Terms of Service

This Software Services Agreement (the "Agreement"), dated as of the date you click the "AGREE' button (the "Effective Date"), is by and between Ryan Business and Technology Solutions, LLC, a Delaware limited liability company, with offices located at 9 East 47th Street, New York, NY 10017 ("RBTS") and you ("Customer" or “you”). This Agreement governs your use of Ryan Eyes software services. Capitalized terms not otherwise defined in the body of the Agreement shall have the meanings given them in Appendix 1 attached hereto.

In consideration of the covenants, terms and conditions herein, Ten Dollars ($10) and other good and valuable consideration, the sufficiency of which are hereby acknowledged, RBTS and Customer, intending to be legally bound, hereby agree as follows:

BY CLICKING THE "AGREE" BUTTON, YOU (A) ACKNOWLEDGE THAT YOU HAVE READ AND UNDERSTAND THIS AGREEMENT; (B) REPRESENT THAT YOU ARE 18 YEARS OF AGE OR OLDER; AND (C) ACCEPT THIS AGREEMENT AND AGREE THAT YOU ARE LEGALLY BOUND BY ITS TERMS. IF YOU DO NOT AGREE TO THESE TERMS, DO NOT INSTALL THE SOFTWARE OR ACCESS THE SERVICES AND, TO THE EXTENT APPLICABLE, DELETE ANY SOFTWARE OR APPLICATION FROM YOUR COMPUTER. YOU FURTHER ACKNOWLEDGE THAT THE SOFTWARE AND/OR THE APPLICATION IS PURELY FOR EVALUATION AND/OR DEMONSTRATION PURPOSES AND SHOULD NOT BE RELIED UPON.

1
Services.
1. 1.1Services. Subject to and conditioned on Customer's and its Authorized Users' compliance with the terms and conditions of this Agreement, during the Term, RBTS shall use commercially reasonable efforts to provide to Customer and its Authorized Users the services described in this Agreement (collectively, the "Services") for evaluation purposes in accordance with the terms and conditions hereof, including to host, manage, operate and maintain the Service Software for remote electronic access and use by Customer and its Authorized Users ("Hosted Services"), except for:
2. 1. - (a)Service downtime or degradation due to a Force Majeure Event;
    - (b)any other circumstances beyond RBTS’ reasonable control, including Customer's or any Authorized User's use of Third Party Materials, misuse of the Hosted Services, or use of the Services other than in compliance with the express terms of this Agreement;
    - (c)any suspension or termination of Customer's or any Authorized Users' access to or use of the Hosted Services as permitted by this Agreement; and
    - (d)any other circumstance in which RBTS, in its sole discretion, determines is material and sufficient to terminate or suspend the Services.
3. 1.2Service and System Control. Except as otherwise expressly provided in this Agreement, as between the parties:
4. 1. - (a)RBTS has and will retain sole control over the operation, provision, maintenance and management of the Services and RBTS Materials, including the: (i) RBTS Systems; (ii) selection, deployment, modification and
    - (b)Customer has and will be solely responsible for the operation, maintenance and management of, and all access to and use of, the Customer Systems, and sole responsibility for all access to and use of the Services and RBTS Materials by any Person by or through the Customer Systems or any other means controlled by Customer or any Authorized User, including any: (i) information, instructions or materials provided by any of them to the Services or RBTS; and (ii) conclusions, decisions or actions based on such use.
5. 1.3Changes. RBTS reserves the right, in its sole discretion, to make any changes to the Services and RBTS Materials that it deems necessary or useful to: (a) maintain or enhance (i) the quality or delivery of RBTS’ services to its customers, (ii) the competitive strength of or market for RBTS' services, or (iii) the Services' cost efficiency or performance; or (b) to comply with applicable Law.
6. 1.4Subcontractors. RBTS may from time to time in its sole discretion engage third parties to perform Services (each, a "Subcontractor").
7. 1.5Suspension or Termination of Services. RBTS may, directly or indirectly, and by use of a Disabling Device or any other lawful means, suspend, terminate or otherwise deny Customer's, any Authorized User's or any other Person's access to or use of all or any part of the Services or RBTS Materials, without incurring any resulting obligation or liability, if: (a) RBTS receives a judicial or other governmental demand or order, subpoena or law enforcement request that expressly or by reasonable implication requires RBTS to do so; or (b) RBTS believes, in its sole discretion, that: (i) Customer or any Authorized User has failed to comply with, any term of this Agreement, or accessed or used the Services beyond the scope of the rights granted or for a purpose not authorized under this Agreement; (ii) Customer or any Authorized User is, has been, or is likely to be involved in any fraudulent, misleading or unlawful activities; or (iii) this Agreement expires or is terminated. This Section 1.5 does not limit any of RBTS' other rights or remedies, whether at law, in equity or under this Agreement.
2
Authorization and Customer Restrictions.
1. 2.1Authorization. Subject to and conditioned on Customer's payment of the Fees and compliance and performance in accordance with all other terms and conditions of this Agreement, RBTS hereby authorizes Customer to access and use, solely in the Territory and during the Term, the Services and such RBTS Materials as RBTS may supply or make available to Customer solely for the Permitted Use by and through Authorized Users in accordance with the conditions and limitations set forth in this Agreement. This authorization is non-exclusive and non-transferable.
2. 2.2Reservation of Rights. Nothing in this Agreement grants any right, title or interest in or to (including any license under) any Intellectual Property Rights in or relating to, the Services, RBTS Materials or Third Party Materials, whether expressly, by implication, estoppel or otherwise. All right, title and interest in and to the Services, the RBTS Materials and the Third Party Materials are and will remain with RBTS and the respective rights holders in the Third Party Materials, if any.
3. 2.3Authorization Limitations and Restrictions. Customer shall not, and shall not permit any other Person to, access or use the Services or RBTS Materials except as expressly permitted by this Agreement and, in the case of Third-Party Materials, the applicable third-party license agreement. For purposes of clarity and without limiting the generality of the foregoing, Customer shall not, except as this Agreement expressly permits:
4. 1. - (a)copy, modify or create derivative works or improvements of the Services or RBTS Materials;
    - (b)rent, lease, lend, sell, sublicense, assign, distribute, publish, transfer or otherwise make available any Services or RBTS Materials to any Person, including on or in connection with the internet or any time-sharing, service bureau, software as a service, cloud or other technology or service;
    - (c)reverse engineer, disassemble, decompile, decode, adapt or otherwise attempt to derive or gain access to the source code of the Services or RBTS Materials, in whole or in part;
    - (d)bypass or breach any security device or protection used by the Services or RBTS Materials or access or use the Services or RBTS Materials other than by an Authorized User through the use of his or her own then valid Access Credentials;
    - (e)input, upload, transmit or otherwise provide to or through the Services or RBTS Systems, any information or materials that are unlawful or injurious, or contain, transmit or activate any Malicious Code;
    - (f)damage, destroy, disrupt, disable, impair, interfere with or otherwise impede or harm in any manner the Services, RBTS Systems or RBTS' provision of services to any third party, in whole or in part;
    - (g)remove, delete, alter or obscure any trademarks, Documentation, warranties or disclaimers, or any copyright, trademark, patent or other intellectual property or proprietary rights notices from any Services or RBTS Materials, including any copy thereof;
    - (h)access or use the Services or RBTS Materials in any manner or for any purpose that infringes, misappropriates or otherwise violates any Intellectual Property Right or other right of any third party (including by any unauthorized access to, misappropriation, use, alteration, destruction or disclosure of the data of any other RBTS customer), or that violates any applicable Law;
    - (i)access or use the Services or RBTS Materials for purposes of competitive analysis of the Services or RBTS Materials, the development, provision or use of a competing software service or product or any other purpose that is to RBTS' detriment or commercial disadvantage; or
    - (j)otherwise access or use the Services or RBTS Materials beyond the scope of the authorization granted under Section 2.1.
3
Customer Obligations.
1. 3.1Customer Systems and Cooperation. Customer shall at all times during the Term: (a) set up, maintain and operate in good repair all Customer Systems on or through which the Services are accessed or used; (b) provide RBTS Personnel with such access to Customer's premises and Customer Systems as is necessary for RBTS to perform the Services; and (c) provide all cooperation and assistance as RBTS may reasonably request to enable RBTS to exercise its rights and perform its obligations under and in connection with this Agreement.
2. 3.2Effect of Customer Failure or Delay. RBTS is not responsible or liable for any delay or failure of performance caused in whole or in part by Customer's delay in performing, or failure to perform, any of its obligations under this Agreement (each, a "Customer Failure").
3. 3.3Corrective Action and Notice. If Customer becomes aware of any actual or threatened activity prohibited by Section 2.3, Customer shall, and shall cause its Authorized Users to, immediately: (a) take all reasonable and lawful measures within their respective control that are necessary to stop the activity or threatened activity and to mitigate its effects (including, where applicable, by discontinuing and preventing any unauthorized access to the Services and RBTS Materials and permanently erasing from their systems and destroying any data to which any of them have gained unauthorized access); and (b) notify RBTS of any such actual or threatened activity.
4. 3.4Non-Solicitation. During the Term and for two (2) years thereafter, Customer shall not, and shall not assist any other Person to, directly or indirectly recruit or solicit for employment or engagement as an independent contractor any Person then or within the prior twenty-four (24) months employed or engaged by RBTS or any Subcontractor and involved in any respect with the Services or the performance of this Agreement. In the event of a violation of this Section 3.4, RBTS will be entitled to liquidated damages equal to the compensation paid by RBTS to the applicable employee or contractor during the prior twenty-four months.
5. 4Service Downtime. RBTS will schedule, at its sole discretion, downtime for routine maintenance of the Hosted Services ("Scheduled Downtime").
6. 5Customer Obligations. The Services do not replace the need for Customer to maintain regular data backups or redundant data archives. RBTS HAS NO OBLIGATION OR LIABILITY FOR ANY LOSS, ALTERATION, DESTRUCTION, DAMAGE, CORRUPTION OR RECOVERY OF CUSTOMER DATA.
7. 6Security
1. 6.1Prohibited Data. Customer acknowledges that the Services are not designed with security and access management for Processing the following categories of information: (a) Personal Information; (b) data that is classified and or used on the U.S. Munitions list, including software and technical data; (c) articles, services and related technical data designated as defense articles or defense services; and (d) ITAR (International Traffic in Arms Regulations) related data, (each of the foregoing, "Prohibited Data"). Customer shall not, and shall not permit any Authorized User or other Person to, provide any Prohibited Data to, or Process any Prohibited Data through, the Services, the RBTS Systems or any RBTS Personnel. Customer is solely responsible for reviewing all Customer Data and shall ensure that no Customer Data constitutes or contains any Prohibited Data.
2. 6.2Customer Control and Responsibility. Customer has and will retain sole responsibility for: (a) all Customer Data, including its content and use; (b) all information, instructions and materials provided by or on behalf of Customer or any Authorized User in connection with the Services; (c) Customer's information technology infrastructure, including computers, software, databases, electronic systems (including database management systems) and networks, whether operated directly by
3. 6.3Access and Security. Customer shall employ all physical, administrative and technical controls, screening and security procedures and other safeguards necessary to: (a) securely administer the distribution and use of all Access Credentials and protect against any unauthorized access to or use of the Hosted Services; and (b) control the content and use of Customer Data, including the uploading or other provision of Customer Data for Processing by the Hosted Services.
1. 7Fees. The fees for the Services are waived during the Term. Customer shall bear its own costs and expenses of performance and evaluation hereunder.
2. 8Intellectual Property Rights.
1. 8.1Services and RBTS Materials. All right, title and interest in and to the Services and RBTS Materials, including all Intellectual Property Rights therein, are and will remain with RBTS and the respective rights holders in the Third-Party Materials. Customer has no right, license or authorization with respect to any of the Services or RBTS Materials (including Third-Party Materials), except as expressly set forth in Section 2.1 or the applicable third-party license, in each case subject to Section 2.3. All other rights in and to the Services and RBTS Materials (including Third-Party Materials) are expressly reserved by RBTS and the respective third-party licensors. In furtherance of the foregoing, Customer hereby unconditionally and irrevocably grants to RBTS an assignment of all right, title and interest in and to the Resultant Data, including all Intellectual Property Rights relating thereto.
2. 8.2Customer Data. As between Customer and RBTS, Customer is and will remain the sole and exclusive owner of all right, title and interest in and to all Customer Data, including all Intellectual Property Rights relating thereto, subject to the rights and permissions granted in Section 8.3.
3. 8.3Consent to Use Customer Data. Customer hereby irrevocably grants all such rights and permissions in or relating to Customer Data: (a) to RBTS, its Subcontractors and the RBTS Personnel as are necessary or useful to perform the Services; and (b) to RBTS as are necessary or useful to enforce this Agreement and exercise its rights and perform its obligations hereunder.
9
Confidentiality.
1. 9.1Confidential Information. In connection with this Agreement, each party (as the "Disclosing Party") may disclose or make available Confidential Information to the other party (as the "Receiving Party"). Subject to Section 9.2, "Confidential Information" means information in any form or medium (whether oral, written, electronic or other) that the Disclosing Party considers confidential or proprietary, including information consisting of or relating to the Disclosing Party’s technology, trade secrets, know-how, business operations, plans, strategies, customers, and pricing, and information with respect to which the Disclosing Party has contractual or other confidentiality obligations, in each case whether or not marked, designated or otherwise identified as "confidential". Without limiting the foregoing: all RBTS Materials are the Confidential Information of RBTS, the financial terms and existence of this Agreement are the Confidential Information of each of the parties, and Resultant Data and RBTS Materials shall not be considered Confidential Information of the Customer.
2. 9.2Exclusions. Confidential Information does not include information that: (a) was rightfully known to the Receiving Party without restriction on use or disclosure prior to such information's being disclosed or made available to the Receiving Party in connection with this Agreement; (b) was or becomes generally known by the public other than by the Receiving Party's or any of its Representatives' noncompliance with this Agreement; (c) was or is received by the Receiving Party on a non-confidential basis from a third party that was not or is not, at the time of such receipt, under any obligation to maintain its confidentiality; (d) the Receiving Party can demonstrate by written or other documentary records was or is independently developed by the Receiving Party without reference to or use of any Confidential Information.
3. 9.3Protection of Confidential Information. As a condition to being provided with any disclosure of or access to Confidential Information, the Receiving Party shall during the Term of the Agreement and for the longer of (i) a period of three (3) years after the expiration or termination of the Agreement, or (ii) the period in which such information qualifies as a trade secret under applicable Law:
4. 1. - (a)not access or use Confidential Information other than as necessary to exercise its rights or perform its obligations under and in accordance with this Agreement;
    - (b)except as may be permitted by and subject to its compliance with Section 9.4, not disclose or permit access to Confidential Information other than to its Representatives who: (i) need to know such Confidential Information for purposes of the Receiving Party's exercise of its rights or performance of its obligations under and in accordance with this Agreement; (ii) have been informed of the confidential nature of the Confidential Information and the Receiving Party's obligations under this Section 9.3; and (iii) are bound by written confidentiality and restricted use obligations at least as protective of the Confidential Information as the terms set forth in this Section 9.3;
    - (c)safeguard the Confidential Information from unauthorized use, access or disclosure using at least the degree of care it uses to protect its similarly sensitive information; and
    - (d)ensure its Representatives' compliance with, and be responsible and liable for any of its Representatives' non-compliance with, the terms of this Section 9.
5. 9.4Compelled Disclosures. If the Receiving Party or any of its Representatives is compelled by applicable Law to disclose any Confidential Information then, to the extent permitted by applicable Law, the Receiving Party shall: (a) promptly, and prior to such disclosure, notify the Disclosing Party in writing of such requirement so that the Disclosing Party can seek a protective order or other remedy or waive its rights under Section 9.3; and (b) provide reasonable assistance to the Disclosing Party, at the Disclosing Party's sole cost and expense, in opposing such disclosure or seeking a protective order or other limitations on disclosure. If the Disclosing Party waives compliance or, after providing the notice and assistance required under this Section 9.4, the Receiving Party remains required by Law to disclose any Confidential Information, the Receiving Party shall disclose only that portion of the Confidential Information that, on the advice of the Receiving Party's legal counsel, the Receiving Party is legally required to disclose and, on the Disclosing Party's request, shall use commercially reasonable efforts to obtain assurances from the applicable court or other presiding authority that such Confidential Information will be afforded confidential treatment.
10
Term and Termination.
1. 10.1Initial Term. The initial term of this Agreement commences as of the Effective Date and, unless terminated earlier pursuant to any of the Agreement's express provisions, will continue in effect for a period of thirty (30) days from such date (the "Initial Term").
2. 10.2Renewal. Upon mutual agreement, this Agreement will automatically renew for additional successive thirty (30) day terms, unless earlier terminated pursuant to this Agreement's express provisions or either party gives the other party written notice of non-renewal at least ten (10) days prior to the expiration of the then-current term (each a "Renewal Term" and, collectively, together with the Initial Term, the "Term")
3. 10.3Termination. In addition to any other express termination rights set forth elsewhere in this Agreement:
4. 1. - (a)RBTS may terminate this Agreement, effective on written notice to Customer, if Customer breaches any of its obligations under Section 2.3 (Use Limitations and Restrictions), Section 6.1 (Prohibited Data) or Section 9 (Confidentiality).
    - (b)either party may terminate this Agreement, effective on written notice to the other party, if the other party materially breaches this Agreement, and such breach: (i) is incapable of cure; or (ii) being capable of cure, remains uncured ten (10) days after the non-breaching party provides the breaching party with written notice of such breach; and
    - (c)either party may terminate this Agreement, effective immediately upon written notice to the other party, if the other party: (i) becomes insolvent or is generally unable to pay, or fails to pay, its debts as they become due; (ii) files or has filed against it, a petition for voluntary or involuntary bankruptcy or otherwise becomes subject, voluntarily or involuntarily, to any proceeding under any domestic or foreign bankruptcy or insolvency Law; (iii) makes or seeks to make a general assignment for the benefit of its creditors; or (iv) applies for or has appointed a receiver, trustee, custodian or similar agent appointed by order of any court of competent jurisdiction to take charge of or sell any material portion of its property or business.
5. 10.4Effect of Expiration or Termination. Upon any expiration or termination of this Agreement, except as expressly otherwise provided in this Agreement:
6. 1. - (a)all rights, licenses, consents and authorizations granted by either party to the other hereunder will immediately terminate;
    - (b)Customer shall immediately cease all use of any Services or RBTS Materials and (i) promptly return to RBTS, or at RBTS' written request, destroy, all documents and tangible materials containing, reflecting, incorporating or based on any RBTS Materials or RBTS' Confidential Information; and (ii) permanently erase all RBTS Materials and RBTS' Confidential Information from all systems Customer directly or indirectly controls; and (iii) certify to RBTS in a signed written instrument that it has complied with the requirements of this Section 10.4(c);
    - (c)notwithstanding anything to the contrary in this Agreement, with respect to information and materials then in its possession or control: (i) the Receiving Party may retain the Disclosing Party's Confidential Information; and (ii) RBTS may retain Customer Data; (iii) Customer may retain RBTS Materials, in the case of each of subclause (i), (ii) and (iii) in its then current state and solely to the extent and for so long as required by applicable Law; (iv) RBTS may also retain Customer Data in its backups, archives and disaster recovery systems until such Customer Data is deleted in the ordinary course; and (v) all information and materials described in this Section 10.4(d) will remain subject to all confidentiality, security and other applicable requirements of this Agreement; and
    - (d)RBTS may disable all Customer and Authorized User access to the Hosted Services and RBTS Materials;
7. 10.5Surviving Terms. The provisions set forth in the following sections, and any other right or obligation of the parties in this Agreement that, by its nature, should survive termination or expiration of this Agreement, will survive any expiration or termination of this Agreement: Section 2.3, Section 9, Section 10.4, this Section 10.5, Section 11, Section 12, Section 13 and Section 15.
11
Representations and Warranties.
1. 11.1Mutual Representations and Warranties. Each party represents and warrants to the other party that:
2. 1. - (a)it is duly organized, validly existing and in good standing as a corporation or other entity under the Laws of the jurisdiction of its incorporation or other organization;
    - (b)it has the full right, power and authority to enter into and perform its obligations and grant the rights, licenses, consents and authorizations it grants or is required to grant under this Agreement;
    - (c)the execution of this Agreement by its representative whose signature is set forth at the end of this Agreement has been duly authorized by all necessary corporate or organizational action of such party; and
    - (d)when executed and delivered by both parties, this Agreement will constitute the legal, valid and binding obligation of such party, enforceable against such party in accordance with its terms.
3. 11.2Additional Customer Representations, Warranties and Covenants. Customer represents, warrants and covenants to RBTS that Customer owns or otherwise has and will have the necessary rights and consents in and relating to the Customer Data so that, as received by RBTS and Processed in accordance with this Agreement, they do not and will not infringe, misappropriate or otherwise violate any Intellectual Property Rights, or any privacy or other rights of any third party or violate any applicable Law.
4. 11.3DISCLAIMER OF WARRANTIES. EXCEPT FOR THE EXPRESS WARRANTIES SET FORTH IN SECTION 11.1 AND SECTION 11.2, ALL SERVICES AND RBTS MATERIALS ARE PROVIDED "AS IS" AND RBTS HEREBY DISCLAIMS ALL WARRANTIES, WHETHER EXPRESS, IMPLIED, STATUTORY OR OTHER, AND RBTS SPECIFICALLY DISCLAIMS ALL IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE AND NON-INFRINGEMENT, AND ALL WARRANTIES ARISING FROM COURSE OF DEALING, USAGE OR TRADE PRACTICE. WITHOUT LIMITING THE FOREGOING, RBTS MAKES NO WARRANTY OF ANY KIND THAT THE SERVICES OR RBTS MATERIALS, OR ANY PRODUCTS OR RESULTS OF THE USE THEREOF, WILL MEET CUSTOMER'S OR ANY OTHER PERSON'S REQUIREMENTS, OPERATE WITHOUT INTERRUPTION, ACHIEVE ANY INTENDED RESULT, BE COMPATIBLE OR WORK WITH ANY SOFTWARE, SYSTEM OR OTHER SERVICES, OR BE SECURE, ACCURATE, COMPLETE, FREE OF MALICIOUS CODE OR ERROR FREE. ALL THIRD-PARTY MATERIALS ARE PROVIDED "AS IS" AND ANY REPRESENTATION OR WARRANTY OF OR CONCERNING ANY THIRD PARTY MATERIALS IS STRICTLY BETWEEN CUSTOMER AND THE THIRD-PARTY OWNER OR DISTRIBUTOR OF THE THIRD-PARTY MATERIALS.
12
Indemnification.
1. 12.1Customer Indemnification. Customer shall indemnify, defend and hold harmless RBTS and its officers, directors, employees, successors and assigns (each, a "RBTS Indemnitee") from and against any and all Losses incurred by such RBTS Indemnitee in connection with any claim, suit, action or proceeding (each, an "Action") by a third party (other than an Affiliate of a RBTS Indemnitee) to the extent that such Losses arise out of or relate to any:
2. 1. - (a)Customer Data, including any Processing of Customer Data by or on behalf of RBTS in accordance with this Agreement;
    - (b)any other materials or information (including any documents, data, specifications, software, content or technology) provided by or on behalf of Customer or any Authorized User, including RBTS' compliance with any specifications or directions provided by or on behalf of Customer or any Authorized User to the extent prepared without any contribution by RBTS;
    - (c)allegation of facts that, if true, would constitute Customer's breach of any of its representations, warranties, covenants or obligations under this Agreement; or
    - (d)negligence or more culpable act or omission (including recklessness or willful misconduct) by Customer, any Authorized User, or any third party on behalf of Customer or any Authorized User, in connection with this Agreement.
3. 12.2Indemnification Procedure. RBTS shall promptly notify the Customer in writing of any Action for which it believes it is entitled to be indemnified pursuant to Section 12.1. The RBTS Indemnitee seeking indemnification (the "Indemnitee") shall cooperate with Customer (the "Indemnitor") at the Indemnitor's sole cost and expense. The Indemnitor shall immediately take control of the defense and investigation of such Action and shall employ counsel to handle and defend the same, at the Indemnitor's sole cost and expense. The Indemnitee's failure to perform any obligations under this Section 12.2 will not relieve the Indemnitor of its obligations under this Section 12, except to the extent that the Indemnitor can demonstrate that it has been materially prejudiced as a result of such failure. The Indemnitee may participate in and observe the proceedings at its own cost and expense with counsel of its own choosing.
13
Limitations of Liability.
1. 13.1EXCLUSION OF DAMAGES. IN NO EVENT WILL RBTS OR ANY OF ITS LICENSORS, SERVICE PROVIDERS OR SUPPLIERS BE LIABLE UNDER OR IN CONNECTION WITH THIS AGREEMENT OR ITS SUBJECT MATTER UNDER ANY LEGAL OR EQUITABLE THEORY, INCLUDING BREACH OF CONTRACT, TORT (INCLUDING NEGLIGENCE), STRICT LIABILITY AND OTHERWISE, FOR ANY: (a) LOSS OF PRODUCTION, USE, BUSINESS, REVENUE OR PROFIT OR DIMINUTION IN VALUE; (b) IMPAIRMENT, INABILITY TO USE OR LOSS, INTERRUPTION OR DELAY OF THE SERVICES, (c) LOSS, DAMAGE, CORRUPTION OR RECOVERY OF DATA, OR BREACH OF DATA OR SYSTEM SECURITY, OR (d) CONSEQUENTIAL, INCIDENTAL, INDIRECT, EXEMPLARY, SPECIAL, ENHANCED OR PUNITIVE DAMAGES, REGARDLESS OF WHETHER SUCH PERSONS WERE ADVISED OF THE POSSIBILITY OF SUCH LOSSES OR DAMAGES OR SUCH LOSSES OR DAMAGES WERE OTHERWISE FORESEEABLE, AND NOTWITHSTANDING THE FAILURE OF ANY AGREED OR OTHER REMEDY OF ITS ESSENTIAL PURPOSE.
2. 13.2CAP ON MONETARY LIABILITY. IN NO EVENT WILL THE COLLECTIVE AGGREGATE LIABILITY OF RBTS AND ITS LICENSORS, SERVICE PROVIDERS AND SUPPLIERS UNDER OR IN CONNECTION WITH THIS AGREEMENT OR ITS SUBJECT MATTER, UNDER ANY LEGAL OR EQUITABLE THEORY, INCLUDING BREACH OF CONTRACT, TORT (INCLUDING NEGLIGENCE), STRICT LIABILITY AND OTHERWISE, EXCEED THE FEES PAID AND PAYABLE TO RBTS BY CUSTOMER DURING THE IMMEDIATELY PRECEDING TWELVE (12) MONTHS. THE FOREGOING LIMITATION APPLIES NOTWITHSTANDING THE FAILURE OF ANY AGREED OR OTHER REMEDY OF ITS ESSENTIAL PURPOSE.
14
Force Majeure.
1. 14.1No Breach or Default. In no event will either party be liable or responsible to the other party, or be deemed to have defaulted under or breached this Agreement, for any failure or delay in fulfilling or performing any term of this Agreement, (except for any payment obligation), when and to the extent such failure or delay is caused by any circumstances beyond such party's reasonable control (a "Force Majeure Event"), including acts of God, flood, fire, earthquake or explosion, war, terrorism, invasion, riot or other civil unrest, embargoes or blockades in effect on or after the date of this Agreement, national or regional emergency, strikes, labor stoppages or slowdowns or other industrial disturbances, passage of Law or any action taken by a governmental or public authority, including imposing an embargo, export or import restriction, quota or other restriction or prohibition or any complete or partial government shutdown, or national or regional shortage of adequate power or telecommunications or transportation.
2. 14.2Affected Party Obligations. In the event of any failure or delay caused by a Force Majeure Event, the affected party shall give prompt written notice to the other party stating the period of time the occurrence is expected to continue and use commercially reasonable efforts to end the failure or delay and minimize the effects of such Force Majeure Event.
15
Miscellaneous.
1. 15.1Further Assurances. Upon a party's reasonable request, the other party shall, at the requesting party's sole cost and expense, execute and deliver all such documents and instruments, and take all such further actions, necessary to give full effect to this Agreement.
2. 15.2Relationship of the Parties. The relationship between the parties is that of independent contractors. Nothing contained in this Agreement shall be construed as creating any agency, partnership, joint venture or other form of joint enterprise, employment or fiduciary relationship between the parties, and neither party shall have authority to contract for or bind the other party in any manner whatsoever.
3. 15.3Public Announcements. Neither party shall issue or release any announcement, statement, press release or other publicity or marketing materials relating to this Agreement or otherwise use the other party's trademarks, service marks, trade names, logos, domain names or other indicia of source, affiliation or sponsorship, in each case, without the prior written consent of the other party, which consent shall not be unreasonably withheld, conditioned or delayed, provided, however, that RBTS may, without Customer's consent, include Customer's name and/or other indicia in its lists of RBTS' current or former customers of RBTS in promotional and marketing materials.
4. 15.4Interpretation. For purposes of this Agreement: (a) the words "include," "includes" and "including" are deemed to be followed by the words "without limitation"; (b) the word "or" is not exclusive; (c) the words "herein," "hereof," "hereby," "hereto" and "hereunder" refer to this Agreement as a whole; (d) words denoting the singular have a comparable meaning when used in the plural, and vice-versa; and (e) words denoting any gender include all genders. Unless the context otherwise requires, references in this Agreement: (x) to sections, exhibits, schedules, attachments and appendices mean the sections of, and exhibits, schedules, attachments and appendices attached to, this Agreement; (y) to an agreement, instrument or other document means such agreement, instrument or other document as amended, supplemented and modified from time to time to the extent permitted by the provisions thereof; and (z) to a statute means such statute as amended from time to time and includes any successor legislation thereto and any regulations promulgated thereunder. The parties intend this Agreement to be construed without regard to any presumption or rule requiring construction or interpretation against the party drafting an instrument or causing any instrument to be drafted. The exhibits, schedules, attachments and appendices referred to herein are an integral part of this Agreement to the same extent as if they were set forth verbatim herein.
5. 15.5Headings. The headings in this Agreement are for reference only and do not affect the interpretation of this Agreement.
6. 15.6Entire Agreement. This Agreement[, together with the exhibits, schedules, attachments and appendices attached hereto and any other documents incorporated herein by reference, constitutes the sole and entire agreement of the parties with respect to the subject matter of this Agreement and supersedes all prior and contemporaneous understandings, agreements, representations and warranties, both written and oral, with respect to such subject matter. In the event of any inconsistency between the statements made in the body of this Agreement, the related exhibits, schedules, attachments and appendices (other than an exception expressly set forth as such therein) and any other documents incorporated herein by reference, the following order of precedence governs: (a) first, this Agreement, excluding its exhibits, schedules, attachments and appendices; (b) second, the exhibits, schedules, attachments and appendices to this Agreement as of the Effective Date; and (c) third, any other documents incorporated herein by reference.
7. 15.7Assignment. Customer shall not assign or otherwise transfer any of its rights, or delegate or otherwise transfer any of its obligations or performance, under this Agreement, in each case whether voluntarily, involuntarily, by operation of law or otherwise, without RBTS' prior written consent, which consent RBTS shall not unreasonably withhold or delay. For purposes of the preceding sentence, and without limiting its generality, any merger, consolidation or reorganization involving Customer (regardless of whether Customer is a surviving or disappearing entity) will be deemed to be a transfer of rights, obligations or performance under this Agreement for which RBTS' prior written consent is required. No delegation or other transfer will relieve Customer of any of its obligations or performance under this Agreement. Any purported assignment, delegation or transfer in violation of this Section 15.8 is void. This Agreement is binding upon and inures to the benefit of the parties hereto and their respective permitted successors and assigns.
8. 15.8No Third-party Beneficiaries. This Agreement is for the sole benefit of the parties hereto and their respective permitted successors and permitted assigns and nothing herein, express or implied, is intended to or shall confer upon any other Person any legal or equitable right, benefit or remedy of any nature whatsoever under or by reason of this Agreement
9. 15.9Amendment and Modification; Waiver. No amendment to or modification of or rescission, termination or discharge of this Agreement is effective unless it is in writing, identified as an amendment to or rescission, termination or discharge of this Agreement and signed by an authorized representative of each party. No waiver by any party of any of the provisions hereof shall be effective unless explicitly set forth in writing and signed by the party so waiving. Except as otherwise set forth in this Agreement, no failure to exercise, or delay in exercising, any rights, remedy, power or privilege arising from this Agreement shall operate or be construed as a waiver thereof; nor shall any single or partial exercise of any right, remedy, power or privilege hereunder preclude any other or further exercise thereof or the exercise of any other right, remedy, power or privilege.
10. 15.10Severability. If any provision of this Agreement is invalid, illegal or unenforceable in any jurisdiction, such invalidity, illegality or unenforceability shall not affect any other term or provision of this Agreement or invalidate or render unenforceable such term or provision in any other jurisdiction. Upon such determination that any term or other provision is invalid, illegal or unenforceable, the parties hereto shall negotiate in good faith to modify this Agreement so as to effect the original intent of the parties as closely as possible in a mutually acceptable manner in order that the transactions contemplated hereby be consummated as originally contemplated to the greatest extent possible.
11. 15.11Governing Law; Submission to Jurisdiction. This Agreement is governed by and construed in accordance with the internal laws of the State of New York without giving effect to any choice or conflict of law provision or rule that would require or permit the application of the laws of any jurisdiction other than those of the State of New York. Any legal suit, action or proceeding arising out of or related to this Agreement or the licenses granted hereunder shall be instituted exclusively in the federal courts of the United States or the courts of the State of New York in each case located in the city of New York and County of New York, and each party irrevocably submits to the exclusive jurisdiction of such courts in any such suit, action or proceeding. Service of process, summons, notice or other document by mail to such party's address set forth herein shall be effective service of process for any suit, action or other proceeding brought in any such court.
12. 15.12Waiver of Jury Trial. Each party irrevocably and unconditionally waives any right it may have to a trial by jury in respect of any legal action arising out of or relating to this Agreement or the transactions contemplated hereby.
13. 15.13Equitable Relief. Each party acknowledges and agrees that a breach or threatened breach by such party of any of its obligations under Section 9 or, in the case of breach by Customer, Section 2.3, Section 3.3 or Section 6.1, would cause the other party irreparable harm for which monetary damages may not be an adequate remedy and agrees that, in the event of such breach or threatened breach, the other party will be entitled to seek equitable relief, including a restraining order, an injunction, specific performance and any other relief that may be available from any court, without any requirement to post a bond or other security, or to prove actual damages or that monetary damages are not an adequate remedy. Such remedies are not exclusive and are in addition to all other remedies that may be available at law, in equity or otherwise.
14. 15.14Attorneys' Fees. In the event that any action, suit, or other legal or administrative proceeding is instituted or commenced by either party hereto against the other party arising out of or related to this Agreement, the prevailing party shall be entitled to recover its reasonable attorneys' fees and court costs from the non-prevailing party.
15. 15.15Counterparts. This Agreement may be executed in counterparts, each of which is deemed an original, but all of which together are deemed to be one and the same agreement. A signed copy of this Agreement delivered by facsimile, e-mail or other means of electronic transmission is deemed to have the same legal effect as delivery of an original signed copy of this Agreement.

APPENDIX 1
DEFINTIONS

"Access Credentials" means any user name, identification number, password, license or security key, security token, PIN or other security code, method, technology or device used, alone or in combination, to verify an individual's identity and authorization to access and use the Hosted Services.

"Authorized User" means each of the individuals authorized to use the Services by Customer pursuant to Section 2.1 and the other terms and conditions of this Agreement, which user shall have been granted Access Credentials prior to accessing the Services.

"Customer Data" means, other than Resultant Data, information, data and other content, in any form or medium that is collected, downloaded or otherwise received, directly or indirectly from Customer or an Authorized User by or through the Services, but excludes RBTS Materials.

"Customer Systems" means the Customer's information technology infrastructure, including computers, software, hardware, databases, electronic systems (including database management systems) and networks, whether operated directly by Customer or through the use of third-party services.

"Documentation" means any manuals, instructions or other documents or materials that RBTS provides or makes available to Customer in any form or medium and which describe the functionality, components, features or requirements of the Services or RBTS Materials, including any aspect of the installation, configuration, integration, operation, use, support or maintenance thereof.

"Intellectual Property Rights" means any and all registered and unregistered rights granted, applied for or otherwise now or hereafter in existence under or related to any patent, copyright, trademark, trade secret, database protection or other intellectual property rights laws, and all similar or equivalent rights or forms of protection, in any part of the world.

"Law" means any statute, law, ordinance, regulation, rule, code, order, constitution, treaty, common law, judgment, decree or other requirement of any federal, state, local or foreign government or political subdivision thereof, or any arbitrator, court or tribunal of competent jurisdiction.

"Losses" means any and all losses, damages, liabilities, deficiencies, claims, actions, judgments, settlements, interest, awards, penalties, fines, costs or expenses of whatever kind, including reasonable attorneys' fees and the costs of enforcing any right to indemnification hereunder and the cost of pursuing any insurance providers.

"Malicious Code" means any software, hardware or other technology, device or means, including any virus, worm, malware or other malicious computer code, the purpose or effect of which is to (a) permit unauthorized access to, or to destroy, disrupt, disable, distort, or otherwise harm or impede in any manner any (i) computer, software, firmware, hardware, system or network or (ii) any application or function of any of the foregoing or the security, integrity, confidentiality or use of any data Processed thereby, or (b) prevent Customer or any Authorized User from accessing or using the Services or RBTS Systems as intended by this Agreement. Malicious Code does not include any RBTS Disabling Device.

"Permitted Use" means any use of the Services by an Authorized User for the benefit of Customer solely in or for Customer's internal business operations.

"Person" means an individual, corporation, partnership, joint venture, limited liability entity, governmental authority, unincorporated organization, trust, association or other entity.

"Personal Information" means any information that does or can identify a specific individual or by or from which a specific individual may be identified, contacted or located. Personal Information includes all "nonpublic personal information" as defined under the Gramm-Leach-Bliley Act, "protected health information" as defined under the Health and Insurance Portability and Accountability Act of 1996, ["Personal Data" as defined in the EU Data Protection Directive (Directive 95/46/EEC),] ["Personal Information" as defined under the Children's Online Privacy Protection Act of 1998,] [[OTHER LAWS OR REGULATIONS],] and all rules and regulations issued under any of the foregoing.

"Process" means to take any action or perform any operation or set of operations that the Services are capable of taking or performing on any data, information or other content, including to collect, receive, input, upload, download, record, reproduce, store, organize, compile, combine, log, catalog, cross-reference, manage, maintain, copy, adapt, alter, translate or make other derivative works or improvements, process, retrieve, output, consult, use, perform, display, disseminate, transmit, submit, post, transfer, disclose or otherwise provide or make available, or block, erase or destroy. "Processing" and "Processed" have correlative meanings.

"RBTS Disabling Device" means any software, hardware or other technology, device or means (including any back door, time bomb, time out, drop dead device, software routine or other disabling device) used by RBTS or its designee to disable Customer's or any Authorized User's access to or use of the Services automatically with the passage of time or under the positive control of RBTS or its designee.

"RBTS Materials" means the Service Software, specifications, Documentation and RBTS Systems and any and all other information, data, documents, materials, works and other content, devices, methods, processes, hardware, software and other technologies and inventions, including any deliverables, technical or functional descriptions, requirements, plans or reports, that are provided or used by RBTS or any Subcontractor in connection with the Services or otherwise comprise or relate to the Services or RBTS Systems. For the avoidance of doubt, RBTS Materials include Resultant Data and any information, data or other content derived from RBTS' monitoring of Customer's access to or use of the Services, but do not include Customer Data.

"RBTS Personnel" means all individuals involved in the performance of Services as employees, agents or independent contractors of RBTS or any Subcontractor.

"RBTS Systems" means the information technology infrastructure used by or on behalf of RBTS in performing the Services, including all computers, software, hardware, databases, electronic systems (including database management systems) and networks, whether operated directly by RBTS or through the use of third-party services.

"Representatives" means, with respect to a party, that party's and its Affiliates' employees, officers, directors, consultants, independent contractors, service providers, sublicensees, subcontractors and legal advisors.

"Resultant Data" means information, data and other content that is derived by or through the Services from Processing Customer Data and is sufficiently different from such Customer Data that such Customer Data cannot be reverse engineered or otherwise identified from the inspection, analysis or further Processing of such information, data or content. For the avoidance of doubt, Customer jobs, i.e. processes requested by the Customer and fulfilled using RBTS Services, are Resultant Data.

"Service Software" means the RBTS software application or applications and any third-party or other software, and all new versions, updates, revisions, improvements and modifications of the foregoing, that RBTS provides remote access to and use of as part of the Services.

"Territory" means the United States.

"Third Party Materials" means materials and information, in any form or medium, including any open-source or other software, documents, data, content, specifications, products, equipment or components of or relating to the Services that are not proprietary to RBTS.

Support schedule

Service Support. The Services include RBTS’ standard customer support services ("Support Services") at the support levels Customer purchases in accordance with the RBTS service support schedule then in effect, a current copy of which is available at portal.ryaneyes.com (or a successor website address) (the "Support Schedule"). RBTS may amend the Support Schedule from time to time in its sole discretion. Customer understands that Support Services shall not exceed two (2) hours per calendar month, and in the event that Support Services exceed two (2) hours per calendar month, Support Services shall be billed separately at RBTS’ then current rates (which is currently at $350 an hour as of the Effective Date).

Data breach

`PREFACE

The security of confidential information, including information relating to the Company products and property, as well as nonpublic personal information, is a high corporate priority. The timely and effective response to potential or actual breaches in the security of such information is critical to the ability to mitigate damage, correct system deficiencies and comply with applicable law.

The procedures prescribed in this Response and Reporting Plan are designed to increase the awareness of information security vulnerabilities and improve Company’s ability to respond appropriately to suspected data security breaches. They prescribe Company’s response and reporting protocols when a suspected or known data security incident occurs.

DEFINITIONS

For purposes of this Plan, the following terms have a specific meaning.

“Company” or “the Company” means Ryan Business and Technology Solutions, LLC and its U.S. affiliates and subsidiaries.

Company Confidential Information (“CCI”) means information whose economic value depends on its confidentiality within the Company, including, without limitation:

The Company’s business records, oral or electronic communications, or any other information regarding the Company’s inventions, discoveries, ideas, concepts, designs, specifications, work product, improvements, criteria, plans, data, proposals, documents, materials, trade secrets, technology, know-how, patent information, disclosures or applications, formulae, structures, models, techniques, standard operating procedures, standard working procedures, studies, methods, processes, programs, software, hardware, configurations, compositions, compounds, assays, protocols, customer lists, research and development activities, products, clinical trials, tests, cost data, pricing, suppliers, business partners, policies, technology, software, marketing and sales objectives and strategies, finances and financial projections or plans, or other business matters or prospective business materials.

“Company Representative” means any employee, contractor, or temporary staff member of the Company to the extent such individual handles, processes, or has access to CCI or NPI.

“Nonpublic Personal Information” (“NPI”) means:

Information in any media or format that identifies or may be used to identify an individual and the protection of which is governed by applicable data privacy or security law (including statutes, regulations, orders, etc.) and does not consist solely of information that is lawfully obtained from public sources, publicly available information, or from federal, state, or local government records lawfully made available to the general public. NPI may include, but is not limited to: (1) an individual’s first name and last name or first initial and last name¹ in combination with any one or more of the following data elements that relate to such individual: (a) Social Security number, (b) driver’s license number, (c) other government-issued identification number, (d) biometric identifier, (e) medical coverage number, or (f) financial account number or credit card/debit card number that would permit access to the individual’s financial account, and (2) health information together or in association with an identifier of an individual (such as initials, an e-mail address, a birth date, or any other identifying number or code).

NPI does not include anonymized data, such as aggregated data, as long as the aggregation is sufficient to prevent identification of an individual from that data either itself or in combination with publicly available data.

“Security Breach” means any incident that is deemed to constitute an information (data) security breach as defined by applicable federal, state, or local law, as well as any other incident involving a compromise in the security of CCI or NPI and may include incidents that result in such a compromise due to:

1. 1. - the theft or loss of a technology asset (laptop computer, PC hard drive, USB or other external drive or storage device, iPad, iPhone, or other Company-issued device) or information asset (e.g., paper, disk, or other medium);
    - unauthorized penetration of information technologies (e.g., computer intrusion, third- party threats);
    - the misuse of any technology asset of the Company; and
    - any other threat or compromise to the security or integrity of CCI or NPI.

“Security Incident” means an incident that involves or is suspected to involve a Security Breach and includes both incidents occurring within the Company or its technology systems and incidents occurring outside the Company (e.g., on the premises or systems of a service provider or business partner that collects, stores, uses, or transmits data provided to it by the Company).

“Third Party” means any person, company, or organization (e.g., a vendor or business partner), public authority/agency, or other entity outside of the Company that handles CCI or NPI provided by Company.

POLICIES AND PROCEDURES

1
INCIDENT DETECTION AND REPORTING.
1. 1.1Incident Awareness Training.
2. All Company Representatives must be educated on their responsibilities under this Plan to detect, report, and mitigate Security Incidents.
3. 1.2Incident Response Readiness.
4. The Core Incident Response Contact List contained in Appendix C should be completed and updated at least annually to ensure that the list includes current key internal contacts and external legal counsel. The completed list should be securely stored with Company’s Legal counsel and access to it should be limited to Company’s Legal counsel and management-level employees involved in executing this Plan.
5. 1.3Incident Discovery Reporting.
6. All Company Representatives must report any suspected or confirmed Security Incident immediately upon discovery, including upon notice of such an incident from a Third Party.
7. 1. 1.3.1Initial Incident Report
  2. Early detection and reporting of a Security Incident is critical. Company Representatives must email the RBTS support email address immediately if they detect or suspect the occurrence of a Security Incident. The support team will request the information called for in the Incident Reporting Form attached hereto as Appendix A. Company Representatives should provide any additional information that may facilitate an effective investigative response.
  3. 1.3.2Report to the Chief Privacy Officer (CPO)²
  4. All Security Incidents must be reported to the CPO, either immediately upon discovery of an incident involving a serious information risk or by Support personnel upon completion of an Incident Reporting Form. Initial reports should include all of the following to the full extent known:
  5. Contact information for the person making the report and any other persons who were involved in identifying the incident;
  6. Names and locations of persons, databases, systems, or other data involved with the incident;
  7. Nature and description of the incident;
  8. Approximate date and time of the incident;
  9. Date and time that the person making the report initially learned of the incident or otherwise when an Company Representative first learned of the incident;
  10. Any tracking or other identification numbers assigned to the incident or data, either by Company or by a vendor; and
  11. Any mitigation or remediation steps taken; and
  12. Any evidence (e.g., log files, physical evidence, etc.) that could help the investigation.

2
INITIAL ASSESSMENT AND COORDINATION
1. 2.1Initial Assessment
2. Upon receipt of an incident report, the CPO shall assess the reported information and make a preliminary determination regarding follow-up action. Except where the incident clearly poses no ongoing threat, the CPO should consult with the Company’s Legal counsel and, as appropriate, other members of the RBTS team.
3. Based on the report of the incident and any additional supporting information, the CPO will make an initial determination as to whether additional investigation is warranted.
4. 2.2Collection and Preservation of Evidence
5. All evidence concerning a Security Incident should be collected and, to the extent possible, preserved in its original form.
6. 2.3Involving Law Enforcement
7. If criminal activity is suspected, the CPO shall notify senior management and, in conjunction with Company’s Legal counsel, a determination should be made as to whether it is necessary and appropriate to report the incident to law enforcement officials.
8. 2.4Coordination; Incident Lead and Security Officer
9. The CPO will coordinate the incident investigation with Company’s Legal counsel and the CPO shall designate an individual to lead the investigation and response effort (the “Incident Lead”) (the CPO may be the Incident Lead).
10. The Incident Lead will take the lead role in handling the day-to-day follow-up response activities and in regularly updating management. The Incident Lead will:
11. 1. - Form an Incident Response Team, using those listed on the Core Incident Response Contact List and, as necessary, other appropriate personnel who are available to act immediately;
    - Coordinate efforts among all groups involved;
    - Identify key tasks;
    - Create a timeline for each step in the response process;
    - Notify all appropriate Company personnel, including, as warranted, senior management, as well as, subject to direction from senior management and Company’s Legal counsel, Company vendors, government authorities, media, and public relations firms; and
    - Document all steps taken to cure and mitigate harm resulting from the Security Incident.

3
INCIDENT INVESTIGATION
1. 3.1Securing Networks, Systems, and Data
2. The Director of Systems shall ensure that all necessary steps have been or are taken to close any security gaps.
3. 3.2Identifying Affected Data Elements and Securing Hard Copy Documents
4. The Incident Lead shall prepare an inventory of exposed data elements and shall ensure that appropriate personnel have taken steps needed to secure hard copy documents or electronic information in compliance with legal requirements as well as with Company’s document retention policies and document hold requirements.
5. 3.3Forensics Experts
6. If the nature of the incident cannot be fully determined using internal Company resources, the Incident Lead shall engage professional forensic experts to assist with the investigation.
7. 3.4Incident Classification
8. The Incident Lead, in consultation with the CPO and Company’s Legal counsel, as appropriate, and based on all information gathered regarding the incident, shall classify the incident according to the following five categories (see Appendix B for a detailed explanation of each classification):
9. 1. - Severe
    - High
    - Medium
    - Low
    - No Impact

4
INCIDENT CONTAINMENT AND DOCUMENTATION
1. 4.1Containment Action Plan
2. The Incident Lead is responsible for assigning personnel to undertake corrective actions to contain the impact of and risks posed by the Security Incident. For incidents with High or Severe impact, Company’s Legal counsel, and Director of Systems will provide input into and approve the containment action plans.
3. Depending on the incident nature and scope, such corrective actions may include:
4. 1. - Physically isolating the affected host(s);
    - Changing all passwords or disabling systems to which the attacker may have had access;
    - Disabling access to compromised file or data systems that are shared with other computers;
    - Continued monitoring of system and network activities;
    - Changing business or administrative processes or systems;
    - Educating and alerting Company Representatives of exposure risks;
    - Revising vendor contracts or statements of work;
    - Conducting vendor site reviews, audits, or other assessments or requiring vendor certification of changes or corrections to business or administrative processes or systems; and
    - Conducting audits, reviews, or other self-assessments of Company processes or systems.
5. 4.2Documentation
6. The CPO is responsible for reviewing and finalizing the following documentation for incidents with low, medium, high, and severe impact:
7. 1. - Incident report(s);
    - Investigative reports, which should include a summary of the incident, a root cause analysis, and recommended corrective action, if any; and
    - Documentation regarding any corrective action taken.
8. Documentation of each Security Incident should be made either by preparing a written report containing substantially the same information as would be included in such logs.

5
BREACH NOTIFICATION
1. 5.1Assessing the Need for Notifications
2. Based on the CPO’s initial classification of each Security Incident, the Company’s Legal counsel, in consultation with the Incident Lead, will determine if the incident involves a “breach” of information security within the meaning of applicable breach notification laws and whether notification therefore must or should be provided to any of the following and/or others:
3. 1. - Individuals whose personal information apparently was involved in a security breach (as defined by law);/li>
    - Law enforcement agencies;/li>
    - State or federal agencies; and/li>
    - The media
4. 5.2Identifying Individuals to Notify
5. If notifications to individuals are required by applicable law, the CPO and the Incident Lead shall:
6. 1. - Prepare a list of apparently affected individuals, to the best of Company’s knowledge; and
    - Use public sources to seek current contact information for individuals if needed for notification letters.
7. 5.3Preparing Notification Letters
8. The CPO and the Company’s Legal counsel shall coordinate to prepare the text of notification letters in accordance with applicable law, which generally shall include statements regarding:
9. 1. - The nature of the incident;
    - The categories of personal information that were compromised;
    - The types of risks that the individual may be exposed to or a statement that harm is not likely as a result of the breach;
    - The actions being taken by Company to mitigate any possible harm;
    - Steps individuals can take to mitigate any possible harm, such as how to obtain free credit reports and how to file fraud alerts with nationwide credit reporting agencies;
    - The need for individuals to remain vigilant over the next 12 to 24 months and to promptly report incidents of suspected identity theft; and
    - The availability of online guidance from the Federal Trade Commission (“FTC”) regarding measures to protect against identity theft, with directions for the individual to report any suspected incidents of identity theft to the FTC.
10. 5.4Notifications to Others
11. Notification letters to federal, state, and local authorities must be addressed to appropriate agencies and contain the specific information required by applicable law. Company’s Legal counsel will advise on the content and specific recipients of such letters based on the scope of the incident and an analysis of applicable law.
12. The Incident Lead and the Company’s Legal counsel shall also address and ensure compliance with any other legal requirements related to breach notification, including notification to consumer reporting agencies, credit/debit card companies, and the media.

6
INCIDENT COMMUNICATIONS
1. 6.1Implement Communications Plan
2. For any incident that is classified as a High or Severe event under the classifications described in Appendix B, the Incident Lead, the CPO, the Company’s Legal counsel , and senior management shall establish a communications plan in order to control the flow of information and help prevent false or misleading reports about the incident. The following steps should be taken when developing the communications plan:
3. 1. - Create communications outlining:
    - Basic facts (what happened, what data was exposed, to whom)
    - Steps Company is taking to prevent reoccurrence
    - Steps Company is taking to mitigate harm;
    - Determine the executive(s) who will deliver messages and obtain media training for the them if necessary; and
    - Create FAQs to support the communications plan.
4. 6.2Standby Media Statements
5. Messages should be prepared to be ready to provide to the media, even if there is no current plan or requirement to report a particular incident to the media.
6. 6.3Responding to Individuals
7. The content and timing of any responsive communications with individuals should be coordinated with any formal notifications being provided under applicable breach notification laws. The CPO and Incident Lead, with input from the Company’s Legal counsel and local IT as appropriate, shall determine how questions from affected individuals will be managed. This could be done by:
8. 1. - Establishing a designated e-mail address to which inquiries should be sent;
    - Posting FAQs on the Company website; or
    - Establishing a call center to receive inquiries.
    - If a call center is established, obtain a toll-free number and train personnel on messages.

7
REMEDIATION FOR INDIVIDUALS
1. 7.1Offering Remedial Assistance to Affected Individuals
2. 1. 7.1.1Additional Corrective Action as Warranted
  2. The CPO will participate in additional discussions around corrective action as warranted by the Security Incident.

8
POST-INCIDENT REVIEW; CLOSING DOCUMENTATION
1. The CPO and Incident Lead shall conduct a post-incident review to determine what steps can be taken to prevent reoccurrence. They shall obtain input from all involved with the incident’s occurrence, discovery, investigation, containment, notification, and remediation. The CPO and Incident Lead shall document and distribute an analysis of the incident and the response to it as a means to facilitate organizational learning. The CPO may also recommend additional specific controls or improvements to the Information Security Program, including additional training, enhanced call center services, etc.

¹ A person’s first and last name or first initial and last name in an e-mail address would qualify as NPI if combined with any of the other data elements listed.

² For purposes of this Plan, the Chief Privacy Officer is the VP of Corporate Ethics and Compliance or his/her designee.

APPENDIX A
INCIDENT DISCOVERY REPORTING FORM

Download Now

APPENDIX B
SECURITY INCIDENT CLASSIFICATIONS

The nature and severity of a security incident will determine the appropriate response strategy. The Incident Lead, together with CPO and Legal, will classify the severity of the incident based on the definitions below. The classification of an incident may be escalated or downgraded based on changes in circumstances and the discovery of additional information.

Classification levels are defined as follows:

No impact. A report and investigation determined that no unauthorized access to, acquisition of, or other disclosure of Company Confidential Information (“CCI”) or Nonpublic Personal Information (“NPI”) occurred.

Low. A low-level event is an event that causes inconvenience, aggravation, and/or minor costs associated with recovery, unintentional actions at the user or administrator level, or unintentional damage or minor loss of recoverable information. The event will have little, if any, material impact on Company’s operations or reputation. Examples: policy or procedural violations, confirmed virus infections, unusual system performance or behavior, system crashes, installation of unauthorized software, and scans of systems.

Medium. A medium-level event is an event that may cause damage, corruption, or loss of replaceable information without compromise or may have a moderate impact on Company’s operations or reputation. Examples: misuse or abuse of authorized access, accidental intrusion, sharing of passwords, unexplained access-privilege changes, or unusual after-hour activities.

High. A high-level event is an event that can cause significant damage, corruption, compromise, or loss of CCI. The event can result in potential damage and liability to Company and to its public image and may degrade customer confidence concerning products and services. Examples: computer intrusions, compromise of critical information, widespread virus infection, attacks against the IT infrastructure (e.g., domain name servers, firewalls, and backup systems) and denial-of-service attacks that disable a critical service or impede business performance.

Severe. A severe event is determined to involve unauthorized access to or acquisition of NPI, with the exception of access to information of less than ten Company Representatives by other Company Representatives, with no further unauthorized access to the NPI by other persons.

APPENDIX C
INCIDENT RESPONSE CONTACT LIST

Incident response contact list available. Please call 1 (347) 759 0105.

Privacy policy

Ryan Business and Technology Solutions, LLC Privacy Policy

The RyanEyes software was created and is maintained by Ryan Business and Technology Solutions, LLC (“RBTS”). This Privacy Policy applies to the RyanEyes.com website, and it explains the information that we collect, the ways in which this information is used, the limited situations in which it is shared and the security that is provided for your data. The policy applies to the RyanEyes mobile application as well as the website.

By accessing RyanEyes.com or the mobile site you consent to the processing of your information in accordance with the US laws that apply.

Information You Provide to Us

When you sign up to join RyanEyes.com you will be asked to supply information such as your name, email address and phone number. We use reasonable and adequate data security measures to protect your information in accordance with our security policy. There are limited situations where the information will be shared, and they are listed below.

Information We Collect Automatically When You Use the Services

The RyanEyes website is designed to track information that can be collected automatically from users. This gathering is in accordance with industry standards and is done to improve the website to create a superior user experience in the future. The collected information falls into two categories, basic information about your connection and information about activity that you undertake while you are logged into the website or the mobile application. The connection information is broken down between log information (browser type, date accessed, web pages visited), device information (computer type and operating system) and location information.

RBTS uses standard analytic tools to track the activity undertaken during a session on RyanEyes.com. This includes such things as time spent on each page, areas scrolled and items clicked. This data is aggregated for feedback purposes and is not reviewed individually.

Use of Information

The information that is collected is not generally associated with the user login information because the goal is to improve the user experience. Toward this end RBTS will evaluate the information collected and decide on areas where the system needs enhancement in order to improve the operating efficiency or reduce confusion in the way the system is utilized. RBTS may also send technical guides and support notifications based on the data and may design tutorials where educational opportunities are identified.

Sharing of Information

RBTS will not share any personal information unless required by a government agency or a lawsuit. Information regarding your usage of RyanEyes.com will be shared with employees and vendors where it is required in order to enhance the experience as detailed in the Use of Information section above.

If RBTS, or substantially all of its assets, were acquired, or in the unlikely event that RBTS goes out of business or enters bankruptcy, user information would be one of the assets that is transferred or acquired by a third party. You acknowledge that such transfers may occur, and that any acquirer of RBTS may continue to use your personal information as set forth in this policy.

Analytics Services Provided by Others

As mentioned above, RBTS will use industry standard analytics services to gather user experience information. This may include the use of tools supplied by external vendors.

Security

RBTS maintains reasonable and adequate data security practices to design measures to protect your information from access, misuse or loss. Multiple tools are used to protect RyanEyes.com from intrusion and to protect your data and our analysis from loss.

Privacy Policy Changes

Although most changes are likely to be minor, RBTS may change its Privacy Policy from time to time at RBTS’s sole discretion. RBTS encourages visitors to frequently check this page for any changes to its Privacy Policy. Your continued use of this site after any change in this Privacy Policy will constitute your acceptance of such change.

Contact Us

Questions, comments or complaints regarding RBTS's Privacy Policy or data collection and processing practices can be emailed to support@ryaneyes.com

You may also call us at 347 759 0105.

Permitted Use

1.1Reservation of Rights. Nothing in this Agreement grants any right, title or interest in or to (including any license under) any Intellectual Property Rights in or relating to, the Services, RBTS Materials or Third Party Materials, whether expressly, by implication, estoppel or otherwise. All right, title and interest in and to the Services, the RBTS Materials and the Third Party Materials are and will remain with RBTS and the respective rights holders in the Third Party Materials.
1.2Authorization Limitations and Restrictions. Customer shall not, and shall not permit any other Person to, access or use the Services or RBTS Materials except as expressly permitted by this Agreement and, in the case of Third-Party Materials, the applicable third-party license agreement. For purposes of clarity and without limiting the generality of the foregoing, Customer shall not, except as this Agreement expressly permits:

(a)copy, modify or create derivative works or improvements of the Services or RBTS Materials;
(b)rent, lease, lend, sell, sublicense, assign, distribute, publish, transfer or otherwise make available any Services or RBTS Materials to any Person, including on or in connection with the internet or any time-sharing, service bureau, software as a service, cloud or other technology or service;
(c)reverse engineer, disassemble, decompile, decode, adapt or otherwise attempt to derive or gain access to the source code of the Services or RBTS Materials, in whole or in part;
(d)bypass or breach any security device or protection used by the Services or RBTS Materials or access or use the Services or RBTS Materials other than by an Authorized User through the use of his or her own then valid Access Credentials;
(e)input, upload, transmit or otherwise provide to or through the Services or RBTS Systems, any information or materials that are unlawful or injurious, or contain, transmit or activate any Harmful Code;
(f)damage, destroy, disrupt, disable, impair, interfere with or otherwise impede or harm in any manner the Services, RBTS Systems or RBTS' provision of services to any third party, in whole or in part;
(g)remove, delete, alter or obscure any trademarks, Specifications, Documentation, warranties or disclaimers, or any copyright, trademark, patent or other intellectual property or proprietary rights notices from any Services or RBTS Materials, including any copy thereof;
(h)access or use the Services or RBTS Materials in any manner or for any purpose that infringes, misappropriates or otherwise violates any Intellectual Property Right or other right of any third party (including by any unauthorized access to, misappropriation, use, alteration, destruction or disclosure of the data of any other customer), or that violates any applicable Law;
(i)access or use the Services or RBTS Materials for purposes of competitive analysis of the Services or RBTS Materials, the development, provision or use of a competing software service or product or any other purpose that is to RBTS' detriment or commercial disadvantage; or
(j)otherwise access or use the Services or RBTS Materials beyond the scope of the authorization granted under Section 2.1.

1.3Service Use and Data Storage. Schedule A sets forth a schedule of Fees for designated levels of Hosted Service usage and data storage (each a "Service Allocation"), beginning with the Fees payable by Customer for the levels of Hosted Service usage and data storage in effect as of the Effective Date. RBTS will use commercially reasonable efforts to notify Customer in writing if Customer has reached ninety percent (90%) of its then current Service Allocation and Customer may increase its Service Allocation and corresponding Fee obligations in accordance with Schedule A. If Customer exceeds its Service Allocation by more than ten percent (10%) for any relevant period, Customer shall also pay to RBTS the applicable excess usage and storage Fees set forth in Schedule A. Customer acknowledges that exceeding its then-current Service Allocation may result in service degradation for Customer and other RBTS customers and agrees that:

(a)RBTS has no obligation to permit Customer to exceed its then-current Service Allocation;
and
(b)Customer is not entitled to any Service Level Credits for periods during which Customer exceeds its then-current Service Allocation, regardless of whether the Hosted Services fail to meet the Availability Requirement during such period.

2Customer Obligations.

2.1Customer Systems and Cooperation. Customer shall at all times during the Term: (a) set up, maintain and operate in good repair and in accordance with the Specifications all Customer Systems on or through which the Services are accessed or used; (b) provide RBTS Personnel with such access to Customer's premises and Customer Systems as is necessary for RBTS to perform the Services in accordance with the Availability Requirement and Specifications; and (c) provide all cooperation and assistance as RBTS may reasonably request to enable RBTS to exercise its rights and perform its obligations under and in connection with this Agreement.

1Services.

2Authorization and Customer Restrictions.

3Customer Obligations.

4Service Downtime. RBTS will schedule, at its sole discretion, downtime for routine maintenance of the Hosted Services ("Scheduled Downtime").

5Customer Obligations. The Services do not replace the need for Customer to maintain regular data backups or redundant data archives. RBTS HAS NO OBLIGATION OR LIABILITY FOR ANY LOSS, ALTERATION, DESTRUCTION, DAMAGE, CORRUPTION OR RECOVERY OF CUSTOMER DATA.

6Security

7Fees. The fees for the Services are waived during the Term. Customer shall bear its own costs and expenses of performance and evaluation hereunder.

8Intellectual Property Rights.

9Confidentiality.

10Term and Termination.

11Representations and Warranties.

12Indemnification.

13Limitations of Liability.

14Force Majeure.

15Miscellaneous.

APPENDIX 1DEFINTIONS

Support schedule

Data breach

`PREFACE

DEFINITIONS

POLICIES AND PROCEDURES

1INCIDENT DETECTION AND REPORTING.

2INITIAL ASSESSMENT AND COORDINATION

3INCIDENT INVESTIGATION

4INCIDENT CONTAINMENT AND DOCUMENTATION

5BREACH NOTIFICATION

6INCIDENT COMMUNICATIONS

7REMEDIATION FOR INDIVIDUALS

8POST-INCIDENT REVIEW; CLOSING DOCUMENTATION

APPENDIX AINCIDENT DISCOVERY REPORTING FORM

APPENDIX BSECURITY INCIDENT CLASSIFICATIONS

APPENDIX CINCIDENT RESPONSE CONTACT LIST

Privacy policy

Ryan Business and Technology Solutions, LLC Privacy Policy

Information You Provide to Us

Information We Collect Automatically When You Use the Services

Use of Information

Sharing of Information

Analytics Services Provided by Others

Security

Privacy Policy Changes

Contact Us

Permitted Use

2Customer Obligations.

Submission Successful

1
Services.

2
Authorization and Customer Restrictions.

3
Customer Obligations.

9
Confidentiality.

10
Term and Termination.

11
Representations and Warranties.

12
Indemnification.

13
Limitations of Liability.

14
Force Majeure.

15
Miscellaneous.

APPENDIX 1
DEFINTIONS

1
INCIDENT DETECTION AND REPORTING.

2
INITIAL ASSESSMENT AND COORDINATION

3
INCIDENT INVESTIGATION

4
INCIDENT CONTAINMENT AND DOCUMENTATION

5
BREACH NOTIFICATION

6
INCIDENT COMMUNICATIONS

7
REMEDIATION FOR INDIVIDUALS

8
POST-INCIDENT REVIEW; CLOSING DOCUMENTATION

APPENDIX A
INCIDENT DISCOVERY REPORTING FORM

APPENDIX B
SECURITY INCIDENT CLASSIFICATIONS

APPENDIX C
INCIDENT RESPONSE CONTACT LIST