Search

DacuSign Envelope ID: 6BE73965-BAEF-4791-B930-DABA9714DC55

DARKTRACE

Appendix 2: Data Processing Agreement

1, DEFINITIONS. For the purposes of this DPA, the terms defined in this Appendix shall have the meanings as set forth in the
Agreement. Any terms not specifically defined by this DPA or the Agreement shall have the meaning given by GDPR.

2. SUBJECT MATTER OF THE DATA PROCESSING AGREEMENT

2.1 This Data Processing Agreement (“DP4”) applies to the processing of Customer Personal Data under the Agreement.

2.2 Customer will be the Data Controller and Darktrace will be the Data Precessor as defined under GDPR. Each Party agrees
that it shall comply with its obligations as a Data Controller and a Data Processor, respectively under the Data Privacy Laws
in exercising its rights and performing its obligations under this Agreement.

2.3 This DPA is an Appendix to the Agreement.

3. NATURE AND PURPOSE OF PROCESSING REGULATED DATA

3.1 The Data Processor shall process Personal Data in order to provide the Support Services as set forth in the Support
Services Datasheet.

3.2 In the event that the Data Controller has purchased Antigena Email, the additional data protection provisions of the
Antigena Email Schedule shall apply and be incorporated into this OPA.

4, TYPES AND CATEGORIES OF PERSONAL DATA
41 Categories of Data Subjects.
Employees inciuding volunteers, agents, temporary workers, independent contractors;
Contractors
- Customer clients, prospects
Suppliers, vendors
Advisors, consultants and other professional experts
Customer officers, directors
- And any other categories of Data Subjects that may be contained in the Data Controller's network.
4.2 Types of Personal Data:
- IP addresses
- Host names
- File names
- Email addresses
- And any other types of Personal Data that may be contained in the Data Controller's network.
5. RIGHTS AND OBLIGATIONS OF THE CONTROLLER

5.1 The Data Controller hereby instructs the Data Processor to take such steps in the processing of Personal Data as are
reasonably necessary for the performance of the Data Processor’s obligations under the Agreement, and agrees that such
instructions, comprising the terms of this DPA and the Agreement, constitute its full and complete instructions as to the
means by which Personal Data shall be processed by the Data Processor.

6. RIGHTS AND OBLIGATIONS OF THE PROCESSOR

6.1 The Data Processor shall only process Personal Data in accordance with the Data Controller's written instruction as
specified herein and shail not use Personal Data except to deliver the Offering and the Services as instructed by the
Agreement, unless such processing is required by Jaw to which the Data Processor is subject, in which case the Data
Processor shall, to the extent permitted by law, inform the Data Controller of that legal requirement prior to carrying
out the applicable processing.

6.2 The Data Processor shall immediately inform the Data Controller if, in the Data Processor’s reasonable opinion, an
instruction from the Data Controller infringes the Data Privacy Laws.

6.3 The Data Processor shall not transfer Personal Data outside the European Economic Area (“EEA”) without the prior
written consent of the Data Controller and not without procuring provision of adequate safeguards (as defined by the
European Commission from time to time);

6.4 In the event that the UK ceases to be a member of the European Union or ceases te be considered by the European
Commission to be an adequate country pursuant to Article 45 of GDPR, then the parties agree that Darktrace shall apply
the EU Model Clauses as set out at https://www.darktrace.com/en/resources/legal-customer-model-clauses.pdf, to
any relevant transfer of data and such EU Model Clauses shall be deemed incorporated from the date of first transfer.

6.5 The Data Processor shall take reasonable steps to ensure the reliability of its agents and employees who have access to

any Personal Data.

V01.04.2020 MCA SHRINKWRAP 13

DocuSign Envelope ID: 6BE73965-BAEF-4791-B930-DABA9714DC055

re

&.

a

11.

12.

‘g° DARKTRACE

SECURITY

71

Taking into account the nature, scope, context and purposes of processing, the Data Processor has implemented
and will maintain the administrative, physical, technical and organisational measures as described in the Darktrace
Information Security Policy to protect any Personal Data accessed or processed by it against unauthorised or unlawful
processing or accidental loss, destruction, damage or disclosure. The parties agree that for the purposes of the
processing hereunder, the measures contained within the Darktrace Information Security Policy are appropriate, given
the nature of the data to be processed and the harm that might result from such unauthorised or unlawful processing
or accidental loss, destruction, disclosure, access or damage.

PERSONAL DATA BREACH NOTIFICATION

8.1

In the event that the Data Processor suffers a Personal Data Breach, the Data Processor shall inform the Data Controller
within twenty-four (24) hours upon learning of the same and reasonably cooperate with the Data Controller to mitigate
the effects and to minimise any damage resulting therefrom. To the extent reasonably possible, the notification to the
Data Controller shall include: (i) a description of the nature of the incident, including where possible the categories and
approximate number of data subjects concerned and the categories and approximate number of Personai Data records
concerned; (ii) the name and contact details of the Data Processor’s data protection officer or another contact point
where more information can be obtained; (iii) a description of the likely consequences of the incident; and {iv} a
description of the measures taken or proposed to be taken by the Data Processor to address the incident including,
where appropriate, measures to mitigate its possible adverse effects

SUBPROCESSORS

9.1

9.2

9.3

Save as expressly provided herein, the Data Processor will not use subprocessors for the processing of Personal Data.
For the purposes of providing Support Services alone: (i) The Data Controller hereby authorises the Data Processor to use
its affiliates specified in the Support Services Datasheet to process Personal Data (the “Affiliate Subprocessors”}; (ii} The
Data Processor shall have in place with the Affiliate Subprocessors a written agreement equivalent to the terms contained
herein to protect Personal Data; and (iii) The EU Model Clauses shall appiy to the extent the processing of Personal Data
by the Affiliate Subprocessors involves a transfer of Personal Data which originates in the EEA to a third country outside
of the EEA. For such purposes, the Data Controller hereby authorises the Data Processor to enter into the EU Model
Clauses with the Affiliate Subprocessors on the Data Controller's behalf.

Save for the foregoing, the Data Processor shall not engage any subprocessors without the prior written authorisation of
the Data Controller. In the event that the Data Controller authorises the use by the Data Processor of any other
subprocessors, the Data Processor shall procure that such subprocessors enter into a written agreement containing
provisions no less stringent than this DPA.

The Data Processor shall be fully liable for any breach by the subprocessors of any data protection obligations set
out in this Clause.

ASSISTANCE WHEN HANDLING REQUESTS FROM DATA SUBJECTS

10.1

AUDIT
11.1

Taking into account the nature of processing and the information available to the Data Processor, the Data Processor will
provide reasonable support to the Data Controller: (i) in complying with any legally mandated request for access to or
correction of any Personal Data by a data subject under Chapter III GDPR (and where such request is submitted to the
Data Processor, the Data Processor will promptly notify the Data Controller of it); (ii) in responding to requests or
demands made to the Data Controller by any court or governmental authority responsible for enforcing privacy or data
protection laws; or (iii) in its preparation of a Data Protection Impact Assessment.

The Data Processor agrees to maintain ISO 27001 certification for the duration of the Term. The Data Processor will use
an external auditor to verify that its security measures meet ISO 27001 standards in accordance with the ISO certification
process. On the Data Controllers written request, and subject to appropriate confidentiality obligations, the Data
Processor will make available to the Data Controller: (i} a copy of the current certificate in relation to the [SO 27001
certification; and (ii) Information reasonably requested by the Data Controller in writing with regards to the Data
Processor’s processing of Personal Data under this DPA. The Data Controller agrees to exercise any right it may have to
conduct an audit or inspection under GDPR (or the EU Model Clauses if they apply) by requesting the foregoing
information.

RETURN/DESTRUCTION OF PERSONAL DATA

12.1

Upon termination of the Agreement, the Data Processor shall delete or return all Personal Data in accordance with the
Data Controller’s written instructions.

V01.04.2020 MCA SHRINKWRAP 14

DocuSign Envelope ID- 6BE73965-BAEF-4791-B930-DABA97 14DC55

Appendix 3: Darktrace Insurance

VG1.04.2020 MCA SHRINKWRAP

‘ DARKTRACE

15

DocuSign Envelope ID- 6BE73965-BAEF-4791-B930-DABA97 140055

@8 MARSH

9" December 2021
To whom it may concern

Dear Sirs

Ishe Mugwira
Client Adviser

Marsh Ltd

Milton Keynes (PO Box}
Milton Keynes Postal Address:
PO Box 3264

NR7 7BH

+44 (0} 1908 846029

Ishe. Mugwia@marsh.com

www.marsh.com

CONFIRMATION OF INSURANCE - Darktrace PLC and Subsidiaries

As requested by the above client, we are writing to confirm that we act as Insurance Brokers to the client and that we
have arranged insurance(s) on its behalf as detailed below:

PROFESSIONAL INDEMNITY &

INSURER:

POLICY NUMBER:

PERIOD OF INSURANCE:

LIMIT OF LIABILITY:

DEDUCTIBLES:

GEOGRAPHICAL LIMITS

EMPLOYERS LIABILITY

INSURER:

POLICY NUMBER:

PERIOD OF INSURANCE:

LOSS LIMIT:

DEDUCTIBLES:

CYBER LIABILITY

American Intemational! Group

0034033810

1 December 2021 te 30 November 2022, both dates inclusive

Blended Professional Indemnity and Cyber Liability - GBP Smillion in the
aggregate.

GBP 350,000 each and every claim or loss and 12 hour waiting period (Network
Interruption).

Worldwide

CHUBB European Group SE
UKINTC92535.
1 December 2021 to 30 November 2022, both dates inclusive

GBP 10,000,000 per occurrence
GBP 5,000,000 per occurrence {Terrorism)

NIL

DocuSign Envelope ID: 66E73965-BAEF-4791-B930-DABA97 140055

a

TERRITORIAL LIMITS

PUBLIC & PRODUCTS LIABILITY
INSURER:

POLICY NUMBER:

PERIOD OF INSURANCE:

LOSS LIMIT:

DEDUCTIBLES:

TERRITORIAL LIMITS

Great Britain, Northern Ireland, ihe Isle of Man, the Channel Islands, Republic of
Ireland and elsewhere in the world in respect of any employee whilst temporarily
outside of these territories provided that such employee normally resides within
the territorial limits stated above

CHUBB European Group SE

UKINTC92535

1 December 2021 to 30 November 2022, both dates inclusive

Public Liability - GBP 15,000,000 per occurrence

Products Liability - GBP 15,000,000 per occurrence and in the aggregate
Pollution & Contamination - GBP 15,000,000 in the aggregate

GBP $00 Third Party Property Damage

Worldwide excluding Cuba and sanctioned territories

This letter is issued as a matter of information only and confers no right upon you other than those provided by the
policy. This letter does not amend, extend or alter the coverage afforded by the policies described herein.
Notwithstanding any requirement, term or condition of any contract or other document with respect to which this letter
may be issued or pertain, the insurance afforded by the policy (policies) described herein is subject to all terms,
conditions, limitations, exclusions and cancellation provisions and may also be subject to warranties. Limits shown may

have been reduced by paid claims.

We express no view and assume ne liability with respect to the solvency or future ability to pay of any of the insurance
companies which have issued the insurance(s).

We assume no obligation to advise yourselves of any developments regarding the insurance(s} subsequent to the date
hereof. This letter is given on the condition that you forever waive any fiability against us based upon the placement of
the insurance(s) and/or the statements made herein with the exception only of wilful default, recklessness or fraud.

This letter may not be reproduced by you or used for any other purpose without our prior written consent.

Financial Conduct Authority.

Registered in England and Wales Number: 1507274, Registered Office: 1 Tower Place r y MARSH & MCLENNAN
West, Tower Place, London EC3R 5B). Marsh Lid is authorised and regulated by the Be

© Copyright 2020 Marsh Ltd. All rights reserved.

DocuSign Envelope ID: 6BE73965-BAEF-4791-8930-DABA97 14DC55

@8 MARSH

This letter shall be governed by and shall be construed in accordance with English law.
Yours faithfully,
she Muciwira

Ishe Mugwira
Client Adviser

Registered in England and Wales Number, 1507274, Registered Cffice; 1 Tower Place MARSH & MCLENNAN
West, Tower Place. London EC3R SEU Marsh Lidis authorised and regulated by the COMPANIES
Financial Conduct Authority.

© Copyright 2020 Marsh Lid. All rights reserved.

ro 4 THE CITY OF NASHUA "The Gate City”

Office of Econonie Developnrent

TO: Board of Aldermen

FROM: Tim Cummings, Economic Development Director
Date: May 17" 2022

RE: ARPA Funding Framework

Request

| am writing to request a meeting to discuss and approve the enclosed framework for spending
based on the funding that came in through the American Recovery Plan Act (“ARPA”).

Background

Municipalities across the nation are the beneficiaries of a significant influx of federal funds via
the American Rescue Plan Act (*ARPA”). The City of Nashua will receive $16,138,777 in total
ARPA funds. The first of two installment payments of $8,069,388.50 was received in May of
2021. We anticipate receiving the second installment this month (May 2022). The Board of
Aldermen have already accepted and appropriated these funds through the adoption of R-21-167
at its meeting on November 9, 2021.

Over the past six months, the Office of Economic Development with the assistance of Financial
Services and the Office of the Mayor undertook a community outreach effort to discuss an
appropriate framework. We offered residents an opportunity to provide feedback on the draft
framework for spending ARPA funding and we first presented to the Board of Aldermen in
September of 2021.

Additionally, we brought on iParametrics to help guide our decision-making and to assist in the
compliance reporting.

Financing Mechanics

Based on the advice of our consultant it is their recommendation that the City use “revenue
replacement” for the ARPA funds. Revenue Replacement is a category a local government may
use to expend ARPA money on a board range of general government services. We anticipate that
the City of Nashua through the U.S Treasury guidance will be eligible to spend the entire ARPA
allocation through this method. As noted above, the City of Nashua accepted and appropriated
these funds as a grant. Accordingly, this grant will not lapse and the funds will be available for
the planned expenditures detailed in the enclosed attachment.

Thank you.

229 Main Street, Suite 234 » Nashua, New Hampshire 03060 * Phone (603) 589-3106

ARPA PLAN 5/10/2022
FISCAL YEAR 2022 SeceiVERetroas FISCAL YEAR 2024 FISCAL YEAR 2025
PROJECT CATEGORY (01/01/22 - (07/01/22- 06/30/23) (07/01/23 - (07/01/24 - 12/31/24) 6 TOTAL
06/30/22) 06/30/24} Mths

REVENUE REPLACEMENT FY ‘22 $ 1,200,000.00 $ 1,200,000.00

HOUSING TRUST FUND $ 10,000,000.00 $ 10,000,000.00
MUNICIPAL CAPITAL REQUESTS

BACK-UP SERVER (iT) $ 500,000.00 $ 500,000.00

FIRE EQUIPMENT / ALARM $ 850,000.00 $ 850,000.00

POLICE - RECORD MANAGEMENT & GATE $ 650,000.00 $ 650,000.00

INFRASTRUCTURE PROJECTS
MAIN STREET & WEST HOLLIS STREET $ 600,000.00 $ 600,000.00
LIBARARY PARK PROJECT $ 1,500,000.00 $ 1,500,000.00
OPITCON SYSTEM $ 600,000.00

ARPA PROGRAM SUPPORT $ 15,000.00 $ 35,000.00 $ 75,000.00 $ 75,000.00 $ 200,000.00

TOTAL $ 1,215,000.00 $ 14,735,000.00 § 75,000.00 § 75,000.00 $ 16,100,000.00

POTENTIAL ARAPA FUNDS $ 16,138,777.00

PROJECTED SPENDING $ 16,100,000,00

BALANCE $ 38,777.00

Nashua Arts Commission

Joseph Olefirowicz
35 Newbury Street
Nashua, NH 03060

Deanna Hoying
361 Whitford Street
Manchester, NH 03104

Lauren Spira-Savett
39 Coburn Avenue
Nashua, NH 03063

Cultural Connections Committee

Claudia Decker
59 Rebinson Road
Hudson, NH 03051

APPOINTMENTS BY THE MAYOR

MAY 24, 2022

Term to Expire

Term to Expire

Term to Expire

Term to Expire

> May 31, 2025

: May 31, 2025

: May 31, 2025

: May 24, 2025

| respectfully request that these appointments be confirmed.

Jim Denchess, Mayor

R-22-036

RESOLUTION

AUTHORIZING PENNICHUCK CORPORATION TO RENEW AND EXTEND ITS
LINE OF CREDIT WITH TD BANK, N.A.

CITY OF NASHUA

In the Year Two Thousand and Twenty-Two

WHEREAS, the City of Nashua is the sole shareholder of Pennichuck Corporation
(“Pennichuck”) and each of its subsidiaries:

WHEREAS, Article IX (3) of the Articles of Incorporation of Pennichuck and Article V
§2 of the by-laws of Pennichuck require the approval of the sole shareholder (the City of
Nashua) for Pennichuck to create, incur or assume any indebtedness for borrowed money, which
includes contracting a loan or line of credit on behalf of Pennichuck or its subsidiaries; and

WHEREAS, Pennichuck requests the City’s authorization to renew and extend its
existing Line of Credit, which will expire on June 30, 2022, with a new two-year Line of Credit,
at the current limit of $4 million, This line of credit facility will continue to be used for working
capital purposes.

NOW, THEREFORE, BE IT RESOLVED, that the City hereby authorizes the renewal
of Pennichuck Corporation’s existing line of credit facility, allowing for borrowing by
Pennichuck Corporation under its line of credit, in the aggregate principal amount of up to
$4,000,000.00 from TD Bank, N.A., pursuant to a senior line of credit facility (the *LOC
Facility”), for the purpose of providing advances to be used for general corporate purposes.