Contract analysis

I. Executive Summary The purpose of this memorandum is to evaluate Cloudvault Infrastructure, Inc. ("Cloudvault") as a proposed sub-processor under the Data Processing Agreement ("DPA") currently being negotiated between our client, Vantage Mobility Systems Corp. ("VMS"), and Meridian Telematics Solutions, Inc. ("Meridian"). This analysis has been prepared at the request of Diana Kowalski, Chief Privacy Officer of VM

II. Background A. The VMS-Meridian Data-Sharing Partnership VMS and Meridian executed a non-binding Letter of Intent ("LOI") on August 5, 2022, setting forth the framework for a connected-vehicle data-sharing partnership. Under the contemplated partnership, Meridian would receive and process vehicle telemetry and in-cabin sensor data generated by VMS's connected-vehicle fleet to develop derivative analytics products

3. Acceleration/deceleration metrics

6. Engine diagnostic codes (OBD-II)

13. Windshield wiper activation status

14. Headlight/taillight status Of these fourteen categories, two — GPS/geolocation data and seat occupancy data — are classified as "Sensitive Vehicle Data" under VMS's internal data governance policy (Version 3.2, effective January 1, 2022) when combined with vehicle identification numbers ("VINs"). The sensitivity classification arises because VIN-linked GPS/geolocation data can reveal the precise movements and hab

III. Cloudvault Infrastructure, Inc. — Entity Profile A. Corporate Overview Based on publicly available information and information disclosed by Meridian during the DPA negotiation process, we have compiled the following corporate profile of the proposed sub-processor: Cloudvault appears to be positioned as a specialized cloud infrastructure provider with a focus on the automotive and mobility technology sector, as e

IV. Scope of Data Accessible to Cloudvault A. Data Categories As the hosting and data storage platform for Meridian's processing of VMS vehicle telemetry data, Cloudvault would potentially have access to all fourteen (14) categories of VMS vehicle telemetry and in-cabin sensor data enumerated in Section II.A above. This is because the raw data streams from VMS's connected vehicles would be ingested into and stored on

V. Competing Sub-Processor Approval Models Sub-processor approval rights represent one of the eleven material open issues in the DPA negotiation between VMS and Meridian. The parties have adopted fundamentally different positions on this issue, reflecting a tension between VMS's interest in maintaining granular control over entities that process its data and Meridian's interest in preserving operational flexibility i

VI. Recommended Hybrid Approach A. Structure of the Hybrid Model We recommend that VMS propose a tiered sub-processor approval mechanism that calibrates the level of VMS control to the sensitivity of the data that the proposed sub-processor would process. This hybrid model is structured as follows: Tier 1 — Initial Approved Sub-Processors. Cloudvault Infrastructure, Inc. (and any other sub-processors identified and a

VII. Flow-Down Contractual Obligations A. Requirement for Written Sub-Processor Agreements Regardless of which sub-processor approval model is ultimately adopted, the DPA must include a robust requirement that Meridian enter into a written agreement with each sub-processor — including Cloudvault — that imposes data protection obligations no less protective than those imposed on Meridian under the VMS-Meridian DPA. Th

VIII. Audit Rights Regarding Sub-Processors A. Competing Positions on Audit Rights (General) The parties' positions on audit rights — one of the eleven material open issues identified in the November 4, 2022 issues memorandum — reflect a significant divergence that has direct implications for the sub-processor audit framework. VMS has proposed a robust audit right under which VMS (or its designated auditors) would ha