Contract analysis

Clause 1 — Purpose and Scope (a) The purpose of these Standard Contractual Clauses is to ensure compliance with the requirements of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (General Data Protection Regulation), and specifically Article 46(2)(c) thereof, for the transfer of personal data to a third country. (b) These Clauses set out appropriate safeguards, including enfor

Clause 2 — Effect and Invariability of the Clauses (a) These Clauses set out appropriate safeguards, including enforceable data subject rights and effective legal remedies, for the transfer of personal data by the Data Exporter to the Data Importer. These Clauses may not be modified by the parties, except: (i) to select the appropriate Module in accordance with the options provided by the European Commission's Implem

Clause 3 — Third-Party Beneficiaries (a) Data subjects may invoke and enforce these Clauses, as third-party beneficiaries, against the Data Exporter and/or the Data Importer, with the following exceptions: (i) Clause 1, paragraph (b); (ii) Clause 2, paragraph (a); (iii) Clause 3; (iv) Clause 4; (v) Clause 5; (vi) Clause 6, paragraphs (a) through (f); (vii) Clause 7; (viii) Clause 8, including all sub-provisions there

Clause 4 — Interpretation (a) Where these Clauses use terms that are defined in Regulation (EU) 2016/679, those terms shall have the same meaning as in the Regulation. This includes, without limitation, the terms "personal data," "special categories of personal data," "processing," "controller," "processor," "data subject," "supervisory authority," "personal data breach," "third country," and "appropriate safeguards.

Clause 5 — Hierarchy (a) In the event of a contradiction between these Clauses and the provisions of any related agreements between the parties existing at the time these Clauses are agreed or entered into thereafter — including, without limitation, the Data Processing Agreement dated on or about February 15, 2026, the Master SaaS Subscription Agreement, and any amendments, exhibits, schedules, or order forms appende

Clause 6 — Description of the Transfer(s) (a) The details of the transfer(s) of personal data, and in particular the categories of personal data that are transferred and the purpose(s) for which they are transferred, are specified in Annex I.B to these Clauses. (b) Without limiting the generality of paragraph (a), the parties confirm that the transfer involves the following principal elements, each of which is descri

Clause 7 — Docking Clause (a) The parties elect to include the optional docking clause as set forth in this Clause 7, in order to permit future clients of the Data Importer, including but not limited to other financial institutions, to accede to these Clauses without requiring the negotiation and execution of a separate and independent set of Standard Contractual Clauses. [Note for negotiation: The inclusion of the D

Clause 8 — Data Protection Safeguards The Data Importer warrants and undertakes to comply with the following data protection safeguards, which are specific to Module 2 (Controller-to-Processor):

Clause 8.1 — Instructions (a) The Data Importer shall process the personal data only on documented instructions from the Data Exporter. The Data Exporter may issue such instructions throughout the duration of the contract. (b) The Data Importer shall immediately inform the Data Exporter if it is unable to follow those instructions. Where the Data Importer is required by the law of the country of destination or any ot

Clause 8.2 — Purpose Limitation (a) The Data Importer shall process the personal data only for the specific purpose(s) of the transfer, as set out in Annex I.B to these Clauses. Specifically, the Data Importer shall process the personal data solely for the purposes of: (i) real-time payment processing on behalf of the Data Exporter; (ii) anti-fraud analytics and detection via the SBF Core platform; and (iii) regulato

Clause 8.3 — Transparency (a) Upon request by a data subject, the Data Exporter shall make a copy of these Clauses, including the Annexes as completed by the parties, available to the data subject free of charge. The Data Exporter shall provide such copy within a reasonable period of time and in any event no later than thirty (30) days following receipt of the data subject's request. (b) To the extent necessary to pr

Clause 8.4 — Accuracy (a) If the Data Importer becomes aware that the personal data it has received is inaccurate, or has become outdated, it shall inform the Data Exporter without undue delay. In such case, the Data Importer shall cooperate with the Data Exporter to erase or rectify the inaccurate or outdated data. (b) The Data Importer shall implement reasonable technical and organisational measures to ensure the o

Clause 8.5 — Duration of Processing and Erasure or Return of Data (a) Processing by the Data Importer shall only take place for the duration specified in Annex I.B. The processing period shall consist of the term of the SaaS subscription agreement between the parties (five years, commencing upon execution of the Data Processing Agreement) plus a period of ninety (90) days following termination or expiration of such a

Clause 8.6 — Security of Processing (a) The Data Importer and, during transmission, the Data Exporter shall implement appropriate technical and organisational measures to ensure the security of the personal data, including protection against a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, the personal data (hereinafter "personal data brea

Clause 8.7 — Sensitive Data (a) Where the transfer involves personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data, or biometric data for the purpose of uniquely identifying a natural person, data concerning health, or data concerning a natural person's sex life or sexual orientation, or data relating to criminal convictions and

Clause 8.8 — Onward Transfers (a) The Data Importer shall only disclose the personal data to a third party on documented instructions from the Data Exporter. Data disclosed to sub-processors engaged by the Data Importer in accordance with Clause 9 shall be subject to the terms and conditions set forth therein. (b) Onward transfers to sub-processors are governed by Clause 9 of these Clauses. Any onward transfer to a t

Clause 8.9 — Documentation and Compliance (a) The Data Importer shall promptly and adequately deal with enquiries from the Data Exporter that relate to the processing of personal data under these Clauses. The Data Importer shall respond to such enquiries within ten (10) business days of receipt, or within such shorter period as may be reasonably required under the circumstances. (b) The parties shall be able to demon

Clause 9 — Use of Sub-processors

Clause 9(a) — General Written Authorization The parties have selected OPTION 2 — GENERAL WRITTEN AUTHORIZATION under this Clause 9. (i) The Data Exporter hereby provides general written authorization to the Data Importer for the engagement of sub-processors from the agreed list set forth in Annex III to these Clauses. As of the date of these Clauses, the approved sub-processors are: (1) Osprey Cloud Infrastructure, I

Clause 9(b) — Written Contract with Sub-processor (i) Where the Data Importer engages a sub-processor to carry out specific processing activities on behalf of the Data Exporter, it shall do so by way of a written contract (including a data processing agreement) that provides for, in substance, the same data protection obligations as those binding on the Data Importer under these Clauses, including with respect to thi

Clause 9(c) — Sub-processor Obligations (i) The Data Importer shall ensure that the sub-processor complies with the obligations to which the Data Importer is subject pursuant to these Clauses and Regulation (EU) 2016/679, including with respect to the security of processing, the limitation of purpose, data subject rights, and the restrictions on onward transfers. (ii) The Data Importer shall, upon the Data Exporter's

Clause 9(d) — Liability for Sub-processors (i) The Data Importer shall remain fully responsible to the Data Exporter for the performance of the sub-processor's obligations under its sub-processor agreement. The Data Importer's liability under this Clause 9(d) is joint and several with the sub-processor to the extent permitted by applicable law. (ii) The Data Importer shall notify the Data Exporter of any failure by t

Clause 9(e) — Approved Sub-processors As of the date of these Clauses, the following sub-processors have been approved by the Data Exporter and are listed in Annex III:

1. Osprey Cloud Infrastructure, Inc. • Address: 2200 Campus Drive, San Jose, California 95131 • Description of processing: IaaS/PaaS hosting of the SBF Core platform; storage and processing of personal data • Data center regions: US-East (Ashburn, Virginia) and EU (Frankfurt, Germany) • Existing DPA: Skybridge–Osprey Cloud DPA dated March 1, 2024 (includes Module 3 SCCs)

2. Skybridge Fintech Europe B.V. • Address: Keizersgracht 482, 1017 EG Amsterdam, Netherlands • KvK (Chamber of Commerce) number: 82104593 • Managing Director: Lena Vogt • Employees: 14 (8 engineers, 4 support, 2 compliance) • Description of processing: Processing of EU personal data for Skybridge customers; engineering, support, and compliance functions • Relationship: Wholly-owned subsidiary / affiliate of Skybridg

Clause 10 — Data Subject Rights (a) The Data Importer shall promptly notify the Data Exporter of any request it has received directly from a data subject relating to the processing of his or her personal data under these Clauses. The Data Importer shall provide the Data Exporter with sufficient details of the request to enable the Data Exporter to respond, including the identity of the data subject (to the extent dis

Clause 11 — Redress (a) The Data Importer shall inform data subjects in a transparent and easily accessible format, through its website or by individual notification, of a contact point authorised to handle complaints. As of the date of these Clauses, the designated contact point is: Thomas Elridge, General Counsel / Chief Privacy Officer Skybridge Fintech Ltd. 4100 Silverside Road, Suite 310 Wilmington, DE 19810 Ema

Clause 12 — Liability (a) Each party shall be liable to the data subject(s), and the data subject(s) shall be entitled to receive compensation, for any material or non-material damages that the party causes the data subject(s) by any breach of these Clauses. (b) The Data Importer agrees that if the data subject is not able to bring a claim for compensation against the Data Exporter arising out of a breach of these Cl

Clause 13 — Supervision (a) The competent supervisory authority with responsibility for ensuring compliance by the Data Exporter with Regulation (EU) 2016/679 as regards the data transfer shall be the Autoriteit Persoonsgegevens (Dutch Data Protection Authority), as the supervisory authority of the Member State in which the Data Importer's EU establishment, Skybridge Fintech Europe B.V., is located. [Note for negotia

Clause 14 — Local Laws and Practices Affecting Compliance with the Clauses

Clause 14(a) — Warranties (i) The parties warrant that they have no reason to believe that the laws and practices in the third country of destination — the United States of America — applicable to the processing of the personal data by the Data Importer, including any requirements to disclose personal data or measures authorising access by public authorities, prevent the Data Importer from fulfilling its obligations

Clause 14(b) — Relevant Legislation and Practices The parties declare that, in particular with regard to the laws and practices of the United States of America, the following elements were taken into account in the assessment under Clause 14(a): (i) Applicable legislation and practices (including those requiring disclosure of data to public authorities or authorising access by such authorities): (A) Foreign intellige

Clause 14(c) — Review Obligation The Data Importer warrants that, in carrying out the assessment under Clause 14(b), it has made its best efforts to provide the Data Exporter with relevant information regarding the laws and practices of the United States applicable to the processing of personal data under these Clauses. The Data Importer agrees that it will continue to cooperate with the Data Exporter in ensuring com

Clause 14(d) — Notification of Changes (i) The Data Importer agrees to notify the Data Exporter promptly if, after having agreed to these Clauses, and for the duration of the contract, it has reason to believe that it is or has become subject to laws or practices not in line with the requirements under Clause 14(a), including following a change in the laws of the country of destination or a measure (such as a disclos

Clause 14(e) — Supplementary Measures The parties have identified the following supplementary measures to address the findings of the Transfer Impact Assessment dated December 8, 2025, and to provide additional safeguards for the transfer of personal data under these Clauses: (i) AES-256 encryption at rest for all personal data stored on the SBF Core platform and associated infrastructure, including on all Osprey Clo

Clause 15 — Obligations of the Data Importer in Case of Access by Public Authorities

Clause 15.1 — Notification (a) The Data Importer agrees to notify the Data Exporter and, where possible, the data subject (with the assistance of the Data Exporter if necessary) promptly if it: (i) receives a legally binding request from a public authority, including judicial authorities, under the laws of the country of destination for the disclosure of personal data transferred pursuant to these Clauses; such notif

Clause 15.2 — Review of Legality and Data Minimization (a) The Data Importer agrees to review the legality of any request for disclosure received from a public authority under the laws of the country of destination, in particular whether the request remains within the powers granted to the requesting public authority, and to challenge the request if, after careful assessment, it concludes that there are reasonable gr

Clause 16 — Non-Compliance with the Clauses and Termination (a) The Data Importer shall promptly inform the Data Exporter if it is unable to comply with these Clauses, for whatever reason. (b) In the event that the Data Importer is in breach of these Clauses or is unable to comply with these Clauses, the Data Exporter shall suspend the transfer of personal data to the Data Importer until compliance is again ensured o

Clause 17 — Governing Law (a) These Clauses shall be governed by the law of the Netherlands, which is the law of the Member State in which the Data Importer's EU establishment, Skybridge Fintech Europe B.V., is located. (b) The governing law selected under this Clause 17 applies solely to these Standard Contractual Clauses. The Data Processing Agreement to which these SCCs are appended, and the Master SaaS Subscripti