AMENDMENT Number 2 TO THE MASTER AGREEMENT BETWEEN CITIBANK, N.A. AND TRX DATA SERVICES INC.
Exhibit 10.40
AMENDMENT
Number 2
TO
BETWEEN
CITIBANK, N.A.
AND
TRX DATA SERVICES INC.
The Master Services Agreement (the “Agreement”), effective as of February 1, 2002, by and between Citibank, N.A. (“Citi”) and TRX Data Services, Inc. (“Provider”), in consideration of the mutual promises of the parties is hereby amended as follows:
1. The following shall be added as a new Subsections G and H to Section 11 “Compliance with Citi Policies and Procedures”:
G. Diversity Initiative. Provider acknowledges that Citi has implemented a Supplier Diversity Program which, among other initiatives, encourages the use of minority and women-owned businesses (“Diverse Suppliers”) as suppliers and subcontractors to the fullest possible extent consistent with the efficient performance of its business strategies. To assist Citi in complying with these goals, Provider will (at no additional cost to Citi) report to Citi within fifteen (15) days of the last day of each calendar quarter, the dollar amount spent by Provider in connection with this Agreement with any Diverse Suppliers which are involved in the provision of the goods and services under this Agreement. These reports shall be forwarded to the attention of the Citigroup Supplier Diversity Program, 000 Xxxx 00xx Xxxxxx, Xxx Xxxx, XX 00000, attention Director Supplier Diversity Program. All such reports shall be kept and treated by Citi in accordance with Citi’s confidentiality obligations herein. Provider further acknowledges that Citi prefers, when contracting with suppliers that are not directly Diverse Suppliers, to contract with suppliers who can substantiate that a minimum of ten percent (10%) of the subcontractors or suppliers that they utilize in providing their products or services to Citi are Diverse Suppliers.
H. Equipment and Network Security. If access to Citi’s or an Affiliate’s computer systems, other equipment or personal property (“Citi’s Systems”) is required in order for Provider to fulfill its obligations to Citi, then Citi shall determine the nature and extent of such access. If Citi or an Affiliate provides Provider with remote access to Citi’s Systems, then any and all information relating to such remote access shall be considered Citi’s Confidential Information and shall be subject to the obligations of confidentiality set forth in Section 8 of the Agreement. In addition, any and all access to Citi’s Systems shall be subject to the following.
| 1) | Citi’s Systems shall be used solely to perform Services for Citi, and shall not be used for any purpose other than the legitimate business purposes of Citi. |
| 2) | Access to Citi’s Systems shall be restricted to Provider’s Personnel who need access in order for Provider to fulfill its obligations under this Agreement; and no access rights will be transferred to any other individuals without the prior written consent of Citi. |
| 3) | Provider will ensure that its Personnel do not attempt to break Citi’s or an Affiliate’s security systems, or attempt to obtain access to any programs or data beyond the scope of the access granted by Citi in writing. |
| 4) | Without limiting any of its other rights, Citi reserves (for itself and its Affiliates) the rights to restrict and monitor the use of Citi’s Systems, and to access, seize, copy and disclose any information, data or files developed, processed, transmitted, displayed, reproduced or otherwise accessed in conjunction with such use. Citi or an Affiliate may exercise its rights reserved hereunder: (i) to verify the performance of Services or the quality of Deliverables; (ii) to assure compliance by Provider’s Personnel with Citi’s or the Affiliate’s policies and procedures; (iii) to investigate conduct that may be illegal or may adversely affect Citi, an Affiliate or its or their employees; or (iv) to prevent inappropriate or excessive personal use of Citi’s Systems. Provider will advise its Personnel concerning the rights reserved hereunder. Notwithstanding the foregoing, this Section shall not apply to Provider’s IP addresses that pass through Citi’s Systems. |
2. The following shall be added at the end of Section 20 “Audit”:
Licensor shall be required to perform a SAS 70 Audit and provide the results to Citi consistent with the terms of this Section 20. All expenses related to such audit shall be paid by Citi. Provider agrees that the results of such audit shall not be shared with any of Provider’s customers. Upon Citi’s request, Provider will provide a completed audited statement of the financial condition of Provider’s organization, including (i) audited year-end results for the three (3) previous years, including revenues, expenses, net income, total assets, liabilities and footnotes; and (ii) the most recent financial interim statement.
3. Section 13 B “Export” shall be deleted in its entirety and replaced with the following:
B. Export Controls. Without limiting the generality of Section 20.1, Provider specifically agrees to comply, and will cause its Personnel to comply, with the requirements of all applicable export laws and regulations, including but not limited to the U.S. Export Administration Regulations. Unless authorized by U.S. regulation or Export License, Provider will not export or reexport, directly or indirectly, any software or technology received from Citi, or allow the direct product thereof to be exported or reexported, directly or indirectly, to (a) any country in Country Group E:2 of the Export Administration Regulations of the Department of Commerce (see xxxx://xxx.xxx.xxx.xxx) or any other country subject to sanctions administered by the Office of Foreign Assets Control (see xxxx://xxx.xxxxx.xxx/xxxx/); or (b) any non-civil (i.e. military) end-users or for any non-civil end-uses in any country in Country Group D:1 of the Export Administration Regulations, as revised from time to time. Provider understands that countries other than the U.S. may restrict the import or use of strong encryption products and may restrict exports, and Provider agrees that it shall be solely responsible for compliance with any such import or use restriction. If requested by Citi, Provider shall cause its Personnel to execute and return to Citi the appropriate form of Assurance of Compliance set forth as Appendix A, either A-1 or A-2. (Attached)
4. The following shall be added as a new Subsection C to Section 13 “Compliance with Laws”.
C. Xxxxxxx Xxxxxxx and Tipping Notice. The Provider acknowledges that the federal securities laws, other applicable local laws, and the Citi’s policies and procedures prohibit any person or entity that has received from the Citi material, nonpublic information about a company, from purchasing or selling securities of that company or from communicating such information to any other person or entity that may sell or purchase such securities
2
5. Section 10 “Insurance” shall be deleted in its entirety and replaced with the following:
INSURANCE REQUIREMENTS
A. Required Coverage. During the term of this Agreement and for so long as any Work Order has not yet been completed or terminated, Provider will maintain, at its own expense, insurance coverage with limits of no less than those set forth below, and with insurers with a minimum A.M. Best Financial Strength rating of “A- (Excellent)” and Financial Size rating of “X”, or equivalent ratings from other valid rating agencies and under forms of policies satisfactory to Citi.
| (1) | Professional Liability Insurance (“Errors and Omissions”) in the minimum amount of $2,000,000 per occurrence, covering losses from any act, errors, omissions, negligence, breach of contract and/or misrepresentations related to Provider’s obligations under this Agreement. This insurance shall be maintained for a period of at least [*] after completion of all Work Orders. |
| (2) | Fidelity/Crime Insurance in the minimum amount of $2,000,000 per occurrence providing coverage for any loss sustained by Citi or an Affiliate as a result of any dishonest act by Provider’s officers, employees, agents or subcontractors (whether acting alone or in collusion with others), including but not limited to theft, forgery, alteration, or transfer of funds (electronically or otherwise). Such insurance must cover (i) property of the Provider; (ii) property of others, which the Provider holds in its care, custody and control; and (iii) property of others for which the Provider is legally liable. |
| (3) | Commercial General Liability including broad form contractual liability and personal injury endorsement, providing coverage against liability for bodily injury, death, and property damages in the minimum amount of $1,000,000 per occurrence and no less than $2,000,000 annual aggregate. |
| (4) | Automobile Liability in the minimum amount of $1,000,000 Combined Single Limit (“CSL”) per occurrence for bodily injury and property damage (covering owned, non-owned and hired vehicles). |
| (5) | Workers Compensation insurance covering Provider’s employees pursuant to applicable state laws and at the statutory limits required for each such state, and Employers Liability coverage in the minimum amount of $500,000 per loss. |
| (6) | Umbrella/Excess Liability providing excess liability coverage in the minimum amount of $5,000,000 per occurrence, to supplement the primary coverage limits for Commercial General Liability, Automobile Liability and Employers Liability provided under the policies listed above. |
B. Certificates of Insurance. Provider will deliver Certificates of Insurance to Citi prior to the execution of the Master Agreement. Said certificate shall indicate that policies providing coverage and limits of insurance are in full force and effect. Each Certificate shall provide that no less than thirty (30) days notice will be given in writing to Citi prior to cancellation, termination, or material alteration of any one of the policies. At least ten (10) days before the expiration of an insurance policy required hereunder, Provider will deliver to Citi a certificate of insurance attesting to the renewal of such insurance. In addition, each policy required pursuant to Subsections A(3), A(4), A(5) (Employers Liability only) and A(6) shall name Citi, Affiliates and assignees (suggest other parties if necessary) as additional insureds. Each policy required pursuant to Subsection A(2) shall name Citi, Affiliates and assignees as loss
[*] - Confidental Treatment Requested
3
payees. Citi’s acceptance of delivery of a Certificate of Insurance that does not conform to the requirements of this Section shall not relieve Provider of its obligation to provide insurance conforming to the requirements hereof.
C. No Limitation. The requirements set forth above as to types, limits and approval of insurance coverage to be maintained by Provider will not in any manner limit the liabilities and obligations assumed by Provider under this Agreement.
6. The parties agree that upon execution of this Amendment #2, they will take steps to consolidate all existing Amendments and Exhibits to the Master Agreement into one Amended and Restated Master Agreement, which accurately reflects the terms and conditions of such Amendments and Exhibits.
All other provisions of the Agreement remain unchanged and in full effect.
UNDERSTOOD AND AGREED:
| CITIBANK, N.A. |
TRX DATA SERVICES INC. | |||||
| Signature: | /s/ Xxxxxxx Xxxxxxxxx |
Signature: | /s/ Xxxxxxx X. Xxxxx III | |||
| Printed Name | Xxxxxxx Xxxxxxxxx |
Printed Name: | Xxxxxxx X. Xxxxx III | |||
| Title: |
|
Title: | President | |||
| Date: | 12/19/05 |
Date: | 6 December 2005 | |||
4
APPENDIX A-1
ASSURANCE OF COMPLIANCE
WITH EXPORT LAW AND REGULATIONS
(PROVIDER’S PERSONNEL, US RESIDENT)
I hereby certify that, unless the permission of the U.S. Departments of Commerce, Treasury, or State, as applicable, is obtained, either in writing or in accordance with applicable regulations; I will not export, reexport or otherwise disclose, directly or indirectly, any proprietary software or technical data received from Citi, Citigroup or any of its direct or indirect subsidiaries or affiliates (collectively, “Citigroup”), or the direct product of any such software or technical data, to any of the following nations or nationals thereof:
| 1. | Country Group E:2 (currently Cuba and Libya) or any other embargoed destinations (currently Iran, Iraq, Sudan, Syria, or the Taliban controlled areas of Afghanistan). |
| 2. | Non-civil (i.e., military) end-users or for any non-civil (i.e., military) end uses in Country Groups D:1 (currently Albania, Armenia, Azerbaijan, Belarus, Bulgaria, China (PRC), Cambodia, Estonia, Georgia, Kazakhstan, North Korea, Kyrgystan, Laos, Latvia, Lithuania, Macau, Moldova, Mongolia, Romania, Russia, Tajikistan, Turkmenistan, Ukraine, Uzbekistan, and Vietnam). |
I agree to be bound by any future modifications of the foregoing list of restricted destinations by amendments to the U.S. Export Administration Regulations or other U.S. Government agencies.
I understand that prior approval of the U.S. Department of Commerce or other appropriate agencies can be provided by regulations authorizing certain exports or by licenses or other authorizations obtained after prior application to the agency.
Additionally, I understand that countries other than the U.S. may restrict exports and may also restrict the import or use of strong encryption products and agree that we shall be solely responsible for compliance with any such export, import or use restrictions.
Further, I understand that failure to comply with the U.S. export regulations exposes Citigroup (and individuals providing services to Citigroup) to severe criminal and administrative penalties and sanctions, as well as adverse publicity, and that violation of this Assurance can result in the termination of my service assignment.
| Signature: | /s/ Xxxxxxx X. Xxxxx III | |
| Name: | Xxxxxxx X. Xxxxx III | |
| Date: | 6 December 2005 | |
| Name of Provider that employs the signatory: |
TRX Data Services, Inc. |
5
APPENDIX A-2
ASSURANCE OF COMPLIANCE
WITH EXPORT LAW AND REGULATIONS
(PROVIDER’S PERSONNEL, FOREIGN NATIONAL)
[DATE]
[Business]
[Street Address]
[City, State, Zip]
[Attn: Export Licensing Coordinator]
Re: No Reexport of Controlled Technical Data or Software
To whom it may concern:
During my engagement with any direct or indirect subsidiary or affiliate of Citigroup (collectively “Citigroup”), I may have access to proprietary technical data and computer software. As a foreign national (non-U.S. citizen without U.S. permanent residency status), I understand that this access constitutes an export of technical data/software from the United States and is therefore governed by the provisions of the U.S. Export Administration Regulations (“EAR”).
Consequently, I agree to comply with U.S. Export Administration Regulations as they pertain to any technical data or computer software to which I have access. I hereby certify that, unless prior written authorization is received from the U.S. Department of Commerce or other appropriate agencies, I shall not knowingly reexport, directly or indirectly, this technical data/computer software without full compliance with U.S. export control laws, and in particular I will not export it to any of the following nations or nationals thereof:
| 1. | Country Group E:2 (currently Cuba and Libya) or any other generally embargoed destinations (currently Iran, Sudan, Syria), or |
| 2. | Non-civil (i.e., military) end-users or for any non-civil (i.e., military) end uses in Country Groups D:1 (currently Albania, Armenia, Azerbaijan, Belarus, Bulgaria, China, Cambodia, Estonia, Georgia, Kazakhstan, North Korea, Kyrgystan, Laos, Latvia, Lithuania, Macau, Moldova, Mongolia, Romania, Russia, Tajikistan, Turkmenistan, Ukraine, Uzbekistan, and Vietnam. |
I agree to be bound by any future modifications of the foregoing list of restricted destinations by amendments to the U.S. Export Administration Regulations or other U.S. Government agencies.
I also agree that, without the prior approval of the U.S. Department of Commerce or other appropriate agencies, I shall not knowingly export to any of the above nations, directly or indirectly, any product (or any part thereof), process or service which is the direct product of this technical data/computer software.
I understand that prior approval of the U.S. Department of Commerce or other appropriate agencies can be provided by regulations authorizing certain exports or by licenses or other authorizations obtained after prior application to the agency, and that prior regulatory approvals are more likely to be available for exports to the second group of countries.
6
Additionally, I understand that countries other than the U.S. may restrict the import or use of strong encryption products and export of any products, and I agree that I will accept responsibility for compliance with any such restrictions.
I certify that I understand that this assurance I am providing is a condition to my having access to such data or software and applies in addition to any commercial nondisclosure agreements to which I am now or may be a party. Failure to comply exposes Citigroup (and individuals providing services to Citigroup) to severe criminal and administrative penalties and sanctions, as well as adverse publicity. Additional personal liability can result, including disciplinary action up to and including termination and/or problems under U.S. immigration laws.
| Signature: | /s/ Xxxxxxx X. Xxxxx III | |
| Name: | Xxxxxxx X. Xxxxx III | |
| Date: | 6 December 2005 | |
| Name of Provider that employs the signatory: |
TRX Data Services, Inc. |
7
