Contract analysis

1. Data retention period — VMS's position of 90-day rolling deletion versus Meridian's request for 18-month retention for model-training purposes.

2. Sub-processor approval rights — VMS's prior written consent requirement versus Meridian's proposed general authorization model with a 30-day objection window.

3. Breach notification timeline — VMS's 24-hour notification requirement versus Meridian's proposed 72-hour standard.

4. Liability cap — VMS's position of uncapped liability for data breaches and unauthorized processing versus Meridian's proposed cap of $15 million.

5. International data transfer restrictions — newly raised by WBC in v3.1, relating to potential future migration of data processing to Cloudvault Infrastructure, Inc.'s Dublin, Ireland facility.

6. Sub-processor audit rights — also newly raised in v3.1, concerning the scope, frequency, and cost-sharing of audits (Meridian proposed annual audits only with 30 calendar days' notice and a $25,000 cost-sharing cap per audit). All existing draft positions and open issues will be preserved in the file. On a forward-looking basis, I want to flag a few points for your consideration as the revised commercial discussio

6. Headlight/taillight status Notably, the rescoped categories do not include GPS/geolocation or seat occupancy data. In other words, none of the data categories classified as "Sensitive Vehicle Data" under VMS's internal data governance policy remain in scope. These changes fundamentally alter the risk profile and data protection requirements of the arrangement. The commercial terms will also need to be renegotiated