Contract analysis

Clause 1 — Purpose and Scope (a) The purpose of these Standard Contractual Clauses is to ensure compliance with the requirements of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (the General Data Protection Regulation) for the transfer of personal data to a third country. Specifically, these Clauses are designed to provide appropriate safeguards as required by Article 46(2)(c

Clause 2 — Effect and Invariability of the Clauses (a) These Clauses set out appropriate safeguards, including enforceable data subject rights and effective legal remedies, pursuant to Article 46(1) and Article 46(2)(c) of Regulation (EU) 2016/679. The Parties acknowledge that these safeguards are intended to provide a level of protection for personal data that is essentially equivalent to that guaranteed by the GDPR

Clause 3 — Third-Party Beneficiaries (a) Data subjects whose personal data is transferred under these Clauses may invoke and enforce these Clauses, as third-party beneficiaries, against the Data Exporter and/or the Data Importer. The Parties acknowledge that the data subjects' status as third-party beneficiaries of these Clauses is a fundamental element of the safeguards provided herein, and the Parties shall not tak

Clause 4 — Interpretation (a) These Clauses shall be read and interpreted in light of the provisions of Regulation (EU) 2016/679 (the GDPR), including the recitals thereto, and in a manner consistent with the objectives and purposes of that Regulation. The Parties acknowledge that the GDPR is the primary legal framework for the protection of personal data within the European Union, and that these Clauses are intended

Clause 8 — Data Protection Safeguards (Module 3) The Data Importer warrants that it has implemented appropriate technical and organizational measures to ensure the security and protection of personal data transferred under these Clauses, and that it will comply with the following obligations throughout the duration of its processing activities:

Clause 8.1 — Instructions (a) The Data Importer (Osprey Cloud Infrastructure, Inc.) shall process the personal data only on documented instructions from the Data Exporter (Skybridge Fintech Ltd.), acting in its capacity as processor on behalf of the Controller (Meridian Federal Savings Bank). Such instructions shall be documented in writing and shall include, at a minimum, the subject matter, duration, nature, and pu

Clause 8.2 — Purpose Limitation (a) The Data Importer shall process the personal data only for the specific purpose(s) of the transfer, as set out in Annex I.B to these Clauses, unless on further documented instructions from the Data Exporter, provided that such further instructions have been authorized by the Controller. The Data Importer acknowledges and agrees that the personal data transferred under these Clauses

Clause 8.3 — Transparency (a) On request, the Data Exporter shall make a copy of these Clauses, including the Annexes as completed by the Parties, available to the data subject free of charge. To the extent necessary to protect business secrets or other confidential information, including personal data of other individuals, the technical and organizational measures described in Annex II, or proprietary security archi

Clause 8.4 — Accuracy (a) If the Data Importer becomes aware that the personal data it has received is inaccurate, or has become outdated, it shall inform the Data Exporter without undue delay and in any event within five (5) business days of becoming aware of such inaccuracy. The notification shall identify the affected data, the nature of the inaccuracy, and, where possible, the steps the Data Importer has taken or

Clause 8.5 — Duration of Processing and Erasure/Return of Data (a) Processing by the Data Importer shall be for the duration of the SaaS subscription agreement between the Data Exporter (Skybridge Fintech Ltd.) and its Controller client (Meridian Federal Savings Bank), plus a period of ninety (90) calendar days following the termination or expiration of such subscription agreement, during which time the Data Exporter

Clause 8.6 — Security of Processing (a) The Data Importer (Osprey Cloud Infrastructure, Inc.) shall implement and maintain appropriate technical and organizational measures to ensure a level of security appropriate to the risk presented by the processing, taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing, as well as the risks of varying l

Clause 8.7 — Sensitive Data (a) Where the transfer of personal data under these Clauses involves special categories of personal data (as defined in Article 9 of the GDPR) or personal data relating to criminal convictions and offences (as referred to in Article 10 of the GDPR), specific restrictions and additional safeguards may apply. The Parties acknowledge that, while the data transferred under these Clauses may no

Clause 8.8 — Onward Transfers (a) The Data Importer shall not sub-contract any of its processing operations performed on behalf of the Data Exporter under these Clauses to another processor (a "further sub-processor") without the prior specific or general written consent of the Data Exporter. The Data Exporter's consent is itself subject to the prior authorization of the Controller (Meridian Federal Savings Bank), as

Clause 8.9 — Documentation and Compliance (a) The Data Importer shall promptly deal with all inquiries from the Data Exporter that relate to the processing of personal data under these Clauses. The Data Importer shall respond to such inquiries in writing and within a reasonable timeframe, which shall not exceed fifteen (15) business days unless the complexity of the inquiry requires additional time, in which case the

Clause 9 — Use of Sub-processors (Module 3)

Clause 9(a) — General Written Authorization (a) The Parties have selected Option 2: GENERAL WRITTEN AUTHORISATION. The Data Exporter hereby grants the Data Importer a general written authorization to engage sub-processors for the processing of personal data transferred under these Clauses, subject to the conditions set out in this Clause 9. (b) The Data Importer shall specifically inform the Data Exporter in writing

Clause 9(b) — Contractual Safeguards Where the Data Importer engages a sub-processor to carry out specific processing activities on behalf of the Data Exporter, it shall do so by way of a written contract that imposes on the sub-processor, in substance, the same data protection obligations as those binding the Data Importer under these Clauses, including with respect to the rights of third-party beneficiaries for dat

Clause 9(c) — Liability (a) The Data Importer shall remain fully liable to the Data Exporter for the performance of the sub-processor's obligations under the sub-processor agreement. The Data Importer's liability under this Clause 9(c) shall be joint and several with the sub-processor's liability to the extent of the sub-processor's processing of personal data under these Clauses. (b) The Data Importer shall notify t

Clause 10 — Data Subject Rights (Module 3) (a) The Data Importer shall promptly notify the Data Exporter of any request it receives directly from a data subject in relation to the personal data processed under these Clauses. Such notification shall be provided without undue delay and in any event within three (3) business days of receipt of the request. The Data Importer shall not respond to the data subject's reques

Clause 11 — Redress (a) The Data Importer shall inform data subjects in a transparent and easily accessible format, through its website or through individual notice, of a contact point authorized to handle complaints. The designated contact point for the Data Importer as of the date of these Clauses is: Osprey Cloud Infrastructure, Inc. Attn: Privacy Office 2200 Campus Drive San Jose, CA 95131 Email: privacy@ospreycl

Clause 12 — Liability (a) Each Party shall be liable to the other Party for any damages it causes the other Party by any breach of these Clauses. The Parties acknowledge and agree that their liability under these Clauses is subject to the general conditions of liability set forth in the GDPR, including Articles 82 and 83 thereof. (b) The Data Importer shall be liable to the data subject, and the data subject shall be

Clause 13 — Local Laws and Practices Affecting Compliance with the Clauses (Module 3)

Clause 13(a) — Representations and Warranties (a) The Parties represent and warrant that they have no reason to believe that the laws and practices in the third country of destination (the United States of America) applicable to the processing of personal data by the Data Importer, including any requirements to disclose personal data or measures authorizing access by public authorities, prevent the Data Importer from

Clause 13(b) — Obligations of the Data Importer in Case of Access by Public Authorities (a) The Data Importer agrees to promptly notify the Data Exporter and, where possible, the data subject (with the assistance of the Data Exporter where necessary), if it receives a legally binding request from a public authority, including judicial authorities, under the laws of the country of destination for the disclosure of per

Clause 14 — Obligations of the Data Importer in Case of Access (Module 3)

Clause 14 of the EU Commission's standard contractual clauses (as set forth in the Annex to Implementing Decision (EU) 2021/914) is optional for Module 3 (Processor-to-Sub-processor) and is not separately completed by the Parties in this document. The obligations of the Data Importer with respect to government access requests are addressed through Clause 13 above and through the supplementary measures set forth in An

Clause 15.1 — Competent Supervisory Authority (a) The competent supervisory authority with responsibility for ensuring compliance with Regulation (EU) 2016/679 with regard to the data transfer shall be the Autoriteit Persoonsgegevens (Dutch Data Protection Authority), being the supervisory authority of the Member State in which the representative of the Data Exporter within the meaning of Article 27(1) of the GDPR —

Clause 15.2 — Cooperation with the Supervisory Authority (a) The Data Importer agrees to cooperate, on request, with the competent supervisory authority in the performance of its tasks. The Data Importer shall respond promptly and appropriately to inquiries from the supervisory authority regarding the processing operations covered by these Clauses, and shall make available to the supervisory authority such informatio

Clause 16 — Non-compliance with the Clauses and Termination (a) The Data Importer shall promptly inform the Data Exporter if it is unable to comply with these Clauses, for whatever reason. The notification shall include a description of the nature and extent of the non-compliance, the reasons for the non-compliance, and the corrective measures taken or proposed to be taken by the Data Importer to restore compliance.