Supplier Code of Conduct

Introduction

Marcus Thomas LLC (“Agency”) is committed to conducting its business in an ethical, legal and socially responsible manner. Agency engages with its suppliers to share this commitment; therefore, it has established this Supplier Code of Conduct. Suppliers, their employees, and any subcontractors must comply with the requirements set out in the Supplier Code of Conduct to do business with Agency or any of its affiliates.

Ethics

In your capacity as a supplier, Agency expects you to know and follow all federal, state, provincial, and international laws and regulations that apply to your work, wherever you do business.

Agency expects its suppliers to comply with all employment and safety laws, support human rights for all people, and foster a diverse and inclusive workplace.

A supplier may never offer, authorize, give, promise, or accept any form of a bribe or improper payment. A supplier should not receive or offer a gift or benefit exceeding the value of $500 USD while working on Agency’s behalf.

Security

A supplier must ensure the security of its physical and digital work environments by following industry best practices related to IT security, including but not limited to:

• Participating in annual security training
• Ensuring strong passwords are used with multi-factor authentication (MFA) for all critical systems and devices
• Maintaining regular updates on all hardware and software
• Maintaining anti-malware software on all systems (e.g., antivirus, firewalls, etc.)
• Leveraging appropriate encryption standards for networking technologies, as well as for data storage and data transfers

A supplier shall not attempt to access any data or programs contained on Agency’s systems for which they do not have authorization. All systems and data should only be used to deliver services agreed to or based on direction from Agency.

A supplier must adhere to Agency’s Clean Desk Policy, which applies to both its offices and external workspaces (e.g., home, remote locations), including:

• Putting away/locking up any sensitive items when not at your desk
• Not leaving sensitive information in publicly viewable areas
• Using secure destruction or returning any physical items as requested or required

The loss of equipment or assets containing or accessing Agency information or Agency client information should be reported to Agency within 12 hours; any theft should be reported immediately.

Data Privacy

Suppliers are expected to understand Agency’s data classifications and use them in decision-making around the handling of data.

Information can be stored on any file system, including approved SaaS solutions used in the course of business. Data can be shared with third parties with Agency’s permission.

Confidentiality

All information and materials that a supplier may be exposed to through the Supplier Agreement must be treated as confidential, whether or not it is a “trade secret” under applicable law, and must not be disclosed to any other party without written authorization from Agency. The supplier must design and maintain processes to provide appropriate protections for this information.

Diversity, Equity and Inclusion

Agency believes that including diverse partners in its business is important to its success. For that reason, Agency seeks to work with suppliers that perform at a high level and contribute their diverse perspectives to Agency’s work. Agency expects that, where applicable, its suppliers identify, adopt, and integrate diversity into their own supply processes and hiring, including equal treatment of diverse-owned businesses in the supplier selection process.

Suppliers should make all employment-related decisions based on skills and aptitude, never on personal characteristics protected by federal, state, provincial, or international law.

The supplier will produce work that is inclusive, respectful, and considerate of different communities and cultures.

Use of Materials

The supplier will only submit material to Agency that was originally created by the supplier and does not infringe on copyright or intellectual property rights of any third party.

Suppliers are responsible for protecting both Agency’s property and its clients’ assets. All assets should be used only for their authorized and intended purpose.

Written permission must be obtained from Agency to use Agency client work in the supplier’s portfolio.

Use of Generative Artificial Intelligence (AI) Tools

Artificial intelligence (AI) tools offer benefits and opportunities to Agency’s work, as well as risks to Agency and clients. As the AI landscape continues to evolve, Agency expects suppliers to interact with AI technologies accountably, responsibly, and ethically.

Any asset inputted to an AI tool, whether text, image, video, audio, data sets, or otherwise, should meet the following requirements:

• Does not include any copyrighted or trademarked material
• Does not include any Agency, sensitive or confidential material (as defined above)
• Prompts cannot be done with the intent of generating output that is in violation of copyright or trademark
• If the asset is client-owned, permission must have been granted for use in an AI tool

Suppliers are required to disclose to Agency when AI is used in performance of work on behalf of Agency.

Suppliers must be mindful of potential infringements on copyrights, trademarks, patents, or other legal protections from the input or output generated from AI tools.

Values Alignment

It is expected that Agency suppliers have a reasonable alignment to Agency’s corporate values:

• Community - Work to make workplace, industry and individual communities better.
• Accountability - Be accountable to others and deliver on what is expected.
• Respect and Collaboration - Be respectful of others and open to other perspectives.
• Inspired Thinking - Demonstrate curiosity; seek inspiration.
• Diversity - The work I produce is respectful and considerate of different communities and cultures.