Request for Proposals - Recreation Registration Software Management System for Parks & Recreation

REQUEST FOR PROPOSALS
Recreation Registration Software Management System
for
Parks and Recreation
Proposals Due: July 6, 2026 @ 3:00 p.m.
TO:
CITY OF LATHROP
PARKS AND RECREATION DEPARTMENT
ATTN: MELISSA STATHAKOPOULOS
390 TOWNE CENTRE DRIVE
Phone: (209) 941-7364
Email: mstathakopoulos@ci.lathrop.ca.us
Page 1 of 20

City of Lathrop
Request for Proposals
for
Recreation Registration Software Management System
NOTICE OF REQUEST FOR PROPOSAL
1. NOTICE IS HEREBY GIVEN that the City of Lathrop (hereinafter "City") requests proposals
(hereinafter "Proposal") for a new RECREATION REGISTRATION SOFTWARE MANAGEMENT
SYSTEM and will receive proposals in the office of PARKS AND RECREATION, 390 Towne Centre
Drive, Lathrop, CA 95330, up to 3:00 p.m. on July 6, 2026. ATTN: MELISSA STATHAKOPOULOS,
PARKS AND RECREATION MANAGER.
2. The services to be performed by the successful proposer(s) are described in the Request for
Proposals (RFP) which is included herein. RFPs are available from the City website: Bids and RFPs |
City of Lathrop CA.
3. Proposals shall be submitted and clearly marked as follows: "Sealed Proposal for Recreation
Registration Software Management System" - "DO NOT OPEN WITH REGULAR MAIL"
4. Entities interested in submitting a proposal should contact Melissa Stathakopoulos at
mstathakopoulos@ci.lathrop.ca.us with the name of the representative, phone number and e-mail
address to ensure receipt of further communications relaying to this RFP, including, but not limited to,
Addendums.
5. For general questions, contact Melissa Stathakopoulos, Parks and Recreation Manager
electronically at mstathakopoulos@ci.lathrop.ca.us. Responses to questions will be e-mailed to all who
have provided a representative's information pursuant to the above #4.
6. All responsive proposals shall be reviewed and evaluated by the City in order to determine which
proposer best meets the City's needs by demonstrating the competence and professional qualifications
necessary for the satisfactory performance of the required services. The criteria by which the City shall
evaluate Proposals are set forth in the RFP.
7. The City Reserves the right to reject any and all Proposals or waive any irregularities in the
Proposal, the RFP or the proposal process.
1.1 GENERAL INFORMATION
The City requests proposals for a new Recreation Registration Software Management System with real-
time Internet Registration to support: program, classes, facility reservations (e.g. fields, gyms,
community centers, picnic shelters), memberships, league scheduling, point of sale, shelter reservations,
senior programs (including trips), payment processing, customized reporting and any related
professional services required to implement/train new users on the software.
Page 2 of 20

The City currently uses REC DESK software from Clubessential Holdings for business needs including
class registration, facility bookings, and point of sale transactions.
The City's objective is to establish a long-term relationship with a vendor capable of keeping current
with recreation management industry trends and best practices. The vendor should be capable of
supporting the City's current and future needs and committed to a highly responsive customer service
approach and to the constant evolution of the proposed Recreation Registration Software Management
System. The new system should strengthen the relationship between the City, our community members,
and community partners.
The selected vendor must be capable of providing all services, including training and user support,
technical support and security, and back up and business protocols. The City desires a single vendor for
all services identified in the RFP. However, the City will consider alternates such as a prime vendor
subcontracting with a third-party service provider for a specific function.
1.2 BACKGROUND
The City of Lathrop is located in the Northern San Joaquin Valley, east and west of the San Joaquin
River. Interstate 5, Interstate 205 and State Route 120 intersect within the City. Lathrop was
incorporated in 1989, with its first General Plan adopted in 1991.
Lathrop is centrally located within a 30-minute commute of Tracy, Manteca, Stockton, Lodi, Modesto,
Livermore and Pleasanton. Lathrop's population as of January 1, 2026, reported by the State of
California Department of Finance, is 40,942, which represents a 5.5% growth from 2025. The City of
Lathrop continues to make headlines as one of California's fastest growing communities.
The Recreation Registration Software Management Systems is used to manage registrations and
memberships for leisure, seniors, sports, teens and youth enrichment programs, to manage facilities and
rentals, and to track associated accounting and customer contact information for these programs.
1.3 SCOPE OF SERVICES
The scope of services should include all software, hardware and services required to support the
implementation, data extraction and migration, and ongoing system functions.
At a minimum, the vendor's services and software capabilities are required to include the following:
* Must be a previously established Registration Software System
* Onsite and Online Activity Registration, with associated transaction accounting
* Facility Management and Reservations, with associated transaction accounting
* Membership Management and Pass Validation, with associated transaction accounting
* Individual, Family and Organizational Account Management
* Cashiering and Point of Sale, with associated transaction accounting
* All inclusive, No additional fees
* Team sports scheduler
* Operational analytics
Page 3 of 20

* System Security, Redundancy and Ongoing Maintenance and Support
* Accounting and Finance coordination with City policies, including integration with New World
Systems Software from Tyler Technologies
* Instructor Management
1.4 IMPLEMENTATION TIMELINE
The City expects to begin implementation with contract execution in preparation for the Summer 2027
registration quarter. The system should be in place and live for summer registrations beginning May
1, 2027. Vendors should be prepared to propose a singular solution and approach that addresses this
timeline.
1.5 RFP SCHEDULE OF EVENTS
Table 1, RFP Schedule of Events, identifies the City's best estimate of the schedule that will be followed.
The City encourages vendors to carefully consider and plan according to the presented schedule of
events.
Table 1 - RFP Schedule of Events
RFP Event Date
Deadline for Written Questions and Comments June 19, 2026
City Issues Responses to Written Questions and Comments June 24, 2026
Deadline for Submitting a Proposal July 6, 2026, by 3:00 PM
City Completes Review, Demos and Ranking July 30, 2026
City Council Approves Contract September 14, 2026
Project Implementation Start Date September 2026 through May 2027
Go Live Date No Later than May 1, 2027
Proposers should be aware that short-listed vendors may be required to perform a full (possibly up to
two (2) days) proof-of capabilities ("POC") demonstrations to allow staff to fully understand the
proposed solution. The POC is not intended to be a generic demonstration of the application, but rather
a demonstration of specific product functionality deemed most critical to the City using scenarios
provided by the City. Proposers must be prepared to invest the time and resources in the POC to
be successful in this procurement.
Time is of the essence with respect to any of the deadlines set forth above. Notwithstanding the
foregoing, the City reserves the right, at its sole discretion, to adjust this schedule, as it deems necessary.
Notifications of any adjustment to the RFP Schedule of Events will be provided to all vendors that
submitted a Letter of Intent to Propose.
Page 4 of 20

1.6 EVALUATION CRITERIA
The City will review all proposals received as part of a documented evaluation process. The sole purpose
of the proposal evaluation process is to determine which solution best meets the City's needs. The
criteria that will be used to evaluate proposals may include, but are not limited to the following:
* Understanding of City's business purpose and needs
* Total cost, including application software, licenses, training, installation, support, maintenance,
hardware, hosting or server costs, and annual fees
* Software features
* Seamless integration of system modules
* Ease of use by the customer, including mobile applications
* Implementation approach
* Technical compatibility, including integration with New World Systems Software
* Security, compliance, and risk management maturity, including alignment with NIST
Cybersecurity Framework (CSF), NIST SP 800-53 security controls, vulnerability management
practices, incident response capabilities, logging and monitoring capabilities, independent
security assessments, and overall cybersecurity program maturity
* Commitment to ongoing customer support
* Future technology direction
* Past experience with similar organizations
* Client references, including satisfaction of prior/current clients
The City may evaluate and score vendor responses related to cybersecurity, privacy, compliance, and
risk management as part of the overall proposal evaluation process. Security-related evaluation factors
may include, but are not limited to:
* NIST CSF and NIST SP 800-53 alignment
* Security certifications and attestations
* Vulnerability management and patch management practices
* Logging, monitoring, and audit capabilities
* Incident response and breach notification procedures
* Disaster recovery and business continuity capabilities
* Third-party security assessments and penetration testing
* Data protection and privacy controls
The City's ultimate acceptance of any proposal and its award of any contract will be based on a
combination of the above-referenced evaluation criteria and a determination of the best overall value for
the City.
1.7 RFP COORDINATOR & QUESTIONS PERTAINING TO THE RFP
All communications concerning this RFP must be submitted in email to the RFP Coordinator, Melissa
Stathakopoulos, Parks and Recreation Manager, at mstathakopoulos@ci.lathrop.ca.us. The RFP
Page 5 of 20

Coordinator will be the sole point of contact for this RFP. Unauthorized vendor contact with anyone
else in the City may result in disqualification of the vendor's bid.
Specific questions concerning the RFP should be submitted via email to the RFP Coordinator before the
date identified in Section 1.5 RFP Schedule of Events. Vendor questions should clearly identify the
relevant section of the RFP and page number(s) related to the question being asked.
All vendors who have notified the City of their intent to respond to the RFP will be provided, via email,
with a copy of any question submitted and the answer given by the City per the RFP Schedule of Events.
The City is not responsible for delayed or lost email, regardless of the cause.
1.8. PROPOSAL PREPARATION COST
The City will not pay any costs associated with the preparation, submittal, or presentation of any
proposal.
Proposals should be prepared simply and economically and provide a straightforward, concise
description of the Proposer's company, qualifications, proposed solution, and capabilities to satisfy the
requirements of this RFP. Emphasis should be on completeness and clarity of content. Glossy sales and
marketing brochures are not necessary or desired.
1.9 RFP AMENDMENTS AND CANCELLATION
The City reserves the unilateral right to amend this RFP in writing at any time. The City also reserves
the right to cancel or reissue all or any part of the RFP at its sole discretion. If an amendment is issued,
it will be provided to all vendors submitting a Letter of Intent to Propose. Vendors will respond to the
final written RFP including any exhibits, attachments, and amendments issued by the City.
1.10 PROPOSAL SUBMITTAL
Proposals are to be submitted in sealed packages by 3:00pm (PST) on July 6, 2026. Proposers assume
the risk of the method of delivery chosen. The City assumes no responsibility for delays caused by any
delivery service. A Proposer's failure to submit as required before the deadline may cause the proposal
to be disqualified.
1.10.1 Proposers are required to submit ONE (1) original, signed master, FIVE (5) hard copies and
ONE (1) electronic.pdf copy via email.
The proposal package should be mailed, couriered, or hand delivered to the following address:
City of Lathrop
Attn: Melissa Stathakopoulos, Parks and Recreation Manager
Parks and Recreation Department
390 Towne Centre Drive
Lathrop, CA 95330
Submittal Email:
Melissa Stathakapoulos, Parks and Recreation Manager, mstathakopoulos@ci.lathrop.ca.us
Page 6 of 20

All proposals must be received by the City by 3:00pm (PST) on July 6, 2026. Proposals received after
this time and date will be returned unopened. Postmarks will not be accepted as proof of receipt.
1.10.2 Failure to comply with the requirements of this RFP may result in disqualification.
1.10.3 Signature on the proposal by the proposer constitutes acceptance by the proposer of terms,
conditions, and requirements set forth herein.
1.10.4 Use the Submittal Checklist (Section 7.1.1 Attachment 1: RFP Checklist) to ensure that all
required documents, forms, and attachments have been completed and submitted as instructed.
1.11 ORGANIZATION OF PROPOSAL
The proposal must be organized into the following major sections. Specific instructions for each section
are provided in SECTION 5.1: DETAILED SUBMITTAL REQUIREMENTS of this RFP. Any
required attachments must be included in the proper section as indicated by the instructions.
Item Item
Number
1 Executive Summary and Introductory Material
2 Company Background
3 Proposed Software
4 Professional Services
5 Technical Information
6 Maintenance and Support
7 Sample Documents
8 Price Proposal
2.1 EXISTING ENVIRONMENT
2.1.1 Current Business Technology
The tables below summarize the estimated volumes of transactions and records associated with the
application processing requirements and preliminary conversion requirements. Volumes reflect
FY24|25 (7.1.2024 - 6.30.25) unless otherwise indicated.
Page 7 of 20

2.1.2 Registration, Facility and Membership Volumes
Volume Description Quantity FY 24|25
Total Active Account Records 22,501
Program Registration Processed 6,771
*Facility Reservations 2,166
Members 22,501
Memberships 147
POS transactions 619
Instructors (Contracted) 42
*Examples: = Shelters, Fields, and Buildings
2.1.3 Transaction Breakdown
Transaction Type Total for FY 24|25 (7.1.2024 -
6.30.2025)
Cash $23,915.73
Check $21,722.58
Credit Cards $480,210.89
TOTAL $525,849.20
3.1 TECHNICAL INFORMATION
3.1.1 Compliance and Data Protection
Vendors must demonstrate compliance with applicable California and Federal data protection and
privacy regulations, including but not limited to:
* California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA).
* California Data Breach Notification Law (SB-24).
* Children's Online Privacy Protection Act (COPPA), where applicable.
* Family Educational Rights and Privacy Act (FERPA), where applicable.
* Health Insurance Portability and Accountability Act (HIPAA), where applicable.
Vendors must provide evidence of data protection policies and a Data Protection Impact Assessment
(DPIA) or equivalent process. The City reserves the right to audit compliance documentation annually.
3.1.2 Service Level Agreements (SLAs)
Vendors must provide Service Level Agreements (SLAs) detailing system availability, uptime, and
performance metrics. At a minimum, the SLAs must include:
- 99.9% system uptime, excluding scheduled maintenance.
- Response time commitments for support requests (Critical: <2 hours; High: <4 hours; Medium: <1
business day; Low: <3 business days).
Page 8 of 20

- System performance requirements: average page load times <2 seconds, transaction processing <5
seconds.
Vendors must provide historical SLA compliance records and remedies/penalties for failure to meet
SLA commitments.
3.1.3 Browser Security and Authentication
The system must adhere to modern web security practices, including:
* Support for current versions of major browsers (Chrome, Edge, Firefox, Safari).
* Implementation of HTTPS/TLS 1.2 or higher for all connections.
* Secure cookie management and session handling.
* Multi-Factor Authentication (MFA) for all administrative and privileged access accounts.
* Role-Based Access Control (RBAC) for staff and customer accounts.
* Support for Single Sign-On (SSO) using SAML 2.0 or OAuth 2.0.
3.1.4 PCI Compliance
Vendors must demonstrate full compliance with the Payment Card Industry Data Security Standard (PCI
DSS v4.0).
Vendors must clarify whether PCI compliance scope is managed directly or through a third-party
payment gateway provider.
Tokenization and fraud prevention tools must be implemented for all payment transactions.
Vendors must provide proof of annual PCI DSS certification and compliance reporting.
3.1.5 Cybersecurity Standards and Testing
Vendors must align their security framework with the National Institute of Standards and Technology
Cybersecurity Framework (NIST CSF) and Center for Internet Security (CIS) Critical Security Controls.
All data must be encrypted at rest using AES-256 or higher and in transit using TLS 1.2 or higher.
Vendors must conduct and provide results of annual independent third-party penetration tests and
vulnerability assessments.
Incident response procedures must be documented, and vendors must notify the City within 24 hours of
any security incident involving City data.
Vendors shall provide a summary matrix identifying alignment with NIST Cybersecurity Framework
(CSF) functions and applicable NIST SP 800-53 security controls relevant to the proposed solution.
3.1.6 Hosting Environment and Data Residency
The proposed solution shall be hosted within the United States. All City data, backups, disaster recovery
data, and associated processing environments must remain within the United States unless otherwise
approved in writing by the City.
The Vendor shall provide documentation describing the hosting environment, system architecture,
security architecture, data flow, security controls, compliance certifications, and operational security
practices applicable to the proposed solution.
Page 9 of 20

At a minimum, the Vendor shall provide evidence of current SOC 2 Type II certification and ISO 27001
certification, or equivalent independent third-party security assessments demonstrating the effectiveness
of security controls.
The Vendor shall demonstrate alignment with the National Institute of Standards and Technology (NIST)
Cybersecurity Framework (CSF) and applicable NIST SP 800-53 security controls. Vendors shall
provide a summary of their security control framework and identify any independent audits, assessments,
certifications, or compliance reports supporting their security program.
Preference may be given to solutions hosted on cloud infrastructure that has achieved FedRAMP
Authorization or that can demonstrate security controls, continuous monitoring capabilities, and
independent third-party validation substantially equivalent to FedRAMP Moderate requirements.
The Vendor shall provide a current system architecture diagram that clearly identifies:
* Hosting provider(s) and cloud platform(s) utilized
* Production, development, test, staging, and disaster recovery environments
* High Availability (HA) architecture and redundancy mechanisms
* Disaster Recovery (DR) architecture, failover processes, and recovery locations
* Security zones, network segmentation, and major system components
* Data storage locations, backup locations, and replication architecture
* External integrations, interfaces, and third-party services
* Identity and authentication components, including Single Sign-On (SSO) integrations where
applicable
* Major security controls, monitoring systems, and logging architecture
The Vendor shall provide the following information as part of its proposal:
* Recovery Time Objective (RTO) and Recovery Point Objective (RPO) commitments
* Data backup frequency, retention periods, and restoration procedures
* High Availability (HA) and Disaster Recovery (DR) testing frequency and results summary
* Continuous monitoring, logging, and vulnerability management practices
* Independent penetration testing and security assessment practices
* Data ownership, portability, and export capabilities
* Security incident response and notification procedures
The Vendor shall maintain documented business continuity and disaster recovery plans and shall provide
a summary of those plans upon request.
The City retains sole ownership of all data generated, collected, stored, transmitted, or processed within
the system. The Vendor shall provide the City the ability to export all City data, metadata, audit logs,
configuration information, and supporting records in a commonly used, non-proprietary format at any
time during the contract term and upon contract termination without additional fees beyond those
identified in the contract.
Page 10 of 20