Contract analysis

I. Summary of Skybridge's Positions on Key Open Issues A. Liability Cap (Section 11.2) Skybridge maintains its position that the aggregate liability cap applicable to the Processor under the DPA should be equal to the greater of (a) five million U.S. dollars ($5,000,000) or (b) two times (2×) the fees actually paid by Controller to Processor in the twelve (12) month period immediately preceding the date on which the

1. Prior Written Notice. Processor shall provide Controller with no fewer than thirty (30) days' prior written notice before engaging any new sub-processor or replacing an existing sub-processor. Such notice shall identify the proposed sub-processor, the nature and scope of the processing to be performed, and the location(s) of processing.

2. Right to Object. Controller retains the right to object to the engagement of any proposed new sub-processor within the thirty (30) day notice period. Any such objection must be in writing, must specify reasonable grounds related to data protection, and must be communicated to Processor before the expiration of the notice period.

3. Resolution and Termination Right. In the event Controller objects to a proposed sub-processor and the parties are unable to resolve the objection within a reasonable period (not to exceed an additional fifteen (15) business days), Controller may, as its sole and exclusive remedy, terminate the affected processing activities (i.e., the specific processing that would have been performed by the objected-to sub-proces

1. Standard Audit. Controller shall have the right to conduct or commission an audit of Processor's processing activities, facilities, and technical and organizational measures, upon no fewer than thirty (30) days' advance written notice. Standard audits shall be limited to no more than one (1) audit per twelve (12) month period and shall be conducted at Controller's sole cost and expense, including any third-party a

2. Additional Audits. Notwithstanding the foregoing frequency limitation, Controller shall be entitled to conduct additional audits in the event of (a) a Personal Data Breach (as defined in the DPA), (b) a regulatory examination or inquiry directed at Controller that necessitates review of Processor's processing activities, or (c) Processor's material failure to remediate a finding from a prior audit within the agree

3. SOC 2 Report Alternative. Skybridge proposes that it may satisfy Controller's audit requests, in the first instance, by providing its current SOC 2 Type II report, together with supplemental questionnaire responses addressing any specific areas of concern identified by Controller. Skybridge's most recent SOC 2 Type II report was issued by Graystone & Ketchum LLP and covers the audit period from October 1, 2024 thr

4. On-Site Audit. In the event that the SOC 2 Type II report and supplemental questionnaire responses are reasonably deemed insufficient by Controller to address Controller's specific audit objectives, an on-site audit shall be made available at Processor's principal processing facility, subject to reasonable scheduling requirements and Processor's confidentiality and security protocols. Critically, the redline prese

II. Additional Matters Addressed in Redline In addition to the key open issues summarized above, the enclosed redline addresses a number of additional matters, including the following: DPIA Cooperation. Skybridge agrees to provide reasonable assistance to Controller in connection with the preparation of Data Protection Impact Assessments ("DPIAs") as may be required under Article 35 of the GDPR or other applicable da

III. Remaining Open Items We note that, notwithstanding the substantial progress reflected in this redline, several items remain open and will require further discussion between the parties. Specifically, we have identified approximately four areas that remain subject to negotiation, including: (1) the precise scope of the data subject categories and data elements described in Annex I to the SCCs; (2) the allocation

IV. Enclosures The following documents are enclosed herewith:

1. Second Redline of Data Processing Agreement (redline/tracked changes format);

2. Clean copy of Data Processing Agreement (for reference);

3. Updated Schedules A through D to the Data Processing Agreement (marked to show changes from the December 20, 2025 version); and

4. Draft Standard Contractual Clauses (Modules 2 and 3), with Annexes I through III. We are available at your convenience to discuss any questions you or your team may have regarding the enclosed materials or to schedule a follow-up call to address the remaining open items identified above. We look forward to resolving the remaining open items promptly and to bringing this transaction to a successful close. Very trul