativeforall Users and no workaround is available. Level 2 High: AnIssuethatmateriallyimpairs substantialfeaturesoftheBoxServicefor many Users and no reasonable workaround is available. Level 3 Normal: An Issuethatimpairsa feature oftheBox Servicefor a few Users and areasonable workaround is available. Level 4 Low: An Issue that involves an inquiry regarding a routine technical issue; information requested on application capabilities, navigation, installation or configuration; or a bug affecting a small number of Users. 2.3 Standard Services Response Times. If Customer has Standard Support Services, Box will use commercially reasonable efforts to meet the following target Response Times during the hours/days, as outlined below. SupportHours:6AM 6PMCustomerlocaltime,Monday Friday Support Language:English Support Access Method: Web/Email Support Response Method: Web/Email Number ofSupport Requests: Unlimited Response Times: Level1 Urgent:Within4businesshours Level 2 High: Within 8 business hours Level 3 Normal: Within 1 business day 2.4 Business Services Response Times. If Customer has purchased Business Services, Box will respond in accordance with the Response Times below. If Box fails to meet the response times, Customer may be entitled to a Business Response Time Credit Support Response Hours: 24 hours/day, 365 days/year Support Language:English Support Access Method: Web/Phone/Email Support Response Method: Web/Phone/Email Number of Support Requests: Unlimited Response Times: Level 1 Urgent: Within 2 hours Level 2 High: Within 4 hours Level 3 Normal: Within 4 hours Level4 Low:Greaterthan4hours Page 21 of 23 Box ServiceAgreement Public Sector 2.5 Enhanced Support Services Response Times. If Customer has purchased one of the Enhanced Support Services, Box will respond in accordance with the Response Times below(for cases submitted in English). If Box fails Enhanced Response Time Credit Support Response Hours: 24 hours/day, 365 days/year Support Language: English or local language (based on availability) Support Access Method: Web/Phone/Email Support Response Method: Web/Phone/Email Number of Support Requests: Unlimited Response Times: Level 1 Urgent: Within 1 hour Level 2 High: Within 2 hours Level 3 Normal: Within 2 hours Level4 Low:Greaterthan2hours 2.6 Business Services and Enhanced Support Services Response Time Credits . If Customer has purchased Business Services or one of the Enhanced Support Services and Box fails to meet the applicable Response Times associatedwithBusiness Services orEnhancedSupportServices, Customer may beentitled toa responsetimecredit Response Time Credit ResponseTimeCredits:Customer willbeeligibletoreceiveaResponseTimeCredit,providedthat: (a)Customer has purchased Business Services or one of theEnhanced Support Services; (b)CustomerhasopenedasupportticketforanIssue;and (c)Box fails to meet the response times for Level 1 and Level 2 support tickets three (3) times during the given calendar month; Collectively, a Response Credit Event In the event that Customer incurs a Response Credit Event, Customer will receive a Response Time Credit of fifteen (15%)percent ofthe fees paid by Customer for the applicableBusiness Support Service or Enhanced SupportService for the month the Response Credit Event occurred. The Response Time Credit will be calculated on a straight-line, pro-rated basis with respect to any fees paid in advance. Notwithstanding anything to the contrary, in no event will the total amount of Response Time Credits exceed the applicable Business Services or Enhanced Support Services fees paid by Customer for the corresponding month. For clarity, for the purpose of calculating Response Time Credits, calendar months are calculated based on US Pacific Time Zone. The Response Time Credit is Customer's sole and exclusive remedy for any failure by Box to meet any response time performance obligations pertaining to the Box Service as set out in this Exhibit A. Customer is not eligible to receive Response Time Credits during any period of time when payments owed are past due. For Customer Orders placed through Box, Response Time Credits will be issued by Box, as determined in its sole discretion, either by applying to future billing cycle(s) or as a refund against annual fees earlier paid. For Customer orders placed through a Box Reseller, Response Time Credits, if any, will be issued as provided in the applicable agreement between Customer and Box Reseller. 2.7 Key Rotation. If Customer is purchasing KeySafe KMS, Box may assist Customer in the implementation of the solely responsible and liable for any such Key Rotations. Customer acknowledges that if it improperly manages the Key Rotation, then: (a) Customer may not be able to decrypt orotherwise access its Content; and (b) Box will not be able to Page 22 of 23 Box ServiceAgreement Public Sector help Customer decrypt or otherwise access the Content. In no event will Box be responsible or otherwise liable for the Key Rotations or impacts of the Key Rotations. Section 3. Service LevelCommitments 3.1.Standard Support Services. If Customer has Standard Support Services, Box will use commercially reasonable efforts to meet an Uptime Percentage of at least 99.9%. 3.2.Business Services. If Customer has purchased Business Services, Box will use commercially reasonable efforts to meet an Uptime Percentage of at least 99.9%. 3.3 Enhanced Support Services. If Customer has purchased one of the Enhanced Support Services, Box will use commercially reasonable efforts to meet an Uptime Percentage of at least 99.9%. If Box fails to the meet the Uptime Percentage Customer will receive Enhanced SLC Credits as follows: UptimePercentage Enhanced SLC Credit Percentage Less than 99.9%but equal to or more than 99.8%5% Less than 99.8%but equal to or more than 99.7%10% Less than 99.7%but equal to or more than 99.6%15% Less than 99.6%but equal to or more than 99.5%20% Less than 99.5%but equal to or more than 99.4%25% Less than 99.4%but equal to or more than 99.3%30% Less than 99.3%but equal to or more than 99.2%35% Less than 99.2%but equal to or more than 99.1%40% Less than 99.1%but equal to or more than 99.0%45% Less than 99.0%50% Customers who have purchased one of the Enhanced Support Services will be eligible to receive SLC Credits provided that: (a)Customer has reported an Issue related to a Downtime event by filing a ticket with Box support within fifteen (15) days of the Downtime event; and (b)once Customer receives the Uptime Percentage report provided by Box and confirms Uptime Percentage as below 99.9%in the month the issue was experienced, Customer has provided Box a written claim request for Enhanced SLC Credits within fifteen (15) days of the date of uptime percentage report. The Enhanced SLC Credits will be equal to the SLC Credit percentage multiplied by the fees paid by Customer for the Box Service that are attributable to the corresponding calendar month (calculated on a straight line, pro-rated basis with respect to any fees paid in advance)and thenpro-rated for based on affected Users. Notwithstandinganything to the contrary, in no event will the total amount ofEnhanced SLC Credits, if any, exceed the fees paid by Customer for the Box Service in the corresponding month. For clarity, for the purpose of calculating Enhanced SLC Credits, calendar months are calculated based on US Pacific Time Zone. The Enhanced SLC Credit is Customer's sole and exclusive remedy for any failure by Box to meet any service level obligations pertaining to the Box Serviceas set out in this Exhibit A. Customer is not eligible to receive Enhanced SLC Credits during any period of time when payments owed are past due. For Customer Orders placed through Box, Enhanced SLC Credits will be issued by Box, as discretion, either by applyingto futurebillingcycle(s)or as a refund against annual fees earlier paid. For Customer Page 23 of 23 Box ServiceAgreement Public Sector orders placed through a Box Reseller, Enhanced SLC Credits, if any, will be issued as provided in the applicable agreement between Customer and the Box Reseller.