Contract analysis

1. Parties to the Processing 1.1 Controller. The Controller under this Schedule A is: Full Legal Name: Meridian Federal Savings Bank Entity Type: Federally chartered savings bank, insured by the Federal Deposit Insurance Corporation ("FDIC") Charter Number: 14-2238 Principal Office Address: 900 Broad Street, Suite 1200, Newark, New Jersey 07102, United States of America Primary Contacts for Data Processing Matters: •

2. Subject Matter and Nature of Processing Subject Matter. The processing of personal data by Processor under this Schedule A arises in connection with the provision of the SBF Core software-as-a-service ("SaaS") platform to Controller, pursuant to the SaaS Subscription Agreement entered into between the parties concurrently with the Agreement (the "Subscription Agreement"). Processor processes personal data solely o

3. Purpose of Processing Processor processes personal data on behalf of Controller solely for the following purposes, each of which is necessary for the performance of Processor's obligations under the Subscription Agreement: 3.1 Payment Processing Processor processes personal data for the purpose of real-time processing of payment transactions initiated by or on behalf of Controller's accountholders, including trans

4. Categories of Data Subjects The personal data processed by Processor under this Schedule A relates to the following categories of data subjects: (a) Retail Accountholders. Individual persons who maintain one or more retail deposit or loan accounts with Controller, including checking account holders, savings account holders, and consumer loan borrowers. As of the effective date of this Schedule A, Controller estima

5. Categories of Personal Data The following categories of personal data are processed by Processor on behalf of Controller under this Schedule A: 5.1 Identity and Contact Data (a) Full legal name of the data subject, including first name, middle name or initial, last name, and suffix (e.g., Jr., Sr., III); (b) Date of birth; (c) Email addresses (personal and, where applicable, business email addresses associated wit

6. Sensitive Data The parties acknowledge and agree that the following categories of personal data processed under this Schedule A constitute sensitive personal data or special category data under one or more applicable data protection laws: (a) Social Security numbers — classified as sensitive personal data under applicable United States state privacy laws, including the CCPA/CPRA and the New Jersey Data Privacy Act

7. Processing Locations Processor shall process Controller's personal data only at the following approved processing locations. Any change in processing location requires Controller's prior written approval in accordance with the terms of the Agreement. Processor shall not transfer, access, or process personal data at any location other than those identified in the table above without Controller's prior written autho

8. Duration of Processing 8.1 Term of Processing Processing of personal data by Processor under this Schedule A shall commence on the effective date of the SaaS Subscription Agreement between Controller and Processor (target effective date: February 15, 2026). Processing shall continue for the full term of the Subscription Agreement, including any renewals, extensions, or modifications thereof. The initial term of th

9. Sub-Processors Processor engages the following sub-processors in connection with the processing of Controller's personal data under this Schedule A: (a) Osprey Cloud Infrastructure, Inc. — Provides infrastructure-as-a-service (IaaS) and platform-as-a-service (PaaS) hosting for the SBF Core platform in the Osprey Cloud US-East data center region (Ashburn, Virginia, USA) and the Osprey Cloud EU data center region (F

10. Controller Instructions Processor shall process personal data solely in accordance with Controller's documented instructions as set forth in the Agreement, this Schedule A, and any subsequent written instructions provided by Controller from time to time in accordance with the terms of the Agreement. The processing activities described in Sections 2 through 5 of this Schedule A constitute Controller's initial comp

11. Applicable Data Protection Laws The processing of personal data described in this Schedule A is subject to, and shall be carried out in compliance with, the following data protection and privacy laws, regulations, and regulatory guidance, as amended from time to time: (a) Gramm-Leach-Bliley Act ("GLBA") (15 U.S.C. §§ 6801–6809) and Regulation P (12 CFR Part 1016) — governing the privacy and security of nonpublic