Information Technology Professional Services Agreement 
THIS INFORMATION TECHNOLOGY PROFESSIONAL SERVICES AGREEMENT is made by and  between Cornell University, a New York not-for-profit education corporation, ("Cornell") on behalf of its ________________________ (“College/Unit”), and _____________________________________ ("Consultant"). 
For good and valuable consideration, the parties agree as follows: 
1. General Purpose. The general purpose of this Agreement is to engage the services of Consultant to perform  the services described in Schedule A (the “Services”). 
2. General Duties of Consultant. Consultant shall perform the Services in conformance with the attached  Schedules, all of which are incorporated herein, and in conformance with professional standards for performing  services of a similar kind. Whether or not Consultant’s performance of the Services, or any part or segment thereof,  conforms with such standards shall be determined solely by Cornell. Cornell has assigned a representative ("Cornell's  Representative") in relation to this Agreement and the Services, as named in Schedule A, to provide direction to  Consultant. The Services to be performed by Consultant shall be performed by the personnel listed in Schedule D.  Consultant may not replace or reassign such personnel without the prior written consent of Cornell. If any such  personnel leave Consultant's employ, Consultant shall replace personnel with a person having at least equivalent  experience and qualifications. Cornell shall have the right to review and approve such replacement personnel. 
3. Term. The term of this Agreement shall be from , 20 until , 20 . 
4. Timetable. The timetable set forth in Schedule B shall be adhered to unless such period is otherwise extended  by Cornell in writing. Consultant shall be responsible to Cornell for any damage caused by its failure to comply with  the timetable. 
5. Compensation. Consultant shall be paid an amount not to exceed $ . The payment terms  and schedule of payments is set forth in Schedule C. All invoices shall be mailed to Cornell Procurement and Payment  Services, Accounts Payable, 377 Pine Tree Road, Ithaca, N.Y. 14850 or emailed to dfa-4040_invoice@cornell.edu, referencing the purchase order number. 
6. Independent Contractor. In the performance of the Services hereunder, Consultant shall be deemed an  independent contractor and not an employee of Cornell. Consultant is not an agent of Cornell, nor is it authorized to  transact business, enter into agreements, or otherwise make commitments on behalf of Cornell unless expressly  authorized in writing by an officer of Cornell. Cornell will not pay or withhold federal, state, or local income tax or  other payroll tax of any kind on behalf of Consultant or its employees. Consultant is not eligible for, not entitled to,  and shall not participate in any of Cornell's pension, health, or other benefit plans. Consultant is responsible for the  payment of all required payroll taxes, whether federal, state, or local in nature, including, but not limited to income  taxes, Social Security taxes, Federal Unemployment Compensation taxes, and any other fees, charges, licenses, or  payments required by law. Consultant indemnifies Cornell, and its agents, officers, employees and trustees, and holds  each harmless against any fines, damages, assessments, or attorney fees in the event a court or administrative agency  shall find that Consultant or anyone or entity engaged through Consultant is an employee of Cornell. 
7. Confidentiality. All data, material, books, records and information in any format or medium (including  provided orally) submitted or made available to Consultant by Cornell, or any other person acting on behalf of Cornell (collectively, “Cornell Data”), unless otherwise publicly available, and all data and information, and other work  developed by Consultant under this Agreement, shall be utilized by Consultant solely in connection with the  performance of the Services under this Agreement only and shall not be made available by Consultant to any other  person unless required by law. In the event of a breach of this Section 7, Cornell shall have all rights available to it  at law and in equity to enforce the provisions hereof including, but not limited to, applying to a court of competent  jurisdiction for specific performance and/or injunctive relief. The obligations of this Section 7 shall expressly survive  the expiration or earlier termination of this Agreement.
Page 1 of 13 
Attach to Requisition or Purchase Order Version: 12/01/2021 

8. Rights and License in and to Cornell Data. Cornell shall own all data, information, and other work product  developed or obtained by Consultant pursuant to this Agreement. Cornell shall at all times have access to review the  ongoing work of Consultant for purposes of inspecting the same and determining that the Services are being performed  in accordance with the terms of this Agreement. Immediately upon termination of this Agreement for any reason, all  such data, information, and other work, in whatever form, including all Cornell Data, shall be turned over to Cornell. 
The parties agree that as between them, all rights including all intellectual property rights in and to data and  information provided by Cornell or on behalf of Cornell (including Cornell Data) or created by Consultant in the  performance of the Services hereunder shall remain the exclusive property of Cornell. Consultant has a limited,  nonexclusive license to use such data and information solely for the purpose of performing its obligations under this  Agreement. This Agreement does not give Consultant any rights, implied or otherwise, data, information, or  intellectual property, except as expressly stated in this Agreement. 
For purposes of this Agreement any copyrightable work ("Work") developed in the course of Consultant’s  performance under this Agreement shall be deemed "work made for hire" under federal copyright law and all  ownership rights to such Work shall belong to Cornell. Should such Work not constitute a "work made for hire" under  copyright law, Consultant hereby grants, transfers, assigns, and conveys to Cornell and its successors and assigns, the  entire right, title, and interest in the Work or any part thereof, including but not limited to the right to reproduce,  prepare derivative works, distribute by sale, license or other transfer, perform publicly, display, and to secure  copyrights or patents and renewals, reissues, and extensions of any such copyrights or patents in the United States of  America or any foreign country. 
Any patentable invention conceived or reduced to practice in the course of Consultant’s performance under  this Agreement shall be the property of Cornell, and Cornell has the right to secure patents, reissues and extensions of  thereof in the United States of America or any foreign country. 
Whether a copyright or patent in the Work will be maintained or registered in the United States of America  or any foreign country shall be at the sole discretion of Cornell. 
Consultant agrees to cooperate fully with Cornell in the preparation and execution of all documents necessary  or incidental to the assignment in this Section 8 and the protection and preservation of rights herein granted to Cornell.  The obligations of this Section 8 shall expressly survive the expiration or earlier termination of this Agreement. 
9. Warranties. Consultant warrants and represents that the Services and all work provided hereunder will not  infringe, individually or collectively, any patent, copyright, trade secret, or other proprietary right of any third party;  and Consultant has no reason to believe that any patent, copyright, trade secret, or other proprietary right of any third  party may be infringed by it providing the Services and any work hereunder. 
10. Data Privacy. Performance of the Services under this Agreement may entail the disclosure to Consultant of  personally identifiable information from student education records protected by the Family Educational Rights and  Privacy Act (FERPA) ("Student Information"). Consultant acknowledges that for the purposes of this Agreement, it  will be designated as a “school official” with “legitimate educational interests” in the Student Information, as those  terms have been defined under FERPA and its implementing regulations, and Consultant agrees to abide by the  limitations and requirements imposed by 34 CFR 99.33(a) on school officials. Consultant will use Student Information  only for the specific purpose of fulfilling its obligations under this Agreement. Consultant may not disclose Student  Information to or share any Student Information with any other party or for any other purpose without the prior written  consent of the student. By way of illustration and not of limitation, Consultant will not use such information for  Consultant’s own benefit or engage in “data mining” of Cornell Data or communications, whether through automated  or human means, except as necessary to fulfill its specific obligations under this Agreement. The provisions of this  section will be applicable to any subcontractors or agents to whom Consultant may release Student Information in  order to perform the Services under this Agreement. Consultant agrees that prior to releasing any Student Information  to any subcontractor or agent, Consultant will require such subcontractor or agent to acknowledge its obligations as a  "university official" and to agree to comply with the FERPA requirements articulated in this section. Improper re disclosure of Student Information can result in Consultant being denied access to such information for at least 5 years.  Consultant shall return or certify destruction of all Student Information (including that provided to or obtained by its  subcontractors or agents) upon termination of this Agreement. 
Consultant will provide access to Cornell Data only to those Consultant employees, subcontractors and agents  who need to access the data to fulfill Consultant’s obligations under this Agreement.
Page 2 of 13 
Attach to Requisition or Purchase Order Version: 12/01/2021 

11. Data Security. All facilities and other resources used to store and/or process Cornell Data will employ  reasonable and appropriate administrative, physical, and technical safeguards to secure such data from unauthorized  access, disclosure, alteration, and use. Such measures will be no less protective than those used to secure Consultant’s  own data of a similar type, and in no event less than reasonable in view of the type and nature of the data involved. 
Consultant will use industry-standard and up-to-date security tools and technologies such as anti-virus  protections and intrusion detection methods in providing the Services under this Agreement. Consultant will update  its tools and technologies during the course of this Agreement as industry standards change and updated tools and  technologies become available. 
Consultant will ensure that its employees, subcontractors and agents who perform work under this Agreement  receive appropriate instruction as to how to protect data consistent with the provisions of this Agreement. Consultant  will perform background checks on all personnel who have potential to access Cornell Data. Background checks will  be performed in accordance with the Fair Credit Reporting Act and will, at a minimum, include Social Security  Number validation and trace or foreign equivalent, seven (7) year felony and misdemeanor criminal records of federal,  state, or local courts, Office of Foreign Assets Control List (OFAC), Bureau of Industry and Security List (BIS) and  Office of Defense Trade Controls Debarred Persons List (DDTC). 
 Consultant agrees to locate all servers and related equipment and infrastructure used to provide the Services and to store and/or process Cornell Data in the United States 
12. Access to Data Response to Legal Demands or Requests for Data. Cornell shall have the right, at all times  during the term of this Agreement for any reason whatsoever in Cornell's sole discretion, to access, copy and/or remove  any and all Cornell Data and information from Consultant. In addition, in connection with Cornell's response to an e discovery request or other legal proceeding, governmental request, or other a claim or demand upon receipt of written  
request from Cornell, Consultant will provide Cornell with any existing logs or other Cornell Data and information. If Consultant files a petition seeking to take advantage of any law relating to the bankruptcy or insolvency or  is adjudicated to be bankrupt, or is the subject of a petition seeking liquidation, reorganization, winding-up, dissolution  or adjustment of indebtedness, or if becomes insolvent or makes an assignment for the benefit of creditors or if a  receiver is appointed, Consultant will return in a readily usable format, remove, or destroy, as directed by Cornell, all  Cornell Data and information. 
Upon receipt of valid legal process (the “Legal Request”) seeking Cornell-related information and/or Cornell Data, Consultant will attempt to redirect the requesting third party to Cornell and/or request that the third party notify  Cornell of its Legal Request. If Consultant’s redirecting efforts are unsuccessful, and provided Consultant is not  prohibited by law from doing so, Consultant will provide commercially reasonable notice to Cornell of the Legal  Request, prior to disclosure of any Cornell information and/or Cornell Data, which would include, to the extent  permitted by law, a copy of the Legal Request received by Consultant from the third party. Consultant will thereafter  respond to the Legal Request in the time permitted unless Cornell has taken appropriate legal steps (i.e., Motion to  Quash or Motion for a Protective Order) to stop or limit Consultant’s response. 
With respect to any legal process served on Cornell for which Cornell intends to respond, Consultant will  provide Cornell with access to any Cornell information and/or Cornell Data in Consultant's possession together with  any necessary encryption keys. If Cornell is unable to access any Cornell information and/or Cornell Data using the  tools and documentation provided by Consultant, then, upon request, Consultant will provide commercially reasonable  assistance to enable Cornell to obtain the Cornell information and/or Cornell Data. 
13. Security Incident Response. Upon becoming aware of any unauthorized access to any Cornell Data stored  on Consultant’s equipment or in Consultant’s facilities, or unauthorized access to any equipment or facilities  reasonably expected to result in loss, disclosure, or alteration of Cornell Data (each a “Security Incident”), Consultant  will: (1) promptly notify Cornell at security@cornell.edu of the Security Incident; (2) investigate the Security Incident  and provide Cornell with detailed information about the Security Incident; (3) take reasonable steps to mitigate the  effects and to minimize any damage resulting from the Security Incident; (4) take prompt and appropriate corrective  action aimed at preventing the reoccurrence of a similar Security Incident in the future; and (5) hold Cornell harmless  from any costs associated with a data breach attributable to the actions or inactions of Consultant, which costs shall  include, but not be limited to, the mailing of legally required notices, providing credit monitoring, and  governmental/regulatory fines and penalties that may be due and owing. The foregoing costs shall be deemed direct  damages, not consequential damages or otherwise. 
Page 3 of 13 
Attach to Requisition or Purchase Order Version: 12/01/2021 

14. Data Transfer Upon Termination or Expiration. Upon expiration or termination of the Services,  Consultant will deliver to Cornell all work performed under this Agreement and return to Cornell in a readily usable  format, remove, or securely delete or destroy, as directed by Cornell, all Cornell Data. 
15. Termination. Cornell may terminate this Agreement at any time without cause, upon written notice to  Consultant or immediately for non-performance. Consultant shall be entitled to payment for work performed to the  satisfaction of Cornell prior to termination, but explicitly waives any right to additional or other amounts of any kind,  including based on quantum meruit or other similar theory. Personnel identified by Cornell as deficient will be  removed in a manner to least affect the progress of the Services. 
16. Indemnification. Consultant shall release, defend, indemnify, and hold harmless Cornell and its trustees, officers, agents, and employees from all suits, actions, or claims of any character, name, or description, including  reasonable attorneys’ fees and litigation expenses, brought on account of any injuries, damage or loss (real or alleged)  received or sustained by any person, persons or property, arising out of (1) negligent acts or omissions of Consultant,  its employees, subcontractors or agents, including, but not limited to any claims for personal injury, including any  injuries or damages sustained by Consultants' employees or for property damage; (2) claims of infringement of  copyright, patent, or other proprietary rights; or (3) any other claims of any nature whatsoever arising out of the  Consultant’s performance of the Services to be provided pursuant to this Agreement, or Consultant's failure to perform  or comply with any requirements of this Agreement, including, but not limited to, employment-related claims arising  under the common law or based upon any federal, state, or local statutes, ordinances, or regulations. Cornell reserves  the right to retain whatever funds which would otherwise be due Consultant under this Agreement until such suits,  action or actions, claim or claims for injuries or damages as aforesaid shall have been settled and satisfactory evidence  to that effect furnished. The obligations of this Section 16 shall expressly survive the expiration or earlier termination  of this Agreement. 
17. Insurance. Consultant shall procure and maintain, at its sole cost and expense, the insurance coverages set  forth below during the term of this Agreement:  
a. Statutory Workers’ Compensation Insurance under the laws of the State of New York and any  other laws that may be applicable thereto. Coverage “B,” Employer’s Liability, must have limits of at least $1,000,000  per accident for bodily injury and disease. 
(This coverage is required for all consultants unless they are exempt under the laws of New York State or other  applicable jurisdiction. Coverage from other states may be substituted by individuals who are residents of other states  but working on a temporary basis in New York State. Individuals providing Services on harbor fronts or over the water  should provide proof of US Longshoremen and Harbor Workers insurance and/or Jones Act insurance.) 
b. Commercial General Liability Insurance: subject to at least limits of $1,000,000 each occurrence  and $2,000,000 aggregate. Coverage must be provided for bodily injury liability, broad form property damage  liability, and contractual liability and products and completed operations coverage. Completed operations coverage is  to be maintained for a minimum period of three (3) years after completion of this Agreement. The policies shall be  primary and non-contributory. Cornell shall be included as an additional insured in the policy utilizing additional  insured endorsements CG 20 10 07 04 and CG 20 37 07 04 or their equivalents. (Coverage shall not contain exclusions  for claims related to (New York) labor law. Consultant must expressly hold harmless, defend and indemnify Cornell  as an additional insured for any suits referencing or seeking recovery under New York Labor Law §§ 200, 240, 240(1),  241, 241(6) and any related sections, and their insurance certificate or accompanying letter from an Authorized  Representative must specifically state the same.) 
c. Automobile Liability Insurance: subject to limits of not less than $1,000,000 combined single limit  for each accident. Such Automobile Liability Insurance shall be for all owned, non-owned, and hired automobiles. (Cornell requires limits of $5,000,000 for any bus charter-related services. Aircraft or watercraft travel that is not a  ticketed event (e.g. charters) requires higher insurance limits and pre-approval from Cornell Risk Management and  Insurance.) 
d. Umbrella/Excess Liability Insurance: subject to limits of not less than $5,000,000 per occurrence  and follow-form of the primary Commercial General Liability, Automobile Liability, and Employers Liability policies.  These policies shall contain an endorsement stating that any entity qualifying as an additional insured on the insurance  stated in the Schedule of Underlying Insurance shall be an additional insured on the Umbrella/Excess liability policy  and that they apply immediately upon exhaustion of the insurance stated in the Schedule of Underlying Insurance as  respects to the coverage afforded to any additional insured. 
e. All Risk Property Insurance: providing replacement cost coverage for any property damage to 
Page 4 of 13 
Attach to Requisition or Purchase Order Version: 12/01/2021 

Consultant’s property which is caused by a loss of any kind and description to any property brought onto Cornell  University premises. Consultant agrees to waive on behalf of itself and its insurance company subrogation against  Cornell for any loss or damage, which is covered or should be covered by this insurance. 
f. Professional Liability/Errors & Omissions: subject to $1,000,000 per claim/$3,000,000 aggregate  covering the activities of the Consultant. The coverage must be maintained during the term of the agreement and at  least three (3) years following its completion. Consultant’s policy will provide a carve-back to the “Insured versus  Insured” exclusion for claims brought by or on behalf of additional insureds. 
g. Crime Insurance (based on scope of work): with a minimum of $1,000,000 per occurrence. h. Cyber and Technology Products & Services Liability Insurance: (based on scope of work) with  limits of not less than $5,000,000 for each wrongful act, that provides coverage for: 
1) Liability for network security failures or privacy breaches, including loss or unauthorized access, use or  disclosure of Cornell Data, whether by Consultant or any of subcontractor or cloud service provider  used by Consultant; 
2) Costs associated with a privacy breach, including notification of affected individuals, customer support,  forensics, crises management/public relations consulting, legal services of a privacy attorney, credit  monitoring and identity fraud resolution services for affected individuals; 
3) Expenses related to regulatory compliance, government investigations, fines, fees/assessments and  penalties; 
4) Liability for technological products and services; 
5) PCI fines, fees, penalties and assessments; 
6) Cyber extortion payment and response costs; 
If the Cyber Liability policy is written on a claims-made basis and non-renewed at any time during and up  until the expiration or earlier termination of this Agreement, Consultant shall purchase an Extended Reporting Period  for at least a two-year period. Consultant’s policy will provide a carve-back to the “Insured versus Insured” exclusion  for claims brought by or on behalf of additional insureds. 
Other Requirements 
a. The limits of insurance stated above for each type of insurance are minimum limits only; in the event that any  policy provided by Consultant provides limits greater than those stated above, then the additional insureds will be  entitled to the full limits of such policy and this Agreement shall be deemed to require such full limits. Except with  respect to professional liability, all policies shall contain a waiver of subrogation. Consultant shall be responsible for  all deductibles under its policies and all defense costs if its policies do not cover such expenses. Insurance coverage  in the minimum amounts shall not relieve the Consultant or any of its subcontractors of any liability, nor shall it  preclude Cornell from exercising any rights or taking such other actions as are available to it under the law. Cornell’s  failure to enforce these requirements shall not be considered a waiver of the requirements. Any changes to these  requirements shall only be made in writing and agreed upon by all parties. 
b. All policies required to be maintained shall be issued by an insurance company licensed or authorized to do  business in New York State with a rating of A- VII or better by A.M. Best. 
c. All contractors and subcontractors used by the Consultant to provide the Services under this Agreement shall  be required to comply with the insurance requirements in this Agreement. 
d. A Certificate of Insurance is required evidencing all coverages outlined above prior to commencement of work.  Further, each policy shall contain provisions giving Cornell at least 30 days written (10 days in the case of non payment) notice of cancellation, non-renewal, or other change in coverage. 
e. Cornell reserves the right to require additional coverage or to increase limits depending upon the liability  exposure in the scope of work in this Agreement. 
18. Compliance with Applicable Laws and Cornell Policies. Consultant warrants and represents that it will  comply with all federal, state and local laws, including data protection and data privacy laws, applicable to the  Consultant's performance of the Services under this Agreement. 
Prior to gaining access to Cornell’s systems and/or prior to gaining access to Cornell’s facilities to perform  Services, Consultant personnel will always agree to the requirements for access privileges and act in compliance with Cornell’s policies and procedures. Consultant and all individuals assigned by Consultant to a project under this  Agreement must comply with Cornell policies. 
Consultant represents that its management and storage of Cornell Data shall in all respects, including, without  limitation, administrative, physical and technical aspects, meet the privacy and security standards set forth in Gramm-
Page 5 of 13 
Attach to Requisition or Purchase Order Version: 12/01/2021 

Leach- Biley Act, 15 U.S.C. sections 6801-6809 ("GLB") and its implementing regulations. Without representing that  it is subject to GLB, Consultant understands that it may have access under this Agreement to Cornell financial  information and other nonpublic personal information protected thereby. To assist Cornell in meeting Cornell’s GLB  obligations, Consultant will implement, maintain, and use appropriate administrative, technical and physical security  measures to protect the confidentiality and integrity of all electronically maintained or transmitted Cornell Data. 
PCI DSS Compliance. The credit card industry has developed technical and business standard that affect the  way in which credit card business is conducted, called “Payment Card Industry Data Security Standards” (PCI DSS)  (www.pcisecuritystandards.org). All processes, procedures, or technologies must follow the security standards  dictated in the credit card industry’s “Payment Card industry Data Security Standards” (PCI DSS). Service provider  must submit annually, an Attestation of Compliance (AOC), which is evidence of a successfully completed PCI DSS  assessment. Failure to submit annually an Attestation of Compliance (AOC) or a successfully completed PCI DSS  assessment indicating you are PCI-compliant will result in the contract being null and void. 
19. Waiver. A delay or failure by either party to exercise any right under this Agreement will not constitute a  waiver of that or any similar or future right. 
20. Assignment. This Agreement may not be assigned by either party without the express prior written  permission of the other party.  
21. Affirmative Action. If required by Cornell, Consultant must provide a copy of its Office of Equal  Opportunity Affirmative Action Policy. 
22. Jurisdiction. This Agreement shall be deemed to have been made in the State of New York. New York law  (exclusive of any choice of law principles) shall govern this Agreement. Consultant consents to the jurisdiction of the  state or federal courts serving Tompkins County, New York for the resolution of any disputes arising under this  Agreement. 
23. Advertisement. Consultant may not use the name Cornell or any variation thereof for advertising or publicity  purposes without first obtaining the written permission of Cornell. 
24. Severability. If any provision of this Agreement is declared invalid by any tribunal, then such provision shall  be deemed automatically modified to conform to the requirements for validity as declared at such time, and as so  modified, shall be deemed a provision of this Agreement as though originally included herein. In the event that the  provision invalidated is of such a nature that it cannot be modified, the provision shall be deemed deleted from this  Agreement as though the provision had never been included herein. In either case, the remaining provisions of this  Agreement shall remain in effect. 
25. Notices. Each notice, request, or demand given or required to be given pursuant to this Agreement shall be  in writing and shall be deemed sufficiently given if deposited in the United States mail, first class, postage pre-paid,  and addressed to the address of the intended recipient set forth on the first page hereof or to such other address as may  be specified in writing by the parties.  
26. Force Majeure: Cornell shall be excused from liability for the failure or delay in performance of an  obligation under this Agreement due to an event beyond its reasonable control including, but not limited to, a fire, a  flood, an explosion, an earthquake, a natural disaster or any other act of God, as well as a pandemic, an epidemic, a  recognized health threat as determined by any federal, state or local government or quasi-governmental authority  (including the federal Centers for Disease Control), civil unrest, a strike or labor disturbance, war or threat of war,  terrorism or a threat of terrorism, a governmental or quasi-governmental order or directive to “shelter in place”, or any  other event, occurrence, order or directive similar to those enumerated above (each, a “Force Majeure Event”). A  Force Majeure Event may also include a then-current order, policy, rule or regulation imposed by Cornell University  based upon the health and safety of its student body, faculty, staff and/or broader community. Notice of Cornell’s failure or delay in performance due to a Force Majeure Event must be given to Consultant promptly but no less than  ten (10) days prior to the required performance; provided, however, that any such notification may be on shorter notice  if the circumstances and/or conditions giving rise to the Force Majeure Event occur within less than the aforementioned  ten (10) day period. 
Page 6 of 13 
Attach to Requisition or Purchase Order Version: 12/01/2021 

27. Sale or Bankruptcy of Consultant’s Business: If, during the term of this Agreement, the Consultant  disposes of its business by sale, transfer, force of law or by any means to another party, all obligations are transferred  to such party. In the event, the new owner(s) may, in Cornell's absolute discretion, be required to submit a performance  bond in the amount of the open balance of this Agreement. In the event of any suspension of payment or the institution  of any proceedings by or against Consultant, voluntary or involuntary, in bankruptcy or insolvency, or under the  provisions of the Federal Bankruptcy Act, or for the appointment of a receiver or trustee or an assignee for the benefit  of creditors of the property of Consultant, Cornell shall have, in addition to the rights stated in the two preceding  sentences, the right to cancel this Agreement. 
28. Payment: Consultant shall be paid after receipt of properly prepared invoices in accordance with Cornell's  invoicing instructions for merchandise or services delivered to and accepted by Cornell, as further set forth below in  this Section 29. Any adjustments in Consultant's invoice due to shortages, rejection or other failure to comply with the  provisions of this Agreement may be made by Cornell before payment. Discount periods shall commence after the  latest of final acceptance, delivery, receipt of any required documentation, or receipt of invoice. Delays in receiving  the invoice, errors or omissions on the invoice, or lack of supporting documentation required by the terms of this 
Agreement, will be cause for withholding settlement without losing prompt payment discount privilege. Invoices must  be accompanied by transportation receipt, if transportation is payable as a separate item. Original invoice shall be  submitted immediately after each shipment in accordance with the instructions on the purchase order. If Consultant  elects to use paper or email invoices, all payments are due either (i) Net 60 days after the receipt of invoice if receiving  check payments, or (ii) Net 45 days after the receipt of invoice if enrolled to receive direct deposit payments. If  Consultant elects to register for electronic invoicing and direct deposit payments through the Automated Clearing  House (ACH), all payments are due Net 30 days after the receipt of invoice. 
29. Right to Audit: Throughout the term hereof, and for a period of three years after the later of final payment, expiration or termination, or longer if required by law, Cornell, at its own expense, shall be entitled to perform, or to  have performed by a third party of Cornell’s choosing, during normal business hours and upon five (5) business days'  notice, an on-site audit of any and all records of Consultant necessary to permit Cornell to evaluate and verify  Consultant’s compliance with the requirements of this Agreement. Consultant grants Cornell permission to view  and/or copy any books, documents, records, data and information (including data and information stored in electronic  form) of Consultant which relate to or have been used in connection with the performance of this Agreement.  Consultant also grants Cornell permission to interview Consultant’s staff and agents as part of the audit. If applicable,  Consultant agrees to provide Cornell with adequate and appropriate workspace for conducting the audit. If Cornell, in  its sole discretion, determines that an on-site audit is not necessary, Consultant agrees to complete, within 30 days of  receipt, an audit questionnaire provided by Cornell. Any overcharges discovered by Cornell, or by a third party of  Cornell’s choosing, shall be paid within 30 days of Consultant’s acceptance of Cornell’s written notification of audit  findings. Consultant may not unreasonably withhold acceptance of audit findings. Consultant shall include this audit  provision in any subcontracts that it may issue under this Agreement. 
30. HIPAA Compliance. If Cornell determines that Consultant’s performance under this Agreement requires  compliance with the Health Insurance Portability and Accountability Act (HIPAA), Consultant agrees to enter into  any and all additional documents or amendments Cornell deems necessary to address HIPAA compliance. 
31. Effective Date. The effective date of this Agreement shall be the later of the two dates of signature below. 
32. Entire Agreement. This Agreement represents the entire understanding of the parties and may not be  modified except by written agreement of the parties and supersedes all prior written and/or oral agreements. This  Agreement may be executed in counterpart signatures. In the event of a conflict between the terms in this Agreement  and the terms of any other agreement, including a purchase order, the terms in this Agreement shall control. 
33. Authority. Each party warrants that it has the authority to enter into this Agreement and that entering into  this Agreement is not restricted or prohibited by any existing agreement to which it is a party. 
34. Tax Withholding for Domestic and Foreign Consultants. All payments from Cornell to Consultant under  this Agreement may be subject to tax withholding. Cornell reserves the sole right and discretion to withhold tax where  it believes it is required to do so under the tax laws of any jurisdiction. By accepting this Agreement, the Consultant 
Page 7 of 13 
Attach to Requisition or Purchase Order Version: 12/01/2021 

is relinquishing all claims against Cornell for any amounts withheld and remitted by Cornell to a tax authority. It is  the Consultant’s sole responsibility to provide Cornell with timely, complete, accurate, and legible forms and/or  documents necessary to claim a reduction or elimination of withholding taxes (e.g., Form W-8BEN). Cornell reserves  the sole right and discretion to make the determinations contemplated in this Section 34 as well as whether such forms  and/or documents are sufficient to reduce or eliminate withholding tax on any payment to the Consultant. 
35. Web Content Accessibility. In accordance with the Americans with Disabilities Act of 1990 and Section  504 of the Rehabilitation Act of 1973, all web pages, web functionality, websites or web applications developed or  provided under this Agreement will attempt to conform to the W3C Web Content Accessibility 2.0 Level AA  Guidelines that can be found at https://www.w3.org/WAI/WCAG20/quickref/. If Consultant is hosting websites or  providing web design services or web-based products, and if required, shall provide written evidence that their product  or service addresses each of the WCAG 2.0, Level AA criteria. For any area of noncompliance, Consultant should  describe any planned remediation roadmaps, including timelines and steps that will be taken to achieve full  compliance, as well as interim workarounds to enable access by individuals with disabilities. Consultants may be  required to demonstrate how to use the product with assistive technology, and may be required to undergo third-party  accessibility testing. Consultant must provide contact information to facilitate more detailed inquiries from Cornell if  so required.  
36. GDPR Compliance. If this Agreement, and/or the activities contemplated hereby involve the processing (as  such term is defined under the Regulation (EU) 2016/679 (General Data Protection Regulation, or “GDPR”)) by  Consultant of personal data (as defined in the GDPR) of which Cornell is the controller (as defined in the GDPR),  regardless of whether such personal data constitutes Cornell Data, then Cornell and Consultant shall execute a  Personal Data Processing Agreement (PDPA) to the extent to which the GDPR applies to such processing (in addition  to the provisions of this Agreement). 
37. Alterations. The terms of this Agreement may not be altered without authorization from Cornell’s Office  of General Counsel, Risk Management and Insurance, or Procurement and Payment Services. Unauthorized changes  will not be binding. 
[Schedules and Signature Page Follow] 
Page 8 of 13 
Attach to Requisition or Purchase Order Version: 12/01/2021 

Schedule A 
STATEMENT OF WORK 
See attached (check if document attached) Project Description, Work Scope and Deliverables: 
Initials Cornell Representative:  Initials Consultant Representative:  
Date: Date: 
Page 9 of 13 
Attach to Requisition or Purchase Order Version: 12/01/2021 
Schedule B 
PROJECT TIMETABLE AND TASK DESCRIPTION Completion Date: See attached (check if document attached) 
Initials Cornell Representative:  Initials Consultant Representative:  
Date: Date: 
Page 10 of 13 
Attach to Requisition or Purchase Order Version: 12/01/2021 
Schedule C 
PAYMENT AMOUNT AND SCHEDULE 
See attached (check if document attached) 
Payment Amount and Schedule: (Specify assigned consultant(s), hourly rate(s), and/or per project  amount(s), estimated total hours, term of assignment (if applicable) 
Initials Cornell Representative:  Initials Consultant Representative:  
Date: Date: 
Page 11 of 13 
Attach to Requisition or Purchase Order Version: 12/01/2021 
Schedule D 
CONSULTANT’S PERSONNEL 
See attached (check if document attached) List of Consultant’s Personnel: 
List of Cornell’s Representative(s): 
Initials Cornell Representative:  Initials Consultant Representative:  
Date: Date: 
Page 12 of 13 
Attach to Requisition or Purchase Order Version: 12/01/2021 

In witness thereof the parties hereto have caused this Agreement to be executed by their  respective duly authorized representatives. 
For Consultant: 
Signature: 
Print Name: 
Title: 
Phone: 
Email: 
Address: 
Date: 
For Cornell Procurement and Payment Services: 
Signature: 
Print Name: 
Title:  
Email:  
Address: 
Cornell PO #: 
Procurement Agent 
 @cornell.edu 377 Pine Tree Rd, Ithaca, NY 14850 
For Cornell College/Unit Representative: 
Name: 
Initials: 
NetID: 
Date:
Page 13 of 13 
Attach to Requisition or Purchase Order Version: 12/01/2021