MASTER COLLABORATION AGREEMENT
Exhibit 10.12
CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENT, MARKED BY [**], HAS BEEN OMITTED BECAUSE ARCHERDX, INC. HAS DETERMINED THE INFORMATION (I) IS NOT MATERIAL AND (II) WOULD LIKELY CAUSE COMPETITIVE HARM TO ARCHERDX, INC. IF PUBLICLY DISCLOSED.
WHENEVER MERCK/ MERCK KGAA IS MENTIONED IN THIS DOCUMENT THIS REFERS TO MERCK KGAA, DARMSTADT, GERMANY
This Master Collaboration Agreement (this “Agreement”) is made effective as of December 6, 2017 (the “Effective Date”), by and between ▇▇▇▇▇▇ DX, Inc. a Delaware corporation with offices at ▇▇▇▇ ▇▇▇▇ ▇▇▇▇▇▇, ▇▇▇▇▇ ▇▇▇, ▇▇▇▇▇▇▇, ▇▇ ▇▇▇▇▇ ▇▇▇ (“▇▇▇▇▇▇”), and Merck KGaA, a corporation with general partners under German law, with offices at ▇▇▇▇▇▇▇▇▇▇▇ ▇▇▇▇▇▇▇ ▇▇▇, ▇▇▇▇▇ ▇▇▇▇▇▇▇▇▇, ▇▇▇▇▇▇▇ (including its Affiliates, “MRK”). MRK and ▇▇▇▇▇▇ are each sometimes hereinafter referred to individually as a “Party” and collectively as the “Parties”.
WHEREAS, ▇▇▇▇▇▇ has developed proprietary technology relating to in vitro diagnostics, including IVD companion diagnostic devices and
WHEREAS, MRK desires to use ▇▇▇▇▇▇’▇ proprietary technology for the discovery of protein and polynucleotide biomarker(s) or a biomarker signature for use as diagnostics and/or in drug development as will be described more fully in Statements of Work (as defined hereinafter); and
WHEREAS, ▇▇▇▇▇▇ is developing an assay that embodies ▇▇▇▇▇▇’▇ proprietary technology and may enter into a further Statement of Work to provide for MRK’s use of the assay in the discovery and/or validation of protein and polynucleotide biomarkers; and
WHEREAS, MRK desires to have ▇▇▇▇▇▇ perform certain services in order for MRK to discover biomarkers and/or validate MRK’s proprietary biomarker for use as diagnostics or in certain indications on the terms and subject to the conditions set forth in this Agreement.
NOW, THEREFORE, in consideration of the mutual covenants contained herein, and for other good and valuable consideration, the receipt and adequacy of which are hereby acknowledged, the Parties hereby agree as follows:
1. DEFINITIONS
Whenever used in the Agreement with an initial capital letter, the terms defined in this Article 1 shall have the meanings specified and may be used in singular or plural.
1.1 “Affiliate” of a Party hereto means any other legal entity that directly or indirectly controls, is controlled by, or is under common control with such Party, for as long as such control exists. “Control”, “controlled by” and “under common control” refers (i) to the ownership, directly or indirectly, of more than fifty percent (50%) of the outstanding voting securities or the capital stock of, or other comparable equity or ownership interest in the respective legal entity, or (ii) in the absence of such ownership interest, to the possession, directly or indirectly, of the power to direct or cause the direction of the management and policies of the respective legal entity, by contract or otherwise.
1.2 “Applicable Laws” means federal, state, local, national and international laws, statutes, rules and regulations, including any rules, regulations, guidance, guidelines or requirements of regulatory authorities, national securities exchanges or securities listing organizations, that may be in effect from time to time and are applicable to a particular activity hereunder.
1.3 “▇▇▇▇▇▇ Background Technology” means any Technology that is in the possession of, or Controlled by ▇▇▇▇▇▇ at any time during the Term.
1.4 “▇▇▇▇▇▇ Invention” means any Invention made by ▇▇▇▇▇▇ in the conduct of the Services other than a Biomarker Invention.
1.5 “▇▇▇▇▇▇ Patent Rights” means any Patent Rights Controlled by ▇▇▇▇▇▇ that contain one or more claims that cover ▇▇▇▇▇▇ Background Technology.
1.6 “Biomarker” means any nucleic acid molecule(s) and/or polypeptides, the presence, absence, or level of which correlates with and/or predicts the presence, absence, severity, characteristics or prognosis of a human condition or disease, or the responsiveness of patients to a treatment or combination of treatments.
1.7 “Biomarker Invention” means any Invention that relates solely to the Biomarker Results and does not include ▇▇▇▇▇▇ Background Technology.
1.8 “Biomarker Results” means any Results that both (i) relate to or arise from the conduct of any Services and (ii) relate solely to the use of Biomarker in MRK Drug Development
1.11 “Drug Development” means any activity usually performed by a pharmaceutical company in drug development, comprising, but not limited to, diagnosis of disease, predicting response of a patient to a specific treatment and clinical development of a drug substance.
1.12 “Invention” means any Technology (including, without limitation,any new and useful process, method of manufacture or composition of matter) that is conceived or first reduced to practice by ▇▇▇▇▇▇ in the conduct of the Services.
1.13 “MRK Technology” means any Technology that is Controlled by MRK during the Term that is necessary or useful for ▇▇▇▇▇▇ to perform the Services. For purposes of clarity, all MRK Technology shall be listed in the applicable Statement of Work.
1.14 “MRK Materials” means any tangible materials and samples provided by MRK to ▇▇▇▇▇▇ for use in performing the Services. For purposes of clarity, all MRK Materials shall be listed in the applicable Statement of Work.
1.15 “MRK Patent Rights” means any Patent Rights Controlled by MRK that contain one or more claims that cover MRK Technology.
1.16 “Patent Rights” means all rights and interests in and to issued patents and pending patent applications including, without limitation, non-provisional patent applications, and all divisions, continuations and continuations-in-part thereof, patents issuing on any of the foregoing,
all reissues, reexaminations, renewals and extensions thereof, and supplementary protection certificates therefor, as well as any certificates of invention or applications therefor, and all foreign equivalents of any of the foregoing.
1.17 “Results” means those results produced or developed by ▇▇▇▇▇▇ in the conduct of the Services that are provided on the Reports.
1.18 “Services” means the services to be conducted by ▇▇▇▇▇▇ pursuant to this Agreement, as described in each Statement of Work.
1.19 “Targeted Indications” means the indications listed on Statements of Work attached hereto and incorporated herein by reference.
1.20 “Technology” means, collectively, inventions, discoveries, improvements, know-how, knowledge, copyrights, software, trade secrets and proprietary methods, whether or not patentable, including, without limitation: (a) methods of production or use of, and structural and functional information pertaining to, chemical compounds, (b) compositions of matter, data, formulations, processes, techniques and results and (c) any one or more Biomarker, alone or in combination with any other Biomarker, for use in Drug Development.
1.21 “Term” means the period beginning on the Effective Date and continuing for a period of three (3) years, subject to early termination pursuant to Section 6.2; provided, that, if this Agreement is terminated prior to the end of the Term, the effective date of such early termination shall become the last day of the Term.
2. PROVISION OF SERVICES
2.1 Services.
2.1.1 Conduct of Services.
(a) Statement of Work. Statements of Work shall be in the form of Schedule A attached hereto and shall describe the Services and include, at a minimum, (i) the specific sequence for any Biomarker to be included as a Biomarker for use in the conduct of the Services; (ii) MRK Materials, if any, that will be provided by MRK in connection with the conduct of the Services; (iii) the specific research and development activities to be performed by ▇▇▇▇▇▇ as part of the Services; and (iv) the timelines and fees, and the additional terms and conditions, if any, applicable to such Services (each, a “Statement of Work”). To the extent executed by the Parties, each such Statement of Work shall be attached hereto as consecutively numbered addendums to Schedule A (e.g., Schedule ▇-▇, ▇▇▇▇▇▇▇▇ ▇-▇, etc.), shall be incorporated herein by reference and shall thereafter be subject to the terms and conditions of this Agreement as a Statement of Work hereunder. If at any time during the Term, either Party reasonably determines that it is necessary in the conduct of the Services to perform additional research activities not specifically provided for in the applicable Statement of Work, such Party shall submit to the other Party for its review and approval a written notice which shall describe in reasonable detail the nature and estimated cost of such additional research activities. Once approved by the other Party, such additional research
activities will be deemed to be part of this Agreement and the applicable Statement of Work. In the event that any provision of any Statement of Work conflicts with the terms of this Agreement, the terms of this Agreement shall control.
(b) MRK Responsibilities. As soon as practicable after the Effective Date, MRK shall supply ▇▇▇▇▇▇ with details and/or reagents required to perform the Biomarker analysis, which may include antibodies and/or other reagents, PCR and/or sequencing primer information, and the quantities of MRK Materials set forth in the Statement of Work attached hereto (if required), to the ▇▇▇▇▇▇ facility set forth in the Statement of Work (the “Facility”) to be used by ▇▇▇▇▇▇ in the conduct of the Services, subject to the restrictions set forth herein, including, without limitation, Section 2.1.2(e).
(c) Use of MRK Materials. MRK warrants and represents that it has the authority to provide MRK Materials to ▇▇▇▇▇▇, (i) that it has obtained all necessary permissions, that it has in good faith ascertained whether informed consent is required by any other applicable legal authority, (ii) that it has, if required by applicable laws and regulatory guidelines (collectively, “Applicable Law”), obtained informed consent and complied with all Applicable Law and institutional review board (IRB) requirements for any collection or use of biological samples from patients, and (iii) that the activities contemplated by the Statement of Work will not violate any Applicable Laws, informed consents or IRB requirements.
(d) ▇▇▇▇▇▇ Responsibilities. ▇▇▇▇▇▇ shall use commercially reasonable efforts during the Term to (i) conduct the Services in accordance with each Statement of Work and (ii) provide to MRK the Reports (as defined below).
(e) Compliance. ▇▇▇▇▇▇ shall perform its obligations under the Statement of Work, and use MRK Materials, in compliance with all Applicable Laws.
(f) Restrictions on Use of MRK Materials. ▇▇▇▇▇▇ hereby agrees that, notwithstanding anything to the contrary in this Agreement or in the Statement of Work, (i) ▇▇▇▇▇▇ shall not use MRK Materials for any purpose other than in the conduct of the Services at the Facility; (ii) ▇▇▇▇▇▇ shall transfer MRK Materials only to those employees or consultants of ▇▇▇▇▇▇ who are conducting the Services at the Facility and who are bound by obligations of confidentiality and non-use comparable in scope to those set forth in this Agreement; (iii) ▇▇▇▇▇▇ shall not transfer, distribute or release any MRK Materials to any third party without the prior written consent of MRK; and (v) ▇▇▇▇▇▇ shall not acquire any right, title or interest in or to MRK Materials as a result of such supply by MRK or the use by ▇▇▇▇▇▇ of MRK Materials in the Services.
(g) Cooperation; Scientific Contact. Each of the Parties shall reasonably cooperate in the conduct of the Services and, subject to the terms of this Agreement and any confidentiality obligations to third parties, shall provide the other Party with such information and materials as are reasonably necessary for the performance of the Services. The respective scientific contacts (each, a “Scientific Contact”) of the Parties for purposes of this Agreement are set forth in the Statement of Work.
(h) Records; Reporting. ▇▇▇▇▇▇ will keep accurate records of its activities under this Agreement. ▇▇▇▇▇▇ shall (i) keep MRK reasonably informed of the progress of the Services by oral or written reports to the MRK Scientific Contact not less than once each [**] period during the Term, (ii) provide a written summary report to the MRK Scientific Contact of the Results within thirty (30) days of the termination or expiration of the Term (collectively, the “Reports”) and (iii) promptly disclose to MRK in writing the conception or reduction to practice of any Biomarker Inventions.
(i) Term. The Services shall commence on the Effective Date and shall continue until the expiration or termination of the Term.
(j) Agreement on Statement of Work. Each Statement of Work shall constitute a separate agreement and MRK shall issue a corresponding purchase order for each Statement of Work. A Statement of Work shall not be valid until it has been signed by the duly authorized representatives of the Parties. ▇▇▇▇▇▇ shall not initiate or order work, or incur expenses chargeable to MRK until a Statement of Work has been fully executed. Any MRK Affiliate may request Services and execute a Statement of Work under this Agreement. Any Affiliate will be solely liable for such Affiliate’s performance under such Statement of Work .
2.2 Grant of License. Subject to the other terms and conditions of this Agreement, MRK hereby grants to ▇▇▇▇▇▇ a non-exclusive, royalty-free, fully-paid license, without the right to grant sublicenses, under MRK Technology, MRK Patent Rights, MRK Materials, Biomarker Results, and Biomarker Inventions, to conduct the Services during the Term.
2.3 Consideration.
(a) Fees. In consideration of the conduct by ▇▇▇▇▇▇ of the Services contemplated by this Agreement, MRK shall pay ▇▇▇▇▇▇ the aggregate sum in the amount set forth in the applicable Statement of Work.
(b) Expense Reimbursement. MRK shall reimburse ▇▇▇▇▇▇ for all out-of-pocket expenses incurred by ▇▇▇▇▇▇ in the performance of the Services as set forth in the applicable Statement of Work. All such expenses will be invoiced to MRK quarterly and each such invoice shall be payable by MRK within [**] from the date of receipt and acceptance of that invoice.
(c) Payment and Invoices. All payments under this Agreement shall be made in U.S. dollars by wire transfer of immediately available funds to such account as may be designated in writing by ▇▇▇▇▇▇ within [**] from the date of receipt and acceptance of that invoice. ▇▇▇▇▇▇ shall send invoices to Merck at
MERCK KGaA
Accounts Payable
[**]
The following references shall be stated on each invoice:
Purchase Order Number: to be informed after signature
Merck Contact Person: [**]
VAT Registration Number: [**]
(d) Late Payments. All payments under this Agreement shall earn interest from the date due until paid at a per annum rate equal to the lesser of (a) the maximum rate permissible under applicable laws and (b) [**] above the monthly Reuters EURIBOR01, measured at 2 p.m. Frankfurt/Germany time on the date payment is due. Interest will be calculated on an actual/360 basis. The payment of such interest shall not limit the Parties from exercising any other rights at their disposal as a consequence of the lateness of any payment.
(e) VAT. For value added tax (VAT) purposes invoiced amounts are net amounts. In case the services provided by ▇▇▇▇▇▇ under this Agreement are subject to VAT in the US, VAT shall be added to the net amounts and be paid by Merck to ▇▇▇▇▇▇. ▇▇▇▇▇▇ shall remit such VAT to the proper tax authorities and shall cooperate with Merck in any way reasonably requested by Merck, to obtain available reductions, credits or refunds of any VAT amount attributable to services contemplated in this Agreement unless otherwise stated by local law. Merck is entitled to receive a proper invoice where any value added tax amount is shown separately, if applicable.
If the services under this Agreement are subject to the reverse-charge-mechanism under the German VAT code, VAT is owed by Merck. Merck will pay this VAT for ▇▇▇▇▇▇ according to the German tax laws (reverse-charge-mechanism). In this case, ▇▇▇▇▇▇ shall refer to the reverse-charge-mechanism on its invoice for the services. ▇▇▇▇▇▇ shall comply with any additional reasonable requests of Merck in relation to such invoices.
(f) Withholding Tax. ▇▇▇▇▇▇ shall be responsible for the payment of any and all Taxes levied on account of payments under this Agreement paid to ▇▇▇▇▇▇ by Merck or its Affiliates or permitted sublicensees under this Agreement. If applicable law requires that Taxes be deducted and withheld from payments paid under this Agreement, Merck shall (i) deduct those Taxes and interests and penalties assessed thereon from the payment or from any other payment owed by Merck hereunder; (ii) pay the Taxes to the proper governmental body; (iii) send evidence of the obligation together with proof of Tax payment to ▇▇▇▇▇▇ within one hundred (100) days following such payment; (iv) remit the net amount after deductions or withholding made under this Section and (v) cooperate with ▇▇▇▇▇▇ in any way reasonably requested by ▇▇▇▇▇▇, to obtain available reductions, credits or refunds of such Taxes. Assuming that ▇▇▇▇▇▇ is the beneficial owner of the intellectual property, the cooperation referred to in subparagraph (v) of the foregoing
sentence shall include, without limitation, that ▇▇▇▇▇▇ shall provide Merck with a written confirmation from the competent tax authority on the local application tax form that ▇▇▇▇▇▇ has its residence in the US which would allow the Parties to benefit from the reduced withholding tax rate set forth in the Double Taxation Convention existing between Germany and the US.
(g) Audit. During the term of this Agreement and for [**] thereafter, ▇▇▇▇▇▇ shall keep complete and accurate records with respect to the performance of Services hereunder, and Merck shall have the right to audit once a year (and at Merck’s expense) such records, during business hours and upon reasonable advance notice, to verify compliance by ▇▇▇▇▇▇ with the terms of this Agreement and any Statement of Work
(h) No Offset. If ▇▇▇▇▇▇ and Merck have entered into more than one Agreement, none of the Parties may offset charges associated with one Agreement to another, unless authorized by the other Party in writing.
3. TREATMENT OF CONFIDENTIAL INFORMATION
3.1 Confidentiality Obligations. MRK and ▇▇▇▇▇▇ each recognizes that the other Party’s Confidential Information constitutes highly valuable assets of such other Party. MRK and ▇▇▇▇▇▇ each agree that, subject to the remainder of this Article 3, during the Term and for an additional five (5) years following the termination or expiration of this Agreement, it will hold in confidence and will not disclose, and will cause its Affiliates not to disclose, any Confidential Information of the other Party and it will not use, and will cause its Affiliates not to use, any Confidential Information of the other Party except as expressly permitted hereunder.
3.2 Limited Disclosure and Use. Each Party agrees that disclosure of the Confidential Information of the Disclosing Party may only be made by the Receiving Party to any employee, consultant or Affiliate of the Receiving Party to enable such Receiving Party to exercise its rights or to carry out its responsibilities under this Agreement; provided, that, any such disclosure or transfer shall only be made to individuals who are bound by written obligations of confidentiality no less restrictive than those described herein. In addition, each Party agrees that the Receiving Party may disclose the Confidential Information of the Disclosing Party (a) on a need-to-know basis to such Receiving Party’s legal and financial advisors who are bound by written obligation of confidentiality no less restrictive than those described herein and (b) as required by Applicable Laws; provided, that, in the case of any disclosure under this clause (b), the Receiving Party shall (i) provide the Disclosing Party with reasonable advance written notice of, and an opportunity to comment on, any such required disclosure and (ii) if requested by the Disclosing Party, cooperate in all reasonable respects with the Disclosing Party’s efforts to obtain confidential treatment or a protective order with respect to any such disclosure, at the Disclosing Party’s expense.
3.3 Publicity. The Parties acknowledge and agree that the existence and the terms of this Agreement constitute Confidential Information of each Party and may only be disclosed as permitted by Section 3.2. Neither Party shall use the name, trademark, trade name or logo of the other Party, its Affiliates or their respective employees in any publicity, promotion, news release or other disclosure relating to this Agreement or its subject matter, without the prior written consent of the other Party, except as may be required by Applicable Laws.
4. INTELLECTUAL PROPERTY RIGHTS
4.1 MRK Intellectual Property Rights. MRK shall have sole and exclusive ownership of all right, title and interest on a worldwide basis in and to any and all MRK Technology, MRK Patent Rights, MRK Materials, Biomarker Results, and Biomarker Inventions. In connection therewith, ▇▇▇▇▇▇ hereby assigns, and shall require its employees to assign, to MRK all right, title and interest in and to all Biomarker Inventions, and MRK accepts such assignment.
4.2 ▇▇▇▇▇▇ Intellectual Property Rights. ▇▇▇▇▇▇ shall have sole and exclusive ownership of all right, title and interest on a worldwide basis in and to any and all ▇▇▇▇▇▇ Background Technology, ▇▇▇▇▇▇ Patent Rights and ▇▇▇▇▇▇ Inventions. In connection therewith, MRK hereby assigns, and shall require its employees to assign, to ▇▇▇▇▇▇ all right, title and interest in and to all ▇▇▇▇▇▇ Inventions.
4.3 No Other Rights. Except as expressly set forth herein, no rights or licenses are granted by either Party to the other Party hereunder.
4.4 Further Assurances. The Parties hereby agree to execute and deliver any documents of assignment or conveyance that are necessary or desirable to effectuate their respective rights under this Article 4.
5. REPRESENTATIONS AND WARRANTIES; INDEMNIFICATION
5.1 Mutual Representations and Warranties. Each Party hereby represents and warrants to the other Party, as of the Effective Date, as follows:
5.1.1 Organization. It is a corporation duly organized, validly existing and in good standing under the laws of the jurisdiction of its organization, and has all requisite power and authority, corporate or otherwise, to execute, deliver and perform this Agreement.
5.1.2 Authorization. The execution and delivery of this Agreement and the performance by it of the transactions contemplated hereby have been duly authorized by all necessary corporate action and will not violate (a) such Party’s certificate of incorporation or bylaws, (b) any agreement, instrument or contractual obligation to which such Party is bound in any material respect, (c) any requirement of any Applicable Laws, or (d) any order, writ, judgment, injunction, decree, determination or award of any court or governmental agency presently in effect applicable to such Party.
5.1.3 Binding Agreement. This Agreement is a legal, valid and binding obligation of such Party enforceable against it in accordance with its terms and conditions.
5.1.4 No Inconsistent Obligation. It is not under any obligation, contractual or otherwise, to any Person that conflicts with or is inconsistent in any respect with the terms of this Agreement or that would impede the diligent and complete fulfillment of its obligations hereunder.
5.2 Additional Representations, Warranties and Covenants of ▇▇▇▇▇▇. ▇▇▇▇▇▇ hereby represents, warrants, and covenants to MRK the following:
5.2.1 Skills and Training. ▇▇▇▇▇▇ will ensure (a) that its staff employed in providing Services have the necessary skills and training to provide the Services and (b) that ▇▇▇▇▇▇’▇ facilities and equipment used by the staff to provide the Services meet industry standards.
5.2.2 No Debarment. ▇▇▇▇▇▇ is not debarred, has not been convicted, and is not subject to debarment or conviction pursuant to ▇▇▇▇▇▇▇ ▇▇▇ ▇▇ ▇▇▇ ▇▇▇▇▇▇ ▇▇▇▇▇▇ Food Drug and Cosmetic Act (“FD&C Act”) or other equivalent laws, rules, regulations or standards of any other relevant jurisdiction. ▇▇▇▇▇▇ has not, to its knowledge, used prior to the Effective Date, and will not use during the Term to perform the Services, any employee, student, representative, agent, consultant, allowed sub-contractor or any other person who has been debarred by any regulatory authority, or, to its knowledge, is the subject of debarment proceedings by a regulatory authority or has been convicted, pursuant to Section 306 of the FD&C Act or other equivalent laws, rules, regulations, or standards of any other relevant jurisdiction.
5.3 Warranty Disclaimer. ▇▇▇▇▇▇ ACKNOWLEDGES THAT MRK MATERIALS ARE EXPERIMENTAL, THAT ▇▇▇▇▇▇ IS AWARE OF THE RISKS OF WORKING WITH EXPERIMENTAL MATERIAL AND THAT IT WILL UTILIZE PRUDENT PRACTICES IN HANDLING MRK MATERIALS. EACH PARTY HEREBY ACKNOWLEDGES THAT THE OTHER PARTY HEREBY DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING, WITHOUT LIMITATION, WARRANTIES OF MERCHANTABILITY AND/OR FITNESS FOR A PARTICULAR PURPOSE.
5.4 Limited Liability. UNDER NO CIRCUMSTANCES SHALL ▇▇▇▇▇▇ BE LIABLE TO MRK OR ANY OF ITS AFFILIATES FOR <(I) ANY SPECIAL, PUNITIVE, INDIRECT, INCIDENTAL OR CONSEQUENTIAL DAMAGES, INCLUDING, WITHOUT LIMITATION, LOST PROFITS OR LOST REVENUES, (II) COST OF PROCUREMENT OF SUBSTITUTE GOODS, TECHNOLOGY OR SERVICES, WHETHER UNDER ANY CONTRACT, WARRANTY, NEGLIGENCE, STRICT LIABILITY OR OTHER LEGAL OR EQUITABLE THEORY OR (III)> ANY LIABILITY, DAMAGE, LOSS OR EXPENSE UNDER THIS AGREEMENT IN EXCESS OF [**].
5.5 Indemnification of MRK by ▇▇▇▇▇▇. ▇▇▇▇▇▇ shall indemnify, defend and hold harmless MRK, its Affiliates, their respective directors, officers, employees and agents, and their respective successors and assigns (the “MRK Indemnitees”), against any liability, damage, loss or expense (including reasonable attorneys’ fees and expenses of litigation) incurred by or imposed upon MRK Indemnitees or any one of them, as a direct result of any claims, suits, actions or demands by third parties (collectively, the “Claims”) arising out of (a) the material breach by ▇▇▇▇▇▇ of any obligation representation, warranty or covenant under this Agreement; (b) the breach by ▇▇▇▇▇▇ of any Applicable Law in performing Services; or (c) the [**] or willful misconduct of ▇▇▇▇▇▇, its Affiliates or their respective employees or consultants; provided, that, ▇▇▇▇▇▇ shall not be obligated to indemnify MRK for any Claims to the extent arising from or
occurring as a result of the [**] or willful misconduct of MRK, its Affiliates or their respective employees or agents.
5.6 Indemnification of ▇▇▇▇▇▇ by MRK. MRK shall indemnify, defend and hold harmless ▇▇▇▇▇▇, its Affiliates, their respective directors, officers, employees and agents, and their respective successors and assigns (the “▇▇▇▇▇▇ Indemnitees”), against any liability, damage, loss or expense (including reasonable attorneys’ fees and expenses of litigation) incurred by or imposed upon ▇▇▇▇▇▇ Indemnitees or any one of them, as a direct result of any claims, suits, actions or demands by third parties (collectively, the “▇▇▇▇▇▇ Claims”) arising out of (a) any study, test, device, product or potential product to which this Agreement or any Statement of Work relates and any personal injury claims arising therefrom; (b) the harmful or otherwise unsafe effect of any MRK Materials; (c) the material breach of any representation, warranty or covenant by MRK under this Agreement; (d) the breach by MRK of any Applicable Law; (e) the use by MRK of the Biomarker Results, the Biomarker Inventions, the Program Biomarker Results, and/or any Program Biomarker Inventions; or (f) the [**] or willful misconduct of MRK, its Affiliates or their respective employees or consultants; provided, that, MRK shall not be obligated to indemnify ▇▇▇▇▇▇ for any ▇▇▇▇▇▇ Claims to the extent arising from or occurring as a result of the [**] or willful misconduct of ▇▇▇▇▇▇, its Affiliates or their respective employees or agents.
5.7 Conditions to Indemnification. An Indemnitee seeking recovery under Sections 5.5 or 5.6 (the “Indemnified Party”) in respect of a Claim shall give prompt written notice of such Claim to the other Party (the “Indemnifying Party”); provided, that, the Indemnifying Party is not contesting its obligation under Sections 5.5 or 5.6, shall permit the Indemnifying Party to control any litigation relating to such Claim and the disposition of such Claim (including without limitation any settlement thereof); provided, further, that, the Indemnifying Party shall not settle or otherwise resolve such Claim without the prior written consent of such Indemnified Party, which consent shall not be unreasonably withheld, conditioned or delayed, unless such settlement includes a full release of the Indemnified Party, in which case the Indemnifying Party may settle or otherwise resolve such Claim without the prior written consent of such Indemnified Party. Each Indemnified Party shall cooperate with the Indemnifying Party in its defense of any such Claim in all reasonable respects and shall have the right to be present in person or through counsel at all legal proceedings with respect to such Claim.
5.8 Insurance. During the Term, each Party shall carry, with financially sound and reputable insurers, insurance coverage (including errors and omissions, professional liability and comprehensive liability coverage) with respect to the conduct of its business against loss from such risks and in such amounts as is customary for well-insured companies engaged in similar businesses. Each Party shall provide a copy of the applicable insurance policy if requested by the other Party.
6. TERM AND TERMINATION
6.1 Term. This Agreement shall commence on the Effective Date and continue, unless earlier terminated as provided herein, until the expiration of the Term.
6.2 Termination.
6.2.1 Unilateral Right to Terminate. Either Party shall have the right to terminate this Agreement, for any reason, effective upon [**] written notice to the other Party.
6.2.2 Termination for Breach. Either Party may terminate this Agreement, effective immediately upon written notice to the other Party, for a material breach by the other Party of this Agreement that, if curable, remains uncured for thirty (30) days after the non-breaching Party first gives written notice to the other Party of such breach and its intent to terminate this Agreement if such breach is not cured.
6.3 Consequences of Expiration of Termination of Agreement or Statement of Work. In the event of the termination of this Agreement or a Statement of Work pursuant to Section 6.2 or the expiration of the Term pursuant to Section 6.1, the following provisions shall apply:
(a) ▇▇▇▇▇▇ shall promptly (i) return to MRK all unused MRK Materials in its possession or control, unless otherwise directed in writing by MRK, (ii) return to MRK all Confidential Information of MRK in its possession or control; provided, that, ▇▇▇▇▇▇ may retain one (1) copy of Confidential Information of MRK in its archives solely for the purpose of establishing the contents thereof and ensuring compliance with its obligations hereunder, and (iii) deliver all deliverables (including works-in-progress) and all data and any other documentation produced as the result of or arising out of the Services performed by ▇▇▇▇▇▇ under the impacted Statement of Work upon payment to ▇▇▇▇▇▇ for all Services having been completed in accordance with the applicable Statement of Work;
(b) MRK shall promptly return to ▇▇▇▇▇▇ all Confidential Information of ▇▇▇▇▇▇ in its possession or control; provided, that, MRK may retain one (1) copy of Confidential Information of ▇▇▇▇▇▇ in its archives solely for the purpose of establishing the contents thereof and ensuring compliance with its obligations hereunder; and
(c) In the event that this Agreement or any Statement of Work is terminated or otherwise expires, ▇▇▇▇▇▇ shall take all steps necessary to wind down and cease the affected Services in an orderly manner. MRK shall pay ▇▇▇▇▇▇ all fees for Services rendered to the effective date of termination in accordance with the applicable Statement of Work, plus all non-cancellable costs and out-of-pocket expenses incurred by ▇▇▇▇▇▇ on behalf of MRK in connection with or and as a result of such termination. In the event that MRK terminates any Statement of Work on less than the period of notice set out at Section 6.2.1 above, ▇▇▇▇▇▇ shall, if applicable, be entitled to charge MRK for lost capacity reserved to perform the Services and which cannot, with reasonable endeavors, be substituted with an alternative project. ▇▇▇▇▇▇ shall provide MRK with an invoice for its termination expenses and charges under this Section 6.3 as soon as reasonably practicable following termination of such Statement of Work and winding-up of such work, including copies of such invoices and other financial information as is necessary to substantiate ▇▇▇▇▇▇’▇ claim. ▇▇▇▇▇▇’▇ invoice shall be due and payable forthwith upon receipt.
6.4 Surviving Provisions. Notwithstanding any provision herein to the contrary, the following Articles and Sections shall survive the termination of this Agreement or the expiration
of the Term of this Agreement: 1, 3, 4, 5, 6.3, 6.4, 7, 8 and any other provisions of this Agreement which, from their nature or context, are apparently intended to survive the termination/expiration of this Agreement.
7. DATA PROTECTION
7.1 General Compliance. Any information related to an identified or identifiable natural person (“Personal Data”) which
(i) either party received from the other party; and/or
(ii) is processed by ▇▇▇▇▇▇
as part of providing services under this Agreement shall be processed by that party only in strict compliance with applicable data protection laws. Sections 7.2-7.5 shall apply accordingly to ▇▇▇▇▇▇ when processing such Personal Data.
7.2 Information. ▇▇▇▇▇▇ shall inform MRK of any rectification or erasure of Personal Data or restriction of processing under applicable data protection laws provided such Personal Data was disclosed to MRK in the course of providing the respective services. ▇▇▇▇▇▇ shall inform its affected personnel about processing of their Personal Data by MRK for the purposes of this Agreement so that MRK complies with its information requirements under applicable data protection laws towards personnel; where Provider is reasonably missing details to provide complete information, MRK will provide such inform upon request.
7.3 Breach Notification. ▇▇▇▇▇▇ shall promptly notify MRK in writing after becoming aware of any breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data subject to this Agreement (“Data Breach”). MRK may request further reasonable information about the Data Breach including but not limited to a reasonably detailed description of the Data Breach and the categories of Personal Data affected by the Data Breach.
7.4 Processor. If and to the extent Personal Data is processed on behalf of MRK by ▇▇▇▇▇▇ so that ▇▇▇▇▇▇ is acting as a “Processor”, the Processing Agreement attached as Exhibit C shall apply.
7.5 Joint Controllers. If and to the extent that the parties jointly determine the purposes and means of processing of Personal Data, acting as “Joint Controllers”, the parties shall agree in writing on a Joint Controller agreement that determines their respective responsibilities for compliance under applicable data protection legislation and that shall apply in addition to the other provisions of this Section.
7.6 Cross-Border Transfer. ▇▇▇▇▇▇ shall not process or transfer Personal Data subject to this Agreement to a country outside of the EU, European Economic Area, or Switzerland without MRK’s prior written consent; such consent is provided by concluding the EU Standard Contractual Clauses attached in Exhibit C. This Section 7.6 does not apply if Section 7.4 applies.
7.7 Subcontracting. Where MRK consents to subcontracting by ▇▇▇▇▇▇ according to Section 2.1 and if ▇▇▇▇▇▇ has access to Personal Data that is subject to this Agreement, ▇▇▇▇▇▇ shall appoint the subcontractor as a data processor under a contract which shall comply with applicable data protection legislation and shall ensure that the subcontractor complies with ▇▇▇▇▇▇’▇ obligations under this Section, including, but not limited to, entering into EU Model Clauses.
8. MISCELLANEOUS
8.1 Governing Law and Jurisprudence. This Agreement will be construed, interpreted and applied in accordance with the laws of the State of New York (excluding its body of law controlling conflicts of law). Each of the Parties hereby (a) irrevocably and unconditionally agrees that any dispute, controversy or claim arising from or related to this Agreement or the performance by either Party of its obligations hereunder shall be brought by such Party exclusively in the state and federal courts of the State of New York ; (b) irrevocably submits to the exclusive jurisdiction of the competent courts in New York ; (c) waives any objection to laying of venue in any such action or proceeding in the New York courts and/or that the New York courts are an inconvenient forum or does not have jurisdiction over any Party hereto; and (d) agrees that service of process upon such Party in any such action or proceeding shall be effective if notice is given in accordance with this Agreement.
8.2 Limitations. Except as expressly set forth in this Agreement, neither Party grants to the other Party any right or license to any of its intellectual property.
8.3 Entire Agreement. This Agreement is the entire agreement between the Parties with respect to the subject matter hereof and supersedes all prior representations, understandings and agreements between the Parties, whether written or oral, with respect to the subject matter hereof. No modification or amendment shall be effective unless in writing with specific reference to this Agreement and signed by the duly authorized representatives of the Parties.
8.4 Waiver. The terms or conditions of this Agreement may be waived only by a written instrument executed by the Party waiving compliance. The failure of either Party at any time or times to require performance of any provision hereof shall in no manner affect its rights at a later time to enforce the same. No waiver by either Party of any condition or term shall be deemed as a continuing waiver of such condition or term or of another condition or term.
8.5 Headings. Section and subsection headings are inserted for convenience of reference only and do not form part of this Agreement.
8.6 Assignment. Neither this Agreement, nor any right or obligation hereunder, may be assigned, delegated or otherwise transferred, in whole or part, by either Party without the prior express written consent of the other not to be unreasonably withheld, conditioned or delayed; provided, that, either Party may, without the written consent of the other, assign this Agreement and its rights and delegate its obligations hereunder to its Affiliates or in connection with the transfer or sale of all or substantially all of such Party’s assets or business to which this Agreement relates or in the event of its merger, consolidation, change in control or similar transaction. Any permitted assignee shall assume all obligations of its assignor under this Agreement. Any purported assignment
in violation of this Section 8.6 shall be void. The terms and conditions of this Agreement shall be binding upon and inure to the benefit of the permitted successors and assigns of the parties.
8.7 Force Majeure. Neither Party shall be liable for failure of or delay in performing its obligations set forth in this Agreement, and neither Party shall be deemed in breach of its obligations, to the extent such failure or delay is due to causes beyond the reasonable control of the affected Party, including, but not limited to, embargoes, war, acts of war (whether war be declared or not), acts of terrorism, insurrections, riots, civil commotions, strikes, lockouts or other labor disturbances, fire, floods, or other acts of God, or acts, inability to procure materials or services, omissions or delays in acting by any governmental authority or the other Party. The affected Party shall notify the other Party of such force majeure circumstances as soon as reasonably practical, and shall promptly undertake all reasonable efforts necessary to cure such force majeure circumstances.
8.8 Construction. The Parties hereto acknowledge and agree that: (a) each Party and its counsel reviewed and negotiated the terms and provisions of this Agreement and have contributed to its revision; (b) the rule of construction to the effect that any ambiguities are resolved against the drafting Party shall not be employed in the interpretation of this Agreement; and (c) the terms and provisions of this Agreement shall be construed fairly as to all Parties hereto and not in favor of or against any Party, regardless of which Party was generally responsible for the preparation of this Agreement.
8.9 Severability. If any provision(s) of this Agreement are or become invalid, are ruled illegal by any court of competent jurisdiction or are deemed unenforceable under then current applicable law from time to time in effect during the Term hereof, it is the intention of the Parties that the remainder of this Agreement shall not be affected thereby; provided, that, a Party’s rights under this Agreement are not materially affected. the Parties hereto covenant and agree to renegotiate any such term, covenant or application thereof in good faith in order to provide a reasonably acceptable alternative to the term, covenant or condition of this Agreement or the application thereof that is invalid, illegal or unenforceable, it being the intent of the Parties that the basic purposes of this Agreement are to be effectuated.
8.10 Status. It is expressly agreed that MRK and ▇▇▇▇▇▇ shall be independent contractors and that nothing in this Agreement is intended or shall be deemed to constitute a partner, agency, employer-employee or joint venture relationship between the Parties. Neither MRK nor ▇▇▇▇▇▇ shall have the authority to make any statements, representations or commitments of any kind, or to take any action, which shall be binding on the other Party, without the prior written consent of the other Party.
8.11 Further Assurances. Each Party agrees to execute, acknowledge and deliver such further instructions, and to do all such other acts, as may be necessary or appropriate in order to carry out the purposes and intent of this Agreement.
8.12 Counterparts. This Agreement may be executed simultaneously in one or more counterparts, each of which shall be deemed an original, but all of which together shall constitute one and the same instrument.
IN WITNESS WHEREOF, the Parties have caused this Agreement to be executed by their respective duly authorized representatives.
MERCK KGAA | ▇▇▇▇▇▇ | ||||
/s/ [**] | By: | /s/▇▇▇▇▇▇▇▇▇ ▇▇▇▇▇▇▇▇ | |||
By: | [**] | Name: | ▇▇▇▇▇▇▇▇▇ ▇▇▇▇▇▇▇▇ | ||
Name: | Senior Director | Title: | General Counsel | 12/6/17 | |
Title: | Head of Market Enabling Technologies and Companion Diagnostics | ||||
By: | |||||
Name: | |||||
Title: | |||||
Address for purposes of notification: | Address for purposes of notification: | ||||
/s/[**] | 2477 ▇▇▇▇ ▇▇▇▇▇▇ | ||||
[**] | ▇▇▇▇▇ ▇▇▇ | ||||
▇▇▇▇▇▇▇▇▇▇▇▇ | Head of Legal | ▇▇▇▇▇▇▇ ▇▇ ▇▇▇▇▇ | ||||
Business Development | |||||
Merck Healthcare | Legal | |||||
Schedule A
SAMPLE STATEMENT OF WORK
THIS STATEMENT OF WORK (this “Statement of Work”) is by and between Merck KGaA (the “MRK”) and ARCHERDX, Inc. (“▇▇▇▇▇▇”), and upon execution will be appended to Schedule A of into the Master Contract Services Agreement between MRK and ▇▇▇▇▇▇ dated __________, 2017 (the “Agreement”). Capitalized terms in this Statement of Work will have the same meaning as set forth in the Agreement.
MRK hereby engages ▇▇▇▇▇▇ to provide the following Services:
(a) Description of Services.
Describe specific Services to be provided including all Deliverables. Attach Protocol, if applicable.
(b) MRK Materials. MRK will provide to ▇▇▇▇▇▇ the following MRK Materials for the conduct of the Services.
Describe the tangible materials, if any, to be provided by MRK.
(c) Biomarkers. The following Biomarkers will be validated as part of the Services:
Provide sequence of the Biomarker.
(d) ▇▇▇▇▇▇ Scientific Contact. Name and Title
(e) MRK Scientific Contact. Name and Title
(f) Fees; Invoicing.
Describe Fee payment schedule.
All invoices for Fees shall be due and payable by MRK [**] from receipt, including each invoice submitted upon termination of a Statement of Work.
In the event of a discrepancy between any terms or conditions set forth in the Statement of Work and any attachments thereto and the Agreement, the terms of the Agreement shall govern.
All other terms and conditions of the Agreement will apply to this Statement of Work.
[Remainder of page intentionally left blank.]
STATEMENT OF WORK AGREED TO AND ACCEPTED BY:
MERCK KGAA | ▇▇▇▇▇▇ | |||
By | By | |||
Print Name: | Print Name: | |||
Title: | Title: | |||
duly authorized | duly authorized | |||
Date: | Date: | |||
By | ||||
Print Name: | ||||
Title: | ||||
duly authorized | ||||
Date: | ||||
APPENDIX 1
Individual Agreement on Data Processing
to the Data Processing Agreement
between Merck KGaA (Controller) and ArcherDx (Processor) dated December 6, .2017
regarding Master Collaboration Agreement dated December 6,.2017
The Controller has authorized the Processor to process of certain Personal Data which are further described below. Thereto the Parties concluded a Service Agreement as referred to above.
The purpose of this APPENDIX is to define details of the Processing of Personal Data. The provisions of the Data Processing Agreement between the Parties shall apply.
1. | Processing Operations |
The Personal Data transferred will be subject to the following processing activities:
• | [**] |
2. | Data Subjects |
The Personal Data transferred concern the following categories of Data Subjects:
• | [**] |
• | [**] |
• | [**] |
3. | Categories of Data |
The Personal Data transferred concern the following categories of data:
• | [**] |
• | [**] |
4. | Special Categories of Data such as Health Data (if applicable)1 |
The Personal Data transferred concern the following Special Categories of Data:
• | The personal data transferred concern the following categories of sensitive data: |
• | As defined by Controller or alternatively, “No personal data needed..” |
5. | International Transfer |
If Controller agrees: Please indicate if Personal Data is transferred to a country/recipient outside the EU/EEA/Switzerland and which data.
• | As defined above, no identifiable, personal data will be transferred |
Country | Categories of data | If applicable (otherwise, leave empty): Mechanism to ensure adequate protection instead of EU Standard Contractual Clauses |
By signing this Appendix, Controller approves the transfer of the described Personal Data to the countries specified above.
___________________
1 Cf. Article 9 GDPR for definition of Special Categories of Personal Data: Personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade-union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation
6. | Subcontracting |
Processor intends to use the service of the following subcontractors for Processing of Personal Data:
• | As defined above, no identifiable, personal data will be processed |
Name of Subcontractor | Address | Task to be performed | International transfer (if applicable) |
Please briefly explain processing activities (one or two keywords are sufficient, e.g. data hosting) | Please indicate to which country Personal Data is transferred if Personal Data is transferred to a country/recipient outside the EU/EEA /Switzerland. | ||
By signing this Appendix, Controller approves the use of the aforementioned subcontractors and the international transfer of Personal Data (if applicable).
7. | Contact Persons |
Questions and notices of Processor under Data Processing Agreement shall be addressed to:
• | Controller contact to be specified under each subordinate schedule of work |
• | Processor contact to be determined under each subordinate schedule of work |
8. | If the EU Standard Contractual Clauses apply: |
Data Exporter
The Data Exporter is the entity identified as “Controller” in the Data Processing Agreement.
Data Importer
The Data Importer is the entity identified as “Processor” in the Data Processing Agreement.
9. | Description of the Technical and Organisational Security Measures according to Section 6.1 of the Data Processing Agreement and according to Appendix 2 of the EU Standard Contractual Clauses (if applicable) |
• | As defined above, no personal data will be transferred to or processed by the Processor. Therefore, for the project in question, the following requirements are marked “N/A”. |
Information Security Program
The Provider has to maintain an information security program governing people, process, and technology used for the handling of personal data. This must especially include:
Information Security Program | Implemented? (Yes / No) | |
1. | The Provider appoints one or more security officers responsible for coordinating and monitoring security policies and procedures. | N/A |
2. | Provider personnel with access to personal data are subject to confidentiality obligations. | N/A |
3. | The Provider performs a risk assessment before processing personal data. | N/A |
4. | The Provider provides security training ensuring his personnel are informed of security policies, procedures, and their respective roles. | N/A |
5. | The Provider informs personnel of the possible consequences resulting from not following security policies and procedures. | N/A |
Physical Access Control
The Provider ensures with proper measures that unauthorized persons do not get access to data processing facilities (in particular phone systems, data bases, application servers and connected hardware) that are utilized for the processing of personal data. This must especially be ensured by:
Access Control | Implemented? (Yes / No) | |
1. | The Provider limits access to facilities where information systems that process personal data are located with badge-controlled access for authorized personnel. | N/A |
2. | Provider premises are monitored 24x7 by a security force utilizing CCTV or similar methods at all entry points. | N/A |
3. | Visitors to Providers’ premises must be accompanied by authorized personnel at all times and visits are logged in a visitor register. | N/A |
4. | Provider uses industry best practice security measures to protect against loss of data due to environmental disruptions such as loss of power or other interferences. | N/A |
5. | Provider maintains records of incoming and outgoing media that contain personal data. | N/A |
System Access Control
The Provider prevents with appropriate measures that the data processing systems cannot be used by unauthorized persons. This must especially be ensured by:
System Access Control | Implemented? (Yes / No) | |
1. | Provider maintains and updates a list of all authorized users that have access to personal data. | N/A |
2. | Provider has implemented measures to prevent unauthorized personnel from accessing data processing systems. | N/A |
3. | Provider may only grant access to personal data to any third party (except personnel and approved sub-contractors) with prior approval from Merck. | N/A |
4. | If Provider personnel has access to Merck systems, the Provider must inform Merck immediately about the termination of contract with such personnel that have access to Merck systems to enable Merck to initiate the account revocation process. | N/A |
5. | The Processor ensures that access control is supported by an authentication system. | N/A |
Data Access Control
The Provider ensures that the IT systems utilized for the data processing allows authorized users only limited access, specified by their individual authorization rights. The Provider must take adequate measures to ensure that personal data cannot be read, copied, modified or deleted in an unauthorized manner. This must especially be ensured by:
Data Access Control | Implemented? (Yes / No) | |
1. | Personal data may only be printed in physically secure areas controlled by the Provider and only shared with personnel on a need to know basis. | N/A |
2. | The access rights of personnel to personal data is restricted to the necessary minimum required for their job functions | N/A |
3. | The Provider has measures in place to prevent use/installation of unauthorized hardware and/or software. | N/A |
4. | The Provider has established rules for the safe and permanent destruction of data that are no longer required. | N/A |
Transmission Control
The Provider ensures with applicable measures that during data transfer personal data cannot be unauthorized read, copied, modified or deleted. This must especially be ensured by:
Data Transmission Control | Implemented? (Yes / No) | |
1. | Any personal data stored in media that is leaving Provider’s facilities is encrypted. | N/A |
2. | Personal data is encrypted when transmitted over Provider’s internal network. | N/A |
3. | Personal data is encrypted when transmitted over public networks. | N/A |
Input Control
The Provider ensures with applicable measures, that it can reproduced who entered personal data in data processing systems or by whom personal data was deleted from data processing systems.
The Provider is also only allowed to process personal data subject to the contract on behalf of Merck and according to contract with and/or further the instructions of Merck. This must especially be ensured by:
Data Input and Job/Order Control | Implemented? (Yes / No) | |
1. | Provider has established logging mechanisms that record data entry and deletion. | N/A |
2. | Provider is logging all activities in the area of data input as for example: • Unsuccessful access attempts; • Authority exceptions; • Privilege changes; • Data object owner changes; • Out of hour’s access. | N/A |
3. | Provider is ensuring that logs are regularly inspected for security incidents. | N/A |
Availability Control
The Provider ensures with applicable measures that personal data cannot be unintentionally lost or destroyed. This must be ensured by:
Availability Control | Implemented? (Yes / No) | |
1. | Provider has business continuity plans and is regularly testing the business continuity concepts. | N/A |
2. | Provider implements backup processes and other measures are that ensure rapid restoration of business critical systems as and when necessary. | N/A |
3. | Provider is using uninterrupted power supplies (for example: UPS, batteries, generators, etc.) to ensure power availability to the data centers. | N/A |
4. | Provider has sufficient capacity for data storage. | N/A |
5. | Provider has a disaster recovery plan in place and is regularly testing it. | N/A |
Data Separation Control
The Provider ensures with applicable measures that data that was collected for different purposes will be processed separately. This must be ensured by:
Data Separation Control | Implemented? (Yes / No) | |
1. | Using technical capabilities (for example: multi-tenancy or separate system landscapes) to achieve data separation between Personal Data from one and any other customer. | N/A |
2. | Maintaining dedicated instances for each Customer. | N/A |
3. | Provider’s customers (including their Affiliates) have access only to their own customer instance(s). | N/A |
Workstation Security
The Provider ensures security of any workstation used to access Merck systems that process personal data. This must be ensured by:
Workstation Security | Implemented? (Yes / No) | |
1. | Hard disk password for each drive in the device’s BIOS settings is activated. | N/A |
2. | A password protected keyboard/screen lock that is automatically activated by a period of Inactivity is set. The inactivity time interval should be no more than 30 minutes. | N/A |
3. | Monitoring of equipment movement to and from the premises by security personnel and logging of the entries in a software system. | N/A |
4. | Antivirus program is installed and run on the workstation. | N/A |
5. | Desktop firewall program is installed and run on the workstation. | N/A |
6. | Personnel with Workstations using Microsoft Windows operating systems will install security patches for their respective version (but only the patches approved by the Provider’s internal infrastructure team). | N/A |
7. | The password associated with a computer access user ID is the primary means of verifying Identity and subsequently allowing access to the computer and to the information. Identity verification password is kept secret and not shared with anyone else. | N/A |
8. | Identity verification passwords must not be trivial or predictable and must: • Be at least 8 positions in length • Contain a mix of alphabetic and non-alphabetic characters (numbers, punctuation or special characters) or a mix of at least two types of non-alphabetic characters. • Not contain the user ID as part of the password | N/A |
9. | The password must be changed at least once every three months (90 days). | N/A |
Information Security Incident Management
The Provider ensures with applicable measures that security incidents involving personal data are managed following industry best practices. This must especially be ensured by:
Information Security Incident Management | Implemented? (Yes / No) | |
1. | The Provider maintains a record of security incidents with a description of the incident, the time period, the consequences, the name of the reporter or service, to whom the incident was reported, and the remediation. | N/A |
Evaluation and certifications
Certifications and evaluation of data security by Provider
Evaluation and certifications | Implemented? (Yes / No) | |
1. | Does the Provider regularly test and evaluate the effectiveness of his data security measures? Please provide reports of such tests. | N/A |
2. | Did Provider obtain any certification regarding its data security and/or data protection systems and organization such as an ISO 27001 certification? If yes, which certifications? | N/A |
Date: | Place: | |||
Controller/ Processor | ||||
Date: | 12/6/2017 | Place: | Boston, MA | |
/s/ Christian La Pointe | Christian La Pointe | |||
General Counsel | ||||