the performance of the Contract and will not knowingly utilize the goods and/or services of any subcontractor, if permitted under the Contract, who will utilize the goods and/or services of illegal immigrants in the performance of the Contract. The Contractor hereby attests, certifies, warrants, and assures that the Contractor shall not knowingly utilize the goods and/or services of an illegal immigrant in the performance of this Contract and shall not knowingly utilize the goods and/or services of any subcontractor who will utilize the goods and/or services of an illegal immigrant in the performance of this Contract.

E.14. Red Flags and Identity Theft. The Service Provider shall have policies and procedures in place to detect relevant Red Flags that may arise in the performance of the Service Provider's activities under the Agreement, or review the Institution's Red Flags identity theft program and repo rt any Red Flags to Institution. E.15. Sales and Use Tax. The Contractor shall be registered or have received an exemption from the Department of Revenue for the collection of Tennessee sales and use tax. This registration requirement is a material requirement of this Contract. The Contractor shall comply, and shall require any subcontractor to comply, with all laws and regulations governing the remittance of sales and use taxes on the sale of goods and services made by the Contractor, or the Contractor's subcontractor. E.16. Data Privacy and Security. Data Privacy. "Personal Information" means information provided to Contractor by or at the direction of Institution, or to which access was provided to Contractor by or at the direction of Institution, in the course of Contractor's performance under this Agreement that: (i) identifies or can be used to identify an individual (including , without limitation , names, signatures, addresses, telephone numbers, e-mail addresses and other unique identifiers); or (ii) can be used to authenticate an individual (including, without limitation, employee identification numbers, government-issued identification numbers, passwords or PINs, financial account numbers, credit report information, biometric or health data, answers to security questions and other personal identifiers.

Contractor represents and warrants that its collection, access, use, storage, disposal and disclosure of Personal Information complies with all applicable federal and state privacy and data protection laws, including without limitation, the Gramm-Leach-Bliley Act ("GLBA"); the Health Information Portability and Accountability Act ("HIPAA");the Family Educational Rights and Privacy Act ("FERPA") of 1974 (20 U.S.C.1232g), the FTC's Red Flag Rules and any applicable federal or state laws, as amended ,together with regulations promulgated thereunder . Some Personal Information provided by Institution to Contractor is subject to FERPA. Contractor acknowledges that its improper disclosure or re-disclosure of Personal Information covered by FERPA may, under certain circumstances, result in Contractor's exclusion from eligibility to contract with Customer for at least five (5) years and agrees to become a 'school official' as defined in the applicable Federal Regulations for the purposes of this Agreement. Data Security. Contractor represents and warrants that Contractor will maintain compliance with the SSAE 16 standard, and shall undertake any audits and risk assessments Contractor deems necessary to maintain compliance with SSAE16. Incident Response. "Security Incident" means any reasonably suspected breach of information security, unauthorized access to any system, server or database, or any other unauthorized access, use, or disclosure of Personal Information or Highly-Sensitive Personal Information occurring on systems under Contractor's control. Contractor shall: (i) provide Institution with the name and contact information for an employee of Contractor who shall serve as Customer's primary security contact and shall be available to assist Customer twenty-four (24) hours per day, seven (7) days per week as a contact in resolving obligations associated with a Security Incident; (ii) notify Institution of a Security Incident as soon as practicable, but no later than forty eight (48) hours after Contractor becomes aware of it, except where disclosure is prohibited by law; and (iii) notify Institution of any such Security Incident by email to IncidentResponse@tbr.edu with a copy by e-mail to Contractor's primary business contact at the Institution.