Contract analysis

I. Executive Summary This memorandum analyzes the compliance of the proposed EMEA distribution arrangement for the Lumos Prism™ AI-driven financial analytics and risk-modeling SaaS platform with Regulation (EU) 2016/679 (the "GDPR"), the UK General Data Protection Regulation (the "UK GDPR," as retained EU law under the European Union (Withdrawal) Act 2018), and the Data Protection Act 2018 (the "DPA 2018"). The distr

II. Background and Transaction Overview A. The Parties and Their Roles Under Data Protection Law A clear delineation of the roles of the parties under data protection law is essential to determining the applicable obligations, the appropriate transfer mechanisms, and the contractual requirements under Articles 26 and 28 of the GDPR. The roles of the parties in this transaction are as follows: Lumos Analytics Inc. Lum

III. Data Processing Agreement (Exhibit C) — Key Provisions This Section provides a detailed analysis of the key provisions of the DPA and their alignment with the requirements of Article 28 of the GDPR and corresponding provisions of the UK GDPR. A. Scope and Subject Matter of Processing

Article 28(3) of the GDPR requires that any processing carried out by a processor on behalf of a controller be governed by a contract or other legal act that sets out the subject matter and duration of the processing, the nature and purpose of the processing, the type of personal data, and the categories of data subjects. The DPA satisfies these requirements as follows: Categories of Data Subjects. The DPA identifies

IV. Standard Contractual Clauses — Module Two (Controller-to-Processor) A. Legal Basis for Cross-Border Data Transfers The transfer of personal data from the EEA or the United Kingdom to a third country that has not been recognized as providing an adequate level of data protection requires the implementation of appropriate safeguards under Chapter V of the GDPR (Articles 44–49) or the corresponding provisions of the

Clause 7 — Docking Clause. The Docking Clause has been included in the SCCs to allow end-user customers to accede to the SCCs as additional data exporters. This is an important structural feature given the three-tier data processing relationship described in Section III.B above. By including the Docking Clause, the parties ensure that end-user customers who are themselves data controllers can directly benefit from th

Clause 8 — Data Protection Safeguards. Clause 8 sets out the core data protection obligations of the data importer (Lumos), including the obligation to process personal data only on documented instructions from the data exporter, to implement appropriate technical and organizational measures, and to assist the data exporter in meeting its obligations under the GDPR. The substance of these obligations mirrors the proc

Clause 9 — Use of Sub-Processors. The parties have selected Option 2 (general written authorization) under Clause 9. Under this option, the data importer (Lumos) has the data exporter's general authorization to engage sub-processors, subject to the requirement that Lumos provide the data exporter with written notice of any intended changes to its list of sub-processors (addition or replacement) at least thirty (30) d

Clause 10 — Data Subject Rights. Clause 10 requires the data importer (Lumos) to assist the data exporter in responding to requests from data subjects seeking to exercise their rights under the GDPR, including the rights of access, rectification, erasure, restriction, portability, and objection. This obligation is consistent with and reinforces the corresponding provision in the DPA, as described in Section III.C abo

Clause 11 — Redress. Clause 11 provides data subjects with redress mechanisms, including the right to lodge complaints with the data exporter, the data importer, and the competent supervisory authority. Data subjects are also entitled to invoke the SCCs as third-party beneficiaries and to bring claims against the data exporter or data importer for breaches of the SCCs. This provision ensures that EMEA data subjects h

Clause 13 — Supervision. The competent supervisory authority for the purposes of the SCCs is determined by the location of the data exporter. For transfers from Meridian GmbH (established in Bavaria, Germany), the competent supervisory authority is the Bayerisches Landesamt für Datenschutzaufsicht ("BayLDA"), the Bavarian Data Protection Authority, located in Ansbach, Germany. For transfers from Meridian UK (establis

Clause 14 — Local Laws and Practices Affecting Compliance. Clause 14 requires the parties to warrant that they have no reason to believe that the laws and practices in the third country of destination (the United States) applicable to the processing of personal data by the data importer, including any requirements to disclose personal data or measures authorizing access by public authorities, prevent the data importe

Clause 15 — Obligations of the Data Importer in Case of Government Access Requests. Clause 15 imposes specific transparency and challenge obligations on the data importer (Lumos) in the event it receives a legally binding request from a public authority (including judicial authorities) for disclosure of personal data transferred under the SCCs. Lumos commits to: (i) notify the data exporter of such request promptly,

Clause 17 — Governing Law. Consistent with the requirements of Module Two, the SCCs are governed by the law of the EU Member State in which the data exporter is established. For EEA transfers from Meridian GmbH, the governing law is the law of Germany. For UK transfers from Meridian UK, the SCCs (as modified by the UK IDTA) are governed by the law of England and Wales. This dual governing law structure ensures that d

Clause 18 — Choice of Forum and Jurisdiction. Any dispute arising under the SCCs shall be resolved by the courts of the country in which the data exporter is established. For EEA transfers, the competent courts are the courts of Munich, Germany. For UK transfers, the competent courts are the courts of England and Wales. These forum selection provisions ensure that data subjects and data exporters have access to a jud

V. Transfer Impact Assessment (TIA) A. Purpose and Methodology

Clause 14 of the SCCs requires that the parties represent and warrant that they have no reason to believe that the laws and practices in the third country of destination applicable to the processing of personal data by the data importer prevent the data importer from fulfilling its obligations under the SCCs. To substantiate this warranty, the parties must conduct a Transfer Impact Assessment evaluating the laws of t

VI. Sub-Processor Management A. Pre-Approved Sub-Processors (Annex III to the DPA) Annex III to the DPA identifies the following pre-approved sub-processor as of the effective date of the Agreement: Stratos Cloud Services AG provides the cloud infrastructure hosting services for all EMEA customer data processed through the Lumos Prism™ platform. Because the Stratos EMEA data center is located in Frankfurt am Main, Ge