Contract analysis

1. Module 2 — Controller-to-Processor: Meridian Federal Savings Bank to Skybridge Fintech Ltd.

2. Module 3 — Processor-to-Sub-processor: Skybridge Fintech Ltd. to Osprey Cloud Infrastructure, Inc.

3. Module 3 — Processor-to-Sub-processor: Skybridge Fintech Ltd. to Skybridge Fintech Europe B.V. For all modules included in this package, the parties select the law of the Netherlands as the governing law of the Standard Contractual Clauses pursuant to Clause 17. Preamble and Recitals Applicable to All Modules These Standard Contractual Clauses are adopted pursuant to Commission Implementing Decision (EU) 2021/914

Clause 1 — Purpose and Scope The purpose of this Module 2 is to ensure compliance with Article 28(3) and Article 28(4) of Regulation (EU) 2016/679 and to provide appropriate safeguards for transfers of personal data from data subjects located in the European Union or European Economic Area to Skybridge Fintech Ltd., a processor established in a third country, namely the United States. This Module 2 applies to the tra

Clause 2 — Effect and Invariability of the Clauses The parties acknowledge and agree that these clauses set out appropriate safeguards, including enforceable data subject rights and effective legal remedies, for the transfer and processing of personal data subject to Regulation (EU) 2016/679. The clauses shall not be modified except as permitted under Commission Implementing Decision (EU) 2021/914. The parties have s

Clause 3 — Third-Party Beneficiaries Data subjects may invoke and enforce these clauses as third-party beneficiaries to the extent provided by the Standard Contractual Clauses. This includes EU-resident Meridian accountholders whose personal data is transferred to, accessed by, or processed by Skybridge Fintech Ltd. in connection with the SBF Core platform. The parties acknowledge that approximately 3,200 EU-resident

Clause 4 — Interpretation These clauses shall be interpreted in light of the provisions and objectives of Regulation (EU) 2016/679. Where these clauses use terms defined in Regulation (EU) 2016/679, those terms shall have the same meaning as under that Regulation. Any ambiguity shall be resolved in a manner that preserves the validity and effectiveness of the clauses as a transfer mechanism under Article 46 of Regula

Clause 5 — Hierarchy In the event of any contradiction between these Standard Contractual Clauses and any other agreement between the parties, including the Data Processing Agreement, the SaaS subscription agreement, any order form, schedule, security exhibit, service level agreement, or other contractual documentation, these Standard Contractual Clauses shall prevail. This hierarchy applies only to the extent necess

Clause 6 — Description of the Transfer(s) The details of the transfer are set out in Annex I.B of this package. Those details include the categories of data subjects, categories of personal data, sensitive data, frequency of transfer, nature of processing, purposes of processing, retention period, and identification of sub-processors. The parties also cross-reference Schedule A of the Data Processing Agreement, which

Clause 7 — Docking Clause The parties include the optional docking clause. Additional entities may accede to this Module 2 as data exporter or data importer, as applicable, with the agreement of the existing parties and by completing and signing the relevant accession documentation and annexes. No accession shall reduce the rights of data subjects or the obligations of the existing parties under this Module 2. Any ac

Clause 8 — Data Protection Safeguards

Clause 8.1 — Instructions Skybridge Fintech Ltd. shall process personal data only on documented instructions from Meridian Federal Savings Bank, including with regard to transfers of personal data to a third country or an international organisation, unless required to do so by applicable law. The documented instructions are set forth in the Data Processing Agreement, its Schedules, the applicable statement of work or

Clause 8.2 — Purpose Limitation Skybridge shall process personal data only for the specific purposes described in Annex I.B and in Schedule A of the Data Processing Agreement. Those purposes are limited to: 1. payment processing through SBF Core; 2. anti-fraud analytics, including fraud detection, risk scoring, and anomaly detection; 3. regulatory reporting and related banking compliance functions; 4. support, mainte

Clause 8.3 — Transparency Skybridge shall make available to Meridian, upon request, a copy of these Standard Contractual Clauses, including any supplements, annexes, and descriptions of technical and organisational measures. Where required by law or reasonably necessary to respond to a data subject inquiry, Meridian may make relevant portions of the clauses available to data subjects, provided that commercially sensi

Clause 8.4 — Accuracy Taking into account the nature of the processing and the information available to Skybridge, Skybridge shall take reasonable steps to ensure that personal data processed on behalf of Meridian is accurate and, where necessary, kept up to date. Where Skybridge becomes aware that personal data received from Meridian or processed on Meridian’s behalf is inaccurate or obsolete, Skybridge shall prompt

Clause 8.5 — Duration of Processing and Erasure or Return Skybridge shall process personal data for the duration of the SaaS subscription agreement between Meridian and Skybridge, which has a five-year term, unless earlier terminated or extended in accordance with its terms. Upon expiration or termination of the services, Skybridge shall return or delete personal data within 90 days, at Meridian’s election and in acc

Clause 8.6 — Security of Processing Skybridge shall implement and maintain technical and organisational measures designed to ensure a level of security appropriate to the risk. The measures are described in Annex II and include, at a minimum: 1. encryption at rest using AES-256 for personal data stored in SBF Core and on Osprey Cloud infrastructure; 2. encryption in transit using TLS 1.2 or higher for all data transm

Clause 8.7 — Sensitive Data The transfer may involve sensitive or high-risk categories of data, including Social Security numbers and anti-fraud behavioral biometric data such as keystroke dynamics and mouse movement patterns. Although these data categories may not in all cases constitute special categories of personal data under Article 9 of Regulation (EU) 2016/679, the parties treat them as sensitive for purposes

Clause 8.8 — Onward Transfers Skybridge shall not disclose or transfer personal data to any third party except as permitted by these clauses, Clause 9, the Data Processing Agreement, and Meridian’s documented instructions. Onward transfers to sub-processors are permitted only where Skybridge complies with Clause 9 and imposes on the sub-processor data protection obligations equivalent to those imposed on Skybridge un

1. Osprey Cloud Infrastructure, Inc., providing IaaS/PaaS hosting; and

2. Skybridge Fintech Europe B.V., providing EU personal data processing, engineering, customer support, and compliance functions. Skybridge shall ensure that Module 3 Standard Contractual Clauses are in place for sub-processing arrangements requiring such clauses.

Clause 8.9 — Documentation and Compliance Skybridge shall make available to Meridian all information necessary to demonstrate compliance with these clauses and the Data Processing Agreement. Skybridge shall allow for and contribute to audits, including inspections, conducted by Meridian or another auditor mandated by Meridian, subject to reasonable confidentiality, security, and operational safeguards. The parties ag

Clause 9 — Use of Sub-processors The parties select Option 2 — General Written Authorisation. Meridian grants Skybridge general written authorisation to engage the sub-processors listed in Annex III. Skybridge shall specifically inform Meridian in writing of any intended additions or replacements of sub-processors at least 30 days before such changes become effective. Meridian shall have the right to object to any pr

1. Osprey Cloud Infrastructure, Inc. — IaaS/PaaS hosting in US-East, Ashburn, Virginia, and EU, Frankfurt, Germany; and

2. Skybridge Fintech Europe B.V. — EU personal data processing in Amsterdam, Netherlands.

Clause 10 — Data Subject Rights Skybridge shall deal promptly and appropriately with inquiries and requests from data subjects relating to the processing of personal data under these clauses. To the extent Skybridge receives a data subject request directly, Skybridge shall promptly notify Meridian unless prohibited by applicable law. Skybridge shall assist Meridian in fulfilling Meridian’s obligations to respond to r

Clause 11 — Redress Skybridge shall inform data subjects, in a transparent and readily accessible manner, of a contact point authorised to handle complaints relating to processing under these clauses, where Skybridge is required to do so under the Standard Contractual Clauses or applicable law. Skybridge shall deal promptly with complaints received from data subjects and shall cooperate with Meridian in investigating

Clause 12 — Liability Each party shall be liable to data subjects for damages caused by its breach of these clauses. Where more than one party is responsible for damage caused to a data subject as a result of a breach of these clauses, the responsible parties shall be jointly and severally liable to the data subject, without prejudice to rights of contribution among the parties. As between Meridian and Skybridge, lia

Clause 13 — Supervision The competent supervisory authority for this Module 2 is the Autoriteit Persoonsgegevens, the Dutch Data Protection Authority. The parties designate the Autoriteit Persoonsgegevens based on the Netherlands establishment of Skybridge Fintech Europe B.V., Skybridge’s EU establishment within the transfer architecture. Skybridge agrees to submit to the jurisdiction of and cooperate with the compet

Clause 14 — Local Laws and Practices Affecting Compliance The parties warrant that they have no reason to believe that the laws and practices in the United States applicable to Skybridge prevent Skybridge from fulfilling its obligations under these clauses. In providing this warranty, the parties have considered, among other factors: 1. the nature and volume of the transferred personal data; 2. the purposes of proces

4. Skybridge’s EU-U.S. Data Privacy Framework self-certification, Certification ID DPF-2025-03912; 5. supplementary technical and organisational measures, including encryption, access controls, logging, and pseudonymisation where applicable; 6. the likelihood and potential scope of access by U.S. public authorities; 7. available legal remedies and transparency mechanisms; and 8. the Transfer Impact Assessment conduct

Clause 15 — Obligations of the Data Importer in Case of Access by Public Authorities

Clause 15.1 — Notification Skybridge shall promptly notify Meridian of any legally binding request by a public authority, including judicial, law enforcement, intelligence, or regulatory authorities, for disclosure of personal data transferred under these clauses, unless prohibited by applicable law. If Skybridge is prohibited from notifying Meridian, Skybridge shall use its best efforts to obtain a waiver of the pro

Clause 15.2 — Review of Legality and Data Minimisation Skybridge shall review the legality of any request for disclosure, including whether the requesting authority has proper jurisdiction and whether the request is valid, binding, proportionate, and sufficiently specific. Where Skybridge concludes that reasonable grounds exist to challenge the request, Skybridge shall challenge it or seek appropriate relief, includi

Clause 15.3 — Transparency To the extent legally permitted, Skybridge shall provide Meridian with aggregate information concerning requests received from public authorities. Such information may include the number of requests, types of requesting authorities, categories of data requested, and outcomes of requests. Skybridge shall not be required to provide information where doing so is prohibited by applicable law, b

Clause 16 — Non-compliance and Termination Skybridge shall promptly inform Meridian if Skybridge is unable to comply with these clauses for any reason. Where Meridian becomes aware that Skybridge is in breach of these clauses or is unable to comply with them, Meridian may suspend the transfer of personal data until compliance is restored or the contract is terminated. Meridian may terminate the affected processing wh

Clause 17 — Governing Law These clauses shall be governed by the law of the Netherlands. The law of the Netherlands is selected as the law of the EU Member State in which Skybridge Fintech Europe B.V., the EU establishment of Skybridge within the transfer architecture, is established.

Clause 18 — Choice of Forum and Jurisdiction Any dispute arising from these clauses shall be resolved by the courts of the Netherlands. Data subjects may also bring legal proceedings before the courts of the Member State in which the data subject has habitual residence, as provided by the Standard Contractual Clauses and Regulation (EU) 2016/679. SECTION II — MODULE 3 — PROCESSOR-TO-SUB-PROCESSOR Skybridge Fintech Lt

Clause 1 — Purpose and Scope The purpose of this Module 3 is to provide appropriate safeguards for the onward transfer of personal data from Skybridge, as Processor, to Osprey Cloud, as Sub-processor, in connection with infrastructure hosting and processing services used to support SBF Core. This Module 3 applies to EU-resident personal data processed through SBF Core and hosted, stored, transmitted, backed up, repli

Clause 2 — Effect and Invariability of the Clauses These clauses provide appropriate safeguards, enforceable data subject rights, and effective legal remedies for transfers of personal data from Skybridge to Osprey Cloud. The clauses shall not be modified except to select the appropriate module, complete the annexes, identify the parties and transfers, or add supplementary safeguards that do not contradict or prejudi

Clause 3 — Third-Party Beneficiaries Data subjects, including approximately 3,200 EU-resident Meridian accountholders, may invoke and enforce these clauses as third-party beneficiaries to the extent provided under the Standard Contractual Clauses. The rights of data subjects are not limited by the processor-to-sub-processor nature of this relationship.

Clause 4 — Interpretation These clauses shall be interpreted consistently with Regulation (EU) 2016/679 and Commission Implementing Decision (EU) 2021/914. Terms used in these clauses that are defined under Regulation (EU) 2016/679 shall have the meanings given to them under that Regulation.

Clause 5 — Hierarchy In the event of a contradiction between these clauses and any other agreement between Skybridge and Osprey Cloud, including the Skybridge–Osprey Cloud Data Processing Agreement dated March 1, 2024, these clauses shall prevail. Additional obligations in the Skybridge–Osprey Cloud Data Processing Agreement may apply to the extent they do not conflict with these clauses.

Clause 6 — Description of the Transfer(s) The details of the transfer to Osprey Cloud are set out in Annex I.B. The nature of processing includes infrastructure hosting, data storage, compute services, networking, backup, replication, monitoring, and disaster recovery. The relevant data locations are:

1. Osprey Cloud US-East, Ashburn, Virginia, as the primary infrastructure region;

2. Osprey Cloud EU, Frankfurt, Germany, as an EU infrastructure region; and

3. Osprey Cloud US-East secondary availability zone, Ashburn, Virginia, for disaster recovery.

Clause 7 — Docking Clause The docking clause is included. Additional entities may accede to this Module 3 as data exporter or data importer with the agreement of Skybridge, Osprey Cloud, and, where required under the Data Processing Agreement, Meridian. No accession shall reduce the protections afforded to data subjects under this Module 3.

Clause 8 — Data Protection Safeguards

Clause 8.1 — Instructions Osprey Cloud shall process personal data only on documented instructions from Skybridge. Skybridge’s instructions to Osprey Cloud shall be consistent with Meridian’s instructions to Skybridge under the Data Processing Agreement and Module 2. Osprey Cloud shall promptly inform Skybridge if, in Osprey Cloud’s opinion, an instruction infringes Regulation (EU) 2016/679 or other applicable data p

Clause 8.2 — Purpose Limitation Osprey Cloud shall process personal data only for hosting and infrastructure services in support of SBF Core, including storage, compute, networking, resiliency, monitoring, backup, and disaster recovery. Osprey Cloud shall not process personal data for its own purposes or for any purpose unrelated to the provision of contracted infrastructure services.

Clause 8.3 — Transparency Osprey Cloud shall make available to Skybridge information necessary to demonstrate compliance with this Module 3, including applicable security documentation, audit summaries, certifications, and information regarding relevant sub-processing activities. Skybridge may provide relevant information to Meridian to enable Meridian to satisfy its compliance and regulatory obligations.

Clause 8.4 — Accuracy Taking into account the nature of infrastructure hosting services, Osprey Cloud shall not alter personal data except as instructed by Skybridge or as necessary to provide the contracted services. Where Osprey Cloud becomes aware of corruption, loss, integrity failure, or other condition affecting the accuracy or integrity of hosted personal data, Osprey Cloud shall promptly notify Skybridge and

Clause 8.5 — Duration of Processing and Erasure or Return Processing by Osprey Cloud shall continue for the duration of the Skybridge–Osprey Cloud Data Processing Agreement dated March 1, 2024, as may be renewed, extended, or replaced. Upon termination or expiration of the relevant services, Osprey Cloud shall return or delete personal data in accordance with the Skybridge–Osprey Cloud Data Processing Agreement, subj

Clause 8.6 — Security of Processing Osprey Cloud shall implement and maintain technical and organisational measures appropriate to the risk and consistent with Annex II. Such measures shall include physical data center security, network segmentation, access controls, encryption at rest, encryption in transit, monitoring, logging, vulnerability management, and resiliency controls. Osprey Cloud shall maintain SOC 2 Typ

Clause 8.7 — Sensitive Data Osprey Cloud may host, transmit, store, or otherwise process sensitive or high-risk data, including Social Security numbers and behavioral biometric data such as keystroke dynamics and mouse movement patterns. Osprey Cloud shall apply additional safeguards to such data, including encryption, network and tenant isolation, privileged-access controls, logging, and restrictions on personnel ac

Clause 8.8 — Onward Transfers Osprey Cloud shall not further sub-process personal data without prior written authorisation from Skybridge and without compliance with Meridian’s general authorisation framework under Module 2. Any further onward transfer or sub-processing shall be subject to contractual obligations equivalent to those imposed by this Module 3 and, where required, appropriate transfer safeguards under C

Clause 8.9 — Documentation and Compliance Osprey Cloud shall make available to Skybridge information necessary to demonstrate compliance with this Module 3. Osprey Cloud shall cooperate with audits and assessments consistent with the Skybridge–Osprey Cloud Data Processing Agreement and the overarching Meridian Data Processing Agreement. Audit procedures shall be implemented in a manner that protects the security and

Clause 9 — Use of Sub-processors The parties select Option 2 — General Written Authorisation. Osprey Cloud may engage further sub-processors only in accordance with the Skybridge–Osprey Cloud Data Processing Agreement, this Module 3, and Skybridge’s documented instructions. Osprey Cloud shall provide at least 30 days’ prior notice of any intended addition or replacement of further sub-processors, enabling Skybridge t

Clause 10 — Data Subject Rights Osprey Cloud shall assist Skybridge in responding to data subject requests forwarded by Meridian. Such assistance shall be proportionate to Osprey Cloud’s role as an infrastructure provider and may include locating, exporting, deleting, restoring, or restricting data within the hosted environment at Skybridge’s instruction. Osprey Cloud shall not respond directly to data subjects unles