Common use of NONDISCLOSURE AND DATA SECURITY AGREEMENT Clause in Contracts

NONDISCLOSURE AND DATA SECURITY AGREEMENT. (CONTRACTOR)‌ The undersigned, an authorized agent of the Contractor and on behalf of SPay Inc dba Stack Sports (“Contractor”), hereby agrees that the Contractor will hold County-provided information, documents, data, images, records and the like confidential and secure and protect them against loss, misuse, alteration, destruction or disclosure. This includes, but is not limited to, the information of the County, its employees, contractors, residents, clients, patients, taxpayers and property as well as information that the County shares with the Contractor for testing, support, conversion or other services provided under Arlington County Agreement No. 23-DPR-SLA-534 (the “Project” or “Main Agreement”) or that may be accessed through other County-owned or -controlled databases (all of the above collectively referred to as “County Information” or “Information”). In addition to the DATA SECURITY obligations set in the County Agreement, the Contractor agrees that it will maintain the privacy and security of County Information, control and limit internal access and authorization for access to such Information and not divulge or allow or facilitate access to County Information for any purpose or by anyone unless expressly authorized. This includes, but is not limited to, any County Information that in any manner describes, locates or indexes anything about an individual, including, but not limited to, his/her (“his”) Personal Health Information, treatment, disability, services eligibility, services provided, investigations, real or personal property holdings and his education, financial transactions, medical history, ancestry, religion, political ideology, criminal or employment record, social security number, tax status or payments, date of birth, address, phone number or anything that affords a basis for inferring personal characteristics, such as finger and voice prints, photographs, or things done by or to such individual, or the record of his presence, registration, or membership in an organization or activity, or admission to an institution. Contractor also agrees that it will not directly or indirectly use or facilitate the use or dissemination of County information (whether intentionally or by inadvertence, negligence or omission and whether verbally, electronically, through paper transmission or otherwise) for any purpose other than that directly associated with its work under the Project. The Contractor acknowledges that any unauthorized use, dissemination or disclosure of County Information is prohibited and may also constitute a violation of Virginia or federal laws, subjecting it or its employees to civil and/or criminal penalties. Contractor agrees that it will not divulge or otherwise facilitate the disclosure, dissemination or access to or by any unauthorized person, for any purpose, of any Information obtained directly, or indirectly, as a result of its work on the Project. The Contractor shall coordinate closely with the County Project Officer to ensure that its authorization to its employees or approved subcontractors is appropriate and tightly controlled and that such person/s also maintain the security and privacy of County Information and the integrity of County-networked resources. Contractor agrees to take strict security measures to ensure that County Information is kept secure; is properly stored in accordance with industry best practices, and if stored is encrypted; and is otherwise protected from retrieval or access by unauthorized persons or for unauthorized purposes. Any device or media on which County Information is stored, even temporarily, will have strict encryption, security, and access control. Any County Information that is accessible will not leave Contractor’s work site or the County’s physical facility, if the Contractor is working onsite, without written authorization of the County Project Officer. If remote access or other media storage is authorized, the Contractor is responsible for the security of such storage device or paper files. Contractor will ensure that any laptops, PDAs, netbooks, tablets, thumb drives or other media storage devices, as approved by the County and connected to the County network, are secure and free of all computer viruses, and running the latest version of an industry-standard virus protection program. The Contractor will ensure that all user accounts and passwords used by its employees or subcontractors are robust, protected and not shared. The Contractor will not download any County Information except as agreed to by the parties and then only onto a County-approved device. The Contractor understands that downloading onto a personally owned device or service, such as personal e-mail, Dropbox, etc., is prohibited. Contractor agrees that it will notify the County Project Officer immediately upon discovery or becoming aware or suspicious of any unauthorized disclosure of County Information, security breach, hacking or other breach of this agreement, the County’s or Contractor’s security policies, or any other breach of Project protocols concerning data security or County Information. The Contractor will fully cooperate with the County to regain possession of any Information and to prevent its further disclosure, use or dissemination. The Contractor also agrees to promptly notify others of a suspected or actual breach if requested. The Contractor agrees that all duties and obligations enumerated in this Agreement also extend to its employees, agents or subcontractors who are given access to County information. Breach of any of the above conditions by Contractor’s employees, agents or subcontractors shall be treated as a breach by the Contractor. The Contractor agrees that it shall take all reasonable measures to ensure that its employees, agents and subcontractors are aware of and abide by the terms and conditions of this agreement and related data security provisions in the Main Agreement. It is the intent of this NonDisclosure and Data Security Agreement to ensure that the Contractor has the highest level of administrative safeguards, information security, disaster recovery and other best practices in place to ensure confidentiality, protection, privacy and security of County information and County- networked resources and to ensure compliance with all applicable local, state and federal laws or regulatory requirements. Therefore, to the extent that this NonDisclosure and Data Security Agreement conflicts with the Main Agreement or with any applicable local, state, or federal law, regulation or provision, the more stringent requirement, law, regulation or provision controls. At the conclusion of the Project, the Contractor agrees to return all County Information to the County Project Officer. These obligations remain in full force and effect throughout the Project and shall survive any termination of the Main Agreement. Authorized Signature: Printed Name and Title: Xxxxxxxx Xxxxxxxx CFO & Treasurer Date:

NONDISCLOSURE AND DATA SECURITY AGREEMENT. (CONTRACTOR)‌ The undersigned, an authorized agent of the Contractor and on behalf of SPay Inc The Fencers Club, LLC dba Stack Sports (“ContractorNova Fencing & Archery Club(“Contractor”), hereby agrees that the Contractor will hold County-provided information, documents, data, images, records and the like confidential and secure and protect them against loss, misuse, alteration, destruction or disclosure. This includes, but is not limited to, the information of the County, its employees, contractors, residents, clients, patients, taxpayers and property as well as information that the County shares with the Contractor for testing, support, conversion or other services provided under Arlington County Agreement No. 2324-DPR-SLA-534 RFP-160x (the “Project” or “Main Agreement”) or that may be accessed through other County-owned or -controlled databases (all of the above collectively referred to as “County Information” or “Information”). In addition to the DATA SECURITY obligations set in the County Agreement, the Contractor agrees that it will maintain the privacy and security of County Information, control and limit internal access and authorization for access to such Information and not divulge or allow or facilitate access to County Information for any purpose or by anyone unless expressly authorized. This includes, but is not limited to, any County Information that in any manner describes, locates or indexes anything about an individual, including, but not limited to, his/her (“his”) Personal Health Information, treatment, disability, services eligibility, services provided, investigations, real or personal property holdings and his education, financial transactions, medical history, ancestry, religion, political ideology, criminal or employment record, social security number, tax status or payments, date of birth, address, phone number or anything that affords a basis for inferring personal characteristics, such as finger and voice prints, photographs, or things done by or to such individual, or the record of his presence, registration, or membership in an organization or activity, or admission to an institution. Contractor also agrees that it will not directly or indirectly use or facilitate the use or dissemination of County information (whether intentionally or by inadvertence, negligence or omission and whether verbally, electronically, through paper transmission or otherwise) for any purpose other than that directly associated with its work under the Project. The Contractor acknowledges that any unauthorized use, dissemination or disclosure of County Information is prohibited and may also constitute a violation of Virginia or federal laws, subjecting it or its employees to civil and/or criminal penalties. Contractor agrees that it will not divulge or otherwise facilitate the disclosure, dissemination or access to or by any unauthorized person, for any purpose, of any Information obtained directly, or indirectly, as a result of its work on the Project. The Contractor shall coordinate closely with the County Project Officer to ensure that its authorization to its employees or approved subcontractors is appropriate and tightly controlled and that such person/s also maintain the security and privacy of County Information and the integrity of County-networked resources. Contractor agrees to take strict security measures to ensure that County Information is kept secure; is properly stored in accordance with industry best practices, and if stored is encrypted; and is otherwise protected from retrieval or access by unauthorized persons or for unauthorized purposes. Any device or media on which County Information is stored, even temporarily, will have strict encryption, security, and access control. Any County Information that is accessible will not leave Contractor’s work site or the County’s physical facility, if the Contractor is working onsite, without written authorization of the County Project Officer. If remote access or other media storage is authorized, the Contractor is responsible for the security of such storage device or paper files. Contractor will ensure that any laptops, PDAs, netbooks, tablets, thumb drives or other media storage devices, as approved by the County and connected to the County network, are secure and free of all computer viruses, and running the latest version of an industry-standard virus protection program. The Contractor will ensure that all user accounts and passwords used by its employees or subcontractors are robust, protected and not shared. The Contractor will not download any County Information except as agreed to by the parties and then only onto a County-approved device. The Contractor understands that downloading onto a personally owned device or service, such as personal e-mail, Dropbox, etc., is prohibited. Contractor agrees that it will notify the County Project Officer immediately upon discovery or becoming aware or suspicious of any unauthorized disclosure of County Information, security breach, hacking or other breach of this agreement, the County’s or Contractor’s security policies, or any other breach of Project protocols concerning data security or County Information. The Contractor will fully cooperate with the County to regain possession of any Information and to prevent its further disclosure, use or dissemination. The Contractor also agrees to promptly notify others of a suspected or actual breach if requested. The Contractor agrees that all duties and obligations enumerated in this Agreement also extend to its employees, agents or subcontractors who are given access to County information. Breach of any of the above conditions by Contractor’s employees, agents or subcontractors shall be treated as a breach by the Contractor. The Contractor agrees that it shall take all reasonable measures to ensure that its employees, agents and subcontractors are aware of and abide by the terms and conditions of this agreement and related data security provisions in the Main Agreement. It is the intent of this NonDisclosure and Data Security Agreement to ensure that the Contractor has the highest level of administrative safeguards, information security, disaster recovery and other best practices in place to ensure confidentiality, protection, privacy and security of County information and County- County-networked resources and to ensure compliance with all applicable local, state and federal laws or regulatory requirements. Therefore, to the extent that this NonDisclosure and Data Security Agreement conflicts with the Main Agreement or with any applicable local, state, or federal law, regulation or provision, the more stringent requirement, law, regulation or provision controls. At the conclusion of the Project, the Contractor agrees to return all County Information to the County Project Officer. These obligations remain in full force and effect throughout the Project and shall survive any termination of the Main Agreement. Authorized Signature: Printed Name and Title: Xxxxxxx Xxxxxxxx Xxxxxxxx CFO & Treasurer Owner/Head Coach Date:: 11/30/2023 NONDISCLOSURE AND DATA SECURITY AGREEMENT (INDIVIDUAL)‌ I, the undersigned, agree that I will hold County-provided information, documents, data, images, records and the like confidential and secure and protect it against loss, misuse, alteration, destruction or disclosure. This includes, but is not limited to, the information of the County, its employees, contractors, residents, clients, patients, taxpayers, and property as well as information that the County shares with my employer or prime contractor for testing, support, conversion or the provision of other services under Arlington County Agreement No. 24-DPR-RFP- 160x (the “Project” or “Main Agreement”) or which may be accessed through County-owned or -controlled databases (all of the above collectively referred to as “County Information” or “Information”). I agree that I will maintain the privacy and security of County Information and will not divulge or allow or facilitate access to County Information for any purpose or by anyone unless expressly authorized to do so by the County Project Officer. This includes, but is not limited to, any County Information that in any manner describes, locates or indexes anything about an individual including, but not limited to, his/her (“his”) Personal Health Information, treatment, disability, services eligibility, services provided, investigations, real or personal property holdings, education, financial transactions, medical history, ancestry, religion, political ideology, criminal or employment record, social security number, tax status or payments, date of birth, or that otherwise affords a basis for inferring personal characteristics, such as finger and voice prints, photographs, or things done by or to such individual, or the record of his presence, registration, or membership in an organization or activity, or admission to an institution. I agree that I will not directly or indirectly use or facilitate the use or dissemination of information (whether intentionally or by inadvertence, negligence or omission and whether verbally, electronically, through paper transmission or otherwise) for any purpose other than that directly authorized and associated with my designated duties on the Project. I understand and agree that any unauthorized use, dissemination or disclosure of County Information is prohibited and may also constitute a violation of Virginia or federal law/s, subjecting me and/or my employer to civil and/or criminal penalties. I also agree that I will not divulge or otherwise facilitate the disclosure, dissemination or access to or by any unauthorized person for any purpose of the Information obtained directly, or indirectly, as a result of my work on the Project. I agree to view, retrieve or access County Information only to the extent concomitant with my assigned duties on the Project and only in accordance with the County’s and my employer’s access and security policies or protocols. I agree that I will take strict security measures to ensure that County Information is kept secure; is properly stored in accordance with industry best practices, and if stored is encrypted; and is otherwise protected from retrieval or access by unauthorized persons or for unauthorized purposes. I will also ensure that any device or media on which County Information is stored, even temporarily, will have strict encryption, security, and access control and that I will not remove, facilitate the removal of or cause any Information to be removed from my employer’s worksite or the County’s physical facility without written authorization of the County Project Officer. If so authorized, I understand that I am responsible for the security of the electronic equipment or paper files on which the Information is stored and agree to promptly return such Information upon request. I will not use any devices, laptops, PDAs, netbooks, tablets, thumb drives or other media storage devices (“Device”) during my work on the Project without pre-approval. I will ensure that any Device connected to the County network is free of all computer viruses and running the latest version of an industry-standard virus protection program. I will also ensure that my user account and password, if any, is robust, protected and not shared. I will not download any County Information except as authorized by the County Project Officer and then only onto a County-approved Device. I understand that downloading onto a personally owned Device or service, such as personal e-mail, Dropbox etc., is prohibited. I agree that I will notify the County Project Officer immediately upon discovery or becoming aware or suspicious of any unauthorized disclosure of County Information, security breach, hacking or other breach of this agreement, the County’s or Contractor’s security policies, or any other breach of Project protocols concerning data security or County Information. I will fully cooperate with the County to help regain possession of any County Information and to prevent its further disclosure, use or dissemination. It is the intent of this NonDisclosure and Data Security Agreement to ensure that the highest level of administrative safeguards, information security, and other best practices are in place to ensure confidentiality, protection, privacy and security of County Information and County-networked resources and to ensure compliance with all applicable local, state and federal laws or regulatory requirements. Therefore, to the extent that this Nondisclosure and Data Security Agreement conflicts with the underlying Main Agreement or any local, state or federal law, regulation or provision, the more stringent requirement, law, regulation or provision controls. Upon completion or termination of my work on the Project, I agree to return all County Information to the County Project Officer. I understand that this agreement remains in full force and effect throughout my work on the Project and shall survive my reassignment from the Project, termination of the above referenced Project or my departure from my current employer. Signed: Printed Name: Date: Witnessed: Contractor’s Project Manager: Printed Name: Date: TO BE COMPLETED PRIOR TO BEGINNING WORK ON THE PROJECT EXHIBIT C CONTRACTOR PERFORMANCE EVALUATION FORM ARLINGTON COUNTY GOVERNMENT Contractor Performance Evaluation Form Contractor Name: Contract No.: Date: Project/Contract Name: Interim Evaluation Final Evaluation Scope of Work/Services Provided: Contract Start Date: / / Contract End Date: / / Actual Completion Date: / / Please rate the effectiveness of the Contractor’s performance on the Contract/Project across the following dimensions: Evaluation Criteria: Unacceptable Poor Satisfactory Excellent Written comments to explain assigned ratings are required for any performance ratings below “satisfactory” or an “excellent” in any category. Evaluation Questions

NONDISCLOSURE AND DATA SECURITY AGREEMENT. (CONTRACTOR)‌ The undersigned, an authorized agent of the Contractor and on behalf of SPay Inc dba Stack Sports (“ContractorFish and Explore, LLC(“Contractor”), hereby agrees that the Contractor will hold County-provided information, documents, data, images, records and the like confidential and secure and protect them against loss, misuse, alteration, destruction or disclosure. This includes, but is not limited to, the information of the County, its employees, contractors, residents, clients, patients, taxpayers and property as well as information that the County shares with the Contractor for testing, support, conversion or other services provided under Arlington County Agreement No. 2324-DPR-SLA-534 RFP-160s (the “Project” or “Main Agreement”) or that may be accessed through other County-owned or -controlled databases (all of the above collectively referred to as “County Information” or “Information”). In addition to the DATA SECURITY obligations set in the County Agreement, the Contractor agrees that it will maintain the privacy and security of County Information, control and limit internal access and authorization for access to such Information and not divulge or allow or facilitate access to County Information for any purpose or by anyone unless expressly authorized. This includes, but is not limited to, any County Information that in any manner describes, locates or indexes anything about an individual, including, but not limited to, his/her (“his”) Personal Health Information, treatment, disability, services eligibility, services provided, investigations, real or personal property holdings and his education, financial transactions, medical history, ancestry, religion, political ideology, criminal or employment record, social security number, tax status or payments, date of birth, address, phone number or anything that affords a basis for inferring personal characteristics, such as finger and voice prints, photographs, or things done by or to such individual, or the record of his presence, registration, or membership in an organization or activity, or admission to an institution. Contractor also agrees that it will not directly or indirectly use or facilitate the use or dissemination of County information (whether intentionally or by inadvertence, negligence or omission and whether verbally, electronically, through paper transmission or otherwise) for any purpose other than that directly associated with its work under the Project. The Contractor acknowledges that any unauthorized use, dissemination or disclosure of County Information is prohibited and may also constitute a violation of Virginia or federal laws, subjecting it or its employees to civil and/or criminal penalties. Contractor agrees that it will not divulge or otherwise facilitate the disclosure, dissemination or access to or by any unauthorized person, for any purpose, of any Information obtained directly, or indirectly, as a result of its work on the Project. The Contractor shall coordinate closely with the County Project Officer to ensure that its authorization to its employees or approved subcontractors is appropriate and tightly controlled and that such person/s also maintain the security and privacy of County Information and the integrity of County-networked resources. Contractor agrees to take strict security measures to ensure that County Information is kept secure; is properly stored in accordance with industry best practices, and if stored is encrypted; and is otherwise protected from retrieval or access by unauthorized persons or for unauthorized purposes. Any device or media on which County Information is stored, even temporarily, will have strict encryption, security, and access control. Any County Information that is accessible will not leave Contractor’s work site or the County’s physical facility, if the Contractor is working onsite, without written authorization of the County Project Officer. If remote access or other media storage is authorized, the Contractor is responsible for the security of such storage device or paper files. Contractor will ensure that any laptops, PDAs, netbooks, tablets, thumb drives or other media storage devices, as approved by the County and connected to the County network, are secure and free of all computer viruses, and running the latest version of an industry-standard virus protection program. The Contractor will ensure that all user accounts and passwords used by its employees or subcontractors are robust, protected and not shared. The Contractor will not download any County Information except as agreed to by the parties and then only onto a County-approved device. The Contractor understands that downloading onto a personally owned device or service, such as personal e-mail, Dropbox, etc., is prohibited. Contractor agrees that it will notify the County Project Officer immediately upon discovery or becoming aware or suspicious of any unauthorized disclosure of County Information, security breach, hacking or other breach of this agreement, the County’s or Contractor’s security policies, or any other breach of Project protocols concerning data security or County Information. The Contractor will fully cooperate with the County to regain possession of any Information and to prevent its further disclosure, use or dissemination. The Contractor also agrees to promptly notify others of a suspected or actual breach if requested. The Contractor agrees that all duties and obligations enumerated in this Agreement also extend to its employees, agents or subcontractors who are given access to County information. Breach of any of the above conditions by Contractor’s employees, agents or subcontractors shall be treated as a breach by the Contractor. The Contractor agrees that it shall take all reasonable measures to ensure that its employees, agents and subcontractors are aware of and abide by the terms and conditions of this agreement and related data security provisions in the Main Agreement. It is the intent of this NonDisclosure and Data Security Agreement to ensure that the Contractor has the highest level of administrative safeguards, information security, disaster recovery and other best practices in place to ensure confidentiality, protection, privacy and security of County information and County- County-networked resources and to ensure compliance with all applicable local, state and federal laws or regulatory requirements. Therefore, to the extent that this NonDisclosure and Data Security Agreement conflicts with the Main Agreement or with any applicable local, state, or federal law, regulation or provision, the more stringent requirement, law, regulation or provision controls. At the conclusion of the Project, the Contractor agrees to return all County Information to the County Project Officer. These obligations remain in full force and effect throughout the Project and shall survive any termination of the Main Agreement. Authorized Signature: Printed Name and Title: Xxxxxxxx Xxxxxxxx CFO & Treasurer Xxxx Xxxxxx Director Date:: 11/27/2023 NONDISCLOSURE AND DATA SECURITY AGREEMENT (INDIVIDUAL)‌ I, the undersigned, agree that I will hold County-provided information, documents, data, images, records and the like confidential and secure and protect it against loss, misuse, alteration, destruction or disclosure. This includes, but is not limited to, the information of the County, its employees, contractors, residents, clients, patients, taxpayers, and property as well as information that the County shares with my employer or prime contractor for testing, support, conversion or the provision of other services under Arlington County Agreement No. 24-DPR-RFP- 160s (the “Project” or “Main Agreement”) or which may be accessed through County-owned or -controlled databases (all of the above collectively referred to as “County Information” or “Information”). I agree that I will maintain the privacy and security of County Information and will not divulge or allow or facilitate access to County Information for any purpose or by anyone unless expressly authorized to do so by the County Project Officer. This includes, but is not limited to, any County Information that in any manner describes, locates or indexes anything about an individual including, but not limited to, his/her (“his”) Personal Health Information, treatment, disability, services eligibility, services provided, investigations, real or personal property holdings, education, financial transactions, medical history, ancestry, religion, political ideology, criminal or employment record, social security number, tax status or payments, date of birth, or that otherwise affords a basis for inferring personal characteristics, such as finger and voice prints, photographs, or things done by or to such individual, or the record of his presence, registration, or membership in an organization or activity, or admission to an institution. I agree that I will not directly or indirectly use or facilitate the use or dissemination of information (whether intentionally or by inadvertence, negligence or omission and whether verbally, electronically, through paper transmission or otherwise) for any purpose other than that directly authorized and associated with my designated duties on the Project. I understand and agree that any unauthorized use, dissemination or disclosure of County Information is prohibited and may also constitute a violation of Virginia or federal law/s, subjecting me and/or my employer to civil and/or criminal penalties. I also agree that I will not divulge or otherwise facilitate the disclosure, dissemination or access to or by any unauthorized person for any purpose of the Information obtained directly, or indirectly, as a result of my work on the Project. I agree to view, retrieve or access County Information only to the extent concomitant with my assigned duties on the Project and only in accordance with the County’s and my employer’s access and security policies or protocols. I agree that I will take strict security measures to ensure that County Information is kept secure; is properly stored in accordance with industry best practices, and if stored is encrypted; and is otherwise protected from retrieval or access by unauthorized persons or for unauthorized purposes. I will also ensure that any device or media on which County Information is stored, even temporarily, will have strict encryption, security, and access control and that I will not remove, facilitate the removal of or cause any Information to be removed from my employer’s worksite or the County’s physical facility without written authorization of the County Project Officer. If so authorized, I understand that I am responsible for the security of the electronic equipment or paper files on which the Information is stored and agree to promptly return such Information upon request. I will not use any devices, laptops, PDAs, netbooks, tablets, thumb drives or other media storage devices (“Device”) during my work on the Project without pre-approval. I will ensure that any Device connected to the County network is free of all computer viruses and running the latest version of an industry-standard virus protection program. I will also ensure that my user account and password, if any, is robust, protected and not shared. I will not download any County Information except as authorized by the County Project Officer and then only onto a County-approved Device. I understand that downloading onto a personally owned Device or service, such as personal e-mail, Dropbox etc., is prohibited. I agree that I will notify the County Project Officer immediately upon discovery or becoming aware or suspicious of any unauthorized disclosure of County Information, security breach, hacking or other breach of this agreement, the County’s or Contractor’s security policies, or any other breach of Project protocols concerning data security or County Information. I will fully cooperate with the County to help regain possession of any County Information and to prevent its further disclosure, use or dissemination. It is the intent of this NonDisclosure and Data Security Agreement to ensure that the highest level of administrative safeguards, information security, and other best practices are in place to ensure confidentiality, protection, privacy and security of County Information and County-networked resources and to ensure compliance with all applicable local, state and federal laws or regulatory requirements. Therefore, to the extent that this Nondisclosure and Data Security Agreement conflicts with the underlying Main Agreement or any local, state or federal law, regulation or provision, the more stringent requirement, law, regulation or provision controls. Upon completion or termination of my work on the Project, I agree to return all County Information to the County Project Officer. I understand that this agreement remains in full force and effect throughout my work on the Project and shall survive my reassignment from the Project, termination of the above referenced Project or my departure from my current employer. Signed: Printed Name: Date: Witnessed: Contractor’s Project Manager: Printed Name: Date: TO BE COMPLETED PRIOR TO BEGINNING WORK ON THE PROJECT EXHIBIT C CONTRACTOR PERFORMANCE EVALUATION FORM ARLINGTON COUNTY GOVERNMENT Contractor Performance Evaluation Form Contractor Name: Contract No.: Date: Project/Contract Name: Interim Evaluation Final Evaluation Scope of Work/Services Provided: Contract Start Date: / / Contract End Date: / / Actual Completion Date: / / Please rate the effectiveness of the Contractor’s performance on the Contract/Project across the following dimensions: Evaluation Criteria: Unacceptable Poor Satisfactory Excellent Written comments to explain assigned ratings are required for any performance ratings below “satisfactory” or an “excellent” in any category. Evaluation Questions

NONDISCLOSURE AND DATA SECURITY AGREEMENT. (CONTRACTOR)‌ The undersigned, an authorized agent of the Contractor and on behalf of SPay Inc dba Stack Sports Patriot Girls Basketball Camp (“Contractor”), hereby agrees that the Contractor will hold County-provided information, documents, data, images, records and the like confidential and secure and protect them against loss, misuse, alteration, destruction or disclosure. This includes, but is not limited to, the information of the County, its employees, contractors, residents, clients, patients, taxpayers and property as well as information that the County shares with the Contractor for testing, support, conversion or other services provided under Arlington County Agreement No. 2324-DPR-SLA-534 RFP-160u (the “Project” or “Main Agreement”) or that may be accessed through other County-owned or -controlled databases (all of the above collectively referred to as “County Information” or “Information”). In addition to the DATA SECURITY obligations set in the County Agreement, the Contractor agrees that it will maintain the privacy and security of County Information, control and limit internal access and authorization for access to such Information and not divulge or allow or facilitate access to County Information for any purpose or by anyone unless expressly authorized. This includes, but is not limited to, any County Information that in any manner describes, locates or indexes anything about an individual, including, but not limited to, his/her (“his”) Personal Health Information, treatment, disability, services eligibility, services provided, investigations, real or personal property holdings and his education, financial transactions, medical history, ancestry, religion, political ideology, criminal or employment record, social security number, tax status or payments, date of birth, address, phone number or anything that affords a basis for inferring personal characteristics, such as finger and voice prints, photographs, or things done by or to such individual, or the record of his presence, registration, or membership in an organization or activity, or admission to an institution. Contractor also agrees that it will not directly or indirectly use or facilitate the use or dissemination of County information (whether intentionally or by inadvertence, negligence or omission and whether verbally, electronically, through paper transmission or otherwise) for any purpose other than that directly associated with its work under the Project. The Contractor acknowledges that any unauthorized use, dissemination or disclosure of County Information is prohibited and may also constitute a violation of Virginia or federal laws, subjecting it or its employees to civil and/or criminal penalties. Contractor agrees that it will not divulge or otherwise facilitate the disclosure, dissemination or access to or by any unauthorized person, for any purpose, of any Information obtained directly, or indirectly, as a result of its work on the Project. The Contractor shall coordinate closely with the County Project Officer to ensure that its authorization to its employees or approved subcontractors is appropriate and tightly controlled and that such person/s also maintain the security and privacy of County Information and the integrity of County-networked resources. Contractor agrees to take strict security measures to ensure that County Information is kept secure; is properly stored in accordance with industry best practices, and if stored is encrypted; and is otherwise protected from retrieval or access by unauthorized persons or for unauthorized purposes. Any device or media on which County Information is stored, even temporarily, will have strict encryption, security, and access control. Any County Information that is accessible will not leave Contractor’s work site or the County’s physical facility, if the Contractor is working onsite, without written authorization of the County Project Officer. If remote access or other media storage is authorized, the Contractor is responsible for the security of such storage device or paper files. Contractor will ensure that any laptops, PDAs, netbooks, tablets, thumb drives or other media storage devices, as approved by the County and connected to the County network, are secure and free of all computer viruses, and running the latest version of an industry-standard virus protection program. The Contractor will ensure that all user accounts and passwords used by its employees or subcontractors are robust, protected and not shared. The Contractor will not download any County Information except as agreed to by the parties and then only onto a County-approved device. The Contractor understands that downloading onto a personally owned device or service, such as personal e-mail, Dropbox, etc., is prohibited. Contractor agrees that it will notify the County Project Officer immediately upon discovery or becoming aware or suspicious of any unauthorized disclosure of County Information, security breach, hacking or other breach of this agreement, the County’s or Contractor’s security policies, or any other breach of Project protocols concerning data security or County Information. The Contractor will fully cooperate with the County to regain possession of any Information and to prevent its further disclosure, use or dissemination. The Contractor also agrees to promptly notify others of a suspected or actual breach if requested. The Contractor agrees that all duties and obligations enumerated in this Agreement also extend to its employees, agents or subcontractors who are given access to County information. Breach of any of the above conditions by Contractor’s employees, agents or subcontractors shall be treated as a breach by the Contractor. The Contractor agrees that it shall take all reasonable measures to ensure that its employees, agents and subcontractors are aware of and abide by the terms and conditions of this agreement and related data security provisions in the Main Agreement. It is the intent of this NonDisclosure and Data Security Agreement to ensure that the Contractor has the highest level of administrative safeguards, information security, disaster recovery and other best practices in place to ensure confidentiality, protection, privacy and security of County information and County- County-networked resources and to ensure compliance with all applicable local, state and federal laws or regulatory requirements. Therefore, to the extent that this NonDisclosure and Data Security Agreement conflicts with the Main Agreement or with any applicable local, state, or federal law, regulation or provision, the more stringent requirement, law, regulation or provision controls. At the conclusion of the Project, the Contractor agrees to return all County Information to the County Project Officer. These obligations remain in full force and effect throughout the Project and shall survive any termination of the Main Agreement. Authorized Signature: Printed Name and Title: Xxxxxxxx Xxxxxxxx CFO & Treasurer Xxx X Xxxxx Director Date:: 11/28/2023 NONDISCLOSURE AND DATA SECURITY AGREEMENT (INDIVIDUAL)‌ I, the undersigned, agree that I will hold County-provided information, documents, data, images, records and the like confidential and secure and protect it against loss, misuse, alteration, destruction or disclosure. This includes, but is not limited to, the information of the County, its employees, contractors, residents, clients, patients, taxpayers, and property as well as information that the County shares with my employer or prime contractor for testing, support, conversion or the provision of other services under Arlington County Agreement No. 24-DPR-RFP- 160u (the “Project” or “Main Agreement”) or which may be accessed through County-owned or -controlled databases (all of the above collectively referred to as “County Information” or “Information”). I agree that I will maintain the privacy and security of County Information and will not divulge or allow or facilitate access to County Information for any purpose or by anyone unless expressly authorized to do so by the County Project Officer. This includes, but is not limited to, any County Information that in any manner describes, locates or indexes anything about an individual including, but not limited to, his/her (“his”) Personal Health Information, treatment, disability, services eligibility, services provided, investigations, real or personal property holdings, education, financial transactions, medical history, ancestry, religion, political ideology, criminal or employment record, social security number, tax status or payments, date of birth, or that otherwise affords a basis for inferring personal characteristics, such as finger and voice prints, photographs, or things done by or to such individual, or the record of his presence, registration, or membership in an organization or activity, or admission to an institution. I agree that I will not directly or indirectly use or facilitate the use or dissemination of information (whether intentionally or by inadvertence, negligence or omission and whether verbally, electronically, through paper transmission or otherwise) for any purpose other than that directly authorized and associated with my designated duties on the Project. I understand and agree that any unauthorized use, dissemination or disclosure of County Information is prohibited and may also constitute a violation of Virginia or federal law/s, subjecting me and/or my employer to civil and/or criminal penalties. I also agree that I will not divulge or otherwise facilitate the disclosure, dissemination or access to or by any unauthorized person for any purpose of the Information obtained directly, or indirectly, as a result of my work on the Project. I agree to view, retrieve or access County Information only to the extent concomitant with my assigned duties on the Project and only in accordance with the County’s and my employer’s access and security policies or protocols. I agree that I will take strict security measures to ensure that County Information is kept secure; is properly stored in accordance with industry best practices, and if stored is encrypted; and is otherwise protected from retrieval or access by unauthorized persons or for unauthorized purposes. I will also ensure that any device or media on which County Information is stored, even temporarily, will have strict encryption, security, and access control and that I will not remove, facilitate the removal of or cause any Information to be removed from my employer’s worksite or the County’s physical facility without written authorization of the County Project Officer. If so authorized, I understand that I am responsible for the security of the electronic equipment or paper files on which the Information is stored and agree to promptly return such Information upon request. I will not use any devices, laptops, PDAs, netbooks, tablets, thumb drives or other media storage devices (“Device”) during my work on the Project without pre-approval. I will ensure that any Device connected to the County network is free of all computer viruses and running the latest version of an industry-standard virus protection program. I will also ensure that my user account and password, if any, is robust, protected and not shared. I will not download any County Information except as authorized by the County Project Officer and then only onto a County-approved Device. I understand that downloading onto a personally owned Device or service, such as personal e-mail, Dropbox etc., is prohibited. I agree that I will notify the County Project Officer immediately upon discovery or becoming aware or suspicious of any unauthorized disclosure of County Information, security breach, hacking or other breach of this agreement, the County’s or Contractor’s security policies, or any other breach of Project protocols concerning data security or County Information. I will fully cooperate with the County to help regain possession of any County Information and to prevent its further disclosure, use or dissemination. It is the intent of this NonDisclosure and Data Security Agreement to ensure that the highest level of administrative safeguards, information security, and other best practices are in place to ensure confidentiality, protection, privacy and security of County Information and County-networked resources and to ensure compliance with all applicable local, state and federal laws or regulatory requirements. Therefore, to the extent that this Nondisclosure and Data Security Agreement conflicts with the underlying Main Agreement or any local, state or federal law, regulation or provision, the more stringent requirement, law, regulation or provision controls. Upon completion or termination of my work on the Project, I agree to return all County Information to the County Project Officer. I understand that this agreement remains in full force and effect throughout my work on the Project and shall survive my reassignment from the Project, termination of the above referenced Project or my departure from my current employer. Signed: Printed Name: Date: Witnessed: Contractor’s Project Manager: Printed Name: Date: TO BE COMPLETED PRIOR TO BEGINNING WORK ON THE PROJECT EXHIBIT C CONTRACTOR PERFORMANCE EVALUATION FORM ARLINGTON COUNTY GOVERNMENT Contractor Performance Evaluation Form Contractor Name: Contract No.: Date: Project/Contract Name: Interim Evaluation Final Evaluation Scope of Work/Services Provided: Contract Start Date: / / Contract End Date: / / Actual Completion Date: / / Please rate the effectiveness of the Contractor’s performance on the Contract/Project across the following dimensions: Evaluation Criteria: Unacceptable Poor Satisfactory Excellent Written comments to explain assigned ratings are required for any performance ratings below “satisfactory” or an “excellent” in any category. Evaluation Questions

NONDISCLOSURE AND DATA SECURITY AGREEMENT. (CONTRACTOR)‌ The undersigned, an authorized agent of the Contractor and on behalf of SPay Inc dba Stack Sports Eastern Research Group, Inc. (“Contractor”), hereby xxxxxx agrees that the Contractor will hold County-provided information, documents, data, images, records and the like confidential and secure and protect them against loss, misuse, alteration, destruction or disclosure. This includes, but is not limited to, the information of the County, its employees, contractors, residents, clients, patients, taxpayers and property as well as information that the County shares with the Contractor for testing, support, conversion or other services provided under Arlington County Agreement No. 23-DPRDES-SLA-534 RFP-230f (the “Project” or “Main Agreement”) or that may be accessed through other County-owned or -controlled databases (all of the above collectively referred to as “County Information” or “Information”). In addition to the DATA SECURITY obligations set in the County Agreement, the Contractor agrees that it will maintain the privacy and security of County Information, control and limit internal access and authorization for access to such Information and not divulge or allow or facilitate access to County Information for any purpose or by anyone unless expressly authorized. This includes, but is not limited to, any County Information that in any manner describes, locates or indexes anything about an individual, including, but not limited to, his/her (“his”) Personal Health Information, treatment, disability, services eligibility, services provided, investigations, real or personal property holdings and his education, financial transactions, medical history, ancestry, religion, political ideology, criminal or employment record, social security number, tax status or payments, date of birth, address, phone number or anything that affords a basis for inferring personal characteristics, such as finger and voice prints, photographs, or things done by or to such individual, or the record of his presence, registration, or membership in an organization or activity, or admission to an institution. Contractor also agrees that it will not directly or indirectly use or facilitate the use or dissemination of County information (whether intentionally or by inadvertence, negligence or omission and whether verbally, electronically, through paper transmission or otherwise) for any purpose other than that directly associated with its work under the Project. The Contractor acknowledges that any unauthorized use, dissemination or disclosure of County Information is prohibited and may also constitute a violation of Virginia or federal laws, subjecting it or its employees to civil and/or criminal penalties. Contractor agrees that it will not divulge or otherwise facilitate the disclosure, dissemination or access to or by any unauthorized person, for any purpose, of any Information obtained directly, or indirectly, as a result of its work on the Project. The Contractor shall coordinate closely with the County Project Officer to ensure that its authorization to its employees or approved subcontractors is appropriate and tightly controlled and that such person/s also maintain the security and privacy of County Information and the integrity of County-networked resources. Contractor agrees to take strict security measures to ensure that County Information is kept secure; is properly stored in accordance with industry best practices, and if stored is encryptedencrypted ; and is otherwise protected from retrieval or access by unauthorized persons or for unauthorized purposes. Any device or media on which County Information is stored, even temporarily, will have strict encryption, security, and access control. Any County Information that is accessible will not leave Contractor’s work site or the County’s physical facility, if the Contractor is working onsite, without written authorization of the County Project Officer. If remote access or other media storage is authorized, the Contractor is responsible for the security of such storage device or paper files. Contractor will ensure that any laptops, PDAs, netbooks, tablets, thumb drives or other media storage devices, as approved by the County and connected to the County network, are secure and free of all computer viruses, and running the latest version of an industry-standard virus protection program. The Contractor will ensure that all user accounts and passwords used by its employees or subcontractors are robust, protected and not shared. The Contractor will not download any County Information except as agreed to by the parties and then only onto a County-approved device. The Contractor understands that downloading onto a personally owned device or service, such as personal e-mail, Dropbox, etc., is prohibited. Contractor agrees that it will notify the County Project Officer immediately upon discovery or becoming aware or suspicious of any unauthorized disclosure of County Information, security breach, hacking or other breach of this agreement, the County’s or Contractor’s security policies, or any other breach of Project protocols concerning data security or County Information. The Contractor will fully cooperate with the County to regain possession of any Information and to prevent its further disclosure, use or dissemination. The Contractor also agrees to promptly notify others of a suspected or actual breach if requested. The Contractor agrees that all duties and obligations enumerated in this Agreement also extend to its employees, agents or subcontractors who are given access to County information. Breach of any of the above conditions by Contractor’s employees, agents or subcontractors shall be treated as a breach by the Contractor. The Contractor agrees that it shall take all reasonable measures to ensure that its employees, agents and subcontractors are aware of and abide by the terms and conditions of this agreement and related data security provisions in the Main Agreement. It is the intent of this NonDisclosure and Data Security Agreement to ensure that the Contractor has the highest level of administrative safeguards, information security, disaster recovery and other best practices in place to ensure confidentiality, protection, privacy and security of County information and County- networked resources and to ensure compliance with all applicable local, state and federal laws or regulatory requirements. Therefore, to the extent that this NonDisclosure and Data Security Agreement conflicts with the Main Agreement or with any applicable local, state, or federal law, regulation or provision, the more stringent requirement, law, regulation or provision controls. At the conclusion of the Project, the Contractor agrees to return all County Information to the County Project Officer. These obligations remain in full force and effect throughout the Project and shall survive any termination of the Main Agreement. Authorized Signature: Printed Name and Title: Xxxxxxxx Xxxxxxxx CFO & Treasurer Xxxxx Xxxxxx President/CEO 7/19/2023 Date:: EXHIBIT D NONDISCLOSURE AND DATA SECURITY AGREEMENT (INDIVIDUAL)‌ I, the undersigned, agree that I will hold County-provided information, documents, data, images, records and the like confidential and secure and protect it against loss, misuse, alteration, destruction or disclosure. This includes, but is not limited to, the information of the County, its employees, contractors, residents, clients, patients, taxpayers, and property as well as information that the County shares with my employer or prime contractor for testing, support, conversion or the provision of other services under Arlington County Agreement No. 23-DES-RFP-230f (the “Project” or “Main Agreement”) or which may be accessed through County-owned or -controlled databases (all of the above collectively referred to as “County Information” or “Information”). I agree that I will maintain the privacy and security of County Information and will not divulge or allow or facilitate access to County Information for any purpose or by anyone unless expressly authorized to do so by the County Project Officer. This includes, but is not limited to, any County Information that in any manner describes, locates or indexes anything about an individual including, but not limited to, his/her (“his”) Personal Health Information, treatment, disability, services eligibility, services provided, investigations, real or personal property holdings, education, financial transactions, medical history, ancestry, religion, political ideology, criminal or employment record, social security number, tax status or payments, date of birth, or that otherwise affords a basis for inferring personal characteristics, such as finger and voice prints, photographs, or things done by or to such individual, or the record of his presence, registration, or membership in an organization or activity, or admission to an institution. I agree that I will not directly or indirectly use or facilitate the use or dissemination of information (whether intentionally or by inadvertence, negligence or omission and whether verbally, electronically, through paper transmission or otherwise) for any purpose other than that directly authorized and associated with my designated duties on the Project. I understand and agree that any unauthorized use, dissemination or disclosure of County Information is prohibited and may also constitute a violation of Virginia or federal law/s, subjecting me and/or my employer to civil and/or criminal penalties. I also agree that I will not divulge or otherwise facilitate the disclosure, dissemination or access to or by any unauthorized person for any purpose of the Information obtained directly, or indirectly, as a result of my work on the Project. I agree to view, retrieve or access County Information only to the extent concomitant with my assigned duties on the Project and only in accordance with the County’s and my employer’s access and security policies or protocols. I agree that I will take strict security measures to ensure that County Information is kept secure; is properly stored in accordance with industry best practices, and if stored is encrypted; and is otherwise protected from retrieval or access by unauthorized persons or for unauthorized purposes. I will also ensure that any device or media on which County Information is stored, even temporarily, will have strict encryption, security, and access control and that I will not remove, facilitate the removal of or cause any Information to be removed from my employer’s worksite or the County’s physical facility without written authorization of the County Project Officer. If so authorized, I understand that I am responsible for the security of the electronic equipment or paper files on which the Information is stored and agree to promptly return such Information upon request. I will not use any devices, laptops, PDAs, netbooks, tablets, thumb drives or other media storage devices (“Device”) during my work on the Project without pre-approval. I will ensure that any Device connected to the County network is free of all computer viruses and running the latest version of an industry- standard virus protection program. I will also ensure that my user account and password, if any, is robust, protected and not shared. I will not download any County Information except as authorized by the County Project Officer and then only onto a County-approved Device. I understand that downloading onto a personally owned Device or service, such as personal e-mail, Dropbox etc., is prohibited. I agree that I will notify the County Project Officer immediately upon discovery or becoming aware or suspicious of any unauthorized disclosure of County Information, security breach, hacking or other breach of this agreement, the County’s or Contractor’s security policies, or any other breach of Project protocols concerning data security or County Information. I will fully cooperate with the County to help regain possession of any County Information and to prevent its further disclosure, use or dissemination. It is the intent of this NonDisclosure and Data Security Agreement to ensure that the highest level of administrative safeguards, information security, and other best practices are in place to ensure confidentiality, protection, privacy and security of County Information and County-networked resources and to ensure compliance with all applicable local, state and federal laws or regulatory requirements. Therefore, to the extent that this Nondisclosure and Data Security Agreement conflicts with the underlying Main Agreement or any local, state or federal law, regulation or provision, the more stringent requirement, law, regulation or provision controls. Upon completion or termination of my work on the Project, I agree to return all County Information to the County Project Officer. I understand that this agreement remains in full force and effect throughout my work on the Project and shall survive my reassignment from the Project, termination of the above referenced Project or my departure from my current employer. Signed: Printed Name: Date: Xxxxx Xxxxxx 7/19/2023 Witnessed: Contractor’s Project Manager: Printed Name: Date: TO BE COMPLETED PRIOR TO BEGINNING WORK ON THE PROJECT Eastern Research Group, Inc. PROPOSAL – BEST AND FINAL OFFER FOR HOURLY RATES RESPONSE TO RFP NO. 23-DES-RFP-230 ENERGY SERVICES Submitted to: Arlington County Office of the Purchasing Agent 0000 Xxxxxxxxx Xxxxxxxxx, Xxxxx 000 Arlington, VA 22201 Submitted by: Eastern Research Group, Inc. 0000 Xxxxxx Xxxxxxxxx, Unit 350 Arlington, VA 22201 June 15, 2023 June 15, 2023 Mr. Sy Gezachew, County Purchasing Agent Arlington County Office of the Purchasing Agent 0000 Xxxxxxxxx Xxxxxxxxx, Xxxxx 000 Arlington, VA 22201 xxxxxxxxx@xxxxxxxxxxx.xx Subject: Request for Proposal (RFP) No. 23-DES-RFP-230 - Energy Services; Best and Final Offer (BAFO) Dear Mr. Gezachew, Eastern Research Group, Inc. (ERG) is pleased to submit its best and final offer (BAFO) for hourly rates associated with RFP No. 23-DES-RFP-230 - Energy Services. We have updated our proposed hourly rates consistent with our current calendar year 2023 rates, and are offering a 2% discount on all staff. If you have any remaining questions or needs concerning our proposal or enclosed BAFO for hourly rates, please contact one of the individuals listed below. Offeror Name and Address Eastern Research Group, Inc. 0000 Xxxxxx Xxxxxxxxx, Unit 350 Arlington, VA 22201 UEI DK4TBEJRAR56 SIN/NAICS Code 541620 Points of Contact Cena Xxxxxxx Xxxxxx Xxxxxx Title Project Director Senior Contract Administrator Telephone Number 000-000-0000 000-000-0000 Email xxxx.xxxxxxx@xxx.xxx xxxxxx.xxxxxx@xxx.xxx ERG looks forward to the opportunity to provide Arlington County the highest quality of support under this procurement. Sincerely, Xxxxx Xxxxxxx, Vice President Eastern Research Group, Inc.

NONDISCLOSURE AND DATA SECURITY AGREEMENT. (CONTRACTOR)‌ The undersigned, an authorized agent of the Contractor and on behalf of SPay Inc dba Stack Sports Blue Whale EV (“Contractor”), hereby xxxxxx agrees that the Contractor will hold County-provided information, documents, data, images, records and the like confidential and secure and protect them against loss, misuse, alteration, destruction or disclosure. This includes, but is not limited to, the information of the County, its employees, contractors, residents, clients, patients, taxpayers and property as well as information that the County shares with the Contractor for testing, support, conversion or other services provided under Arlington County Agreement No. 23-DPRDES-SLA-534 RFP-230b (the “Project” or “Main Agreement”) or that may be accessed through other County-owned or -controlled databases (all of the above collectively referred to as “County Information” or “Information”). In addition to the DATA SECURITY obligations set in the County Agreement, the Contractor agrees that it will maintain the privacy and security of County Information, control and limit internal access and authorization for access to such Information and not divulge or allow or facilitate access to County Information for any purpose or by anyone unless expressly authorized. This includes, but is not limited to, any County Information that in any manner describes, locates or indexes anything about an individual, including, but not limited to, his/her (“his”) Personal Health Information, treatment, disability, services eligibility, services provided, investigations, real or personal property holdings and his education, financial transactions, medical history, ancestry, religion, political ideology, criminal or employment record, social security number, tax status or payments, date of birth, address, phone number or anything that affords a basis for inferring personal characteristics, such as finger and voice prints, photographs, or things done by or to such individual, or the record of his presence, registration, or membership in an organization or activity, or admission to an institution. Contractor also agrees that it will not directly or indirectly use or facilitate the use or dissemination of County information (whether intentionally or by inadvertence, negligence or omission and whether verbally, electronically, through paper transmission or otherwise) for any purpose other than that directly associated with its work under the Project. The Contractor acknowledges that any unauthorized use, dissemination or disclosure of County Information is prohibited and may also constitute a violation of Virginia or federal laws, subjecting it or its employees to civil and/or criminal penalties. Contractor agrees that it will not divulge or otherwise facilitate the disclosure, dissemination or access to or by any unauthorized person, for any purpose, of any Information obtained directly, or indirectly, as a result of its work on the Project. The Contractor shall coordinate closely with the County Project Officer to ensure that its authorization to its employees or approved subcontractors is appropriate and tightly controlled and that such person/s also maintain the security and privacy of County Information and the integrity of County-networked resources. Contractor agrees to take strict security measures to ensure that County Information is kept secure; is properly stored in accordance with industry best practices, and if stored is encryptedencrypted ; and is otherwise protected from retrieval or access by unauthorized persons or for unauthorized purposes. Any device or media on which County Information is stored, even temporarily, will have strict encryption, security, and access control. Any County Information that is accessible will not leave Contractor’s work site or the County’s physical facility, if the Contractor is working onsite, without written authorization of the County Project Officer. If remote access or other media storage is authorized, the Contractor is responsible for the security of such storage device or paper files. Contractor will ensure that any laptops, PDAs, netbooks, tablets, thumb drives or other media storage devices, as approved by the County and connected to the County network, are secure and free of all computer viruses, and running the latest version of an industry-standard virus protection program. The Contractor will ensure that all user accounts and passwords used by its employees or subcontractors are robust, protected and not shared. The Contractor will not download any County Information except as agreed to by the parties and then only onto a County-approved device. The Contractor understands that downloading onto a personally owned device or service, such as personal e-mail, Dropbox, etc., is prohibited. Contractor agrees that it will notify the County Project Officer immediately upon discovery or becoming aware or suspicious of any unauthorized disclosure of County Information, security breach, hacking or other breach of this agreement, the County’s or Contractor’s security policies, or any other breach of Project protocols concerning data security or County Information. The Contractor will fully cooperate with the County to regain possession of any Information and to prevent its further disclosure, use or dissemination. The Contractor also agrees to promptly notify others of a suspected or actual breach if requested. The Contractor agrees that all duties and obligations enumerated in this Agreement also extend to its employees, agents or subcontractors who are given access to County information. Breach of any of the above conditions by Contractor’s employees, agents or subcontractors shall be treated as a breach by the Contractor. The Contractor agrees that it shall take all reasonable measures to ensure that its employees, agents and subcontractors are aware of and abide by the terms and conditions of this agreement and related data security provisions in the Main Agreement. It is the intent of this NonDisclosure and Data Security Agreement to ensure that the Contractor has the highest level of administrative safeguards, information security, disaster recovery and other best practices in place to ensure confidentiality, protection, privacy and security of County information and County- networked resources and to ensure compliance with all applicable local, state and federal laws or regulatory requirements. Therefore, to the extent that this NonDisclosure and Data Security Agreement conflicts with the Main Agreement or with any applicable local, state, or federal law, regulation or provision, the more stringent requirement, law, regulation or provision controls. At the conclusion of the Project, the Contractor agrees to return all County Information to the County Project Officer. These obligations remain in full force and effect throughout the Project and shall survive any termination of the Main Agreement. Authorized Signature: Printed Name and Title: S_cott Xxxxxxxxx Chief Revenue Officer Date: 7/18/2023 EXHIBIT D NONDISCLOSURE AND DATA SECURITY AGREEMENT (INDIVIDUAL)‌ I, the undersigned, agree that I will hold County-provided information, documents, data, images, records and the like confidential and secure and protect it against loss, misuse, alteration, destruction or disclosure. This includes, but is not limited to, the information of the County, its employees, contractors, residents, clients, patients, taxpayers, and property as well as information that the County shares with my employer or prime contractor for testing, support, conversion or the provision of other services under Arlington County Agreement No. 23-DES-RFP-230b (the “Project” or “Main Agreement”) or which may be accessed through County-owned or -controlled databases (all of the above collectively referred to as “County Information” or “Information”). I agree that I will maintain the privacy and security of County Information and will not divulge or allow or facilitate access to County Information for any purpose or by anyone unless expressly authorized to do so by the County Project Officer. This includes, but is not limited to, any County Information that in any manner describes, locates or indexes anything about an individual including, but not limited to, his/her (“his”) Personal Health Information, treatment, disability, services eligibility, services provided, investigations, real or personal property holdings, education, financial transactions, medical history, ancestry, religion, political ideology, criminal or employment record, social security number, tax status or payments, date of birth, or that otherwise affords a basis for inferring personal characteristics, such as finger and voice prints, photographs, or things done by or to such individual, or the record of his presence, registration, or membership in an organization or activity, or admission to an institution. I agree that I will not directly or indirectly use or facilitate the use or dissemination of information (whether intentionally or by inadvertence, negligence or omission and whether verbally, electronically, through paper transmission or otherwise) for any purpose other than that directly authorized and associated with my designated duties on the Project. I understand and agree that any unauthorized use, dissemination or disclosure of County Information is prohibited and may also constitute a violation of Virginia or federal law/s, subjecting me and/or my employer to civil and/or criminal penalties. I also agree that I will not divulge or otherwise facilitate the disclosure, dissemination or access to or by any unauthorized person for any purpose of the Information obtained directly, or indirectly, as a result of my work on the Project. I agree to view, retrieve or access County Information only to the extent concomitant with my assigned duties on the Project and only in accordance with the County’s and my employer’s access and security policies or protocols. I agree that I will take strict security measures to ensure that County Information is kept secure; is properly stored in accordance with industry best practices, and if stored is encrypted; and is otherwise protected from retrieval or access by unauthorized persons or for unauthorized purposes. I will also ensure that any device or media on which County Information is stored, even temporarily, will have strict encryption, security, and access control and that I will not remove, facilitate the removal of or cause any Information to be removed from my employer’s worksite or the County’s physical facility without written authorization of the County Project Officer. If so authorized, I understand that I am responsible for the security of the electronic equipment or paper files on which the Information is stored and agree to promptly return such Information upon request. I will not use any devices, laptops, PDAs, netbooks, tablets, thumb drives or other media storage devices (“Device”) during my work on the Project without pre-approval. I will ensure that any Device connected to the County network is free of all computer viruses and running the latest version of an industry- standard virus protection program. I will also ensure that my user account and password, if any, is robust, protected and not shared. I will not download any County Information except as authorized by the County Project Officer and then only onto a County-approved Device. I understand that downloading onto a personally owned Device or service, such as personal e-mail, Dropbox etc., is prohibited. I agree that I will notify the County Project Officer immediately upon discovery or becoming aware or suspicious of any unauthorized disclosure of County Information, security breach, hacking or other breach of this agreement, the County’s or Contractor’s security policies, or any other breach of Project protocols concerning data security or County Information. I will fully cooperate with the County to help regain possession of any County Information and to prevent its further disclosure, use or dissemination. It is the intent of this NonDisclosure and Data Security Agreement to ensure that the highest level of administrative safeguards, information security, and other best practices are in place to ensure confidentiality, protection, privacy and security of County Information and County-networked resources and to ensure compliance with all applicable local, state and federal laws or regulatory requirements. Therefore, to the extent that this Nondisclosure and Data Security Agreement conflicts with the underlying Main Agreement or any local, state or federal law, regulation or provision, the more stringent requirement, law, regulation or provision controls. Upon completion or termination of my work on the Project, I agree to return all County Information to the County Project Officer. I understand that this agreement remains in full force and effect throughout my work on the Project and shall survive my reassignment from the Project, termination of the above referenced Project or my departure from my current employer. Signed: Printed Name: Date: Xxxxx Xxxxxxxxx 7/18/2023 Witnessed: Contractor’s Project Manager: Printed Name: Date: TO BE COMPLETED PRIOR TO BEGINNING WORK ON THE PROJECT EV Charging - Investment Summary Quotation For: Arlington County Government ( 23 -DES-RFP-230 ) - BAFO Date: First Name, Last Name Xx Xxxxxxxx Xxxxxxxx CFO Quotation #: Company Name Arlington County Government Customer ID: Street Address, City, State/Province, ZIP Code 6/12/2023 23-DES-RFP-230 Arlington County - BAFO 12 months - 6/12/2024 Xxxxx Xxxxxxxxx xxxxxxxxxx@xxxxxxxxxxx.xxx 000-000-0000 0000 Xxxxxxxxx Xxxx, Xxxxx 000, Xxxxxxxxx, XX 00000 Quotation valid until: Phone/email 000-000-0000, xxxxxxxxx@xxxxxxxxxxx.xx Prepared by: Comments or Special Instructions ( Site Location) email: Cell: Line Item # EV Charging Station Labor Categories Quantity Unit Unit Price Total 1 Electrician w 6+ years of experience 1 Hourly $ 100.00 Included 2 Master Certified Electrician 1 Hourly $ 135.00 Included 3 Apprentice 1 Hourly $ 72.00 Included 4 Program Manager / Project Manager 1 Hourly $ 110.00 Included 5 Engineering Services 1 Hourly $ 180.00 Included 6 Business Planning Services 1 Hourly $ 160.00 Included 7 Design Expert 1 Hourly $ 125.00 Included 8 Sr. Construction Oversight Manager 1 Hourly $ 110.00 Included Professional Services Subtotal $ - Installation Description - $ Total (Services) Optional Services Notes & Treasurer Date:Disclaimers: All rebates, grants, and tax credits are subject to the approval/denial of the issuing agency. Blue Whale EV will assist with the pursuit of such incentives but is not held responsible should rebates be unavailable. All electrical quotes are based on a visual inspection at time of site walk. A load study will be completed to confirm electrical requirements are met. If additional electrical requirements are deemed necessary as a result of the load test, this estimate is subject to additional charges for that completion. Due to constant changes and updates in the EV charging industry, this quote remains valid for 1 year. Blue Whale EV will communicate any updates to the EV industry in a prompt manner, but changes to the project as a result of changes outside of Blue Whale EV's preview, will be the responsibility of the client. Thank you for your business! Customer Representative (Signature) Date Customer Representative (Written Name) Blue Whale EV Representative (Signature) Date Signature is agreement to the above scope, terms and conditions; for the total price as indicated as QUOTATION PRICE. Any deviation of, or addition to, the above scope will result in a change order at additional charge. Any change order will be presented for approval prior to the commencement of any related change order work. Signature also agrees to all Notes, Terms and Conditions on any corresponding pages with the same Quotation No Blue Whale EV

NONDISCLOSURE AND DATA SECURITY AGREEMENT. (CONTRACTOR)‌ The undersigned, an authorized agent of the Contractor and on behalf of SPay Inc dba Stack Sports Xxxx Xxxxxxx Consulting Engineers, P (“Contractor”), hereby xxxxxx agrees that the Contractor will hold County-provided information, documents, data, images, records and the like confidential and secure and protect them against loss, misuse, alteration, destruction or disclosure. This includes, but is not limited to, the information of the County, its employees, contractors, residents, clients, patients, taxpayers and property as well as information that the County shares with the Contractor for testing, support, conversion or other services provided under Arlington County Agreement No. 23-DPRDES-SLA-534 RFP-230d (the “Project” or “Main Agreement”) or that may be accessed through other County-owned or -controlled databases (all of the above collectively referred to as “County Information” or “Information”). In addition to the DATA SECURITY obligations set in the County Agreement, the Contractor agrees that it will maintain the privacy and security of County Information, control and limit internal access and authorization for access to such Information and not divulge or allow or facilitate access to County Information for any purpose or by anyone unless expressly authorized. This includes, but is not limited to, any County Information that in any manner describes, locates or indexes anything about an individual, including, but not limited to, his/her (“his”) Personal Health Information, treatment, disability, services eligibility, services provided, investigations, real or personal property holdings and his education, financial transactions, medical history, ancestry, religion, political ideology, criminal or employment record, social security number, tax status or payments, date of birth, address, phone number or anything that affords a basis for inferring personal characteristics, such as finger and voice prints, photographs, or things done by or to such individual, or the record of his presence, registration, or membership in an organization or activity, or admission to an institution. Contractor also agrees that it will not directly or indirectly use or facilitate the use or dissemination of County information (whether intentionally or by inadvertence, negligence or omission and whether verbally, electronically, through paper transmission or otherwise) for any purpose other than that directly associated with its work under the Project. The Contractor acknowledges that any unauthorized use, dissemination or disclosure of County Information is prohibited and may also constitute a violation of Virginia or federal laws, subjecting it or its employees to civil and/or criminal penalties. Contractor agrees that it will not divulge or otherwise facilitate the disclosure, dissemination or access to or by any unauthorized person, for any purpose, of any Information obtained directly, or indirectly, as a result of its work on the Project. The Contractor shall coordinate closely with the County Project Officer to ensure that its authorization to its employees or approved subcontractors is appropriate and tightly controlled and that such person/s also maintain the security and privacy of County Information and the integrity of County-networked resources. Contractor agrees to take strict security measures to ensure that County Information is kept secure; is properly stored in accordance with industry best practices, and if stored is encryptedencrypted ; and is otherwise protected from retrieval or access by unauthorized persons or for unauthorized purposes. Any device or media on which County Information is stored, even temporarily, will have strict encryption, security, and access control. Any County Information that is accessible will not leave Contractor’s work site or the County’s physical facility, if the Contractor is working onsite, without written authorization of the County Project Officer. If remote access or other media storage is authorized, the Contractor is responsible for the security of such storage device or paper files. Contractor will ensure that any laptops, PDAs, netbooks, tablets, thumb drives or other media storage devices, as approved by the County and connected to the County network, are secure and free of all computer viruses, and running the latest version of an industry-standard virus protection program. The Contractor will ensure that all user accounts and passwords used by its employees or subcontractors are robust, protected and not shared. The Contractor will not download any County Information except as agreed to by the parties and then only onto a County-approved device. The Contractor understands that downloading onto a personally owned device or service, such as personal e-mail, Dropbox, etc., is prohibited. Contractor agrees that it will notify the County Project Officer immediately upon discovery or becoming aware or suspicious of any unauthorized disclosure of County Information, security breach, hacking or other breach of this agreement, the County’s or Contractor’s security policies, or any other breach of Project protocols concerning data security or County Information. The Contractor will fully cooperate with the County to regain possession of any Information and to prevent its further disclosure, use or dissemination. The Contractor also agrees to promptly notify others of a suspected or actual breach if requested. The Contractor agrees that all duties and obligations enumerated in this Agreement also extend to its employees, agents or subcontractors who are given access to County information. Breach of any of the above conditions by Contractor’s employees, agents or subcontractors shall be treated as a breach by the Contractor. The Contractor agrees that it shall take all reasonable measures to ensure that its employees, agents and subcontractors are aware of and abide by the terms and conditions of this agreement and related data security provisions in the Main Agreement. It is the intent of this NonDisclosure and Data Security Agreement to ensure that the Contractor has the highest level of administrative safeguards, information security, disaster recovery and other best practices in place to ensure confidentiality, protection, privacy and security of County information and County- networked resources and to ensure compliance with all applicable local, state and federal laws or regulatory requirements. Therefore, to the extent that this NonDisclosure and Data Security Agreement conflicts with the Main Agreement or with any applicable local, state, or federal law, regulation or provision, the more stringent requirement, law, regulation or provision controls. At the conclusion of the Project, the Contractor agrees to return all County Information to the County Project Officer. These obligations remain in full force and effect throughout the Project and shall survive any termination of the Main Agreement. Authorized Signature: Printed Name and Title: Xxxxxxxx Xxxxxxxx CFO & Treasurer Xxxxx Xxxxxxxxxxx 7/18/2023 Corporate Secretary Date:: EXHIBIT D NONDISCLOSURE AND DATA SECURITY AGREEMENT (INDIVIDUAL)‌ I, the undersigned, agree that I will hold County-provided information, documents, data, images, records and the like confidential and secure and protect it against loss, misuse, alteration, destruction or disclosure. This includes, but is not limited to, the information of the County, its employees, contractors, residents, clients, patients, taxpayers, and property as well as information that the County shares with my employer or prime contractor for testing, support, conversion or the provision of other services under Arlington County Agreement No. 23-DES-RFP-230d (the “Project” or “Main Agreement”) or which may be accessed through County-owned or -controlled databases (all of the above collectively referred to as “County Information” or “Information”). I agree that I will maintain the privacy and security of County Information and will not divulge or allow or facilitate access to County Information for any purpose or by anyone unless expressly authorized to do so by the County Project Officer. This includes, but is not limited to, any County Information that in any manner describes, locates or indexes anything about an individual including, but not limited to, his/her (“his”) Personal Health Information, treatment, disability, services eligibility, services provided, investigations, real or personal property holdings, education, financial transactions, medical history, ancestry, religion, political ideology, criminal or employment record, social security number, tax status or payments, date of birth, or that otherwise affords a basis for inferring personal characteristics, such as finger and voice prints, photographs, or things done by or to such individual, or the record of his presence, registration, or membership in an organization or activity, or admission to an institution. I agree that I will not directly or indirectly use or facilitate the use or dissemination of information (whether intentionally or by inadvertence, negligence or omission and whether verbally, electronically, through paper transmission or otherwise) for any purpose other than that directly authorized and associated with my designated duties on the Project. I understand and agree that any unauthorized use, dissemination or disclosure of County Information is prohibited and may also constitute a violation of Virginia or federal law/s, subjecting me and/or my employer to civil and/or criminal penalties. I also agree that I will not divulge or otherwise facilitate the disclosure, dissemination or access to or by any unauthorized person for any purpose of the Information obtained directly, or indirectly, as a result of my work on the Project. I agree to view, retrieve or access County Information only to the extent concomitant with my assigned duties on the Project and only in accordance with the County’s and my employer’s access and security policies or protocols. I agree that I will take strict security measures to ensure that County Information is kept secure; is properly stored in accordance with industry best practices, and if stored is encrypted; and is otherwise protected from retrieval or access by unauthorized persons or for unauthorized purposes. I will also ensure that any device or media on which County Information is stored, even temporarily, will have strict encryption, security, and access control and that I will not remove, facilitate the removal of or cause any Information to be removed from my employer’s worksite or the County’s physical facility without written authorization of the County Project Officer. If so authorized, I understand that I am responsible for the security of the electronic equipment or paper files on which the Information is stored and agree to promptly return such Information upon request. I will not use any devices, laptops, PDAs, netbooks, tablets, thumb drives or other media storage devices (“Device”) during my work on the Project without pre-approval. I will ensure that any Device connected to the County network is free of all computer viruses and running the latest version of an industry- standard virus protection program. I will also ensure that my user account and password, if any, is robust, protected and not shared. I will not download any County Information except as authorized by the County Project Officer and then only onto a County-approved Device. I understand that downloading onto a personally owned Device or service, such as personal e-mail, Dropbox etc., is prohibited. I agree that I will notify the County Project Officer immediately upon discovery or becoming aware or suspicious of any unauthorized disclosure of County Information, security breach, hacking or other breach of this agreement, the County’s or Contractor’s security policies, or any other breach of Project protocols concerning data security or County Information. I will fully cooperate with the County to help regain possession of any County Information and to prevent its further disclosure, use or dissemination. It is the intent of this NonDisclosure and Data Security Agreement to ensure that the highest level of administrative safeguards, information security, and other best practices are in place to ensure confidentiality, protection, privacy and security of County Information and County-networked resources and to ensure compliance with all applicable local, state and federal laws or regulatory requirements. Therefore, to the extent that this Nondisclosure and Data Security Agreement conflicts with the underlying Main Agreement or any local, state or federal law, regulation or provision, the more stringent requirement, law, regulation or provision controls. Upon completion or termination of my work on the Project, I agree to return all County Information to the County Project Officer. I understand that this agreement remains in full force and effect throughout my work on the Project and shall survive my reassignment from the Project, termination of the above referenced Project or my departure from my current employer. Signed: Printed Name: Xxxxx Xxxxxxxxxxx 7/18/2023 Date: Witnessed: Contractor’s Project Manager: Printed Name: Date: TO BE COMPLETED PRIOR TO BEGINNING WORK ON THE PROJECT DocuSign Envelope ID: F029B337-9709-4A9A-87AB-D1B3267E2FFD Tuesday, June 20, 2023 Sy Gezachew, VCCO, VCO/A Procurement Officer Arlington County Government Department of Management and Finance 0000 Xxxxxxxxx Xxxx., Xxxxx 000 Arlington, VA 22201 RE: 23-DES-RFP-230 Buro Happold, BAFO Dear Xx, Thank you for the opportunity to submit a Best and Final Offer (BAFO) for the following services for the above referenced RFP.

NONDISCLOSURE AND DATA SECURITY AGREEMENT. (CONTRACTOR)‌ The undersigned, an authorized agent of the Contractor and on behalf of SPay Inc dba Stack Sports Spark Business Academy, Inc. (“Contractor”), hereby xxxxxx agrees that the Contractor will hold County-provided information, documents, data, images, records and the like confidential and secure and protect them against loss, misuse, alteration, destruction or disclosure. This includes, but is not limited to, the information of the County, its employees, contractors, residents, clients, patients, taxpayers and property as well as information that the County shares with the Contractor for testing, support, conversion or other services provided under Arlington County Agreement No. 2324-DPR-SLA-534 RFP-160v (the “Project” or “Main Agreement”) or that may be accessed through other County-owned or -controlled databases (all of the above collectively referred to as “County Information” or “Information”). In addition to the DATA SECURITY obligations set in the County Agreement, the Contractor agrees that it will maintain the privacy and security of County Information, control and limit internal access and authorization for access to such Information and not divulge or allow or facilitate access to County Information for any purpose or by anyone unless expressly authorized. This includes, but is not limited to, any County Information that in any manner describes, locates or indexes anything about an individual, including, but not limited to, his/her (“his”) Personal Health Information, treatment, disability, services eligibility, services provided, investigations, real or personal property holdings and his education, financial transactions, medical history, ancestry, religion, political ideology, criminal or employment record, social security number, tax status or payments, date of birth, address, phone number or anything that affords a basis for inferring personal characteristics, such as finger and voice prints, photographs, or things done by or to such individual, or the record of his presence, registration, or membership in an organization or activity, or admission to an institution. Contractor also agrees that it will not directly or indirectly use or facilitate the use or dissemination of County information (whether intentionally or by inadvertence, negligence or omission and whether verbally, electronically, through paper transmission or otherwise) for any purpose other than that directly associated with its work under the Project. The Contractor acknowledges that any unauthorized use, dissemination or disclosure of County Information is prohibited and may also constitute a violation of Virginia or federal laws, subjecting it or its employees to civil and/or criminal penalties. Contractor agrees that it will not divulge or otherwise facilitate the disclosure, dissemination or access to or by any unauthorized person, for any purpose, of any Information obtained directly, or indirectly, as a result of its work on the Project. The Contractor shall coordinate closely with the County Project Officer to ensure that its authorization to its employees or approved subcontractors is appropriate and tightly controlled and that such person/s also maintain the security and privacy of County Information and the integrity of County-networked resources. Contractor agrees to take strict security measures to ensure that County Information is kept secure; is properly stored in accordance with industry best practices, and if stored is encrypted; and is otherwise protected from retrieval or access by unauthorized persons or for unauthorized purposes. Any device or media on which County Information is stored, even temporarily, will have strict encryption, security, and access control. Any County Information that is accessible will not leave Contractor’s work site or the County’s physical facility, if the Contractor is working onsite, without written authorization of the County Project Officer. If remote access or other media storage is authorized, the Contractor is responsible for the security of such storage device or paper files. Contractor will ensure that any laptops, PDAs, netbooks, tablets, thumb drives or other media storage devices, as approved by the County and connected to the County network, are secure and free of all computer viruses, and running the latest version of an industry-standard virus protection program. The Contractor will ensure that all user accounts and passwords used by its employees or subcontractors are robust, protected and not shared. The Contractor will not download any County Information except as agreed to by the parties and then only onto a County-approved device. The Contractor understands that downloading onto a personally owned device or service, such as personal e-mail, Dropbox, etc., is prohibited. Contractor agrees that it will notify the County Project Officer immediately upon discovery or becoming aware or suspicious of any unauthorized disclosure of County Information, security breach, hacking or other breach of this agreement, the County’s or Contractor’s security policies, or any other breach of Project protocols concerning data security or County Information. The Contractor will fully cooperate with the County to regain possession of any Information and to prevent its further disclosure, use or dissemination. The Contractor also agrees to promptly notify others of a suspected or actual breach if requested. The Contractor agrees that all duties and obligations enumerated in this Agreement also extend to its employees, agents or subcontractors who are given access to County information. Breach of any of the above conditions by Contractor’s employees, agents or subcontractors shall be treated as a breach by the Contractor. The Contractor agrees that it shall take all reasonable measures to ensure that its employees, agents and subcontractors are aware of and abide by the terms and conditions of this agreement and related data security provisions in the Main Agreement. It is the intent of this NonDisclosure and Data Security Agreement to ensure that the Contractor has the highest level of administrative safeguards, information security, disaster recovery and other best practices in place to ensure confidentiality, protection, privacy and security of County information and County- County-networked resources and to ensure compliance with all applicable local, state and federal laws or regulatory requirements. Therefore, to the extent that this NonDisclosure and Data Security Agreement conflicts with the Main Agreement or with any applicable local, state, or federal law, regulation or provision, the more stringent requirement, law, regulation or provision controls. At the conclusion of the Project, the Contractor agrees to return all County Information to the County Project Officer. These obligations remain in full force and effect throughout the Project and shall survive any termination of the Main Agreement. Authorized Signature: Printed Name and Title: Xxxxxxxx Xxxxxxxx CFO & Treasurer Xxxxx Xxxxxx Xxxxxxx CEO 11/24/2023 Date:: NONDISCLOSURE AND DATA SECURITY AGREEMENT (INDIVIDUAL)‌ I, the undersigned, agree that I will hold County-provided information, documents, data, images, records and the like confidential and secure and protect it against loss, misuse, alteration, destruction or disclosure. This includes, but is not limited to, the information of the County, its employees, contractors, residents, clients, patients, taxpayers, and property as well as information that the County shares with my employer or prime contractor for testing, support, conversion or the provision of other services under Arlington County Agreement No. 24-DPR-RFP- 160v (the “Project” or “Main Agreement”) or which may be accessed through County-owned or -controlled databases (all of the above collectively referred to as “County Information” or “Information”). I agree that I will maintain the privacy and security of County Information and will not divulge or allow or facilitate access to County Information for any purpose or by anyone unless expressly authorized to do so by the County Project Officer. This includes, but is not limited to, any County Information that in any manner describes, locates or indexes anything about an individual including, but not limited to, his/her (“his”) Personal Health Information, treatment, disability, services eligibility, services provided, investigations, real or personal property holdings, education, financial transactions, medical history, ancestry, religion, political ideology, criminal or employment record, social security number, tax status or payments, date of birth, or that otherwise affords a basis for inferring personal characteristics, such as finger and voice prints, photographs, or things done by or to such individual, or the record of his presence, registration, or membership in an organization or activity, or admission to an institution. I agree that I will not directly or indirectly use or facilitate the use or dissemination of information (whether intentionally or by inadvertence, negligence or omission and whether verbally, electronically, through paper transmission or otherwise) for any purpose other than that directly authorized and associated with my designated duties on the Project. I understand and agree that any unauthorized use, dissemination or disclosure of County Information is prohibited and may also constitute a violation of Virginia or federal law/s, subjecting me and/or my employer to civil and/or criminal penalties. I also agree that I will not divulge or otherwise facilitate the disclosure, dissemination or access to or by any unauthorized person for any purpose of the Information obtained directly, or indirectly, as a result of my work on the Project. I agree to view, retrieve or access County Information only to the extent concomitant with my assigned duties on the Project and only in accordance with the County’s and my employer’s access and security policies or protocols. I agree that I will take strict security measures to ensure that County Information is kept secure; is properly stored in accordance with industry best practices, and if stored is encrypted; and is otherwise protected from retrieval or access by unauthorized persons or for unauthorized purposes. I will also ensure that any device or media on which County Information is stored, even temporarily, will have strict encryption, security, and access control and that I will not remove, facilitate the removal of or cause any Information to be removed from my employer’s worksite or the County’s physical facility without written authorization of the County Project Officer. If so authorized, I understand that I am responsible for the security of the electronic equipment or paper files on which the Information is stored and agree to promptly return such Information upon request. I will not use any devices, laptops, PDAs, netbooks, tablets, thumb drives or other media storage devices (“Device”) during my work on the Project without pre-approval. I will ensure that any Device connected to the County network is free of all computer viruses and running the latest version of an industry-standard virus protection program. I will also ensure that my user account and password, if any, is robust, protected and not shared. I will not download any County Information except as authorized by the County Project Officer and then only onto a County-approved Device. I understand that downloading onto a personally owned Device or service, such as personal e-mail, Dropbox etc., is prohibited. I agree that I will notify the County Project Officer immediately upon discovery or becoming aware or suspicious of any unauthorized disclosure of County Information, security breach, hacking or other breach of this agreement, the County’s or Contractor’s security policies, or any other breach of Project protocols concerning data security or County Information. I will fully cooperate with the County to help regain possession of any County Information and to prevent its further disclosure, use or dissemination. It is the intent of this NonDisclosure and Data Security Agreement to ensure that the highest level of administrative safeguards, information security, and other best practices are in place to ensure confidentiality, protection, privacy and security of County Information and County-networked resources and to ensure compliance with all applicable local, state and federal laws or regulatory requirements. Therefore, to the extent that this Nondisclosure and Data Security Agreement conflicts with the underlying Main Agreement or any local, state or federal law, regulation or provision, the more stringent requirement, law, regulation or provision controls. Upon completion or termination of my work on the Project, I agree to return all County Information to the County Project Officer. I understand that this agreement remains in full force and effect throughout my work on the Project and shall survive my reassignment from the Project, termination of the above referenced Project or my departure from my current employer. Signed: Printed Name: Date: Witnessed: Contractor’s Project Manager: Printed Name: Date: TO BE COMPLETED PRIOR TO BEGINNING WORK ON THE PROJECT EXHIBIT C CONTRACTOR PERFORMANCE EVALUATION FORM ARLINGTON COUNTY GOVERNMENT Contractor Performance Evaluation Form Contractor Name: Contract No.: Date: Project/Contract Name: Interim Evaluation Final Evaluation Scope of Work/Services Provided: Contract Start Date: / / Contract End Date: / / Actual Completion Date: / / Please rate the effectiveness of the Contractor’s performance on the Contract/Project across the following dimensions: Evaluation Criteria: Unacceptable Poor Satisfactory Excellent Written comments to explain assigned ratings are required for any performance ratings below “satisfactory” or an “excellent” in any category. Evaluation Questions

NONDISCLOSURE AND DATA SECURITY AGREEMENT. (CONTRACTOR)‌ The undersigned, an authorized agent of the Contractor and on behalf of SPay Inc dba Stack Sports Orange Line Sports, LLC (“Contractor”), hereby agrees that the Contractor will hold County-provided information, documents, data, images, records and the like confidential and secure and protect them against loss, misuse, alteration, destruction or disclosure. This includes, but is not limited to, the information of the County, its employees, contractors, residents, clients, patients, taxpayers and property as well as information that the County shares with the Contractor for testing, support, conversion or other services provided under Arlington County Agreement No. 2324-DPR-SLA-534 RFP-160t (the “Project” or “Main Agreement”) or that may be accessed through other County-owned or -controlled databases (all of the above collectively referred to as “County Information” or “Information”). In addition to the DATA SECURITY obligations set in the County Agreement, the Contractor agrees that it will maintain the privacy and security of County Information, control and limit internal access and authorization for access to such Information and not divulge or allow or facilitate access to County Information for any purpose or by anyone unless expressly authorized. This includes, but is not limited to, any County Information that in any manner describes, locates or indexes anything about an individual, including, but not limited to, his/her (“his”) Personal Health Information, treatment, disability, services eligibility, services provided, investigations, real or personal property holdings and his education, financial transactions, medical history, ancestry, religion, political ideology, criminal or employment record, social security number, tax status or payments, date of birth, address, phone number or anything that affords a basis for inferring personal characteristics, such as finger and voice prints, photographs, or things done by or to such individual, or the record of his presence, registration, or membership in an organization or activity, or admission to an institution. Contractor also agrees that it will not directly or indirectly use or facilitate the use or dissemination of County information (whether intentionally or by inadvertence, negligence or omission and whether verbally, electronically, through paper transmission or otherwise) for any purpose other than that directly associated with its work under the Project. The Contractor acknowledges that any unauthorized use, dissemination or disclosure of County Information is prohibited and may also constitute a violation of Virginia or federal laws, subjecting it or its employees to civil and/or criminal penalties. Contractor agrees that it will not divulge or otherwise facilitate the disclosure, dissemination or access to or by any unauthorized person, for any purpose, of any Information obtained directly, or indirectly, as a result of its work on the Project. The Contractor shall coordinate closely with the County Project Officer to ensure that its authorization to its employees or approved subcontractors is appropriate and tightly controlled and that such person/s also maintain the security and privacy of County Information and the integrity of County-networked resources. Contractor agrees to take strict security measures to ensure that County Information is kept secure; is properly stored in accordance with industry best practices, and if stored is encrypted; and is otherwise protected from retrieval or access by unauthorized persons or for unauthorized purposes. Any device or media on which County Information is stored, even temporarily, will have strict encryption, security, and access control. Any County Information that is accessible will not leave Contractor’s work site or the County’s physical facility, if the Contractor is working onsite, without written authorization of the County Project Officer. If remote access or other media storage is authorized, the Contractor is responsible for the security of such storage device or paper files. Contractor will ensure that any laptops, PDAs, netbooks, tablets, thumb drives or other media storage devices, as approved by the County and connected to the County network, are secure and free of all computer viruses, and running the latest version of an industry-standard virus protection program. The Contractor will ensure that all user accounts and passwords used by its employees or subcontractors are robust, protected and not shared. The Contractor will not download any County Information except as agreed to by the parties and then only onto a County-approved device. The Contractor understands that downloading onto a personally owned device or service, such as personal e-mail, Dropbox, etc., is prohibited. Contractor agrees that it will notify the County Project Officer immediately upon discovery or becoming aware or suspicious of any unauthorized disclosure of County Information, security breach, hacking or other breach of this agreement, the County’s or Contractor’s security policies, or any other breach of Project protocols concerning data security or County Information. The Contractor will fully cooperate with the County to regain possession of any Information and to prevent its further disclosure, use or dissemination. The Contractor also agrees to promptly notify others of a suspected or actual breach if requested. The Contractor agrees that all duties and obligations enumerated in this Agreement also extend to its employees, agents or subcontractors who are given access to County information. Breach of any of the above conditions by Contractor’s employees, agents or subcontractors shall be treated as a breach by the Contractor. The Contractor agrees that it shall take all reasonable measures to ensure that its employees, agents and subcontractors are aware of and abide by the terms and conditions of this agreement and related data security provisions in the Main Agreement. It is the intent of this NonDisclosure and Data Security Agreement to ensure that the Contractor has the highest level of administrative safeguards, information security, disaster recovery and other best practices in place to ensure confidentiality, protection, privacy and security of County information and County- County-networked resources and to ensure compliance with all applicable local, state and federal laws or regulatory requirements. Therefore, to the extent that this NonDisclosure and Data Security Agreement conflicts with the Main Agreement or with any applicable local, state, or federal law, regulation or provision, the more stringent requirement, law, regulation or provision controls. At the conclusion of the Project, the Contractor agrees to return all County Information to the County Project Officer. These obligations remain in full force and effect throughout the Project and shall survive any termination of the Main Agreement. Authorized Signature: Printed Name and Title: Xxxxxxxx Xxxxxxxx CFO & Treasurer Xxxxxx Xxxx Owner 11/21/2023 Date:: NONDISCLOSURE AND DATA SECURITY AGREEMENT (INDIVIDUAL)‌ I, the undersigned, agree that I will hold County-provided information, documents, data, images, records and the like confidential and secure and protect it against loss, misuse, alteration, destruction or disclosure. This includes, but is not limited to, the information of the County, its employees, contractors, residents, clients, patients, taxpayers, and property as well as information that the County shares with my employer or prime contractor for testing, support, conversion or the provision of other services under Arlington County Agreement No. 24-DPR-RFP- 160t (the “Project” or “Main Agreement”) or which may be accessed through County-owned or -controlled databases (all of the above collectively referred to as “County Information” or “Information”). I agree that I will maintain the privacy and security of County Information and will not divulge or allow or facilitate access to County Information for any purpose or by anyone unless expressly authorized to do so by the County Project Officer. This includes, but is not limited to, any County Information that in any manner describes, locates or indexes anything about an individual including, but not limited to, his/her (“his”) Personal Health Information, treatment, disability, services eligibility, services provided, investigations, real or personal property holdings, education, financial transactions, medical history, ancestry, religion, political ideology, criminal or employment record, social security number, tax status or payments, date of birth, or that otherwise affords a basis for inferring personal characteristics, such as finger and voice prints, photographs, or things done by or to such individual, or the record of his presence, registration, or membership in an organization or activity, or admission to an institution. I agree that I will not directly or indirectly use or facilitate the use or dissemination of information (whether intentionally or by inadvertence, negligence or omission and whether verbally, electronically, through paper transmission or otherwise) for any purpose other than that directly authorized and associated with my designated duties on the Project. I understand and agree that any unauthorized use, dissemination or disclosure of County Information is prohibited and may also constitute a violation of Virginia or federal law/s, subjecting me and/or my employer to civil and/or criminal penalties. I also agree that I will not divulge or otherwise facilitate the disclosure, dissemination or access to or by any unauthorized person for any purpose of the Information obtained directly, or indirectly, as a result of my work on the Project. I agree to view, retrieve or access County Information only to the extent concomitant with my assigned duties on the Project and only in accordance with the County’s and my employer’s access and security policies or protocols. I agree that I will take strict security measures to ensure that County Information is kept secure; is properly stored in accordance with industry best practices, and if stored is encrypted; and is otherwise protected from retrieval or access by unauthorized persons or for unauthorized purposes. I will also ensure that any device or media on which County Information is stored, even temporarily, will have strict encryption, security, and access control and that I will not remove, facilitate the removal of or cause any Information to be removed from my employer’s worksite or the County’s physical facility without written authorization of the County Project Officer. If so authorized, I understand that I am responsible for the security of the electronic equipment or paper files on which the Information is stored and agree to promptly return such Information upon request. I will not use any devices, laptops, PDAs, netbooks, tablets, thumb drives or other media storage devices (“Device”) during my work on the Project without pre-approval. I will ensure that any Device connected to the County network is free of all computer viruses and running the latest version of an industry-standard virus protection program. I will also ensure that my user account and password, if any, is robust, protected and not shared. I will not download any County Information except as authorized by the County Project Officer and then only onto a County-approved Device. I understand that downloading onto a personally owned Device or service, such as personal e-mail, Dropbox etc., is prohibited. I agree that I will notify the County Project Officer immediately upon discovery or becoming aware or suspicious of any unauthorized disclosure of County Information, security breach, hacking or other breach of this agreement, the County’s or Contractor’s security policies, or any other breach of Project protocols concerning data security or County Information. I will fully cooperate with the County to help regain possession of any County Information and to prevent its further disclosure, use or dissemination. It is the intent of this NonDisclosure and Data Security Agreement to ensure that the highest level of administrative safeguards, information security, and other best practices are in place to ensure confidentiality, protection, privacy and security of County Information and County-networked resources and to ensure compliance with all applicable local, state and federal laws or regulatory requirements. Therefore, to the extent that this Nondisclosure and Data Security Agreement conflicts with the underlying Main Agreement or any local, state or federal law, regulation or provision, the more stringent requirement, law, regulation or provision controls. Upon completion or termination of my work on the Project, I agree to return all County Information to the County Project Officer. I understand that this agreement remains in full force and effect throughout my work on the Project and shall survive my reassignment from the Project, termination of the above referenced Project or my departure from my current employer. Signed: Printed Name: Date: Witnessed: Contractor’s Project Manager: Printed Name: Date: TO BE COMPLETED PRIOR TO BEGINNING WORK ON THE PROJECT EXHIBIT C CONTRACTOR PERFORMANCE EVALUATION FORM ARLINGTON COUNTY GOVERNMENT Contractor Performance Evaluation Form Contractor Name: Contract No.: Date: Project/Contract Name: Interim Evaluation Final Evaluation Scope of Work/Services Provided: Contract Start Date: / / Contract End Date: / / Actual Completion Date: / / Please rate the effectiveness of the Contractor’s performance on the Contract/Project across the following dimensions: Evaluation Criteria: Unacceptable Poor Satisfactory Excellent Written comments to explain assigned ratings are required for any performance ratings below “satisfactory” or an “excellent” in any category. Evaluation Questions

NONDISCLOSURE AND DATA SECURITY AGREEMENT. (CONTRACTOR)‌ The undersigned, an authorized agent of the Contractor and on behalf of SPay Inc dba Stack Sports Stantec Consulting Se_rvices Inc. (“Contractor”), hereby xxxxxx agrees that the Contractor will hold County-provided information, documents, data, images, records and the like confidential and secure and protect them against loss, misuse, alteration, destruction or disclosure. This includes, but is not limited to, the information of the County, its employees, contractors, residents, clients, patients, taxpayers and property as well as information that the County shares with the Contractor for testing, support, conversion or other services provided under Arlington County Agreement No. 23-DPRDES-SLA-534 RFP-230j (the “Project” or “Main Agreement”) or that may be accessed through other County-owned or -controlled databases (all of the above collectively referred to as “County Information” or “Information”). In addition to the DATA SECURITY obligations set in the County Agreement, the Contractor agrees that it will maintain the privacy and security of County Information, control and limit internal access and authorization for access to such Information and not divulge or allow or facilitate access to County Information for any purpose or by anyone unless expressly authorized. This includes, but is not limited to, any County Information that in any manner describes, locates or indexes anything about an individual, including, but not limited to, his/her (“his”) Personal Health Information, treatment, disability, services eligibility, services provided, investigations, real or personal property holdings and his education, financial transactions, medical history, ancestry, religion, political ideology, criminal or employment record, social security number, tax status or payments, date of birth, address, phone number or anything that affords a basis for inferring personal characteristics, such as finger and voice prints, photographs, or things done by or to such individual, or the record of his presence, registration, or membership in an organization or activity, or admission to an institution. Contractor also agrees that it will not directly or indirectly use or facilitate the use or dissemination of County information (whether intentionally or by inadvertence, negligence or omission and whether verbally, electronically, through paper transmission or otherwise) for any purpose other than that directly associated with its work under the Project. The Contractor acknowledges that any unauthorized use, dissemination or disclosure of County Information is prohibited and may also constitute a violation of Virginia or federal laws, subjecting it or its employees to civil and/or criminal penalties. Contractor agrees that it will not divulge or otherwise facilitate the disclosure, dissemination or access to or by any unauthorized person, for any purpose, of any Information obtained directly, or indirectly, as a result of its work on the Project. The Contractor shall coordinate closely with the County Project Officer to ensure that its authorization to its employees or approved subcontractors is appropriate and tightly controlled and that such person/s also maintain the security and privacy of County Information and the integrity of County-networked resources. Contractor agrees to take strict security measures to ensure that County Information is kept secure; is properly stored in accordance with industry best practices, and if stored is encryptedencrypted ; and is otherwise protected from retrieval or access by unauthorized persons or for unauthorized purposes. Any device or media on which County Information is stored, even temporarily, will have strict encryption, security, and access control. Any County Information that is accessible will not leave Contractor’s work site or the County’s physical facility, if the Contractor is working onsite, without written authorization of the County Project Officer. If remote access or other media storage is authorized, the Contractor is responsible for the security of such storage device or paper files. Contractor will ensure that any laptops, PDAs, netbooks, tablets, thumb drives or other media storage devices, as approved by the County and connected to the County network, are secure and free of all computer viruses, and running the latest version of an industry-standard virus protection program. The Contractor will ensure that all user accounts and passwords used by its employees or subcontractors are robust, protected and not shared. The Contractor will not download any County Information except as agreed to by the parties and then only onto a County-approved device. The Contractor understands that downloading onto a personally owned device or service, such as personal e-mail, Dropbox, etc., is prohibited. Contractor agrees that it will notify the County Project Officer immediately upon discovery or becoming aware or suspicious of any unauthorized disclosure of County Information, security breach, hacking or other breach of this agreement, the County’s or Contractor’s security policies, or any other breach of Project protocols concerning data security or County Information. The Contractor will fully cooperate with the County to regain possession of any Information and to prevent its further disclosure, use or dissemination. The Contractor also agrees to promptly notify others of a suspected or actual breach if requested. The Contractor agrees that all duties and obligations enumerated in this Agreement also extend to its employees, agents or subcontractors who are given access to County information. Breach of any of the above conditions by Contractor’s employees, agents or subcontractors shall be treated as a breach by the Contractor. The Contractor agrees that it shall take all reasonable measures to ensure that its employees, agents and subcontractors are aware of and abide by the terms and conditions of this agreement and related data security provisions in the Main Agreement. It is the intent of this NonDisclosure and Data Security Agreement to ensure that the Contractor has the highest level of administrative safeguards, information security, disaster recovery and other best practices in place to ensure confidentiality, protection, privacy and security of County information and County- networked resources and to ensure compliance with all applicable local, state and federal laws or regulatory requirements. Therefore, to the extent that this NonDisclosure and Data Security Agreement conflicts with the Main Agreement or with any applicable local, state, or federal law, regulation or provision, the more stringent requirement, law, regulation or provision controls. At the conclusion of the Project, the Contractor agrees to return all County Information to the County Project Officer. These obligations remain in full force and effect throughout the Project and shall survive any termination of the Main Agreement. Authorized Signature: Printed Name and Title: Da_vid Xxxxx 7/19/2023 Senior Vice President, Transportation Date: EXHIBIT D NONDISCLOSURE AND DATA SECURITY AGREEMENT (INDIVIDUAL)‌ I, the undersigned, agree that I will hold County-provided information, documents, data, images, records and the like confidential and secure and protect it against loss, misuse, alteration, destruction or disclosure. This includes, but is not limited to, the information of the County, its employees, contractors, residents, clients, patients, taxpayers, and property as well as information that the County shares with my employer or prime contractor for testing, support, conversion or the provision of other services under Arlington County Agreement No. 23-DES-RFP-230j (the “Project” or “Main Agreement”) or which may be accessed through County-owned or -controlled databases (all of the above collectively referred to as “County Information” or “Information”). I agree that I will maintain the privacy and security of County Information and will not divulge or allow or facilitate access to County Information for any purpose or by anyone unless expressly authorized to do so by the County Project Officer. This includes, but is not limited to, any County Information that in any manner describes, locates or indexes anything about an individual including, but not limited to, his/her (“his”) Personal Health Information, treatment, disability, services eligibility, services provided, investigations, real or personal property holdings, education, financial transactions, medical history, ancestry, religion, political ideology, criminal or employment record, social security number, tax status or payments, date of birth, or that otherwise affords a basis for inferring personal characteristics, such as finger and voice prints, photographs, or things done by or to such individual, or the record of his presence, registration, or membership in an organization or activity, or admission to an institution. I agree that I will not directly or indirectly use or facilitate the use or dissemination of information (whether intentionally or by inadvertence, negligence or omission and whether verbally, electronically, through paper transmission or otherwise) for any purpose other than that directly authorized and associated with my designated duties on the Project. I understand and agree that any unauthorized use, dissemination or disclosure of County Information is prohibited and may also constitute a violation of Virginia or federal law/s, subjecting me and/or my employer to civil and/or criminal penalties. I also agree that I will not divulge or otherwise facilitate the disclosure, dissemination or access to or by any unauthorized person for any purpose of the Information obtained directly, or indirectly, as a result of my work on the Project. I agree to view, retrieve or access County Information only to the extent concomitant with my assigned duties on the Project and only in accordance with the County’s and my employer’s access and security policies or protocols. I agree that I will take strict security measures to ensure that County Information is kept secure; is properly stored in accordance with industry best practices, and if stored is encrypted; and is otherwise protected from retrieval or access by unauthorized persons or for unauthorized purposes. I will also ensure that any device or media on which County Information is stored, even temporarily, will have strict encryption, security, and access control and that I will not remove, facilitate the removal of or cause any Information to be removed from my employer’s worksite or the County’s physical facility without written authorization of the County Project Officer. If so authorized, I understand that I am responsible for the security of the electronic equipment or paper files on which the Information is stored and agree to promptly return such Information upon request. I will not use any devices, laptops, PDAs, netbooks, tablets, thumb drives or other media storage devices (“Device”) during my work on the Project without pre-approval. I will ensure that any Device connected to the County network is free of all computer viruses and running the latest version of an industry- standard virus protection program. I will also ensure that my user account and password, if any, is robust, protected and not shared. I will not download any County Information except as authorized by the County Project Officer and then only onto a County-approved Device. I understand that downloading onto a personally owned Device or service, such as personal e-mail, Dropbox etc., is prohibited. I agree that I will notify the County Project Officer immediately upon discovery or becoming aware or suspicious of any unauthorized disclosure of County Information, security breach, hacking or other breach of this agreement, the County’s or Contractor’s security policies, or any other breach of Project protocols concerning data security or County Information. I will fully cooperate with the County to help regain possession of any County Information and to prevent its further disclosure, use or dissemination. It is the intent of this NonDisclosure and Data Security Agreement to ensure that the highest level of administrative safeguards, information security, and other best practices are in place to ensure confidentiality, protection, privacy and security of County Information and County-networked resources and to ensure compliance with all applicable local, state and federal laws or regulatory requirements. Therefore, to the extent that this Nondisclosure and Data Security Agreement conflicts with the underlying Main Agreement or any local, state or federal law, regulation or provision, the more stringent requirement, law, regulation or provision controls. Upon completion or termination of my work on the Project, I agree to return all County Information to the County Project Officer. I understand that this agreement remains in full force and effect throughout my work on the Project and shall survive my reassignment from the Project, termination of the above referenced Project or my departure from my current employer. Signed: Printed Name: Date: Xxxxx Xxxxx 7/19/2023 Witnessed: Contractor’s Project Manager: Printed Name: Date: TO BE COMPLETED PRIOR TO BEGINNING WORK ON THE PROJECT Stantec Consulting Services Inc. 0000 Xxxxxxxxxx Xxxxxxxxx, Xxxxxxxxx, XX 00000 June 15, 2023 Attention: Xx Xxxxxxxx Procurement Officer Arlington County Government, Dept. of Management and Finance 0000 Xxxxxxxxx Xxxxxxxxx, Xxxxx 000 Arlington, VA 22201 xxxxxxxxx@xxxxxxxxxxx.xx Reference: BAFO for 23-DES-RFP-230, Arlington County Energy Services contract Dear Xx Xxxxxxxx, Thank you for the opportunity to present a Best and Final Offer (BAFO) to the Selection Advisory Committee of Arlington County for the Arlington County Energy Services contract, 23-DES-RFP-230. As requested, we are providing our BAFO on hourly rates for the contract positions. As we illustrated in our proposal dated October 17, 2022, we are extremely qualified to perform the services identified in the Request for Proposals (RFP) and are local to your projects. Given our long-standing relationship with Arlington County, we are pleased to offer you a volume discount on the contract. If, in any given contract year, we are awarded more than $2,999,999 worth of work, we can offer Arlington County a 5% discount on work for the remainder of that contract year, from the 3,000,000th dollar to the completion of the contract year. Please see our rates attached to this letter. Thank you for the opportunity to submit a BAFO. We look forward to continuing our relationship with Arlington County and look forward to working with you. Please do not hesitate to contact us with any questions. Regards, Stantec Consulting Services Inc. Xxxxx Xxxxx Xxxx Xxxxxxxx CFO & Treasurer Date:Senior Vice President Senior Principal Transportation Program Director Phone: 000-000-0000 Phone: 000-000-0000 xxxxx.xxxxx@xxxxxxx.xxx xxxx.xxxxxxxx@xxxxxxx.xxx Project Cost The tables below set out the fully loaded hourly rates proposed for work to be performed under this contract. We have defined 12 rate levels that cover the full range of expertise and seniority needed to execute the scope of work. Table 2 identifies the specific rate level and rate that apply to each expert identified by name in this proposal. On larger and more complex task orders, the Stantec team proposes to include support staff that will make the consulting services we provide to the County more cost- effective. The support staff, which will be identified during task order proposal preparation, will fit into the lower rate levels in Table 1 below. Stantec reserves the right to negotiate escalated rates in future years of the contract to account for inflation, should our contract by extended beyond one year.

NONDISCLOSURE AND DATA SECURITY AGREEMENT. (CONTRACTOR)‌ The undersigned, an authorized agent of the Contractor and on behalf of SPay Inc dba Stack Sports Arlington Soccer Association, Inc. (“Contractor”), hereby xxxxxx agrees that the Contractor will hold County-provided information, documents, data, images, records and the like confidential and secure and protect them against loss, misuse, alteration, destruction or disclosure. This includes, but is not limited to, the information of the County, its employees, contractors, residents, clients, patients, taxpayers and property as well as information that the County shares with the Contractor for testing, support, conversion or other services provided under Arlington County Agreement No. 2324-DPR-SLA-534 RFP-160q (the “Project” or “Main Agreement”) or that may be accessed through other County-owned or -controlled databases (all of the above collectively referred to as “County Information” or “Information”). In addition to the DATA SECURITY obligations set in the County Agreement, the Contractor agrees that it will maintain the privacy and security of County Information, control and limit internal access and authorization for access to such Information and not divulge or allow or facilitate access to County Information for any purpose or by anyone unless expressly authorized. This includes, but is not limited to, any County Information that in any manner describes, locates or indexes anything about an individual, including, but not limited to, his/her (“his”) Personal Health Information, treatment, disability, services eligibility, services provided, investigations, real or personal property holdings and his education, financial transactions, medical history, ancestry, religion, political ideology, criminal or employment record, social security number, tax status or payments, date of birth, address, phone number or anything that affords a basis for inferring personal characteristics, such as finger and voice prints, photographs, or things done by or to such individual, or the record of his presence, registration, or membership in an organization or activity, or admission to an institution. Contractor also agrees that it will not directly or indirectly use or facilitate the use or dissemination of County information (whether intentionally or by inadvertence, negligence or omission and whether verbally, electronically, through paper transmission or otherwise) for any purpose other than that directly associated with its work under the Project. The Contractor acknowledges that any unauthorized use, dissemination or disclosure of County Information is prohibited and may also constitute a violation of Virginia or federal laws, subjecting it or its employees to civil and/or criminal penalties. Contractor agrees that it will not divulge or otherwise facilitate the disclosure, dissemination or access to or by any unauthorized person, for any purpose, of any Information obtained directly, or indirectly, as a result of its work on the Project. The Contractor shall coordinate closely with the County Project Officer to ensure that its authorization to its employees or approved subcontractors is appropriate and tightly controlled and that such person/s also maintain the security and privacy of County Information and the integrity of County-networked resources. Contractor agrees to take strict security measures to ensure that County Information is kept secure; is properly stored in accordance with industry best practices, and if stored is encrypted; and is otherwise protected from retrieval or access by unauthorized persons or for unauthorized purposes. Any device or media on which County Information is stored, even temporarily, will have strict encryption, security, and access control. Any County Information that is accessible will not leave Contractor’s work site or the County’s physical facility, if the Contractor is working onsite, without written authorization of the County Project Officer. If remote access or other media storage is authorized, the Contractor is responsible for the security of such storage device or paper files. Contractor will ensure that any laptops, PDAs, netbooks, tablets, thumb drives or other media storage devices, as approved by the County and connected to the County network, are secure and free of all computer viruses, and running the latest version of an industry-standard virus protection program. The Contractor will ensure that all user accounts and passwords used by its employees or subcontractors are robust, protected and not shared. The Contractor will not download any County Information except as agreed to by the parties and then only onto a County-approved device. The Contractor understands that downloading onto a personally owned device or service, such as personal e-mail, Dropbox, etc., is prohibited. Contractor agrees that it will notify the County Project Officer immediately upon discovery or becoming aware or suspicious of any unauthorized disclosure of County Information, security breach, hacking or other breach of this agreement, the County’s or Contractor’s security policies, or any other breach of Project protocols concerning data security or County Information. The Contractor will fully cooperate with the County to regain possession of any Information and to prevent its further disclosure, use or dissemination. The Contractor also agrees to promptly notify others of a suspected or actual breach if requested. The Contractor agrees that all duties and obligations enumerated in this Agreement also extend to its employees, agents or subcontractors who are given access to County information. Breach of any of the above conditions by Contractor’s employees, agents or subcontractors shall be treated as a breach by the Contractor. The Contractor agrees that it shall take all reasonable measures to ensure that its employees, agents and subcontractors are aware of and abide by the terms and conditions of this agreement and related data security provisions in the Main Agreement. It is the intent of this NonDisclosure and Data Security Agreement to ensure that the Contractor has the highest level of administrative safeguards, information security, disaster recovery and other best practices in place to ensure confidentiality, protection, privacy and security of County information and County- County-networked resources and to ensure compliance with all applicable local, state and federal laws or regulatory requirements. Therefore, to the extent that this NonDisclosure and Data Security Agreement conflicts with the Main Agreement or with any applicable local, state, or federal law, regulation or provision, the more stringent requirement, law, regulation or provision controls. At the conclusion of the Project, the Contractor agrees to return all County Information to the County Project Officer. These obligations remain in full force and effect throughout the Project and shall survive any termination of the Main Agreement. Authorized Signature: Printed Name and Title: Xxxxxxxx Xxxxxxxx CFO & Treasurer Xxxxxxx Xxxxxx Director of Operations Date:: 11/21/2023 NONDISCLOSURE AND DATA SECURITY AGREEMENT (INDIVIDUAL)‌ I, the undersigned, agree that I will hold County-provided information, documents, data, images, records and the like confidential and secure and protect it against loss, misuse, alteration, destruction or disclosure. This includes, but is not limited to, the information of the County, its employees, contractors, residents, clients, patients, taxpayers, and property as well as information that the County shares with my employer or prime contractor for testing, support, conversion or the provision of other services under Arlington County Agreement No. 24-DPR-RFP- 160q (the “Project” or “Main Agreement”) or which may be accessed through County-owned or -controlled databases (all of the above collectively referred to as “County Information” or “Information”). I agree that I will maintain the privacy and security of County Information and will not divulge or allow or facilitate access to County Information for any purpose or by anyone unless expressly authorized to do so by the County Project Officer. This includes, but is not limited to, any County Information that in any manner describes, locates or indexes anything about an individual including, but not limited to, his/her (“his”) Personal Health Information, treatment, disability, services eligibility, services provided, investigations, real or personal property holdings, education, financial transactions, medical history, ancestry, religion, political ideology, criminal or employment record, social security number, tax status or payments, date of birth, or that otherwise affords a basis for inferring personal characteristics, such as finger and voice prints, photographs, or things done by or to such individual, or the record of his presence, registration, or membership in an organization or activity, or admission to an institution. I agree that I will not directly or indirectly use or facilitate the use or dissemination of information (whether intentionally or by inadvertence, negligence or omission and whether verbally, electronically, through paper transmission or otherwise) for any purpose other than that directly authorized and associated with my designated duties on the Project. I understand and agree that any unauthorized use, dissemination or disclosure of County Information is prohibited and may also constitute a violation of Virginia or federal law/s, subjecting me and/or my employer to civil and/or criminal penalties. I also agree that I will not divulge or otherwise facilitate the disclosure, dissemination or access to or by any unauthorized person for any purpose of the Information obtained directly, or indirectly, as a result of my work on the Project. I agree to view, retrieve or access County Information only to the extent concomitant with my assigned duties on the Project and only in accordance with the County’s and my employer’s access and security policies or protocols. I agree that I will take strict security measures to ensure that County Information is kept secure; is properly stored in accordance with industry best practices, and if stored is encrypted; and is otherwise protected from retrieval or access by unauthorized persons or for unauthorized purposes. I will also ensure that any device or media on which County Information is stored, even temporarily, will have strict encryption, security, and access control and that I will not remove, facilitate the removal of or cause any Information to be removed from my employer’s worksite or the County’s physical facility without written authorization of the County Project Officer. If so authorized, I understand that I am responsible for the security of the electronic equipment or paper files on which the Information is stored and agree to promptly return such Information upon request. I will not use any devices, laptops, PDAs, netbooks, tablets, thumb drives or other media storage devices (“Device”) during my work on the Project without pre-approval. I will ensure that any Device connected to the County network is free of all computer viruses and running the latest version of an industry-standard virus protection program. I will also ensure that my user account and password, if any, is robust, protected and not shared. I will not download any County Information except as authorized by the County Project Officer and then only onto a County-approved Device. I understand that downloading onto a personally owned Device or service, such as personal e-mail, Dropbox etc., is prohibited. I agree that I will notify the County Project Officer immediately upon discovery or becoming aware or suspicious of any unauthorized disclosure of County Information, security breach, hacking or other breach of this agreement, the County’s or Contractor’s security policies, or any other breach of Project protocols concerning data security or County Information. I will fully cooperate with the County to help regain possession of any County Information and to prevent its further disclosure, use or dissemination. It is the intent of this NonDisclosure and Data Security Agreement to ensure that the highest level of administrative safeguards, information security, and other best practices are in place to ensure confidentiality, protection, privacy and security of County Information and County-networked resources and to ensure compliance with all applicable local, state and federal laws or regulatory requirements. Therefore, to the extent that this Nondisclosure and Data Security Agreement conflicts with the underlying Main Agreement or any local, state or federal law, regulation or provision, the more stringent requirement, law, regulation or provision controls. Upon completion or termination of my work on the Project, I agree to return all County Information to the County Project Officer. I understand that this agreement remains in full force and effect throughout my work on the Project and shall survive my reassignment from the Project, termination of the above referenced Project or my departure from my current employer. Signed: Printed Name: Date: Witnessed: Contractor’s Project Manager: Printed Name: Date: TO BE COMPLETED PRIOR TO BEGINNING WORK ON THE PROJECT EXHIBIT C VALUATION FORM ARLINGTON COUNTY GOVERNMENT Contractor Performance Evaluation Form Contractor Name: Contract No.: Date: Project/Contract Name: Interim Evaluation Final Evaluation Scope of Work/Services Provided: Contract Start Date: / / Contract End Date: / / Actual Completion Date: / / Please rate the effectiveness of the Contractor’s performance on the Contract/Project across the following dimensions: Evaluation Criteria: Unacceptable Poor Satisfactory Excellent Written comments to explain assigned ratings are required for any performance ratings below “satisfactory” or an “excellent” in any category. Evaluation Questions

NONDISCLOSURE AND DATA SECURITY AGREEMENT. (CONTRACTOR)‌ The undersigned, an authorized agent of the Contractor and on behalf of SPay Inc dba Stack Sports The Cadmus Group LLC (“Contractor”), hereby xxxxxx agrees that the Contractor will hold County-provided information, documents, data, images, records and the like confidential and secure and protect them against loss, misuse, alteration, destruction or disclosure. This includes, but is not limited to, the information of the County, its employees, contractors, residents, clients, patients, taxpayers and property as well as information that the County shares with the Contractor for testing, support, conversion or other services provided under Arlington County Agreement No. 23-DPRDES-SLA-534 RFP-230l (the “Project” or “Main Agreement”) or that may be accessed through other County-owned or -controlled databases (all of the above collectively referred to as “County Information” or “Information”). In addition to the DATA SECURITY obligations set in the County Agreement, the Contractor agrees that it will maintain the privacy and security of County Information, control and limit internal access and authorization for access to such Information and not divulge or allow or facilitate access to County Information for any purpose or by anyone unless expressly authorized. This includes, but is not limited to, any County Information that in any manner describes, locates or indexes anything about an individual, including, but not limited to, his/her (“his”) Personal Health Information, treatment, disability, services eligibility, services provided, investigations, real or personal property holdings and his education, financial transactions, medical history, ancestry, religion, political ideology, criminal or employment record, social security number, tax status or payments, date of birth, address, phone number or anything that affords a basis for inferring personal characteristics, such as finger and voice prints, photographs, or things done by or to such individual, or the record of his presence, registration, or membership in an organization or activity, or admission to an institution. Contractor also agrees that it will not directly or indirectly use or facilitate the use or dissemination of County information (whether intentionally or by inadvertence, negligence or omission and whether verbally, electronically, through paper transmission or otherwise) for any purpose other than that directly associated with its work under the Project. The Contractor acknowledges that any unauthorized use, dissemination or disclosure of County Information is prohibited and may also constitute a violation of Virginia or federal laws, subjecting it or its employees to civil and/or criminal penalties. Contractor agrees that it will not divulge or otherwise facilitate the disclosure, dissemination or access to or by any unauthorized person, for any purpose, of any Information obtained directly, or indirectly, as a result of its work on the Project. The Contractor shall coordinate closely with the County Project Officer to ensure that its authorization to its employees or approved subcontractors is appropriate and tightly controlled and that such person/s also maintain the security and privacy of County Information and the integrity of County-networked resources. Contractor agrees to take strict security measures to ensure that County Information is kept secure; is properly stored in accordance with industry best practices, and if stored is encryptedencrypted ; and is otherwise protected from retrieval or access by unauthorized persons or for unauthorized purposes. Any device or media on which County Information is stored, even temporarily, will have strict encryption, security, and access control. Any County Information that is accessible will not leave Contractor’s work site or the County’s physical facility, if the Contractor is working onsite, without written authorization of the County Project Officer. If remote access or other media storage is authorized, the Contractor is responsible for the security of such storage device or paper files. Contractor will ensure that any laptops, PDAs, netbooks, tablets, thumb drives or other media storage devices, as approved by the County and connected to the County network, are secure and free of all computer viruses, and running the latest version of an industry-standard virus protection program. The Contractor will ensure that all user accounts and passwords used by its employees or subcontractors are robust, protected and not shared. The Contractor will not download any County Information except as agreed to by the parties and then only onto a County-approved device. The Contractor understands that downloading onto a personally owned device or service, such as personal e-mail, Dropbox, etc., is prohibited. Contractor agrees that it will notify the County Project Officer immediately upon discovery or becoming aware or suspicious of any unauthorized disclosure of County Information, security breach, hacking or other breach of this agreement, the County’s or Contractor’s security policies, or any other breach of Project protocols concerning data security or County Information. The Contractor will fully cooperate with the County to regain possession of any Information and to prevent its further disclosure, use or dissemination. The Contractor also agrees to promptly notify others of a suspected or actual breach if requested. The Contractor agrees that all duties and obligations enumerated in this Agreement also extend to its employees, agents or subcontractors who are given access to County information. Breach of any of the above conditions by Contractor’s employees, agents or subcontractors shall be treated as a breach by the Contractor. The Contractor agrees that it shall take all reasonable measures to ensure that its employees, agents and subcontractors are aware of and abide by the terms and conditions of this agreement and related data security provisions in the Main Agreement. It is the intent of this NonDisclosure and Data Security Agreement to ensure that the Contractor has the highest level of administrative safeguards, information security, disaster recovery and other best practices in place to ensure confidentiality, protection, privacy and security of County information and County- networked resources and to ensure compliance with all applicable local, state and federal laws or regulatory requirements. Therefore, to the extent that this NonDisclosure and Data Security Agreement conflicts with the Main Agreement or with any applicable local, state, or federal law, regulation or provision, the more stringent requirement, law, regulation or provision controls. At the conclusion of the Project, the Contractor agrees to return all County Information to the County Project Officer. These obligations remain in full force and effect throughout the Project and shall survive any termination of the Main Agreement. Authorized Signature: Printed Name and Title: Xx_xx Xxxxxxxx Deputy Director of Contracts Date: 7/17/2023 EXHIBIT D NONDISCLOSURE AND DATA SECURITY AGREEMENT (INDIVIDUAL)‌ I, the undersigned, agree that I will hold County-provided information, documents, data, images, records and the like confidential and secure and protect it against loss, misuse, alteration, destruction or disclosure. This includes, but is not limited to, the information of the County, its employees, contractors, residents, clients, patients, taxpayers, and property as well as information that the County shares with my employer or prime contractor for testing, support, conversion or the provision of other services under Arlington County Agreement No. 23-DES-RFP-230l (the “Project” or “Main Agreement”) or which may be accessed through County-owned or -controlled databases (all of the above collectively referred to as “County Information” or “Information”). I agree that I will maintain the privacy and security of County Information and will not divulge or allow or facilitate access to County Information for any purpose or by anyone unless expressly authorized to do so by the County Project Officer. This includes, but is not limited to, any County Information that in any manner describes, locates or indexes anything about an individual including, but not limited to, his/her (“his”) Personal Health Information, treatment, disability, services eligibility, services provided, investigations, real or personal property holdings, education, financial transactions, medical history, ancestry, religion, political ideology, criminal or employment record, social security number, tax status or payments, date of birth, or that otherwise affords a basis for inferring personal characteristics, such as finger and voice prints, photographs, or things done by or to such individual, or the record of his presence, registration, or membership in an organization or activity, or admission to an institution. I agree that I will not directly or indirectly use or facilitate the use or dissemination of information (whether intentionally or by inadvertence, negligence or omission and whether verbally, electronically, through paper transmission or otherwise) for any purpose other than that directly authorized and associated with my designated duties on the Project. I understand and agree that any unauthorized use, dissemination or disclosure of County Information is prohibited and may also constitute a violation of Virginia or federal law/s, subjecting me and/or my employer to civil and/or criminal penalties. I also agree that I will not divulge or otherwise facilitate the disclosure, dissemination or access to or by any unauthorized person for any purpose of the Information obtained directly, or indirectly, as a result of my work on the Project. I agree to view, retrieve or access County Information only to the extent concomitant with my assigned duties on the Project and only in accordance with the County’s and my employer’s access and security policies or protocols. I agree that I will take strict security measures to ensure that County Information is kept secure; is properly stored in accordance with industry best practices, and if stored is encrypted; and is otherwise protected from retrieval or access by unauthorized persons or for unauthorized purposes. I will also ensure that any device or media on which County Information is stored, even temporarily, will have strict encryption, security, and access control and that I will not remove, facilitate the removal of or cause any Information to be removed from my employer’s worksite or the County’s physical facility without written authorization of the County Project Officer. If so authorized, I understand that I am responsible for the security of the electronic equipment or paper files on which the Information is stored and agree to promptly return such Information upon request. I will not use any devices, laptops, PDAs, netbooks, tablets, thumb drives or other media storage devices (“Device”) during my work on the Project without pre-approval. I will ensure that any Device connected to the County network is free of all computer viruses and running the latest version of an industry- standard virus protection program. I will also ensure that my user account and password, if any, is robust, protected and not shared. I will not download any County Information except as authorized by the County Project Officer and then only onto a County-approved Device. I understand that downloading onto a personally owned Device or service, such as personal e-mail, Dropbox etc., is prohibited. I agree that I will notify the County Project Officer immediately upon discovery or becoming aware or suspicious of any unauthorized disclosure of County Information, security breach, hacking or other breach of this agreement, the County’s or Contractor’s security policies, or any other breach of Project protocols concerning data security or County Information. I will fully cooperate with the County to help regain possession of any County Information and to prevent its further disclosure, use or dissemination. It is the intent of this NonDisclosure and Data Security Agreement to ensure that the highest level of administrative safeguards, information security, and other best practices are in place to ensure confidentiality, protection, privacy and security of County Information and County-networked resources and to ensure compliance with all applicable local, state and federal laws or regulatory requirements. Therefore, to the extent that this Nondisclosure and Data Security Agreement conflicts with the underlying Main Agreement or any local, state or federal law, regulation or provision, the more stringent requirement, law, regulation or provision controls. Upon completion or termination of my work on the Project, I agree to return all County Information to the County Project Officer. I understand that this agreement remains in full force and effect throughout my work on the Project and shall survive my reassignment from the Project, termination of the above referenced Project or my departure from my current employer. Signed: Printed Name: Date: Xxxx Xxxxxxxx CFO & Treasurer 7/17/2023 Witnessed: Contractor’s Project Manager: Printed Name: Date:: TO BE COMPLETED PRIOR TO BEGINNING WORK ON THE PROJECT Proposal for Energy Services RFP No. 23-DES-RFP-230 Project Cost The following table provides Xxxxxx’ fully loaded hourly rates for all staff who may be assigned to work on projects under the resultant contract. The proposed rates reflect discounts from Cadmus’ standard commercial billing rates, with an average discount of 12.5% across all labor categories. Cadmus reserves the right to offer additional discounts at the task order level depending on the size and scope of the project. Labor Category Commercial Rate Discount % Discounted Rate Executive Consultant $345.00 5.8% $325.00 Sr. Managing Consultant $340.00 10.3% $305.00 Principal II $305.00 9.8% $275.00 Principal I $275.00 9.1% $250.00 Sr. Associate III $235.00 12.8% $205.00 Sr. Associate II $215.00 14.0% $185.00 Sr. Associate I $195.00 12.8% $170.00 Associate III $170.00 5.9% $160.00 Associate II $160.00 6.3% $150.00 Associate I $150.00 6.7% $140.00 Sr. Analyst II $145.00 10.3% $130.00 Sr. Analyst I $140.00 14.3% $120.00 Analyst III $130.00 15.4% $110.00 Analyst II $120.00 16.7% $100.00 Analyst I $110.00 18.2% $90.00 Research Analyst $100.00 20.0% $80.00 Administrative Support II $145.00 13.8% $125.00 Administrative Support I $90.00 22.2% $70.00 The rates provided above will remain firm for the first 12-month period of the contract. It is understood that it is Arlington County’ s practice to benchmark price adjustments based on the percent change in the U.S. Department of Labor Consumer Price Index, All Items, Unadjusted, Urban Areas (CPI-U) for the most recent 12-month period. To limit significant price increases as a result of the current inflationary environment, Xxxxxx has elected to cap our annual escalation at 3.0% beyond the first year, despite the prevailing CPI-U figures at the time of adjustment. October 17, 2022 93

NONDISCLOSURE AND DATA SECURITY AGREEMENT. (CONTRACTOR)‌ CONTRACTOR) The undersigned, an authorized agent of the Contractor and on behalf of SPay Inc dba Stack Sports Xxxxxxx, A Division of Xxxxxx Computers, 0 Xxxxxxx Xxxxx, Xxxxx 000 Xxxxxx, Xxxxxxx, Xxxxxx X0X 0X0 (“Contractor”), hereby agrees that the Contractor will hold County-provided information, documents, data, images, records and the like confidential and secure and protect them against loss, misuse, alteration, destruction or disclosure. This includes, but is not limited to, the information of the County, its employees, contractors, residents, clients, patients, taxpayers and property as well as information that the County shares with the Contractor for testing, support, conversion or other services provided under Arlington County Agreement No. 23No.16-DPR248-SLA-534 RFP (the “Project” or “Main Agreement”) or that may be accessed through other County-owned or -controlled databases (all of the above collectively referred to as “County Information” or “Information”). In addition to the DATA SECURITY obligations set in the County Agreement, the Contractor agrees that it will maintain the privacy and security of County Information, control and limit internal access and authorization for access to such Information and not divulge or allow or facilitate access to County Information for any purpose or by anyone unless expressly authorized. This includesmay include, but is not limited to, any County Information that in any manner describes, locates or indexes anything about an individual, including, but not limited to, his/her (“his”) Personal Health Information, treatment, disability, services eligibility, services provided, investigations, real or personal property holdings and his education, financial transactions, medical history, ancestry, religion, political ideology, criminal or employment record, social security number, tax status or payments, date of birth, address, phone number or anything that affords a basis for inferring personal characteristics, such as finger and voice prints, photographs, or things done by or to such individual, or the record of his presence, registration, or membership in an organization or activity, or admission to an institution. Contractor also agrees that it will not directly or indirectly use or facilitate the use or dissemination of County information (whether intentionally or by inadvertence, negligence or omission and whether verbally, electronically, through paper transmission or otherwise) for any purpose other than that directly associated with its work under the Project. The Contractor acknowledges that any unauthorized use, dissemination or disclosure of County Information is prohibited and may also constitute a violation of Virginia or federal laws, subjecting it or its employees to civil and/or criminal penalties. Contractor agrees that it will not divulge or otherwise facilitate the disclosure, dissemination or access to or by any unauthorized person, for any purpose, of any Information obtained directly, or indirectly, as a result of its work on the Project. The Contractor shall coordinate closely with the County Project Officer to ensure that its authorization to its employees or approved subcontractors is appropriate and tightly controlled and that such person/s also maintain the security and privacy of County Information and the integrity of County-networked resources. Contractor agrees to take strict security measures to ensure that County Information is kept secure; is properly stored in accordance with industry best practices, and if stored is encrypted; and is otherwise protected from retrieval or access by unauthorized persons or for unauthorized purposes. Any device or media on which County Information is stored, even temporarily, will have strict encryption, security, and access control. Any County Information that is accessible will not leave Contractor’s work site or the County’s physical facility, if the Contractor is working onsite, without written authorization of the County Project Officer. If remote access or other media storage is authorized, the Contractor is responsible for the security of such storage device or paper files. Contractor will ensure that any laptops, PDAs, netbooks, tablets, thumb drives or other media storage devices, as approved by the County and connected to the County network, are secure and free of all computer viruses, and running the latest version of an industry-standard virus protection program. The Contractor will ensure that all user accounts and passwords used by its employees or subcontractors are robust, protected and not shared. The Contractor will not download any County Information except as agreed to by the parties and then only onto a County-approved device. The Contractor understands that downloading onto a personally owned device or service, such as personal e-mail, Dropbox, etc., is prohibited. Contractor agrees that it will notify the County Project Officer immediately upon discovery or becoming aware or suspicious of any unauthorized disclosure of County Information, security breach, hacking or other breach of this agreement, the County’s or Contractor’s security policies, or any other breach of Project protocols concerning data security or County Information. The Contractor will fully cooperate with the County to regain possession of any Information and to prevent its further disclosure, use or dissemination. The Contractor also agrees to promptly notify others of a suspected or actual breach if requested. The Contractor agrees that all duties and obligations enumerated in this Agreement also extend to its employees, agents or subcontractors who are given access to County information. Breach of any of the above conditions by Contractor’s employees, agents or subcontractors shall be treated as a breach by the Contractor. The Contractor agrees that it shall take all reasonable measures to ensure that its employees, agents and subcontractors are aware of and abide by the terms and conditions of this agreement and related data security provisions in the Main Agreement. It is the intent of this NonDisclosure and Data Security Agreement to ensure that the Contractor has the highest level of administrative safeguards, information security, disaster recovery and other best practices in place to ensure confidentiality, protection, privacy and security of County information and County- networked resources and to ensure compliance with all applicable local, state and federal laws or regulatory requirements. Therefore, to the extent that this NonDisclosure and Data Security Agreement conflicts with the Main Agreement or with any applicable local, state, or federal law, regulation or provision, the more stringent requirement, law, regulation or provision controls. At the conclusion of the Project, the Contractor agrees to return all County Information to the County Project Officer. These obligations remain in full force and effect throughout the Project and shall survive any termination of the Main Agreement. Authorized Signature: Printed Name and Title: Xxxxxxxx Xxxxxxxx CFO & Treasurer Date:

NONDISCLOSURE AND DATA SECURITY AGREEMENT. (CONTRACTOR)‌ CONTRACTOR) The undersigned, an authorized agent of the Contractor and on behalf of SPay Inc dba Stack Sports Cayenta, A Division of Xxxxxx Computers, 0 Xxxxxxx Xxxxx, Xxxxx 000 Xxxxxx, Xxxxxxx, Xxxxxx X0X 0X0 (“Contractor”), hereby agrees that the Contractor will hold County-provided information, documents, data, images, records and the like confidential and secure and protect them against loss, misuse, alteration, destruction or disclosure. This includes, but is not limited to, the information of the County, its employees, contractors, residents, clients, patients, taxpayers and property as well as information that the County shares with the Contractor for testing, support, conversion or other services provided under Arlington County Agreement No. 23No.16-DPR248-SLA-534 RFP (the “Project” or “Main Agreement”) or that may be accessed through other County-owned or -controlled databases (all of the above collectively referred to as “County Information” or “Information”). In addition to the DATA SECURITY obligations set in the County Agreement, the Contractor agrees that it will maintain the privacy and security of County Information, control and limit internal access and authorization for access to such Information and not divulge or allow or facilitate access to County Information for any purpose or by anyone unless expressly authorized. This includesmay include, but is not limited to, any County Information that in any manner describes, locates or indexes anything about an individual, including, but not limited to, his/her (“his”) Personal Health Information, treatment, disability, services eligibility, services provided, investigations, real or personal property holdings and his education, financial transactions, medical history, ancestry, religion, political ideology, criminal or employment record, social security number, tax status or payments, date of birth, address, phone number or anything that affords a basis for inferring personal characteristics, such as finger and voice prints, photographs, or things done by or to such individual, or the record of his presence, registration, or membership in an organization or activity, or admission to an institution. Contractor also agrees that it will not directly or indirectly use or facilitate the use or dissemination of County information (whether intentionally or by inadvertence, negligence or omission and whether verbally, electronically, through paper transmission or otherwise) for any purpose other than that directly associated with its work under the Project. The Contractor acknowledges that any unauthorized use, dissemination or disclosure of County Information is prohibited and may also constitute a violation of Virginia or federal laws, subjecting it or its employees to civil and/or criminal penalties. Contractor agrees that it will not divulge or otherwise facilitate the disclosure, dissemination or access to or by any unauthorized person, for any purpose, of any Information obtained directly, or indirectly, as a result of its work on the Project. The Contractor shall coordinate closely with the County Project Officer to ensure that its authorization to its employees or approved subcontractors is appropriate and tightly controlled and that such person/s also maintain the security and privacy of County Information and the integrity of County-networked resources. Contractor agrees to take strict security measures to ensure that County Information is kept secure; is properly stored in accordance with industry best practices, and if stored is encrypted; and is otherwise protected from retrieval or access by unauthorized persons or for unauthorized purposes. Any device or media on which County Information is stored, even temporarily, will have strict encryption, security, and access control. Any County Information that is accessible will not leave Contractor’s work site or the County’s physical facility, if the Contractor is working onsite, without written authorization of the County Project Officer. If remote access or other media storage is authorized, the Contractor is responsible for the security of such storage device or paper files. Contractor will ensure that any laptops, PDAs, netbooks, tablets, thumb drives or other media storage devices, as approved by the County and connected to the County network, are secure and free of all computer viruses, and running the latest version of an industry-standard virus protection program. The Contractor will ensure that all user accounts and passwords used by its employees or subcontractors are robust, protected and not shared. The Contractor will not download any County Information except as agreed to by the parties and then only onto a County-approved device. The Contractor understands that downloading onto a personally owned device or service, such as personal e-mail, Dropbox, etc., is prohibited. Contractor agrees that it will notify the County Project Officer immediately upon discovery or becoming aware or suspicious of any unauthorized disclosure of County Information, security breach, hacking or other breach of this agreement, the County’s or Contractor’s security policies, or any other breach of Project protocols concerning data security or County Information. The Contractor will fully cooperate with the County to regain possession of any Information and to prevent its further disclosure, use or dissemination. The Contractor also agrees to promptly notify others of a suspected or actual breach if requested. The Contractor agrees that all duties and obligations enumerated in this Agreement also extend to its employees, agents or subcontractors who are given access to County information. Breach of any of the above conditions by Contractor’s employees, agents or subcontractors shall be treated as a breach by the Contractor. The Contractor agrees that it shall take all reasonable measures to ensure that its employees, agents and subcontractors are aware of and abide by the terms and conditions of this agreement and related data security provisions in the Main Agreement. It is the intent of this NonDisclosure and Data Security Agreement to ensure that the Contractor has the highest level of administrative safeguards, information security, disaster recovery and other best practices in place to ensure confidentiality, protection, privacy and security of County information and County- networked resources and to ensure compliance with all applicable local, state and federal laws or regulatory requirements. Therefore, to the extent that this NonDisclosure and Data Security Agreement conflicts with the Main Agreement or with any applicable local, state, or federal law, regulation or provision, the more stringent requirement, law, regulation or provision controls. At the conclusion of the Project, the Contractor agrees to return all County Information to the County Project Officer. These obligations remain in full force and effect throughout the Project and shall survive any termination of the Main Agreement. Authorized Signature: Printed Name and Title: Xxxxxxxx Xxxxxxxx CFO & Treasurer Date:

NONDISCLOSURE AND DATA SECURITY AGREEMENT. (CONTRACTOR)‌ The undersigned, an authorized agent of the Contractor and on behalf of SPay Inc dba Stack Sports Tennis Central Corp. (“Contractor”), hereby xxxxxx agrees that the Contractor will hold County-provided information, documents, data, images, records and the like confidential and secure and protect them against loss, misuse, alteration, destruction or disclosure. This includes, but is not limited to, the information of the County, its employees, contractors, residents, clients, patients, taxpayers and property as well as information that the County shares with the Contractor for testing, support, conversion or other services provided under Arlington County Agreement No. 2324-DPR-SLA-534 RFP-160w (the “Project” or “Main Agreement”) or that may be accessed through other County-owned or -controlled databases (all of the above collectively referred to as “County Information” or “Information”). In addition to the DATA SECURITY obligations set in the County Agreement, the Contractor agrees that it will maintain the privacy and security of County Information, control and limit internal access and authorization for access to such Information and not divulge or allow or facilitate access to County Information for any purpose or by anyone unless expressly authorized. This includes, but is not limited to, any County Information that in any manner describes, locates or indexes anything about an individual, including, but not limited to, his/her (“his”) Personal Health Information, treatment, disability, services eligibility, services provided, investigations, real or personal property holdings and his education, financial transactions, medical history, ancestry, religion, political ideology, criminal or employment record, social security number, tax status or payments, date of birth, address, phone number or anything that affords a basis for inferring personal characteristics, such as finger and voice prints, photographs, or things done by or to such individual, or the record of his presence, registration, or membership in an organization or activity, or admission to an institution. Contractor also agrees that it will not directly or indirectly use or facilitate the use or dissemination of County information (whether intentionally or by inadvertence, negligence or omission and whether verbally, electronically, through paper transmission or otherwise) for any purpose other than that directly associated with its work under the Project. The Contractor acknowledges that any unauthorized use, dissemination or disclosure of County Information is prohibited and may also constitute a violation of Virginia or federal laws, subjecting it or its employees to civil and/or criminal penalties. Contractor agrees that it will not divulge or otherwise facilitate the disclosure, dissemination or access to or by any unauthorized person, for any purpose, of any Information obtained directly, or indirectly, as a result of its work on the Project. The Contractor shall coordinate closely with the County Project Officer to ensure that its authorization to its employees or approved subcontractors is appropriate and tightly controlled and that such person/s also maintain the security and privacy of County Information and the integrity of County-networked resources. Contractor agrees to take strict security measures to ensure that County Information is kept secure; is properly stored in accordance with industry best practices, and if stored is encrypted; and is otherwise protected from retrieval or access by unauthorized persons or for unauthorized purposes. Any device or media on which County Information is stored, even temporarily, will have strict encryption, security, and access control. Any County Information that is accessible will not leave Contractor’s work site or the County’s physical facility, if the Contractor is working onsite, without written authorization of the County Project Officer. If remote access or other media storage is authorized, the Contractor is responsible for the security of such storage device or paper files. Contractor will ensure that any laptops, PDAs, netbooks, tablets, thumb drives or other media storage devices, as approved by the County and connected to the County network, are secure and free of all computer viruses, and running the latest version of an industry-standard virus protection program. The Contractor will ensure that all user accounts and passwords used by its employees or subcontractors are robust, protected and not shared. The Contractor will not download any County Information except as agreed to by the parties and then only onto a County-approved device. The Contractor understands that downloading onto a personally owned device or service, such as personal e-mail, Dropbox, etc., is prohibited. Contractor agrees that it will notify the County Project Officer immediately upon discovery or becoming aware or suspicious of any unauthorized disclosure of County Information, security breach, hacking or other breach of this agreement, the County’s or Contractor’s security policies, or any other breach of Project protocols concerning data security or County Information. The Contractor will fully cooperate with the County to regain possession of any Information and to prevent its further disclosure, use or dissemination. The Contractor also agrees to promptly notify others of a suspected or actual breach if requested. The Contractor agrees that all duties and obligations enumerated in this Agreement also extend to its employees, agents or subcontractors who are given access to County information. Breach of any of the above conditions by Contractor’s employees, agents or subcontractors shall be treated as a breach by the Contractor. The Contractor agrees that it shall take all reasonable measures to ensure that its employees, agents and subcontractors are aware of and abide by the terms and conditions of this agreement and related data security provisions in the Main Agreement. It is the intent of this NonDisclosure and Data Security Agreement to ensure that the Contractor has the highest level of administrative safeguards, information security, disaster recovery and other best practices in place to ensure confidentiality, protection, privacy and security of County information and County- County-networked resources and to ensure compliance with all applicable local, state and federal laws or regulatory requirements. Therefore, to the extent that this NonDisclosure and Data Security Agreement conflicts with the Main Agreement or with any applicable local, state, or federal law, regulation or provision, the more stringent requirement, law, regulation or provision controls. At the conclusion of the Project, the Contractor agrees to return all County Information to the County Project Officer. These obligations remain in full force and effect throughout the Project and shall survive any termination of the Main Agreement. Authorized Signature: Printed Name and Title: Xxxxxxxx Xxxxxxxx CFO & Treasurer Xxxx Xxxxxx CEO Date:: 11/21/2023 NONDISCLOSURE AND DATA SECURITY AGREEMENT (INDIVIDUAL)‌ I, the undersigned, agree that I will hold County-provided information, documents, data, images, records and the like confidential and secure and protect it against loss, misuse, alteration, destruction or disclosure. This includes, but is not limited to, the information of the County, its employees, contractors, residents, clients, patients, taxpayers, and property as well as information that the County shares with my employer or prime contractor for testing, support, conversion or the provision of other services under Arlington County Agreement No. 24-DPR-RFP- 160w (the “Project” or “Main Agreement”) or which may be accessed through County-owned or -controlled databases (all of the above collectively referred to as “County Information” or “Information”). I agree that I will maintain the privacy and security of County Information and will not divulge or allow or facilitate access to County Information for any purpose or by anyone unless expressly authorized to do so by the County Project Officer. This includes, but is not limited to, any County Information that in any manner describes, locates or indexes anything about an individual including, but not limited to, his/her (“his”) Personal Health Information, treatment, disability, services eligibility, services provided, investigations, real or personal property holdings, education, financial transactions, medical history, ancestry, religion, political ideology, criminal or employment record, social security number, tax status or payments, date of birth, or that otherwise affords a basis for inferring personal characteristics, such as finger and voice prints, photographs, or things done by or to such individual, or the record of his presence, registration, or membership in an organization or activity, or admission to an institution. I agree that I will not directly or indirectly use or facilitate the use or dissemination of information (whether intentionally or by inadvertence, negligence or omission and whether verbally, electronically, through paper transmission or otherwise) for any purpose other than that directly authorized and associated with my designated duties on the Project. I understand and agree that any unauthorized use, dissemination or disclosure of County Information is prohibited and may also constitute a violation of Virginia or federal law/s, subjecting me and/or my employer to civil and/or criminal penalties. I also agree that I will not divulge or otherwise facilitate the disclosure, dissemination or access to or by any unauthorized person for any purpose of the Information obtained directly, or indirectly, as a result of my work on the Project. I agree to view, retrieve or access County Information only to the extent concomitant with my assigned duties on the Project and only in accordance with the County’s and my employer’s access and security policies or protocols. I agree that I will take strict security measures to ensure that County Information is kept secure; is properly stored in accordance with industry best practices, and if stored is encrypted; and is otherwise protected from retrieval or access by unauthorized persons or for unauthorized purposes. I will also ensure that any device or media on which County Information is stored, even temporarily, will have strict encryption, security, and access control and that I will not remove, facilitate the removal of or cause any Information to be removed from my employer’s worksite or the County’s physical facility without written authorization of the County Project Officer. If so authorized, I understand that I am responsible for the security of the electronic equipment or paper files on which the Information is stored and agree to promptly return such Information upon request. I will not use any devices, laptops, PDAs, netbooks, tablets, thumb drives or other media storage devices (“Device”) during my work on the Project without pre-approval. I will ensure that any Device connected to the County network is free of all computer viruses and running the latest version of an industry-standard virus protection program. I will also ensure that my user account and password, if any, is robust, protected and not shared. I will not download any County Information except as authorized by the County Project Officer and then only onto a County-approved Device. I understand that downloading onto a personally owned Device or service, such as personal e-mail, Dropbox etc., is prohibited. I agree that I will notify the County Project Officer immediately upon discovery or becoming aware or suspicious of any unauthorized disclosure of County Information, security breach, hacking or other breach of this agreement, the County’s or Contractor’s security policies, or any other breach of Project protocols concerning data security or County Information. I will fully cooperate with the County to help regain possession of any County Information and to prevent its further disclosure, use or dissemination. It is the intent of this NonDisclosure and Data Security Agreement to ensure that the highest level of administrative safeguards, information security, and other best practices are in place to ensure confidentiality, protection, privacy and security of County Information and County-networked resources and to ensure compliance with all applicable local, state and federal laws or regulatory requirements. Therefore, to the extent that this Nondisclosure and Data Security Agreement conflicts with the underlying Main Agreement or any local, state or federal law, regulation or provision, the more stringent requirement, law, regulation or provision controls. Upon completion or termination of my work on the Project, I agree to return all County Information to the County Project Officer. I understand that this agreement remains in full force and effect throughout my work on the Project and shall survive my reassignment from the Project, termination of the above referenced Project or my departure from my current employer. Signed: Printed Name: Date: Witnessed: Contractor’s Project Manager: Printed Name: Date: TO BE COMPLETED PRIOR TO BEGINNING WORK ON THE PROJECT EXHIBIT C CONTRACTOR PERFORMANCE EVALUATION FORM ARLINGTON COUNTY GOVERNMENT Contractor Performance Evaluation Form Contractor Name: Contract No.: Date: Project/Contract Name: Interim Evaluation Final Evaluation Scope of Work/Services Provided: Contract Start Date: / / Contract End Date: / / Actual Completion Date: / / Please rate the effectiveness of the Contractor’s performance on the Contract/Project across the following dimensions: Evaluation Criteria: Unacceptable Poor Satisfactory Excellent Written comments to explain assigned ratings are required for any performance ratings below “satisfactory” or an “excellent” in any category. Evaluation Questions

NONDISCLOSURE AND DATA SECURITY AGREEMENT. (CONTRACTOR)‌ The undersigned, an authorized agent of the Contractor and on behalf of SPay Inc dba Stack Sports Raftelis Financial Consultants, Inc. (“Contractor”), hereby xxxxxx agrees that the Contractor will hold County-provided information, documents, data, images, records and the like confidential and secure and protect them against loss, misuse, alteration, destruction or disclosure. This includes, but is not limited to, the information of the County, its employees, contractors, residents, clients, patients, taxpayers and property as well as information that the County shares with the Contractor for testing, support, conversion or other services provided under Arlington County Agreement No. 2324-DPRDES-SLA-534 SLA-721 (the “Project” or “Main Agreement”) or that may be accessed through other County-owned or -controlled databases (all of the above collectively referred to as “County Information” or “Information”). In addition to the DATA SECURITY obligations set in the County Agreement, the Contractor agrees that it will maintain the privacy and security of County Information, control and limit internal access and authorization for access to such Information and not divulge or allow or facilitate access to County Information for any purpose or by anyone unless expressly authorized. This includes, but is not limited to, any County Information that in any manner describes, locates or indexes anything about an individual, including, but not limited to, his/her (“his”) Personal Health Information, treatment, disability, services eligibility, services provided, investigations, real or personal property holdings and his education, financial transactions, medical history, ancestry, religion, political ideology, criminal or employment record, social security number, tax status or payments, date of birth, address, phone number or anything that affords a basis for inferring personal characteristics, such as finger and voice prints, photographs, or things done by or to such individual, or the record of his presence, registration, or membership in an organization or activity, or admission to an institution. Contractor also agrees that it will not directly or indirectly use or facilitate the use or dissemination of County information (whether intentionally or by inadvertence, negligence or omission and whether verbally, electronically, through paper transmission or otherwise) for any purpose other than that directly associated with its work under the Project. The Contractor acknowledges that any unauthorized use, dissemination or disclosure of County Information is prohibited and may also constitute a violation of Virginia or federal laws, subjecting it or its employees to civil and/or criminal penalties. Contractor agrees that it will not divulge or otherwise facilitate the disclosure, dissemination or access to or by any unauthorized person, for any purpose, of any Information obtained directly, or indirectly, as a result of its work on the Project. The Contractor shall coordinate closely with the County Project Officer to ensure that its authorization to its employees or approved subcontractors is appropriate and tightly controlled and that such person/s also maintain the security and privacy of County Information and the integrity of County-networked resources. Contractor agrees to take strict security measures to ensure that County Information is kept secure; is properly stored in accordance with industry best practices, and if stored is encrypted; and is otherwise protected from retrieval or access by unauthorized persons or for unauthorized purposes. Any device or media on which County Information is stored, even temporarily, will have strict encryption, security, and access control. Any County Information that is accessible will not leave Contractor’s work site or the County’s physical facility, if the Contractor is working onsite, without written authorization of the County Project Officer. If remote access or other media storage is authorized, the Contractor is responsible for the security of such storage device or paper files. Contractor will ensure that any laptops, PDAs, netbooks, tablets, thumb drives or other media storage devices, as approved by the County and connected to the County network, are secure and free of all computer viruses, and running the latest version of an industry-standard virus protection program. The Contractor will ensure that all user accounts and passwords used by its employees or subcontractors are robust, protected and not shared. The Contractor will not download any County Information except as agreed to by the parties and then only onto a County-approved device. The Contractor understands that downloading onto a personally owned device or service, such as personal e-mail, Dropbox, etc., is prohibited. Contractor agrees that it will notify the County Project Officer immediately upon discovery or becoming aware or suspicious of any unauthorized disclosure of County Information, security breach, hacking or other breach of this agreement, the County’s or Contractor’s security policies, or any other breach of Project protocols concerning data security or County Information. The Contractor will fully cooperate with the County to regain possession of any Information and to prevent its further disclosure, use or dissemination. The Contractor also agrees to promptly notify others of a suspected or actual breach if requested. The Contractor agrees that all duties and obligations enumerated in this Agreement also extend to its employees, agents or subcontractors who are given access to County information. Breach of any of the above conditions by Contractor’s employees, agents or subcontractors shall be treated as a breach by the Contractor. The Contractor agrees that it shall take all reasonable measures to ensure that its employees, agents and subcontractors are aware of and abide by the terms and conditions of this agreement and related data security provisions in the Main Agreement. It is the intent of this NonDisclosure and Data Security Agreement to ensure that the Contractor has the highest level of administrative safeguards, information security, disaster recovery and other best practices in place to ensure confidentiality, protection, privacy and security of County information and County- networked resources and to ensure compliance with all applicable local, state and federal laws or regulatory requirements. Therefore, to the extent that this NonDisclosure and Data Security Agreement conflicts with the Main Agreement or with any applicable local, state, or federal law, regulation or provision, the more stringent requirement, law, regulation or provision controls. At the conclusion of the Project, the Contractor agrees to return all County Information to the County Project Officer. These obligations remain in full force and effect throughout the Project and shall survive any termination of the Main Agreement. Authorized Signature: Xxxxxxxx Xxxxxxxxx Printed Name and Title: Xxxxxxxx Xxxxxxxx CFO & Treasurer Vice President, Raftelis 6/18/2024 Date:: NONDISCLOSURE AND DATA SECURITY AGREEMENT (INDIVIDUAL)‌ I, the undersigned, agree that I will hold County-provided information, documents, data, images, records and the like confidential and secure and protect it against loss, misuse, alteration, destruction or disclosure. This includes, but is not limited to, the information of the County, its employees, contractors, residents, clients, patients, taxpayers, and property as well as information that the County shares with my employer or prime contractor for testing, support, conversion or the provision of other services under Arlington County Agreement No. 24-DES-SLA-721 (the “Project” or “Main Agreement”) or which may be accessed through County-owned or -controlled databases (all of the above collectively referred to as “County Information” or “Information”). I agree that I will maintain the privacy and security of County Information and will not divulge or allow or facilitate access to County Information for any purpose or by anyone unless expressly authorized to do so by the County Project Officer. This includes, but is not limited to, any County Information that in any manner describes, locates or indexes anything about an individual including, but not limited to, his/her (“his”) Personal Health Information, treatment, disability, services eligibility, services provided, investigations, real or personal property holdings, education, financial transactions, medical history, ancestry, religion, political ideology, criminal or employment record, social security number, tax status or payments, date of birth, or that otherwise affords a basis for inferring personal characteristics, such as finger and voice prints, photographs, or things done by or to such individual, or the record of his presence, registration, or membership in an organization or activity, or admission to an institution. I agree that I will not directly or indirectly use or facilitate the use or dissemination of information (whether intentionally or by inadvertence, negligence or omission and whether verbally, electronically, through paper transmission or otherwise) for any purpose other than that directly authorized and associated with my designated duties on the Project. I understand and agree that any unauthorized use, dissemination or disclosure of County Information is prohibited and may also constitute a violation of Virginia or federal law/s, subjecting me and/or my employer to civil and/or criminal penalties. I also agree that I will not divulge or otherwise facilitate the disclosure, dissemination or access to or by any unauthorized person for any purpose of the Information obtained directly, or indirectly, as a result of my work on the Project. I agree to view, retrieve or access County Information only to the extent concomitant with my assigned duties on the Project and only in accordance with the County’s and my employer’s access and security policies or protocols. I agree that I will take strict security measures to ensure that County Information is kept secure; is properly stored in accordance with industry best practices, and if stored is encrypted; and is otherwise protected from retrieval or access by unauthorized persons or for unauthorized purposes. I will also ensure that any device or media on which County Information is stored, even temporarily, will have strict encryption, security, and access control and that I will not remove, facilitate the removal of or cause any Information to be removed from my employer’s worksite or the County’s physical facility without written authorization of the County Project Officer. If so authorized, I understand that I am responsible for the security of the electronic equipment or paper files on which the Information is stored and agree to promptly return such Information upon request. I will not use any devices, laptops, PDAs, netbooks, tablets, thumb drives or other media storage devices (“Device”) during my work on the Project without pre-approval. I will ensure that any Device connected to the County network is free of all computer viruses and running the latest version of an industry- standard virus protection program. I will also ensure that my user account and password, if any, is robust, protected and not shared. I will not download any County Information except as authorized by the County Project Officer and then only onto a County-approved Device. I understand that downloading onto a personally-owned Device or service, such as personal e-mail, Dropbox etc., is prohibited. I agree that I will notify the County Project Officer immediately upon discovery or becoming aware or suspicious of any unauthorized disclosure of County Information, security breach, hacking or other breach of this agreement, the County’s or Contractor’s security policies, or any other breach of Project protocols concerning data security or County Information. I will fully cooperate with the County to help regain possession of any County Information and to prevent its further disclosure, use or dissemination. It is the intent of this NonDisclosure and Data Security Agreement to ensure that the highest level of administrative safeguards, information security, and other best practices are in place to ensure confidentiality, protection, privacy and security of County Information and County-networked resources and to ensure compliance with all applicable local, state and federal laws or regulatory requirements. Therefore, to the extent that this Nondisclosure and Data Security Agreement conflicts with the underlying Main Agreement or any local, state or federal law, regulation or provision, the more stringent requirement, law, regulation or provision controls. Upon completion or termination of my work on the Project, I agree to return all County Information to the County Project Officer. I understand that this agreement remains in full force and effect throughout my work on the Project and shall survive my reassignment from the Project, termination of the above referenced Project or my departure from my current employer. Signed: Printed Name: Date: Witnessed: Contractor’s Project Manager: Printed Name: Date: TO BE COMPLETED PRIOR TO BEGINNING WORK ON THE PROJECT EXHIBIT D CONTRACTOR PERFORMANCE EVALUATION FORM ARLINGTON COUNTY GOVERNMENT Contractor Performance Evaluation Form Contractor Name: Contract No.: Date: Project/Contract Name: Interim Evaluation Final Evaluation Scope of Work/Services Provided: Contract Start Date: / / Contract End Date: / / Actual Completion Date: / / Please rate the effectiveness of the Contractor’s performance on the Contract/Project across the following dimensions: Evaluation Criteria: Unacceptable Poor Satisfactory Excellent Written comments to explain assigned ratings are required for any performance ratings below “satisfactory” or an “excellent” in any category. Evaluation Questions

NONDISCLOSURE AND DATA SECURITY AGREEMENT. (CONTRACTOR)‌ The undersigned, an authorized agent of the Contractor and on behalf of SPay Inc dba Stack Sports Conduent State & Local Solutions, Inc., (“Contractor”), hereby agrees that the Contractor will hold County-provided information, documents, data, images, records and the like confidential and secure and protect them against loss, misuse, alteration, destruction or disclosure. This includes, but is not limited to, the information of the County, its employees, contractors, residents, clients, patients, taxpayers and property as well as information that the County shares with the Contractor for testing, support, conversion or other services provided under Arlington County Agreement No. 23647-DPR-SLA-534 15 (the “Project” or “Main Agreement”) or that may be accessed through other County-County- owned or -controlled databases (all of the above collectively referred to as “County Information” or “Information”). In addition to the DATA SECURITY obligations set in the County Agreement, the Contractor agrees that it will maintain the privacy and security of County Information, control and limit internal access and authorization for access to such Information and not divulge or allow or facilitate access to County Information for any purpose or by anyone unless expressly authorized. This includes, but is not limited to, any County Information that in any manner describes, locates or indexes anything about an individual, including, but not limited to, his/her (“his”) Personal Health Information, treatment, disability, services eligibility, services provided, investigations, real or personal property holdings and his education, financial transactions, medical history, ancestry, religion, political ideology, criminal or employment record, social security number, tax status or payments, date of birth, address, phone number or anything that affords a basis for inferring personal characteristics, such as finger and voice prints, photographs, or things done by or to such individual, or the record of his presence, registration, or membership in an organization or activity, or admission to an institution. Contractor also agrees that it will not directly or indirectly use or facilitate the use or dissemination of County information (whether intentionally or by inadvertence, negligence or omission and whether verbally, electronically, through paper transmission or otherwise) for any purpose other than that directly associated with its work under the Project. The Contractor acknowledges that any unauthorized use, dissemination or disclosure of County Information is prohibited and may also constitute a violation of Virginia or federal laws, subjecting it or its employees to civil and/or criminal penalties. penalties (e.g., the Government Data Collection and Dissemination Practices Act, formerly called the Privacy Protection Act, Va. Code§ 2.2-3800 et seq., and the Secrecy of Information Act, Va. Code§ 58.1-3, which may be punishable by a jail sentence of up to six months and/or a fine of up to $1,000.00.) Contractor agrees that it will not divulge or otherwise facilitate the disclosure, dissemination or access to or by any unauthorized person, for any purpose, of any Information obtained directly, or indirectly, as a result of its work on the Project. The Contractor shall coordinate closely with the County Project Officer to ensure that its authorization to its employees or approved subcontractors is appropriate and tightly controlled and that such person/s also maintain the security and privacy of County Information and the integrity of County-networked resources. Contractor agrees to take strict security measures to ensure that County Information is kept secure; is properly stored in accordance with industry best practices, and if stored is encryptedencrypted both in transit and at rest; and is otherwise protected from retrieval or access by unauthorized persons or for unauthorized purposes. Any device or media on which County Information is stored, even temporarily, will have strict encryption, security, security and access control. Any County Information that is accessible will not leave Contractor’s work site or the County’s physical facility, if the Contractor is working onsite, without written authorization of the County Project Officer. If remote access or other media storage is authorized, the Contractor is responsible for the security of such storage device or paper files. Contractor will ensure that any laptops, PDAs, netbooks, tablets, thumb drives or other media storage devices, as approved by the County and connected to the County network, are secure and free of all computer viruses, and or running the latest version of an industry-standard virus protection program. The Contractor will ensure that all user accounts and passwords used by its employees or subcontractors are robust, protected and not shared. The Contractor will not download any County Information except as agreed to by the parties and then only onto a County-County- approved device. The Contractor understands that downloading onto a personally owned device or service, such as personal e-mail, Dropbox, etc., is prohibited. Contractor agrees that it will notify the County Project Officer immediately upon discovery or becoming aware or suspicious of any unauthorized disclosure of County Information, security breach, hacking or other breach of this agreement, the County’s or Contractor’s security policies, or any other breach of Project protocols concerning data security or County Information. The Contractor will fully cooperate with the County to regain possession of any Information and to prevent its further disclosure, use or dissemination. The Contractor also agrees to promptly notify others of a suspected or actual breach if requested. The Contractor agrees that all duties and obligations enumerated in this Agreement also extend to its employees, agents or subcontractors who are given access to County information, including those employed by parent companies, sister companies, subsidiary companies, and/or other affiliates. Breach of any of the above conditions by Contractor’s employees, agents or subcontractors subcontractors, including those employed by parent companies, sister companies, subsidiary companies, and/or other affiliates, shall be treated as a breach by the Contractor. The Contractor agrees that it shall take all reasonable measures to ensure that its employees, agents and subcontractors subcontractors, including those employed by parent companies, sister companies, subsidiary companies, and/or other affiliates, are aware of and abide by the terms and conditions of this agreement and related data security provisions in the Main Agreement. It is the intent of this NonDisclosure and Data Security Agreement to ensure that the Contractor has the highest level of administrative safeguards, information security, disaster recovery and other best practices in place to ensure confidentiality, protection, privacy and security of County information and County- County-networked resources and to ensure compliance with all applicable local, state and federal laws or regulatory requirements. Therefore, to the extent that this NonDisclosure and Data Security Agreement conflicts with the Main Agreement or with any applicable local, state, or federal law, regulation or provision, the more stringent requirement, law, regulation or provision controls. At the conclusion of the Project, the Contractor agrees to return all County Information to the County Project Officer. These obligations remain in full force and effect throughout the Project and shall survive any termination of the Main Agreement. Authorized Signature: Printed Name and Title: Xxxxxxxx Xxxxxxxx CFO Date: ARLINGTON COUNTY AGREEMENT 674-15 EXHIBIT F SOFTWARE AND HARDWARE UPGRADES AS REVISED BY CONTRACT AMENDMENT 2 Table of Contents Introduction 1 Software Upgrades 1 Current Software 1 Future Software 1 Hardware Upgrades 2 Handhelds 2 Printers 2 Upgrade Project Schedule & Treasurer Date:Milestones 3 Hardware Configuration & Delivery 3 System Testing, Training & Acceptance 3

NONDISCLOSURE AND DATA SECURITY AGREEMENT. (CONTRACTOR)‌ The undersigned, an authorized agent of the Contractor and on behalf of SPay Inc dba Stack Sports Xxxxxxx Camps, Inc. (“Contractor”), hereby xxxxxx agrees that the Contractor will hold County-provided information, documents, data, images, records and the like confidential and secure and protect them against loss, misuse, alteration, destruction or disclosure. This includes, but is not limited to, the information of the County, its employees, contractors, residents, clients, patients, taxpayers and property as well as information that the County shares with the Contractor for testing, support, conversion or other services provided under Arlington County Agreement No. 2324-DPR-SLA-534 RFP-160r (the “Project” or “Main Agreement”) or that may be accessed through other County-owned or -controlled databases (all of the above collectively referred to as “County Information” or “Information”). In addition to the DATA SECURITY obligations set in the County Agreement, the Contractor agrees that it will maintain the privacy and security of County Information, control and limit internal access and authorization for access to such Information and not divulge or allow or facilitate access to County Information for any purpose or by anyone unless expressly authorized. This includes, but is not limited to, any County Information that in any manner describes, locates or indexes anything about an individual, including, but not limited to, his/her (“his”) Personal Health Information, treatment, disability, services eligibility, services provided, investigations, real or personal property holdings and his education, financial transactions, medical history, ancestry, religion, political ideology, criminal or employment record, social security number, tax status or payments, date of birth, address, phone number or anything that affords a basis for inferring personal characteristics, such as finger and voice prints, photographs, or things done by or to such individual, or the record of his presence, registration, or membership in an organization or activity, or admission to an institution. Contractor also agrees that it will not directly or indirectly use or facilitate the use or dissemination of County information (whether intentionally or by inadvertence, negligence or omission and whether verbally, electronically, through paper transmission or otherwise) for any purpose other than that directly associated with its work under the Project. The Contractor acknowledges that any unauthorized use, dissemination or disclosure of County Information is prohibited and may also constitute a violation of Virginia or federal laws, subjecting it or its employees to civil and/or criminal penalties. Contractor agrees that it will not divulge or otherwise facilitate the disclosure, dissemination or access to or by any unauthorized person, for any purpose, of any Information obtained directly, or indirectly, as a result of its work on the Project. The Contractor shall coordinate closely with the County Project Officer to ensure that its authorization to its employees or approved subcontractors is appropriate and tightly controlled and that such person/s also maintain the security and privacy of County Information and the integrity of County-networked resources. Contractor agrees to take strict security measures to ensure that County Information is kept secure; is properly stored in accordance with industry best practices, and if stored is encrypted; and is otherwise protected from retrieval or access by unauthorized persons or for unauthorized purposes. Any device or media on which County Information is stored, even temporarily, will have strict encryption, security, and access control. Any County Information that is accessible will not leave Contractor’s work site or the County’s physical facility, if the Contractor is working onsite, without written authorization of the County Project Officer. If remote access or other media storage is authorized, the Contractor is responsible for the security of such storage device or paper files. Contractor will ensure that any laptops, PDAs, netbooks, tablets, thumb drives or other media storage devices, as approved by the County and connected to the County network, are secure and free of all computer viruses, and running the latest version of an industry-standard virus protection program. The Contractor will ensure that all user accounts and passwords used by its employees or subcontractors are robust, protected and not shared. The Contractor will not download any County Information except as agreed to by the parties and then only onto a County-approved device. The Contractor understands that downloading onto a personally owned device or service, such as personal e-mail, Dropbox, etc., is prohibited. Contractor agrees that it will notify the County Project Officer immediately upon discovery or becoming aware or suspicious of any unauthorized disclosure of County Information, security breach, hacking or other breach of this agreement, the County’s or Contractor’s security policies, or any other breach of Project protocols concerning data security or County Information. The Contractor will fully cooperate with the County to regain possession of any Information and to prevent its further disclosure, use or dissemination. The Contractor also agrees to promptly notify others of a suspected or actual breach if requested. The Contractor agrees that all duties and obligations enumerated in this Agreement also extend to its employees, agents or subcontractors who are given access to County information. Breach of any of the above conditions by Contractor’s employees, agents or subcontractors shall be treated as a breach by the Contractor. The Contractor agrees that it shall take all reasonable measures to ensure that its employees, agents and subcontractors are aware of and abide by the terms and conditions of this agreement and related data security provisions in the Main Agreement. It is the intent of this NonDisclosure and Data Security Agreement to ensure that the Contractor has the highest level of administrative safeguards, information security, disaster recovery and other best practices in place to ensure confidentiality, protection, privacy and security of County information and County- County-networked resources and to ensure compliance with all applicable local, state and federal laws or regulatory requirements. Therefore, to the extent that this NonDisclosure and Data Security Agreement conflicts with the Main Agreement or with any applicable local, state, or federal law, regulation or provision, the more stringent requirement, law, regulation or provision controls. At the conclusion of the Project, the Contractor agrees to return all County Information to the County Project Officer. These obligations remain in full force and effect throughout the Project and shall survive any termination of the Main Agreement. Authorized Signature: Printed Name and Title: Xxxxxxxx Xxxxxxxx CFO & Treasurer Xxxxx Xxxxxxx President Date:: 11/21/2023 NONDISCLOSURE AND DATA SECURITY AGREEMENT (INDIVIDUAL)‌ I, the undersigned, agree that I will hold County-provided information, documents, data, images, records and the like confidential and secure and protect it against loss, misuse, alteration, destruction or disclosure. This includes, but is not limited to, the information of the County, its employees, contractors, residents, clients, patients, taxpayers, and property as well as information that the County shares with my employer or prime contractor for testing, support, conversion or the provision of other services under Arlington County Agreement No. 24-DPR-RFP- 160r (the “Project” or “Main Agreement”) or which may be accessed through County-owned or -controlled databases (all of the above collectively referred to as “County Information” or “Information”). I agree that I will maintain the privacy and security of County Information and will not divulge or allow or facilitate access to County Information for any purpose or by anyone unless expressly authorized to do so by the County Project Officer. This includes, but is not limited to, any County Information that in any manner describes, locates or indexes anything about an individual including, but not limited to, his/her (“his”) Personal Health Information, treatment, disability, services eligibility, services provided, investigations, real or personal property holdings, education, financial transactions, medical history, ancestry, religion, political ideology, criminal or employment record, social security number, tax status or payments, date of birth, or that otherwise affords a basis for inferring personal characteristics, such as finger and voice prints, photographs, or things done by or to such individual, or the record of his presence, registration, or membership in an organization or activity, or admission to an institution. I agree that I will not directly or indirectly use or facilitate the use or dissemination of information (whether intentionally or by inadvertence, negligence or omission and whether verbally, electronically, through paper transmission or otherwise) for any purpose other than that directly authorized and associated with my designated duties on the Project. I understand and agree that any unauthorized use, dissemination or disclosure of County Information is prohibited and may also constitute a violation of Virginia or federal law/s, subjecting me and/or my employer to civil and/or criminal penalties. I also agree that I will not divulge or otherwise facilitate the disclosure, dissemination or access to or by any unauthorized person for any purpose of the Information obtained directly, or indirectly, as a result of my work on the Project. I agree to view, retrieve or access County Information only to the extent concomitant with my assigned duties on the Project and only in accordance with the County’s and my employer’s access and security policies or protocols. I agree that I will take strict security measures to ensure that County Information is kept secure; is properly stored in accordance with industry best practices, and if stored is encrypted; and is otherwise protected from retrieval or access by unauthorized persons or for unauthorized purposes. I will also ensure that any device or media on which County Information is stored, even temporarily, will have strict encryption, security, and access control and that I will not remove, facilitate the removal of or cause any Information to be removed from my employer’s worksite or the County’s physical facility without written authorization of the County Project Officer. If so authorized, I understand that I am responsible for the security of the electronic equipment or paper files on which the Information is stored and agree to promptly return such Information upon request. I will not use any devices, laptops, PDAs, netbooks, tablets, thumb drives or other media storage devices (“Device”) during my work on the Project without pre-approval. I will ensure that any Device connected to the County network is free of all computer viruses and running the latest version of an industry-standard virus protection program. I will also ensure that my user account and password, if any, is robust, protected and not shared. I will not download any County Information except as authorized by the County Project Officer and then only onto a County-approved Device. I understand that downloading onto a personally owned Device or service, such as personal e-mail, Dropbox etc., is prohibited. I agree that I will notify the County Project Officer immediately upon discovery or becoming aware or suspicious of any unauthorized disclosure of County Information, security breach, hacking or other breach of this agreement, the County’s or Contractor’s security policies, or any other breach of Project protocols concerning data security or County Information. I will fully cooperate with the County to help regain possession of any County Information and to prevent its further disclosure, use or dissemination. It is the intent of this NonDisclosure and Data Security Agreement to ensure that the highest level of administrative safeguards, information security, and other best practices are in place to ensure confidentiality, protection, privacy and security of County Information and County-networked resources and to ensure compliance with all applicable local, state and federal laws or regulatory requirements. Therefore, to the extent that this Nondisclosure and Data Security Agreement conflicts with the underlying Main Agreement or any local, state or federal law, regulation or provision, the more stringent requirement, law, regulation or provision controls. Upon completion or termination of my work on the Project, I agree to return all County Information to the County Project Officer. I understand that this agreement remains in full force and effect throughout my work on the Project and shall survive my reassignment from the Project, termination of the above referenced Project or my departure from my current employer. Signed: Printed Name: Date: Witnessed: Contractor’s Project Manager: Printed Name: Date: TO BE COMPLETED PRIOR TO BEGINNING WORK ON THE PROJECT EXHIBIT C CONTRACTOR PERFORMANCE EVALUATION FORM ARLINGTON COUNTY GOVERNMENT Contractor Performance Evaluation Form Contractor Name: Contract No.: Date: Project/Contract Name: Interim Evaluation Final Evaluation Scope of Work/Services Provided: Contract Start Date: / / Contract End Date: / / Actual Completion Date: / / Please rate the effectiveness of the Contractor’s performance on the Contract/Project across the following dimensions: Evaluation Criteria: Unacceptable Poor Satisfactory Excellent Written comments to explain assigned ratings are required for any performance ratings below “satisfactory” or an “excellent” in any category. Evaluation Questions