Contract analysis

I. Executive Summary This memorandum analyzes the eleven material open issues arising from the redlined Data Processing Agreement version 2.0 ("DPA v2.0" or the "Redline") returned by Whitfield, Barrow & Crane LLP ("WBC"), outside counsel to Meridian Telematics Solutions, Inc. ("Meridian"), on October 21, 2022. The purpose of this memorandum is to provide Vantage Mobility Systems Corp. ("VMS") and its privacy leaders

II. Summary Table of Material Open Issues The following table provides a high-level overview of each of the eleven material open issues, the relevant DPA provision, the positions of each party, and our priority classification. Detailed analysis follows in Part III.

III. Detailed Analysis of Each Material Open Issue Issue 1: Data Retention Period (DPA v1.0, Section 7.3) A. VMS Position (DPA v1.0) DPA v1.0, Section 7.3, provides that all raw vehicle telemetry data transmitted by VMS or collected by Meridian on VMS's behalf is subject to a ninety-day rolling deletion cycle. Specifically, after Meridian has completed its processing of raw telemetry data and delivered the resulting

Section 8 also requires that Meridian impose on any approved sub-processor, through a written sub-processing agreement, data protection obligations that are substantively equivalent to those imposed on Meridian under the DPA. Meridian remains fully liable to VMS for the acts and omissions of its sub-processors as if such acts and omissions were Meridian's own. B. Meridian/WBC Position (DPA v2.0 Redline) WBC's Redline

Section 10.1 further requires that the initial notification include, at minimum: the nature and category of the breach, the data categories and approximate number of data records affected, the identity of any sub-processor involved, the measures taken or proposed to address the breach, and a contact person at Meridian for further inquiries. Meridian is required to cooperate fully with VMS's investigation and remediat

Section 12 does not address the broader liability framework for non-data-protection claims under the DPA (e.g., breach of commercial terms), which is governed by the master services agreement being negotiated in parallel. B. Meridian/WBC Position (DPA v2.0 Redline) WBC's Redline proposes a liability cap of fifteen million dollars ($15,000,000) for all claims arising under the DPA, inclusive of claims for data breache