SERVICE AGREEMENT. for LEXIS NEXIS KNOWLEDGE BASED AUTHENTICATION SERVICES

Transcription

1 SERVICE AGREEMENT for LEXIS NEXIS KNOWLEDGE BASED AUTHENTICATION SERVICES THIS SERVICE AGREEMENT ("AGREEMENT") IS EFFECTIVE AS OF THE DATE OF THE CUSTOMER S SIGNED ACCEPTANCE OF THE APPLICABLE QUOTATION MAKING REFERENCE TO THIS AGREEMENT. ANY AND ALL REFERENCES TO "CUSTOMER" SHALL BE DEEMED TO MEAN THE CUSTOMER AS SET FORTH IN AN APPLICABLE QUOTATION ISSUED BY RSA. IF CUSTOMER IS LOCATED IN (1) THE UNITED STATES, THEN THIS IS A LEGAL AGREEMENT BETWEEN THE CUSTOMER AND RSA WITH RSA MEANING RSA SECURITY LLC; OR (2) THE UNITED KINGDOM, THEN THIS IS A LEGAL AGREEMENT BETWEEN THE CUSTOMER AND RSA, WITH RSA MEANING THE LOCAL EMC SALES SUBSIDIARY IN THE UNITED KINGDOM. RSA AND CUSTOMER SHALL HEREINAFTER BE REFERRED TO INDIVIDUALLY AS A PARTY AND COLLECTIVELY AS THE PARTIES. REFERENCES TO LN HEREIN MEAN LEXISNEXIS RISK SOLUTIONS FL INC. ANY QUOTATION ISSUED TO OR SIGNED BY A CUSTOMER WHO IS NOT LOCATED IN THE UNITED STATES OR THE UNITED KINGDOM IS NULL AND VOID. THIS AGREEMENT SETS FORTH THE TERMS AND CONDITIONS UNDER WHICH CUSTOMER WILL RECEIVE AND USE THE KNOWLEDGE BASED AUTHENTICATION SERVICES PROVIDED BY LN ( SERVICES ). 1. RESTRICTED LICENSE RSA hereby grants to Customer a restricted license to use the Services in conjunction with the data contained therein, subject to the obligations, restrictions and limitations set forth below: i. Generally. RSA hereby grants to Customer a restricted, non-exclusive, personal, non-transferrable, non-sublicenseable license to use the Services solely for Customer s own internal business purposes. Customer represents and warrants that all of Customer s use of the Services shall be for only its own legitimate business purposes consistent with these terms and conditions between Customer and RSA. Customer shall not use the Services for marketing purposes or resell or broker the Services to any third party and shall not use the Services for personal (non-business) purposes. Customer shall not use the Services to provide data processing services to thirdparties or evaluate the data of or for third-parties. Customer agrees that if RSA determines that continued provision of Services to Customer may entail or result in a breach of any of these terms and conditions or any laws or regulations RSA may immediately suspend the delivery of, and license to use, the Services. Customer shall not access the Services from Internet Protocol addresses located outside of the United States and its territories without RSA s prior written approval. Customer may not use the Services to create a competing product. Customer shall not use the information returned from the Services to formulate questions or the like so as to provide question based identity verification services. Customer shall comply with all laws, regulations and rules which govern the use of the Services and information provided therein. In the event that Customer desires to make a change or desires that a change be made to the Services, which in either case could be considered a material change to the Services, Customer must first provide information in regard to the desired change to RSA and obtain RSA s consent thereto. Examples of changes which would be material include without limitation a change of control of the Customer entity, a material change of the user group within the Customer utilizing such Services, and a change in regard to whether the Services are integrated or bundled with either RSA s, Customer s, or a third party s products or services and regardless of whether any of the foregoing products or services are proprietary to Customer or not. Without RSA s written agreement to make a change, Customer may not make such change. Customer shall not resell or otherwise provide or transfer the Services in whole or in part to any other person or entity. ii. GLBA Data. Some of the information contained in the Services is nonpublic personal information, as defined in the Gramm-Leach-Bliley Act (15 U.S.C. 6801, et seq.) and related state laws, (collectively, the GLBA ), and is regulated by the GLBA ( GLBA Data ). Customer shall not obtain and/or use GLBA Data through the Services, in any manner that would violate the GLBA, or any similar state or local laws, regulations and rules. Customer Page 1 of 7

2 acknowledges and agrees that it may be required to certify its permissible use of GLBA Data falling within an exception set forth in the GLBA at the time it requests information in connection with certain Services. Customer certifies with respect to GLBA Data received through the Services that it complies with the Interagency Standards for Safeguarding Customer Information issued pursuant to the GLBA. iii. DPPA Data. Some of the information contained in the Services is personal information, as defined in the Drivers Privacy Protection Act (18 U.S.C. 2721, et seq.) and related state laws, (collectively, the DPPA ), and is regulated by the DPPA ( DPPA Data ). Customer shall not obtain and/or use DPPA Data through the Services in any manner that would violate the DPPA. Customer acknowledges and agrees that it may be required to certify its permissible use of DPPA Data at the time it requests information in connection with certain Services. iv. Social Security and Driver s License Numbers. If Customer obtains Social Security numbers or Driver s License Numbers (collectively SSNs ) through the Services, Customer certifies it will not use the SSNs for any purpose other than as expressly authorized by the terms and conditions herein and applicable laws and regulations. In addition to the restrictions on distribution otherwise set forth in Section 2 below, Customer agrees that it will not permit SSNs obtained through the Services to be used by an employee or contractor that is not an authorized user with an authorized use. Customer agrees it will certify, in writing, its uses for SSNs and recertify the same if required by RSA. v. Copyrighted and Trademarked Materials. Customer shall not remove or obscure any trademarks, copyright notices or other notices contained on materials accessed through the Services. Both parties acknowledge and agree that they may receive personal information about individual consumers or other proprietary or confidential information under this Agreement which requires confidential treatment., including but not limited to technical, developmental, operating, computer system, software, performance, cost, know-how and process information. In regard to proprietary or confidential information marked as such or information which one in the industry might reasonably regard as any proprietary or confidential, each Party warrants that (a) except as otherwise permitted by this Agreement, it will maintain any proprietary or confidential information obtained in strict confidence and will not disclose such information other than to its employees who have a need to know; and (b) will use the information only for purposes of this Agreement; and (c) in regard to Customer, shall not disassemble, decompile, or reverse engineer any of the Services; and (d) in regard to Customer, shall not create, attempt to resell, or resell any derivative works from the Services; and (e) in regard to Customer, shall not copy or retain any of the data or information transmitted by the Services; and (f) in regard to Customer, shall not modify or alter the Services in any way. Upon termination of this Agreement or at the request of RSA, Customer will promptly return to RSA all proprietary and confidential information provided to Customer by RSA and any copies thereof. vi. National Change of Address Database. LN is a licensee of the United States Postal Service s NCOALINK database ( NCOA Database ). The information contained in the NCOA Database is regulated by the Privacy Act of 1974 and may be used only to provide a mailing list correction service for lists that will be used for preparation of mailings. If Customer receives all or a portion of the NCOA Database through the Services, Customer hereby certifies to RSA that it will not use such information for any other purpose. Prior to obtaining or using information from the NCOA Database, Customer agrees to complete, execute and submit to RSA the NCOA Processing Acknowledgement Form. vii. Fair Credit Reporting Act. The Services provided pursuant to this Agreement are not provided by consumer reporting agencies, as that term is defined in the Fair Credit Reporting Act, (15 U.S.C. 1681, et seq.), (the FCRA ), and do not constitute consumer reports as that term is defined in the FCRA. Accordingly, the Services may not be used in whole or in part as a factor in determining eligibility for credit, insurance, employment or another purpose in connection with which a consumer report may be used under the FCRA. Further, (A) Customer certifies that it will not use any of the information it receives through the Services to determine, in whole or in part an individual s eligibility for any of the following products, services or transactions: (1) credit or insurance to be used primarily for personal, family or household purposes; (2) employment purposes; (3) a license or other benefit granted by a government agency; or (4) any other product, service or transaction in connection with which a consumer report may be used under the FCRA or any similar state statute, including without limitation apartment rental, check-cashing, or the opening of a deposit or transaction account; (B) by way of clarification, without limiting the foregoing, Customer may use, except as otherwise prohibited or limited by this Agreement, information received through the Services for the following purposes: (1) to verify or authenticate an individual s identity; (2) to prevent or detect fraud or other unlawful activity; and (C) Customer shall not use any of the information it receives through the Services to take any adverse action as that term is defined in the FCRA. viii. MVR Data. If Customer is permitted to access Motor Vehicle Records ( MVR Data ), without in any way limiting Customer s obligations to comply with all state and federal laws governing use of MVR Data, the following specific restrictions apply and are subject to change: a. Customer shall not use any MVR Data, or portions of information contained therein, to create or update a file that Customer uses to develop its own source of driving history information. Page 2 of 7

3 b. As requested by RSA, Customer shall complete any state forms that LN is legally or contractually bound to obtain from Customer before providing Customer with MVR Data. c. RSA (and certain third party vendors) may conduct reasonable and periodic audits of Customer s use of MVR Data. Further, in response to any audit, Customer must be able to substantiate the reason for each MVR Data order. ix. American Board of Medical Specialties ( ABMS ) Data. If Customer is permitted to access ABMS Data, Customer shall not use, nor permit others to use, ABMS Data for purposes of determining, monitoring, tracking, profiling or evaluating in any manner the patterns or frequency of physicians prescriptions or medications, pharmaceuticals, controlled substances, or medical devices for use by their patients. x. HIPAA. Customer represents and warrants that Customer will not provide RSA with any Protected Health Information (as that term is defined in 45 C.F.R. Sec ) or with Electronic Health Records or Patient Health Records (as those terms are defined in 42 U.S.C. Sec (5), and 42 U.S.C. Sec (11), respectively) or with information from such records without the execution of a separate agreement between the parties. xi. Retention of Records. For uses of GLB Data, DPPA Data and MVR Data, as described in Sections 1(ii), 1(iii) and 1(viii), Customer shall maintain for a period of five (5) years a complete and accurate record (including consumer identity, purpose and, if applicable, consumer authorization) pertaining to every access to such data. 2. SECURITY Customer acknowledges that the information available through the Services may include personally identifiable information and it is Customer s obligation to keep all such accessed information confidential and secure. Accordingly, Customer shall (a) restrict access to Services to those employees who have a need to know as part of their official duties; (b) ensure that none of its employees shall (i) obtain and/or use any information from the Services for personal reasons, or (ii) transfer any information received through the Services to any Party except as permitted hereunder; (c) keep all user identification numbers, and related passwords, or other security measures (collectively, User IDs ) confidential and prohibit the sharing of User IDs; (d) immediately deactivate the User ID of any employee who no longer has a need to know, or for terminated employees on or prior to the date of termination; (e) in addition to any obligations under Section 1, take all commercially reasonable measures to prevent unauthorized access to, or use of, the Services or data received therefrom, whether the same is in electronic form or hard copy, by any person or entity; (f) maintain and enforce data destruction procedures to protect the security and confidentiality of all information obtained through Services as it is being disposed; (g) unless otherwise required by law or for legal or regulatory compliance purposes, purge all information received through the Services and stored electronically or on hard copy by Customer within ninety (90) days of initial receipt; (h) be capable of receiving the Services where the same are provided utilizing secure socket layer, or such other means of secure transmission as is deemed industry standard. Customer agrees that on at least a quarterly basis it will review searches performed by its User IDs to ensure that such searches were performed for a legitimate business purpose and in compliance with all terms and conditions herein. Customer will promptly notify RSA and LN in writing if Customer suspects, has reason to believe or confirms that a User ID or the Services (or data derived directly or indirectly therefrom) is or has been lost, stolen, compromised, misused or used, accessed or acquired in an unauthorized manner or by any unauthorized person, or for any purpose other than legitimate business reasons. Customer shall remain solely responsible for remediation for any related security breach, including applicable consumer and regulator notices. Customer agrees that such notification shall not reference LN or RSA or the product through which the data was provided, nor shall LN or RSA be otherwise identified or referenced in connection with such a security event, without LN or RSA s express written consent, respectively. In the event of a security event, RSA or LN may, in its sole discretion, take immediate action, including suspension or termination of Customer s account, without further obligation or liability of any kind. Upon expiration or termination of this Agreement, the license granted herein will automatically terminate. If so requested upon termination or expiration, Customer will certify in writing that i) it has either returned to RSA or destroyed all copies of the Services or derivatives thereof in its possession or ii) it has purged its computer system thereof, inclusive of back-up or archival copies, except as required for legal or regulatory compliance purposes. 3. PERFORMANCE Customer acknowledges and agrees that RSA obtains its data from third party sources, which may or may not be completely thorough and accurate, and that Customer shall not rely on RSA for the accuracy or completeness of information supplied through the Services. Without limiting the foregoing, the criminal record data that may be provided as part of the Services may include records that have been expunged, sealed, or otherwise have become inaccessible to the public since the date on which the data was last updated or collected. Page 3 of 7

4 4. INTELLECTUAL PROPERTY; CONFIDENTIALITY Customer agrees that Customer shall not reproduce, retransmit, republish, or otherwise transfer the Services' information, programs or computer applications. Customer acknowledges that RSA (and/or its third party data providers) shall retain all right, title, and interest under applicable contractual, copyright, patent, trademark, trade secret and related proprietary rights in and to the Services and the data and information that they provide and any documentation provided therewith. Notwithstanding anything in this Agreement to the contrary, RSA or RSA s data provider shall own Customer s search inquiry data used to access the Services (in the past or future) and may use such data for any purpose consistent with applicable federal, state and local laws, rules and regulations. Customer hereby agrees that RSA may provide to LN a copy of Customer s agreement with RSA, any documentation related thereto, and any documentation related to credentialing or auditing, all as deemed necessary in RSA s discretion. 5. WARRANTIES; DISCLAIMER OF WARRANTIES; LIMITATION OF LIABILITY Neither RSA, nor its subsidiaries and affiliates (including their respective, employees, agents, officers, directors) nor any third party data provider shall be liable to Customer for any: (i) damage or loss arising from or related to performance of the Services; (ii) claims for indemnification, warranties, or any other basis for liability; and (iii) loss or injury arising out of or caused in whole or in part by RSA's and/or any third party data provider acts or omissions in procuring, compiling, collecting, interpreting, reporting, communicating, or delivering the Services. For the avoidance of any doubt: (a) nothing herein creates any third party beneficiary rights and obligation in favor of any aggrieved person on whom data may have been provided to the Customer in the courses of Customer s use of the services; and (b) Customer acknowledges that RSA disclaims all liability for any and all claim for damages, injury or loss incurred by any such aggrieved person. Customer accepts all information AS IS. BECAUSE THE SERVICES INVOLVE CONVEYING INFORMATION PROVIDED BY OTHER SOURCES, RSA CANNOT AND WILL NOT BE AN INSURER OR GUARANTOR OF THE ACCURACY OR RELIABILITY OF THE SERVICES, DATA CONTAINED IN ANY DATABASE, OR DATA CONTAINED IN THE SERVICES. RSA DOES NOT GUARANTEE OR WARRANT THE ACCURACY, TIMELINESS, COMPLETENESS, CURRENTNESS, MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE OF THE SERVICES, INFORMATION IN THE SERVICES OR THE MEDIA ON OR THROUGH WHICH THE SERVICES ARE PROVIDED. RSA SHALL NOT BE LIABLE TO CUSTOMER OR OTHER THIRD PARTIES FOR ANY LOSS OR INJURY ARISING OUT OF OR CAUSED IN WHOLE OR IN PART BY RSA ACTS OR OMISSIONS, WHETHER NEGLIGENT OR OTHERWISE, IN PROCURING, COMPILING, COLLECTING, INTERPRETING, REPORTING, COMMUNICATING OR DELIVERING THE SERVICES OR INFORMATION THEREIN. RSA S TOTAL LIABILITY (INCLUDING THE LIABILITY OF ANY SUPPLIER, SUBCONTRACTOR, EMPLOYEE OR AGENT OF RSA), AND CUSTOMER S SOLE AND EXCLUSIVE REMEDY FOR ANY CLAIM OF ANY TYPE WHATSOEVER ARISING OUT OF OR IN CONNECTION WITH ANY SERVICES PROVIDED HEREUNDER, SHALL BE LIMITED TO PROVEN DIRECT DAMAGES CAUSED BY RSA S SOLE NEGLIGENCE IN AN AMOUNT NOT TO EXCEED THE PRICE PAID BY CUSTOMER TO RSA IN THE TWELVE (12) MONTH PERIOD IMMEDIATELY PRECEDING THE EVENT GIVING RISE TO A CLAIM HEREUNDER. RSA (INCLUDING RSA S SUPPLIERS, SUBCONTRACTORS, EMPLOYEES AND AGENTS) DISCLAIMS AND SHALL HAVE NO LIABILITY TO CUSTOMER FOR ANY SPECIAL, CONSEQUENTIAL, EXEMPLARY, INCIDENTAL, OR INDIRECT DAMAGES (INCLUDING, BUT NOT LIMITED TO, LOSS OF PROFITS, REVENUES, DATA AND/OR USE), EVEN IF ADVISED OF THE POSSIBILITY THEREOF. 6. INDEMNITY Customer shall defend, indemnify, and hold both LN and RSA and their respective Affiliates, directors, officers, employees, and agents, harmless from and against any and all third party claims and charges and corresponding losses, damages, judgments, costs, and expenses (including reasonable attorney s fees) ( Losses ) which RSA suffers or incurs to the extent arising out of (i) Customer s violation of law or regulation applicable to Customer; or (ii) a Customer Security Event (as defined below); or (iii) any access, use, disclosure, sale, transfer, assignment, conveyance, representation, publication, storage, or retention of the Services or any data therein by Customer in violation of this Agreement. A Customer Security Event means the unauthorized acquisition, loss or misuse of or to personally identifiable information (i) provided by or accessed through the Services; or (ii) resulting from a third party s use of knowledge or data gained from quizzes generated as part of the Services. Page 4 of 7

5 7. CREDENTIALING AND AUDIT RSA is responsible for credentialing and auditing Customer with respect to the Services, which credentialing and auditing may include a formal review program and informal discussions/reviews undertaken as part of ongoing customer relationship management. Customer understands and agrees that RSA may investigate and confirm that Customer has a permissible purpose for receiving the Services and that Customer will act in accordance with this Agreement and applicable law. In addition, RSA may credential Customer prior to allowing Customer access or use the Services. Customer agrees that RSA has no obligation to allow Customer to receive the Services and that Customer will not be allowed to receive, or continue to receive in the event of an audit, the Services or any data provided therein unless and until successful completion of the credentialing or auditing processes. Furthermore, Customer understands and agrees that, in order to ensure compliance with the FCRA, GLBA, DPPA, other similar state or federal laws, regulations or rules, regulatory agency requirements, these terms and conditions, and RSA s obligations under its contracts with its data providers and RSA s internal policies, RSA may conduct periodic reviews of Customer s use of the Services and may, upon reasonable notice, audit Customer s records, processes and procedures related to Customer s use, storage and disposal of Services and information received therefrom. Customer shall fully cooperate with such reviews and audits. Customer shall provide RSA reasonable access to such properties, records and personnel as may be reasonably required for such purpose. Violations discovered in any review or audit may be subject to immediate action including, but not limited to, legal action, suspension of the provision of the Services or referral to federal or state regulatory agencies. In the event that Customer s affiliate, branch or department ( Customer Affiliate ) also wishes to access or use the Services, Customer shall first provide RSA information regarding the permissible purpose for which the Customer Affiliate shall use the Services and information documenting the nature of the affiliation and the business type and any other information or documentation which may be required by RSA in the credentialing process. Customer acknowledges and agrees that Customer remains wholly responsible and liable for all acts and omissions of any of its Customer Affiliates. In addition to those credentialing and auditing functions RSA will perform hereunder, Customer understands and agrees that RSA may outsource certain of its credentialing and auditing obligations hereunder to LN and Customer agrees that LN may perform RSA s outsourced credentialing or auditing functions hereunder. Though LN is not a Party to this Agreement, LN shall be deemed a third party beneficiary of Sections 1, 2, 7, and 10 of this Agreement and may exercise any of the rights and pursue any of the remedies available to or accorded to RSA hereunder. Notwithstanding any other terms and conditions included in this Agreement, Customer acknowledges and agrees that it shall have no right to pursue LN directly hereunder or otherwise and that LN s performance of any of RSA s credentialing and auditing functions shall in no way make LN a Party hereto, constitute an assumption of risk or liability by LN, or be interpreted as a representation or warranty on LN s part that Customer is likely to timely pay for services or otherwise perform its duties and obligations under this Agreement or that RSA is likely to perform its duties and obligations under this Agreement. 8. EMPLOYEE TRAINING Customer shall train new employees prior to allowing access to Services on Customer s obligations under this Agreement, including, but not limited to, the licensing requirements and restrictions under Section 1 and the security requirements of Section 2. Customer shall conduct a similar review of its obligations under this Agreement with existing employees who have access to Services no less than annually. Customer shall keep records of such training. 9. CUSTOMER CHANGES Customer acknowledges and understands that RSA will only allow Customer access to the Services if Customer s credentials can be verified in accordance with LN s internal credentialing procedures. Customer shall notify RSA immediately of any changes to the information on Customer's application for the Services, and, if at any time Customer no longer meets LN s] criteria for providing such service, RSA may terminate this Agreement. Customer is required to promptly notify RSA of a change in ownership of Customer s company, any change in the name of Customer s company, and/or any change in the physical address of Customer s company. 10. COMPLIANCE WITH LAWS Customer shall comply with all applicable laws relevant to its duties, obligations and performance under this Agreement, including all applicable laws, ordinances, codes, regulations, standards and judicial or administrative orders concerning bribery, corruption and related matters, including those of the United States and the United Kingdom. Page 5 of 7

6 11. NOTICE Customer will immediately notify both LN and RSA in writing directed to: LN at: LN Privacy, Security and Compliance Organization at 1000 Alderman Drive, Alpharetta, Georgia and by and by phone ( ), RSA at: RSA Security LLC, 174 Middlesex Turnpike, Bedford, MA 01730, attn: Legal Department if Customer suspects, has reason to believe or confirms that a User ID or the Services (or data derived directly or indirectly there from) is or has been lost, stolen, compromised, misused or used, accessed or acquired in an unauthorized manner or by any unauthorized person, or for any purpose other than legitimate business reasons. Any legal notices permitted or required under this Agreement shall be in writing, and shall be deemed given when delivered (i) in person; (ii) by overnight courier, upon written confirmation of receipt; (iii) by certified or registered mail, with proof of delivery; or (iv) by , with confirmation of receipt. Notices shall be sent to the address, facsimile number or address set forth above, or at such other address, facsimile number or address as provided to the other party in writing. 11. TERM The initial Term of this Agreement (the Initial Term ) shall commence on the last date of signature on the Quotation and shall end on the date one (1) year after the first day of the calendar month following the Activation Date unless sooner terminated by a party hereto in accordance with this Agreement. The Agreement may be renewed for additional one (1) year terms (each a Renewal Term ) upon mutual written agreement between the Parties at least sixty (60) days prior to the end of the Initial Term or the applicable Renewal Term. Activation Date means the sooner of the date upon which the Service is first used by Customer or made available by RSA for Customer to use. Either party may notify the other in writing in case of the other's alleged breach of a material provision of this Agreement. The recipient shall have thirty (30) days from the date of receipt of such notice to effect a cure. If the recipient of the notice fails to effect a cure within such period, then the sender of the notice shall have the option of sending a written notice of termination, which notice shall take effect upon receipt. Upon termination, Customer shall promptly return to RSA, or destroy and certify in writing to RSA, that it has destroyed the original and all copies, in whole or in part, in any form, of the documentation, and any other confidential information disclosed by RSA. Termination shall not discharge any payment obligations accrued as of the effective date of such termination even if such obligations are payable after the termination date. 12. INVOICING AND PAYMENT RSA shall submit invoices for fees and reimbursable costs and expenses and Customer shall pay each invoice in the manner specified in the applicable Quotation. Customer will also pay all related taxes and withholdings, except for those based on RSA s net income. If Customer is required to withhold taxes, then Customer will forward any withholding receipts to RSA. Subject to RSA s credit approval, all amounts are due in the currency stated on the invoice and in full 30 days after the date of RSA's invoice, with interest accruing thereafter at the lesser of 1.5% per month or the highest lawful rate. If Customer's account is fifteen (15) days or more overdue, in addition to any of its other rights or remedies, RSA reserves the right to suspend the Service provided to Customer, without liability to RSA, until such amounts are paid in full. 13. EXPORT CONTROLS The Services and any technology delivered in connection therewith may be subject to governmental restrictions on (i) exports from the U.S.; (ii) exports from other countries in which such Services and technology may be provided or located; (iii) disclosures of technology to foreign persons; (iv) exports from abroad of derivative products thereof; and (v) the importation and/or use of such technology included therein outside of the United States (collectively, "Export Laws"). Diversion contrary to U.S. law is expressly prohibited. Customer shall, at its sole expense, comply with all Export Laws. Customer represents that it is not a Restricted Person, which shall be deemed to include any person or entity: that may, from time to time, become subject to U.S. export controls for anti-terrorism reasons or with which U.S. persons are generally prohibited from engaging in financial transactions; or on any restricted person or entity list maintained by any U.S. governmental agency. Certain information, services or technology may be subject to the International Traffic in Arms Regulations. This information, services or technology shall only be exported, transferred or Page 6 of 7

7 released to foreign nationals inside or outside the United States in compliance with such regulations. Certain information, products or technology may be subject to the International Traffic in Arms Regulations ( ITAR ). This information, products or technology shall only be exported, transferred or released to foreign nationals inside or outside the United States in compliance with ITAR. 14. INDEPENDENT CONTRACTORS RSA and LN are independent contractors for all purposes under this Agreement. Nothing contained herein shall be deemed to constitute either party as an agent or representative of the other party, or both parties as joint venturers or partners for any purpose. Neither party shall be responsible for the acts or omissions of the other party, and neither party will have authority to speak for, represent or obligate the other party in any way without the prior written approval of the other party. 15. MISCELLANEOUS This Agreement (i) shall constitute the complete statement of the agreement of the Parties with regard to the subject matter hereof and (ii) may be modified only by a writing signed by authorized representatives of both parties. Except for the payment of fees, neither party shall be liable under this Agreement because of a failure or delay in performing its obligations hereunder on account of any force majeure event, such as strikes, riots, insurrection, terrorism, fires, natural disasters, acts of God, war, governmental action, or any other cause which is beyond the reasonable control of such party. RSA shall not be liable under this Agreement because of failure or delay in performing its obligations hereunder on account of Customer s failure to provide timely access to facilities, space, power, documentation, networks, files, software, and Customer personnel that are reasonably necessary for RSA to perform its obligations. Customer shall not assign this Agreement to a separate legal entity, without RSA's written consent such consent not to be unreasonably withheld. Nothing herein shall limit RSA s right to assign its right to receive and collect payments hereunder. This Agreement is governed by the laws of the Commonwealth of Massachusetts, excluding its conflict of laws rules. The Parties hereby: (1) irrevocably commit to the exclusive jurisdiction of the federal and state courts located in the Commonwealth of Massachusetts for the purpose of any suit, action or proceeding arising out of this Agreement, the subject matter hereof or any of the transaction contemplated hereby brought by either Party or its successors or assigns; (2) waives, and agrees not to assert, by way of motion, as a defense or otherwise, in such suit, action or proceeding, to the fullest extent permitted by applicable law, that the suit, action or proceeding is brought in an inconvenient forum, that the venue or the suit, action or proceeding is improper, that that this Agreement, or the subject matter hereof or any of the transactions contemplated hereby may not be enforced in or by such courts; (3) waives the right to trial by jury of any suit, action or proceeding; and (4) waives any right, claim, or entitlement to any punitive or exemplary damages whatsoever, except as otherwise provided in this Agreement. All terms of any purchase order or similar document provided by Customer, including but not limited to any pre-printed terms thereon and any terms that are inconsistent, add to, or conflict with this Agreement, shall be null and void and of no legal force or effect. No waiver shall be deemed a waiver of any prior or subsequent default hereunder. If any part of this Agreement is held unenforceable, the validity of the remaining provisions shall not be affected. In case of any conflict between a Quotation and this Agreement, the Agreement shall control. Each Party will comply with all applicable laws and will obtain, and will maintain in full force and effect, all licenses, permits, approvals, and other authorizations that are necessary or required to perform its obligations under this Agreement. The titles and headings of the Sections and other subdivisions of this Agreement are for convenience of reference only and shall not modify, define or limit any of the terms or provisions of this Agreement. # # # Page 7 of 7