NUTANIX VENDOR MASTER SERVICES AGREEMENT

This Vendor Master Services Agreement (this "Agreement") is between Nutanix, Inc., located at 1740 Technology Drive, Suite 150, San Jose, CA 95110, United States, on behalf of itself and its affiliates, or the entity as specified on the purchase order (“Nutanix”) and the entity providing Services to Nutanix on behalf of itself and its affiliates (“Service Provider”, “Vendor”), is made as of the first delivery of the Services (the “Effective Date”). In the event of a conflict between the terms of this Agreement and the terms of any other document, the terms of this Agreement will prevail. If Service Provider and Nutanix have a mutually executed written agreement in place for the provision of the Services, such agreement shall prevail to the extent of any conflict between such agreement and this Agreement. In consideration of the mutual promises and upon the terms and conditions set forth below, the parties hereby agree as follows:

1. DEFINITIONS

‘’Intellectual Property Rights’’ means copyrights, trademarks, service marks, patents, trade secrets, know-how, moral rights and all other proprietary rights, including registrations, applications, renewals and extensions of such rights existing anywhere in the world, whether registered or unregistered.

“Service(s)” means the work to be performed or delivered by Service Provider on behalf of Nutanix pursuant to this Agreement and as described in a Statement of Work.

“Statement of Work” or “SOW” means a written description of the Services and any work product or deliverables to be provided.  Each SOW shall by reference incorporate the terms and conditions of this Agreement and this Agreement shall govern each SOW and shall take precedence over any conflicting or inconsistent terms in an SOW. For the purpose of this Agreement, an SOW includes any form of ordering document through which Service Provider delivers or has delivered Services. Each SOW, and any exhibit to an applicable SOW or an order, is subject to this Agreement and is incorporated herein by reference.

“Security Incident” means any unauthorized access or breach of security leading to, or reasonably believed to have led to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access to Nutanix data.

2. PERFORMANCE STANDARDS

Unless otherwise specified in an SOW, Service Provider shall be solely responsible for determining the method, details and means of performing the Services. Service Provider shall provide the Services personally, and may not assign or sub-contract the provision of the Services to any other person, firm or company without the prior written consent of Nutanix. Service Provider must also comply with any applicable Nutanix policies or Code of Business Conduct and Ethics, which can be found at: https://www.nutanix.com/legal/vendor-code-of-conduct.

3. PAYMENT

3.1 Fees. Except to the extent provided otherwise in the applicable SOW, Service Provider will invoice Nutanix monthly in arrears for such fees as agreed in such SOW. An SOW may estimate fees only to the extent that Services will be billed on a time-and-materials basis, in which case Service Provider represents and warrants that it will not invoice or otherwise charge Nutanix more than estimated for any line item unless Nutanix has pre-approved in writing and the estimate for that line item specifies how the actual fee will be calculated. Service Provider may invoice Nutanix for fees in addition to those agreed in the applicable SOW only if both parties have agreed in a signed writing to such additional fees and the related additions or changes to the scope of Services. Each invoice will explain how all fees have been determined and will include such other information as Nutanix may specify from time to time.

3.2 Expenses. All expenses incurred by Service Provider in performing the Services will be borne by Service Provider, unless otherwise pre-approved by Nutanix in writing. Service Provider will submit in arrears expense reports with receipts and any other documentation that Nutanix may reasonably request. Service Provider agrees to comply with the terms and conditions of Nutanix’s Travel & Expense Guidelines, a copy of which is available upon request.

3.3 Invoicing. Each proper undisputed invoice and expense report submitted to Nutanix will be due and payable forty-five (45) days from receipt. On termination of an SOW for any reason permitted by this Agreement, Nutanix will pay Service Provider a proportionate value of the Services completed as of the effective date of such termination provided that Service Provider has delivered to Nutanix the portion of the Services completed. All amounts payable under this Agreement will be paid in U.S. dollars less any required government withholding, including but not limited to applicable sales, use and similar taxes. Nutanix will not be responsible for paying any tax not specified on an SOW and the corresponding invoice.

4. WORKING RELATIONSHIP AND RIGHTS OR OWNERSHIP

4.1 No Agency. Nutanix and Service Provider are independent contractors and neither party is the legal representative, agent, joint ventures, partner, employee or employer of the other party for any purpose whatsoever, and neither party has any right, power or authority to assume or create any obligation of any kind or to make any representation or warranty on behalf of the other party, whether express or implied, or to bind the other party in any respect.

4.2 No Benefits or Contributions. Neither Service Provider nor Service Provider’s employees, agents or representatives are entitled to any of the benefits that Nutanix may make available to its own employees, such as group insurance, profit sharing or retirement benefits. Service Provider will be solely responsible for, and will file on a timely basis, all tax returns and payments required to be filed with or made to any federal, state or local tax authority with respect to Service Provider's performance of the Services and receipt of compensation under this Agreement. Service Provider shall have the full responsibility for compliance with all applicable laws, rules and regulations applicable to the Services, all applicable labor and employment requirements with respect to Service Provider’s Assigned Personnel, its designation of self-employment, sole proprietorship or other form of business organization, and with respect to the personnel, including jurisdictionally required insurance coverage (i.e., workers compensation) and any jurisdictional immigration or work visa requirements.

4.3  Assigned Personnel. If Service Provider assigns any of its employees, service providers contractors or other personnel (the “Assigned Personnel”) to perform any of the Services at Nutanix’s offices or facilities (other than occasional visits for meetings with Nutanix that are not scheduled on a regular basis), then in compliance with and to the extent permitted by applicable laws: (i) Service Provider will ensure that each Assigned Personnel has properly demonstrated eligibility to work in the jurisdiction in which the Services will be performed; (ii)  Service Provider will, in accordance with applicable law, conduct a criminal background check on each Assigned Personnel covering the counties, states, and/or countries in which such person was employed or resided for the past seven years and in such other areas as Nutanix may reasonably specify (such as a driving record check, credit check, etc.); (iv) Service Provider will not provide any Assigned Personnel who: (a) has any felony convictions or misdemeanor convictions involving violence or dishonesty; (b) has a restriction (e.g.. a court order or restrictive covenant) that would prevent the person from providing services or impose limitations on the services that the person is able to provide to Nutanix; (c) may present a higher than normal security risk to Nutanix; or (d) does not meet other guidelines specified by Nutanix from time to time.  Nutanix may at any time request that Service Provider remove an Assigned Personnel and Service Provider shall comply with such request as soon as possible.

4.4 Nutanix Facilities and Equipment. If any Service Provider personnel visits or performs Services at any Nutanix office or facility, then Service Provider will ensure that such personnel complies with all applicable Nutanix rules and policies and other requests from Nutanix and takes all necessary precautions to prevent injury to any person or damage to any property.   Service Provider shall indemnify, defend and hold Nutanix harmless for any breach or alleged of this Section 4.4.

4.5  Pre-Existing Property and Ownership.  All Services are “works for hire” and any and all work product, deliverables, code, data, information or reports that are referenced in any SOW or otherwise provided to Nutanix as part and parcel of this Agreement is and shall be the sole and exclusive property of Nutanix and shall be deemed to be Nutanix Intellectual Property Rights and subject to all non-disclosure and other protections afforded hereunder.  Service Provider hereby assigns to Nutanix any and all rights it may obtain to any such work product or deliverable. Service Provider shall execute any and all documentation as may be required to effectuate the requirements of this section 4.5. Nutanix owns all of its data, customer and employee information, and all information regarding its technology and its business (‘’Nutanix Materials’’) and this Agreement effectuates no license or transfer of any such Nutanix Materials to Service Provider or other third party. Service Provider owns and continues to own any Service Provider developed data, information or technology that pre-exists this Agreement less any Nutanix Intellectual Property Rights that may be contained therein. However, Service Provider hereby grants to Nutanix a fully paid, royalty free, perpetual, non-terminable and global license to use any such Service Provider data, information or technology for any legitimate Nutanix business purpose.

5. REPRESENTATIONS AND WARRANTIES

5.1 By Nutanix. Nutanix warrants to Service Provider that Nutanix is duly organized, validly existing and in good standing under the laws of the jurisdiction of its organization, that this Agreement has been duly authorized by all necessary corporate action, and that this Agreement is the legal, valid, and binding obligation of Nutanix, enforceable against Nutanix in accordance with its terms.

5.2 By Service Provider.  Service Provider represents and warrants to Nutanix that:

5.2.1  Service Provider is duly organized, validly existing and in good standing under the laws of the jurisdiction of its organization, that this Agreement has been duly authorized by all necessary corporate (or other entity) action, and that this Agreement is the legal, valid, and binding obligation of Service Provider, enforceable against Service Provider in accordance with its terms.

5.2.2 Service Provider has obtained any and all consents, permits, licenses and authorizations necessary for or in connection with providing the Services to Nutanix. Service Provider’s entry into or performance of this Agreement does not and will not violate any other agreement by which Service Provider is bound, and Service Provider has full power, authority, unrestricted ability and all rights (including but not limited to license rights of intellectual property) necessary: to enter into this Agreement; and to perform all of Service Provider's obligations hereunder.

5.2.3 The Services will be performed by qualified personnel in a timely manner on a good and workmanlike best-efforts basis, and will meet and conform to all applicable specifications as stated in any SOW.  The Services and any work product and/or deliverable shall be of the highest prevailing standard within Service Providers industry, and shall meet the reasonable requirements of Nutanix as stated within any SOW.  In the event of a breach of this warranty, Nutanix shall notify Service Provider in writing as the specifications of any such breach, whereupon Service Provider shall, at the reasonable discretion of Nutanix, re-perform all non-conforming services at no additional charge to Nutanix, replace any non-conforming work product or deliverable with a fully conforming item or deliverable,  or refund any all applicable fees paid for any such non- conforming work product or deliverable. Service Provider shall be liable for any and all reasonable costs of cover and\or replacement Services in the event of a breach of these warranties.

5.2.4 Service Provider and its employees, and contractors have complied and will comply with all laws, rules, regulations and ordinances applicable to the provision of the Services. Service Provider represents that it has completed all training of its personnel providing Services under this Agreement required under applicable law, including, but not limited to, any applicable anti-harassment and/or other compliance-related training. Service Provider agreed that it will make records reflecting compliance with all such mandatory trainings available for audit and inspection upon Nutanix’s reasonable request. Additionally, Service Provider agrees that it will ensure that its personnel providing Services under this Agreement will complete additional training and compliance certifications provided by Nutanix and/or its third party vendors at Nutanix’s request.  Service Provider agrees not to export, directly or indirectly, any U.S. source technical data acquired from Nutanix or any products utilizing such data to countries outside the United States, which export may be in violation of the United States export laws or regulations (including the U.S. Export Administration Act and the regulations thereunder).

6. INSURANCE

During the term of the Engagement, Service Provider will (at Service Provider's sole cost and expense) obtain and maintain all appropriate insurance coverages required by federal or state law (including without limitation workers' compensation and disability insurance). Service Provider will also (at Service Provider's sole cost and expense) maintain the following minimum insurance coverages during the term of the Engagement: (a) comprehensive general liability insurance for bodily injury, death, and property damage with a per occurrence limit of at least $3,000,000, with such policy to include broad-form contractual liability, advertisers liability, protective liability, and personal injury/property damage coverage; (b) workers' compensation and employer's liability coverage of at least $1,000,000; (c) comprehensive automobile liability insurance for all owned, leased, non-owned, and hired vehicles with policy limits of at least $1,000,000 combined single limit for bodily injury and property damage; (d) if any of Service Provider's personnel are to visit or perform Services at any of Nutanix's offices or facilities, then fidelity bond coverage (or an employee crime policy) of at least $1,000,000; and (e) if Service Provider will have any access to any personally identifiable information of Nutanix users or Service Provider provides computer programming services to Nutanix, then Professional Liability Insurance (Errors & Omissions) in the amount of at least $5,000,000 for each claim covering the products and/or services provided by Service Provider.  The  Professional Liability Insurance policy (if required) will not exclude claims based on computer virus, computer attack, e commerce transactions, or breach of security.  Each insurance policy required by this Section will be with an insurance company rated at least A-, VII by the most recent AM Best ratings guide. With respect to each type of insurance policy required by this Section, there will be coverage for the entire term of the Engagement; without limiting the generality of the foregoing, for any claims-made policy, the "prior acts" or "retroactive" date will be before the Effective Date. Promptly after the Effective Date, Service Provider will provide to Nutanix certificates from Service Provider's insurers indicating the amount of insurance coverage, the nature of such coverage, and the expiration date of each applicable policy. Each such certificate will indicate that the policy will not be materially changed (including erosion of limits) or terminated without at least 30 days' prior written notice to Nutanix, will name Nutanix as an additional insured on the general liability and auto policies, and will indicate that the insurer has waived the insurer's subrogation rights against Nutanix. The fact that this Section requires Service Provider to maintain insurance with certain minimum coverages will not be deemed to limit Service Provider’s liability under this Agreement in any way.

7. INDEMNIFICATION

7.1            By Service Provider. Service Provider will defend, indemnify, and hold harmless Nutanix, Nutanix’s subsidiaries and affiliates, and their respective directors, officers, employees, sublicensees, customers, agents, attorneys, affiliates, successors, and assigns (collectively, the “Indemnified Parties”), against and from any and all claims, losses, liabilities, damages, suits, actions, government procedures, taxes, penalties or interest, associated auditing and legal expenses, and other costs (including reasonable attorneys’ fees and costs of suit) that may be imposed on, incurred by, or asserted against any Indemnified Party resulting from, arising out of, or relating to any third party claims for the following: (a) any misrepresentation or breach of any representation, warranty, obligation, or covenant of this Agreement by Service Provider (or any of Service Provider's employees, service providers, contractors, or agents); (b) the performance of the Services or Service Provider's other obligations under this Agreement (or any of Service Provider's employees, Assigned Personnel, service providers, contractors, or agents); (c) any claim that any part of the Services, the Deliverables,  or the use thereof: (i) infringes any patent, copyright, trademark right, or other Intellectual Property Rights of a third party, (ii) is a misappropriation of any third party trade secret, or (iii) violates any other rights of a third party; (d) security incidents and/or breaches of applicable privacy laws; (e) any negligence, willful misconduct, errors, or omissions of Service Provider (or any of Service Provider’s employees, service providers, contractors, or agents); and (f) any claims arising from a death, bodily injury, tortious conduct or damage to real or personal property.  Nutanix will have the right to withhold from any payments due to Service Provider under this Agreement the amount of any such defense costs plus additional reasonable amounts as security for Service Provider’s obligations under this Section 7 (Indemnification). Service Provider will not enter into any settlement that affects Nutanix’s rights or interest without Nutanix’s prior written approval. Nutanix will have the right to participate in the defense of any applicable claim at Nutanix’s own expense. In the event of a violation of this Section  7 (i), Service Provider shall, at the reasonable discretion of Nutanix, procure at Service Provider’s expense and for the benefit of Nutanix a license to use the allegedly infringing item, or replace the applicable deliverable or work product with a non-fringing item with the same or better features and/or functionality and which is non-infringing, or refund any and all applicable fees paid by Nutanix. These remedies are in addition to and independent of the indemnification obligations listed herein.

7.2            By Nutanix.  Nutanix will indemnify and hold harmless Service Provider and its employees, and agents from and against any and all liabilities, losses, damages, costs, and other expenses (including attorneys’ and expert witnesses’ costs and fees) arising from or relating to any third party claim caused by: (i) gross negligence and intentional misconduct of Nutanix or any of its employees, or (ii) the alleged breach of any Intellectual Property Rights of a third party by Service Provider’s use of any Nutanix Materials provided by Nutanix to Service Provider in connection with the Services. The foregoing indemnity applies to Nutanix Materials in its original form and will not apply to claims where the Nutanix Materials have been modified by Service Provider or any third party. 

8. LIMITATION OF LIABILITY

EXCEPT FOR A BREACH OF CONFIDENTILIATY OBLIGATIONS OR A BREACH OF NUTANIX’S INTELLECTUAL PROPERTY RIGHTS, NEITHER PARTY WILL BE LIABLE FOR SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES OR LOST PROFITS (HOWEVER ARISING, INCLUDING NEGLIGENCE) ARISING OUT OF OR IN CONNECTION WITH THIS AGREEMENT, EVEN IF SUCH PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

EXCEPT WITH RESPECT TO A VIOLATION OF NUTANIX’S RIGHT IN ITS INTELLECTUAL PROPERTY OR A BREACH OF ANY PRIVACY OR SECURITY OBLIGATION IMPOSED BY THIS AGREEMENT OR APPLICABLE LAW, BREACHES OR OBLIGATIONS OF SECTION 5 (REPRESENTATIONS AND WARRANTIES), SECTION 9 (CONFIDENTIAL INFORMATION AND PERSONAL DATA), INDEMNIFICATION OBLIGATIONS IN THIS AGREEMENT, OR PARTY’S GROSS NEGLIGENCE OR WILLFUL MISCONDUCT, IN NO EVENT WILL EITHER PARTY BE LIABLE TO THE OTHER PARTY FOR AN AMOUNT GREATER THAN THE AMOUNTS PAID OR PAYABLE BY NUTANIX HEREUNDER FOR THE SERVICES GIVING RISE TO THE CAUSE OF ACTION.

9. CONFIDENTIAL INFORMATION

“Confidential Information” shall mean (a) all non-public information relating to a party’s (the “Disclosing Party”) technology or business that is disclosed hereunder to the other party (the “Receiving Party”); (b) any information designated in writing, or identified orally at time of disclosure, by the disclosing party as “confidential” or “proprietary"; or (c) any information by the nature of circumstances surrounding the disclosure, a reasonable person would deem the information to be “confidential” or “proprietary” information. All rights, title and interest in and to the Confidential Information will remain vested in the Disclosing Party. Service Provider agrees to hold the Confidential Information of Nutanix in strict confidence and agrees not to disclose any Confidential Information to any third party.

Receiving Party will (a) use the same degree of care as the Receiving Party uses with its own Confidential Information, but no less than reasonable care, to protect Confidential Information and to prevent any unauthorized access, reproduction, disclosure, or use of any of the Confidential Information; (b) not use Confidential Information except for providing Services to Nutanix under this Agreement; (c) not disclose or permit disclosure of or access to any Confidential Information of Disclosing Party to any third parties or to any of Receiving Party’s officers, directors, agents, contractors, employees, or other representatives (collectively, “Representatives”), except for those Representatives who have a need to know such Confidential Information for the purpose of providing Services hereunder and who are prohibited from disclosing the information by a contractual, legal or fiduciary obligation no less restrictive than as provided herein, provided that Receiving Party will remain liable for any breach of this Agreement by any of its Representatives; (d) immediately notify in writing Disclosing Party in the event of unauthorized use or disclosure of Confidential Information; and (f) not export or re-export any Confidential Information except in compliance with applicable export laws, including without limitation, laws of the United States.

Notwithstanding the above, Receiving Party will not have liability to Disclosing Party with regard to any Confidential Information that the Receiving Party can demonstrate and document (a) was in the public domain through no improper conduct by Receiving Party; (b) was known to Receiving Party without restriction prior to its receipt from Disclosing Party; (c) was obtained by Receiving Party from a third party that had no obligation of confidentiality; or (d) was publicly disclosed with the prior written approval of Disclosing Party; (e) was independently developed by or for Receiving Party without access to the Confidential Information. In the event Receiving Party is required to disclose any Confidential Information of the Disclosing Party pursuant to any valid order or requirement of a court, administrative agency, or other governmental body, Receiving Party will provide prompt written notice of such court order or requirement to Disclosing Party prior to making any disclosure to enable Disclosing Party to seek, at its sole cost and expense,  a protective order or prevent or restrict such disclosure.

The parties agree that unauthorized use of Confidential Information or other breach of confidentiality may cause irreparable harm for which remedies at law would be inadequate, and that a party is entitled to seek equitable relief, in addition to remedies at law. Upon any termination or cancelation of this Agreement, SOW, or similar ordering document for any reason, Service Provider will promptly (i) cease to further use or process any Nutanix Confidential Information, including any Personal Data (as defined below), and (ii) destroy or (if requested by Nutanix) return to Nutanix all data or information provided by or obtained from Nutanix, including Nutanix Confidential Information. This Section 9 supplements but does not replace any existing non-disclosure agreement by the parties, which is hereby incorporated by reference. 

10. SECURITY AND DATA PROTECTION REQUIREMENTS

10.1 Minimum Security. As applicable, Service Provider will, at a minimum, comply with the Service Provider Security Requirements, attached hereto as Attachment A, which are incorporated herein by reference, and shall provide to Nutanix all reasonably required information in order for Nutanix to ensure compliance therewith.

10.2 Data Protection. To the extent Service Provider receives, accesses, or otherwise processes any information relating to identified or identifiable individuals (“Personal Data”) from or on behalf of Nutanix in connection with the Agreement, Service Provider warrants that it will process such Personal Data solely to provide the Services specified in the Agreement or the applicable SOW, in accordance with the Data Processing Addendum (“DPA”) executed by the parties , and in compliance with all applicable laws and regulations. 

11. TERM AND TERMINATION

11.1 Term. This Agreement will take effect on the Effective Date and will continue in effect for one year (the “Term”) from unless terminated earlier in accordance with this Agreement. The Agreement shall thereafter automatically renew for successive one (1) year terms until terminated (in accordance with Section 11.2 below) by either party. The execution of an SOW after the expiration of this Agreement shall automatically extend the Term until the completion of the Services described in such SOW.

11.2 Termination for Convenience. Nutanix may terminate this Agreement or any SOW at any time by giving to Service Provider written notice of termination thereof at least fifteen (15) days prior to the date of termination. Termination of the Agreement will also serve to terminate any SOW in progress. Service Provider may terminate the Agreement at any time that there is no uncompleted SOW in effect by giving to Nutanix written notice of termination thereof at least thirty (30) days prior to the date of termination.

11.3  Termination for Cause. Nutanix is entitled to terminate this Agreement immediately if Service Provider: (i) commits a serious breach of any obligations owed to Nutanix under this Agreement; (ii) fails, or continues to fail, or refuses to provide the Services to the standards or time scales reasonably required by Nutanix; or (iii) acts in any way which materially prejudices the interests of Nutanix.

11.4. Return of Materials. When this Agreement expires or is terminated, Service Provider shall promptly return any Confidential Information and Personal Data in Service Provider's possession to Nutanix pursuant to SECTION 9 (CONFIDENTIAL INFORMATION AND PERSONAL DATA).

12. GENERAL PROVISIONS

12.1 No Publicity. Except to the extent that Service Provider obtains the prior written approval of Nutanix,  Service Provider will not directly or indirectly issue or permit the issuance of any publicity, press or news release, or other public statement concerning the relationship between the parties, this Agreement, any SOW, the terms hereof or thereof, or any of the transactions contemplated hereby or thereby; and will not use the name, trademarks, or service marks of Nutanix in any promotional materials. Any approval or consent given by Nutanix under this Agreement for any continued use may be revoked by Nutanix at any time by giving to Service Provider written notice of such revocation.

12.2 Force Majeure. Neither party shall be liable to the other for delayed performance caused by events outside of its reasonable control, including war, civil unrest, fire, earthquake or other natural disaster, provided that the party affected by such force majeure provides prompt notice of it to the other party and uses reasonable efforts to overcome its effects.

12.3 Assignment. Nutanix may assign this Agreement. Service Provider may not assign this Agreement or Service Provider’s rights, nor delegate Service Provider’s duties hereunder, without Nutanix’s prior written consent.

12.4 Entire Agreement. This Agreement (including the Attachments hereto which are incorporated herein by this reference) and any other documents expressly contemplated hereby constitute the entire agreement between the parties with respect to the subject matter hereof.

12.5 Severability. If any provision of this Agreement is for any reason held to be invalid, illegal, or unenforceable under applicable law in any respect, then this Agreement will be construed as if such invalid, illegal, or unenforceable provision were excluded from this Agreement.

12.6 Waiver. No waiver of any provision of this Agreement will be effective unless in writing and signed by the party against whom such waiver is sought to be enforced.

12.7 Amendment. This Agreement may only be amended, modified, or supplemented by an instrument in writing specifically mentioning this Agreement and signed by the party against whom such amendment, modification, or supplement is sought to be enforced.

12.8 Notices. Any notice, demand, request, or other communication required or permitted to be given under this Agreement (any “Notice”) will be made in writing and will be delivered by personal delivery (with notice deemed given when delivered personally), by overnight courier (with notice deemed given upon written verification of receipt) or by certified or registered mail, return receipt requested (with notice deemed given upon verification of receipt). Notices will be addressed to a party as provided in this Section or such other address as such party may request by notifying the other party (or parties) thereof in writing. Any notice to Service Provider will be addressed to the address indicated as such on the signature page hereto.

12.9  Specific Performance; Remedies Cumulative. Each party acknowledges that a breach of this Agreement cannot be adequately compensated for by money damages. Each arty  acknowledges that compliance with the provisions of this Agreement is necessary in order to protect the proprietary rights of each party. Each party further acknowledges that any unauthorized use or disclosure to any third party in breach of this Agreement will result in irreparable and continuing damage to the other party. Accordingly, each party hereby consents to the issuance of any injunctive relief or the enforcement of other equitable remedies against it at the suit of the injured party (without bond or other security), to compel performance of any of the terms of this Agreement, and waives any defenses thereto, including without limitation the defenses of failure of consideration, breach of any other provision of this Agreement, and availability of relief in damages. All remedies, whether under this Agreement, provided by law, or otherwise, shall be cumulative and not alternative.

12.10 Compliance.  Service Provider shall comply with all applicable Nutanix policies, which may be updated from time to time as well as with all applicable laws and regulations including those relating to anti-corruption, e.g. the U.S. Foreign Corrupt Practices Act and legislation implementing the OECD Convention on Combating Bribery of Foreign Public Officials in International Business Transactions.

12.11 Exhibits. The exhibits named below are incorporated by reference herein. Service Provider agrees to comply with the terms and conditions of the policies reflected by such exhibits as Nutanix may update them from time to time.

  • Service Provider Security Requirements (Attachment A)

12.12 Governing Law and Venue. This Agreement and any dispute or claim arising out of or in connection with it or its subject matter shall be governed and construed in accordance with the laws and under the exclusive jurisdiction of the competent courts as follows:

Nutanix contracting entity

Governing law

Courts with exclusive jurisdiction

Nutanix Inc.

State of California and controlling United States law

Federal or state courts located in San Francisco

Any other entity

The Netherlands

Amsterdam

ATTACHMENT A

Service Provider Security Requirements
Technical and Organizational Measures

Vendor shall implement the following minimum technical and organizational measures (including any relevant certifications) to ensure an appropriate level of security taking into account the nature, scope, context and purposes of the processing, and the risks for the rights and freedoms of natural persons:

Type of measure

Implemented measure

1. Measures of encryption of personal data

  • Encryption of the Nutanix data while at rest and in transit consistent with industry standards and at a minimum of 256-bit encryption.

2. Measures for ensuring ongoing confidentiality, integrity and resilience of processing systems and services

 

 

  • Confidentiality Obligations. Ensure employees are required to sign a confidentiality agreement when accepting a new hire offer and contractors who access the facilities and/or data required to sign a confidentiality or non-disclosure agreement.
  • Training. Implement and maintain security and privacy awareness training for all employees regarding the handling and securing of confidential information and Personal Data consistent with applicable law (including Applicable Privacy Law).
  • Remote access to systems must utilize secure applications, i.e. VPN. Access to remote resources must be authenticated using multiple authentication factors (MFA).
  • Identify appropriately defined organizational roles for security and incident response.
  • Include appropriate controls addressing (A) critical asset identification and asset management; (B) access controls and management; (C) physical and environmental security; (D) communications and operations security and management; (E) systems acquisition, development, and maintenance; (F) third-party risk management; (G) configuration and change management for software systems; (H) incident response, planning, and management, including appropriate maintenance, monitoring and analysis of audit logs; and (I) business continuity management and contingency planning/redundancy.
  • Segregation of the Nutanix data from all other third-party data.
  • Proper user authentication for all employees and contractors with access to the Personal Data, including, without limitation, by assigning each employee/contractor unique access credentials for access to any system on which the Personal Data can be accessed and prohibiting employees/contractors from sharing such access credentials.
  • Restrict and track access to the Nutanix data by only those employees/contractors whose access is necessary to performing the services and implement and maintain logging and monitoring technology to help detect and prevent unauthorized access attempts to networks and production systems. 
  • Conduct periodic reviews of changes affecting systems’ handling authentication, authorization, and auditing; and privileged access to production systems. 
  • Upon termination of any employee/contractor, ensure the terminated employee/contractor’s access to any Personal Data on Vendor’s systems will be immediately revoked.
  • If Vendor or any authorized person is granted access to or connects to any computing system, network, platform, facilities or telecommunications or other information system (the "Systems") owned, controlled, or operated by or on behalf of Nutanix or any of its Affiliates, then Vendor and any applicable authorized person will be subject to and shall comply with all then-current Nutanix policies, including without limitation, all security, privacy, safety, environmental, information technology, legal and business conduct policies. Any such access or connection to the Systems is strictly for the purpose of Vendor's performance of the Services under and in accordance with the Agreement. Vendor agrees that Nutanix may perform periodic network assessments, and should any such assessment reveal inadequate security by Vendor, Nutanix, in addition to other remedies it may have, may suspend Vendor's access to the Systems until such security issue has been eliminated.

3. Measures for ensuring the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident

  • Business Continuity Plan. Maintain internal practices, plans or procedures that are designed to reasonably ensure Vendor's products and services are uninterrupted during the term of the Agreement. 
  • Maintain: (i) periodic backups (including backup encryption) of production file systems and databases according to a defined schedule; and (ii) a formal disaster recovery plan for the production data center and conduct regular testing on the effectiveness of such plan.

4. Processes for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures in order to ensure the security of the processing

 

  • Regularly conduct internal security audits and contract annually for external security assessments and penetration tests of Vendor systems including, without limitation, cloud architecture, business processes and procedures, access controls and encryption measures.
  • Implement and maintain a risk assessment program to help identify foreseeable internal and external risks to Vendor’s information resources and determine if existing controls, policies, and procedures are adequate.
  • Vendor shall maintain records in accordance with ISO 27001, 27018 or similar applicable Information Security Management System ("ISMS") standards. Notwithstanding the foregoing, during the term of the Agreement, Vendor agrees to at a minimum maintain the following third-party certifications: PCI, SOC 1, Type II, SOC 2, Type II, ISO 27001, ISO 27017, ISO 27018, ISO 31000 and other certifications as appropriate.

5. Measures for user identification and authorisation

 

 

  • Proper user authentication for all employees and contractors with access to the Nutanix data, including, without limitation, by assigning each employee/contractor unique access credentials for access to any system on which the Nutanix data can be accessed and prohibiting employees/contractors from sharing such access credentials. 
  • Restrict and track access to the Nutanix data to only those employees/contractors whose access is necessary to performing the services and implement and maintain logging and monitoring technology to help detect and prevent unauthorized access attempts to networks and production systems. 
  • Conduct periodic reviews of changes affecting systems’ handling authentication, authorization, and auditing; and privileged access to production systems. 

6. Measures for the protection of Data during storage

  • Encryption at rest. See Section 1. above.
  • Multifactor authentication is enabled for user access to the production environment.
  • Not store the Nutanix data on any removable storage devices.

7. Measures for ensuring physical security of locations at which Nutanix data are processed

  • Establish limits on physical access to information systems and facilities using physical controls (e.g., coded badge access) that provide reasonable assurance that access to data centers is limited to authorized individuals. 
  • Install camera or video surveillance systems at critical internal and external entry points.
  • All access logs and cameras shall be monitored 24x7. Alerts to unauthorized access or activities are responded to immediately by a designated incident response team. Record retention shall be maintained for 6 months if permitted under applicable law.

8. Measures for ensuring events logging

 

 

  • All activities impacting the Nutanix data, the management of this data, and changes to access shall be logged and reviewed on a regular schedule for unauthorized access or activities. These logs shall be securely stored and processed by a security event and incident management system, which shall be configured to alert for suspicious or unauthorized activities 24x7. A designated team shall be responsible to manage and monitor these systems and logs.

9. Measures for ensuring system configuration, including default configuration

  • Implement and maintain policies and procedures for managing changes to production systems, applications and databases, including without limitation, processes for documenting testing and approval of changes into production, security patching, and authentication.

10. Measures for internal IT and IT security governance and management

  • Implement and enforce disciplinary measures against employees and contractors for failure to abide by its security policies and procedures.

11. Measures for certification/assurance of processes and products

  • All information security roles and responsibilities are defined and allocated. Minimization of opportunities for unauthorized or unintentional modification or misuse of assets and data.

12. Measures for ensuring data minimisation and accountability

  • Detailed privacy assessments are performed related to implementation of new products/services and processing of Nutanix data by Vendor and third parties. 
  • Security measures are in place to provide only the minimum amount of access necessary to perform required functions.
  • Data retention time limits restricted.

13. Measures for ensuring data quality

  • Exercise of rights.
  • Secure development environment. Development environments are protected from malicious or accidental development and update of code that may create vulnerabilities or compromise confidentiality, integrity, and availability of the platform