Contract analysis

I. Purpose and Summary The purpose of this memorandum is to memorialize the dormant status of Matter No. 1007-00007, to document the current state of all outstanding work product, to summarize the financial status of the engagement through the date of dormancy, and to identify material considerations that will bear on any potential reactivation of the matter. This memorandum is intended to serve as a comprehensive re

II. Engagement Background A. The Client and the Commercial Partnership The Client. Vantage Mobility Systems Corp. ("VMS") is a Delaware corporation headquartered at 4700 Automation Boulevard, Suite 300, Auburn Hills, Michigan 48326. VMS designs, manufactures, and sells connected-vehicle hardware modules and integrated mobility platforms for the automotive industry. Its flagship product is the VantageLink system, a co

6. Engine diagnostic codes (OBD-II and proprietary)

13. Windshield wiper activation

14. Headlight/taillight status Of these fourteen categories, two — GPS/geolocation data and seat occupancy data — are classified as "Sensitive Vehicle Data" under VMS's internal data governance policy (the "VMS Data Governance Policy," version 4.2, effective March 2022). The Sensitive Vehicle Data designation is triggered because these two categories, when combined with vehicle identification numbers ("VINs") or othe

III. Chronological Summary of Engagement Activity The following is a chronological summary of material events and milestones during the active period of the engagement, from opening through dormancy designation: September 14, 2022. The engagement was formally opened. Calderwood & Harkness's conflicts department cleared the engagement, and Matter No. 1007-00007 was assigned. An engagement letter was executed by Thomas

IV. Current Status of the DPA — Version 3.1 A. Overview. The DPA is currently at version 3.1, dated December 16, 2022, as returned by Whitfield, Barrow & Crane LLP. This version represents WBC's most recent redline and reflects Meridian's positions on the four previously unresolved issues as well as two newly raised issues. Six material issues remain open and unresolved as of the date that the matter was placed on ho

V. Regulatory Compliance Work Product A. Applicable Statutes Analyzed The regulatory applicability memorandum prepared on October 18, 2022, analyzed the applicability of the following statutes to the data processing contemplated by the DPA:

1. Michigan Identity Theft Protection Act (MCL 445.61 et seq.) — Applicable as the governing law of the DPA is Michigan and VMS is a Michigan-headquartered entity. The Act imposes obligations with respect to the security of personal information, breach notification, and third-party service provider oversight.

2. California Consumer Privacy Act / California Privacy Rights Act (Cal. Civ. Code § 1798.100 et seq., as amended by Proposition 24, effective January 1, 2023) — Applicable to the extent that vehicle telemetry data constitutes "personal information" of California residents and VMS or Meridian meets the jurisdictional thresholds under the CCPA/CPRA.

3. Federal Drivers' Privacy Protection Act (18 U.S.C. § 2721 et seq.) — Applicable to the extent that any of the data categories processed under the DPA constitute "personal information" derived from motor vehicle records, as defined under the DPPA. The governing law of the DPA is Michigan. The DPA was drafted subject to Michigan law, and the parties have not disputed the choice of law. However, the multistate nature

VI. Financial Summary A. Fees and Hours The following table summarizes the total hours recorded and gross fees generated by each timekeeper on the engagement from opening through the date of dormancy: The allocation of hours across timekeepers reflects the typical staffing model for a data processing agreement negotiation of this scope and complexity. The majority of the hours were recorded by the lead associate (Ala

VII. Work Product Inventory The following is a complete inventory of all Calderwood & Harkness work product and key correspondence generated or received in connection with this engagement. All items are maintained on Calderwood & Harkness's document management system under Matter No. 1007-00007.

1. Engagement Letter — Dated September 14, 2022. Executed by Thomas Langford on behalf of VMS.

2. DPA v1.0, Initial Draft — Dated September 28, 2022. Forty-seven (47) pages including body and three annexes: Annex A (Data Categories and Processing Description), Annex B (Technical and Organizational Measures), and Annex C (Approved Sub-Processors, listing Cloudvault Infrastructure, Inc.).

3. Transmittal Letter to WBC — Dated October 7, 2022. Cover letter from Rachel Bernstein to Catherine Ng transmitting DPA v1.0 following VMS internal approval.

4. Regulatory Applicability Memorandum — Dated October 18, 2022. Analysis of the applicability of the Michigan Identity Theft Protection Act, CCPA/CPRA, and DPPA to the data processing contemplated by the DPA, with DPA provision recommendations.

5. DPA v2.0, WBC Redline — Received October 21, 2022. WBC's redlined version of DPA v1.0, containing 63 substantive comments and proposed revisions.

6. Internal Issues Memorandum — Dated November 4, 2022. Identified 11 material open issues from WBC's redline of DPA v2.0, with categorization, significance assessment, and negotiation strategy recommendations. Circulated to Diana Kowalski and Thomas Langford at VMS.

7. Sub-Processor Risk Analysis Memorandum — Dated November 10, 2022. Evaluation of Cloudvault Infrastructure, Inc. as proposed sub-processor, including corporate profile, security certifications, incident history, and recommended hybrid sub-processor approval approach.

8. Negotiation Call Summary Memorandum — Dated November 15, 2022. Summary of the negotiation call held among Calderwood & Harkness, WBC, VMS (Diana Kowalski), and Meridian (Lena Torrance). Documents resolutions on 7 of 11 open issues and identifies 4 remaining unresolved issues.

9. DPA v3.0, Revised Draft — Dated December 2, 2022. Incorporating agreed resolutions on 7 issues and VMS's positions on 4 remaining open issues. Circulated to WBC in clean and redlined versions.

10. DPA v3.1, WBC Revised Return — Received December 16, 2022. WBC's revised redline addressing 4 remaining issues and raising 2 new issues (international data transfer restrictions and sub-processor audit rights). This is the most current version of the DPA.

11. Cross-Border Data Transfer Impact Assessment Memorandum — Dated December 20, 2022. Analysis of implications of Meridian's potential future migration to Cloudvault's proposed Dublin, Ireland data center, including GDPR applicability assessment, transfer mechanism evaluation, and recommended DPA provisions.

12. Client Instruction Email from Thomas Langford — Dated January 18, 2023. Email from VMS General Counsel instructing Calderwood & Harkness to pause DPA negotiations pending finalization of revised commercial term sheet.

13. Rachel Bernstein Acknowledgment Email — Dated January 18, 2023. Email from Rachel Bernstein acknowledging Thomas Langford's instruction and confirming the pause.

14. Formal Hold Notification Letter to WBC — Dated January 25, 2023. Letter from Calderwood & Harkness to Catherine Ng at WBC confirming the pause in negotiations and preservation of all draft positions and open issues. Note: The Pinehurst Cybersecurity Advisors LLC preliminary security assessment (delivered to VMS on November 22, 2022) is VMS's document and was prepared by Pinehurst under a separate engagement with

VIII. Reactivation Considerations The following considerations are intended to provide a roadmap for the efficient reactivation of this matter if and when VMS instructs Calderwood & Harkness to resume work on the DPA. A. Revised Commercial Terms As discussed in Section III above, on January 10, 2023, Meridian CEO Priya Ramanathan informed VMS Vice President Marcus Chen that Meridian intended to rescope the commercial

6. Headlight/taillight status The eight categories eliminated from the rescoped partnership include the two Sensitive Vehicle Data categories (GPS/geolocation and seat occupancy) as well as six additional categories (acceleration/deceleration, in-cabin temperature, in-cabin humidity, seatbelt status, ambient noise levels, and windshield wiper activation). No revised commercial term sheet has been executed between VMS

IX. File Retention and Administrative Matters A. File Retention All electronic work product, correspondence, and draft documents generated or received in connection with Matter No. 1007-00007 are maintained on Calderwood & Harkness's document management system (Tidewater Systems) under the matter number. All documents are indexed and organized by date and document type. The work product inventory set forth in Section

1. Whether VMS and Meridian have executed a revised commercial term sheet and, if so, the material terms of the revised partnership;

2. Whether VMS wishes to reactivate the DPA engagement;

3. Whether there have been any material developments in VMS's data governance practices or reg