Professional Services Rate Card (Colorado)

PROFESSIONAL SERVICES RATE CARD

STATE OF COLORADO

DOCUMENT INFORMATION

1. STANDARD HOURLY RATES

*Premium rates apply outside standard business hours or on Colorado state holidays.

Colorado State Holidays

• New Year's Day
• Martin Luther King Jr. Day
• Presidents' Day
• Memorial Day
• Independence Day
• Labor Day
• Frances Xavier Cabrini Day
• Veterans Day
• Thanksgiving Day
• Christmas Day

2. BILLING TERMS

3. INTELLECTUAL PROPERTY AND WORK PRODUCT

Ownership of Work Product

Select one of the following ownership structures for all deliverables, reports, code, documentation, and other work product ("Work Product") created by Provider under this Rate Card:

☐ Option 1 — Client Owns All Work Product (Work Made for Hire). All Work Product created by Provider in the performance of services shall be considered "work made for hire" as defined under 17 U.S.C. § 101. To the extent any Work Product does not qualify as work made for hire, Provider hereby irrevocably assigns to Client all right, title, and interest in and to such Work Product, including all intellectual property rights therein. Provider shall execute any documents reasonably requested by Client to perfect such assignment.

☐ Option 2 — Provider Retains Ownership; Client Receives License. Provider shall retain all right, title, and interest in and to the Work Product. Provider hereby grants Client a non-exclusive, perpetual, irrevocable, royalty-free, fully paid-up license to use, reproduce, modify, distribute, and display the Work Product for Client's internal business purposes. The scope of the license shall be further defined in the applicable statement of work or master services agreement.

☐ Option 3 — Joint Ownership. Provider and Client shall jointly own all right, title, and interest in and to the Work Product. Each party may use, license, and exploit the Work Product without the consent of or accounting to the other party, unless otherwise agreed in writing.

Colorado Practice Note: Federal copyright law (17 U.S.C. § 101) defines "work made for hire" narrowly for independent contractors — it applies only to nine enumerated categories and requires a signed written agreement. Under Community for Creative Non-Violence v. Reid, 490 U.S. 730 (1989), the U.S. Supreme Court held that the common-law agency test governs whether a hired party is an employee for work-made-for-hire purposes. Colorado does not have a state-specific employee invention assignment restriction statute (unlike California, Illinois, or Washington). Ownership of inventions and work product is governed by contract and common law. Accordingly, parties should clearly specify ownership by written agreement rather than relying on default rules. Where Provider personnel are independent contractors, a backup assignment clause (as in Option 1) is strongly recommended.

Provider Pre-Existing IP

All intellectual property owned by or licensed to Provider prior to the effective date of this Rate Card, and any improvements thereto made outside the scope of services ("Provider IP"), shall remain the sole property of Provider. To the extent Provider IP is incorporated into any Work Product delivered to Client, Provider hereby grants Client a non-exclusive, perpetual, irrevocable, royalty-free license to use such embedded Provider IP solely as part of the delivered Work Product.

Client Materials

All data, content, trademarks, and other materials provided by Client to Provider in connection with the services ("Client Materials") shall remain the sole property of Client. Provider shall use Client Materials only as necessary to perform the services and shall return or destroy all Client Materials upon completion of the engagement or upon Client's request.

4. DATA PROTECTION AND PRIVACY

Applicability

Select one:

☐ Provider will access, receive, process, or store personal data on behalf of Client in connection with the services.

☐ Provider will NOT access, receive, process, or store personal data on behalf of Client. (If selected, the remainder of this Section 4 does not apply.)

Data Handling Obligations

Where Provider processes personal data on behalf of Client, Provider shall:

1. Process personal data only in accordance with Client's documented instructions and solely for the purpose of performing the services.
2. Implement and maintain reasonable administrative, technical, and physical safeguards to protect personal data against unauthorized access, use, disclosure, alteration, or destruction.
3. Not sell, rent, or otherwise disclose personal data to any third party except as required to perform the services or as required by law.
4. Notify Client of any confirmed or reasonably suspected data breach involving personal data within [____] hours of discovery, and provide sufficient information for Client to comply with applicable notification requirements, including C.R.S. § 6-1-716.
5. Cooperate with Client in investigating and remediating any data breach, including providing timely access to relevant records and personnel.
6. Upon termination or expiration of the engagement, return or securely destroy all personal data in Provider's possession within [____] days, and certify such return or destruction in writing.
7. Permit Client (or Client's designated auditor) to conduct reasonable audits of Provider's data handling practices upon [____] days' prior written notice, no more than once per calendar year absent cause.

Subprocessors

Provider shall not engage any subcontractor or subprocessor to process personal data on behalf of Client without Client's prior written consent. Provider shall impose data protection obligations on any approved subprocessor that are no less protective than those set forth in this Section 4 and shall remain fully liable for any subprocessor's acts or omissions.

Compliance with Applicable Law

Both parties shall comply with all applicable data protection and privacy laws, including without limitation:

• Colorado Privacy Act (CPA) — C.R.S. § 6-1-1301 et seq. (effective July 1, 2023; comprehensive consumer data privacy law granting Colorado consumers rights to access, correct, delete, and port personal data, and to opt out of targeted advertising, sale of personal data, and certain profiling; imposes data protection assessment requirements on controllers)
• Colorado Data Breach Notification Law — C.R.S. § 6-1-716 (requiring a covered entity to investigate a possible breach and, unless the statutory misuse standard is cleared, give affected-resident notice without unreasonable delay and no later than 30 days after determination; AG notice has a separate 500-or-more-resident threshold)
• Colorado Computer Crime Statute — C.R.S. § 18-5.5-102 (prohibiting unauthorized access to computer systems and data)
• Federal Regulations — as applicable to the nature of the data processed, including HIPAA (45 C.F.R. Parts 160 and 164), the Gramm-Leach-Bliley Act (15 U.S.C. § 6801 et seq.), and FERPA (20 U.S.C. § 1232g)
• Cross-State Privacy Laws — where Client or its customers are located in states with comprehensive consumer privacy laws (e.g., California Consumer Privacy Act, Virginia Consumer Data Protection Act, Connecticut Data Privacy Act), Provider shall cooperate with Client to ensure compliance with such laws to the extent applicable

Colorado Practice Note: Colorado is one of the first states in the nation to enact a comprehensive consumer data privacy law. The Colorado Privacy Act (CPA), C.R.S. § 6-1-1301 et seq., took effect on July 1, 2023, and is actively enforced by the Colorado Attorney General. The CPA applies to entities that conduct business in Colorado or produce products or services targeted to Colorado residents and that either (a) control or process the personal data of 100,000 or more consumers per year, or (b) derive revenue from the sale of personal data and control or process the personal data of 25,000 or more consumers. Unlike some other state privacy laws, the CPA requires controllers to conduct data protection assessments for processing activities that present a heightened risk of harm. The Colorado AG has issued detailed implementing rules (4 CCR 904-3). Practitioners should ensure that any professional services engagement involving Colorado consumer data includes CPA-compliant data processing agreements, privacy notices, and consent mechanisms. Under C.R.S. § 6-1-716, required covered-entity notice has a 30-day outside limit measured from breach determination, subject to the statute's investigation, misuse, role, threshold, encryption/key, law-enforcement, and restoration rules.

5. ELECTRONIC SIGNATURES

The parties agree to conduct this transaction electronically. Colorado UETA applies subject to other law, and electronic form alone is not a reason to deny effect. Typed, digital, platform, PDF, or image signatures still require attribution, authority, consent, delivery, and every other applicable validity or professional-formality element; this clause does not waive a nonwaivable challenge.

6. ACKNOWLEDGMENT

Provider: _________________________________ Date: ___________