Contract analysis

Clause 1 — Purpose and Scope (a) The purpose of these Standard Contractual Clauses is to ensure compliance with the requirements of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (the "GDPR"), and in particular Article 28(3) and (4) thereof, for the transfer of personal data from the Data Exporter, Skybridge Fintech Ltd., acting as a Processor on behalf of the Controller, Meri

Clause 2 — Effect and Invariability of the Clauses (a) These Clauses set forth appropriate safeguards, including enforceable data subject rights and effective legal remedies, within the meaning of Article 46(1) and Article 46(2)(c) of Regulation (EU) 2016/679 and, with respect to data transfers from processors to sub-processors, in compliance with Article 28(3) and (4) of Regulation (EU) 2016/679. (b) These Clauses s

Clause 3 — Third-Party Beneficiaries (a) Data subjects may invoke and enforce these Clauses, as third-party beneficiaries, against the Data Exporter and/or the Data Importer, with the following exceptions: (i) Clause 1, Clause 2, Clause 3, Clause 6, Clause 7 — data subjects may invoke and enforce these provisions; (ii) Clause 8 — data subjects may invoke and enforce Clause 8.1, Clause 8.8, and Clause 8.9; (iii) Claus

Clause 4 — Interpretation (a) Where these Clauses use terms that are defined in Regulation (EU) 2016/679, those terms shall have the same meaning as in that Regulation. (b) These Clauses shall be read and interpreted in the light of the provisions of Regulation (EU) 2016/679. (c) These Clauses shall not be interpreted in a way that conflicts with rights and obligations provided for in Regulation (EU) 2016/679.

Clause 5 — Hierarchy (a) In the event of a contradiction between these Clauses and the provisions of the Data Processing Agreement between Meridian Federal Savings Bank and Skybridge Fintech Ltd. (the "DPA"), or of the SaaS subscription agreement between Meridian Federal Savings Bank and Skybridge Fintech Ltd., these Clauses shall prevail. (b) In the event of a contradiction between these Clauses and any related agre

Clause 6 — Description of the Transfer(s) The details of the transfer(s), and in particular the categories of personal data that are transferred and the purpose(s) for which they are transferred, are specified in Annex I.B. The Parties agree that the following key elements characterize the transfer(s) covered by these Clauses: (a) Data Exporter: Skybridge Fintech Ltd., 4100 Silverside Road, Suite 310, Wilmington, DE

Clause 7 — Docking Clause (a) An entity that is not a Party to these Clauses may, with the agreement of the Parties, accede to these Clauses at any time, either as a data exporter or as a data importer, by completing the Appendix and signing Annex I.A. (b) Once it has completed the Appendix and signed Annex I.A, the acceding entity shall become a Party to these Clauses and have the rights and obligations of a data ex

Clause 8 — Data Protection Safeguards The Data Importer warrants that it has implemented and shall maintain appropriate technical and organizational measures to protect personal data in accordance with the GDPR and these Clauses, and that it has no reason to believe that the laws and practices applicable to it prevent it from fulfilling its obligations under these Clauses. 8.1 — Instructions. (a) The Data Importer sh

Clause 9 — Use of Sub-processors 9(a) — General Written Authorization. The Parties have selected OPTION 2: General written authorization. (i) The Data Importer (SBF Europe) has the Data Exporter's (Skybridge's) general written authorization to engage sub-processors to carry out specific processing activities on its behalf in connection with the processing of personal data under these Clauses. A list of sub-processors

Clause 10 — Data Subject Rights (a) The Parties shall cooperate in responding to requests from data subjects exercising their rights under the GDPR, including the rights of access (Article 15), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18), data portability (Article 20), and objection (Article 21). (b) Where the Data Importer receives a request directly from a data subject,

Clause 11 — Redress 11(a) — Complaint Mechanism. (i) The Data Importer shall inform data subjects in a transparent and easily accessible manner, through its website or by other appropriate means, of a contact point authorized to handle complaints. As of the date of these Clauses, the designated contact point is: Lena Vogt Managing Director Skybridge Fintech Europe B.V. Keizersgracht 482 1017 EG Amsterdam, Netherlands

Clause 12 — Liability (a) Each Party shall be liable to data subjects, and each data subject shall be entitled to receive compensation, for any material or non-material damages caused by a breach of these Clauses by either Party. (b) Where both the Data Exporter and the Data Importer are responsible for any damage caused to a data subject as a result of a breach of these Clauses, the data subject shall be entitled to

Clause 13 — Supervision 13(a) — Competent Supervisory Authority. (i) The competent supervisory authority with responsibility for ensuring compliance with Regulation (EU) 2016/679 regarding the data transfer is the: Autoriteit Persoonsgegevens (Dutch Data Protection Authority) Bezuidenhoutseweg 30 2594 AV The Hague, Netherlands (ii) The Autoriteit Persoonsgegevens is the competent supervisory authority because the Dat

Clause 14 — Local Laws and Practices Affecting Compliance with the Clauses 14(a) — Warranties. (i) Each Party warrants that it has no reason to believe that the laws and practices in the country of the Data Importer (the Netherlands), including any requirements to disclose personal data or measures authorizing access by public authorities, prevent the Data Importer from fulfilling its obligations under these Clauses.

Clause 15 — Obligations of the Data Importer in Case of Access by Public Authorities 15.1 — Notification. (a) The Data Importer shall promptly notify the Data Exporter and, where possible, the data subject (if necessary with the help of the Data Exporter), if the Data Importer: (i) receives a legally binding request from a public authority, including judicial authorities, under the laws of the Netherlands or any othe

Clause 16 — Non-Compliance with the Clauses and Termination (a) The Data Importer shall promptly inform the Data Exporter if it is unable to comply with these Clauses, for whatever reason. (b) In the event that the Data Importer is in breach of these Clauses or unable to comply with these Clauses, the Data Exporter shall suspend the transfer of personal data to the Data Importer until compliance is restored or the co

Clause 17 — Governing Law (a) These Clauses shall be governed by the law of the Netherlands. (b) The Netherlands is the EU Member State in which the Data Importer, Skybridge Fintech Europe B.V., is established, and is therefore the applicable governing law in accordance with Clause 17 of the Standard Contractual Clauses adopted pursuant to EU Commission Implementing Decision (EU) 2021/914. (c) For the avoidance of do

Clause 18 — Choice of Forum and Jurisdiction (a) Any dispute arising from these Clauses shall be resolved by the courts of the Netherlands, with competent jurisdiction as determined under Dutch law. (b) A data subject may also bring legal proceedings against the Data Exporter and/or the Data Importer before the courts of the EU Member State in which the data subject has his or her habitual residence. (c) The Parties