Contract analysis

Section 1.1 — Defined Terms For purposes of this DPA, the following terms shall have the meanings set forth below: (a) "Applicable Data Protection Laws" means all federal, state, and local laws, regulations, rules, orders, and regulatory guidance applicable to the Processing of Customer Data under or in connection with this DPA and the MSA, including without limitation: (i) the Gramm-Leach-Bliley Act, 15 U.S.C. § 680

Section 1.2 — Interpretation (a) Unless the context otherwise requires, references in this DPA to the MSA shall be deemed to include all exhibits, schedules, annexes, and order forms attached thereto or incorporated therein by reference, including the Service Level Agreement Exhibit (Exhibit A), the Security Exhibit (Exhibit B), this DPA (Exhibit C), and the Acceptable Use Policy (Exhibit D). (b) The headings and cap

ARTICLE 2 — SCOPE AND PURPOSE OF PROCESSING

Section 2.1 — Scope (a) Provider shall Process Customer Data solely for the purpose of providing the SkyComply™ platform services and related implementation, support, and managed services as described in the MSA, the applicable Order Form, and this DPA. Provider acknowledges that it is Processing Customer Data as a service provider to Customer and not for any independent purpose. (b) The nature and purpose of the Pro

Section 2.2 — Processing Instructions (a) Provider shall Process Customer Data only in accordance with Customer's documented instructions, as set forth in the MSA, this DPA, the applicable Order Form, and any additional written instructions provided by Customer to Provider from time to time. Customer's initial processing instructions are set forth in Schedule A to this DPA and in the MSA. (b) Provider shall not Proce

Section 2.3 — Data Classification Customer Data shall be classified and handled in accordance with Customer's data classification policy as communicated to Provider in writing. As of the Effective Date, Customer's data classification policy includes the following classifications relevant to this DPA: (a) Confidential. Customer Data classified as "Confidential" is subject to the standard confidentiality protections se

ARTICLE 3 — DATA SECURITY OBLIGATIONS

Section 3.1 — Security Standards (a) Provider's detailed security obligations with respect to Customer Data are set forth in the Security Exhibit (Exhibit B to the MSA), which is incorporated herein by reference. Provider shall comply with all obligations set forth in the Security Exhibit as they apply to the Processing of Customer Data under this DPA. (b) Without limiting the generality of the foregoing, Provider sh

Section 3.2 — Encryption Provider shall implement and maintain the following encryption standards with respect to Customer Data: (a) Data at Rest. All Customer Data stored on Provider's systems or the systems of its Approved Subprocessors shall be encrypted using Advanced Encryption Standard with a minimum key length of 256 bits (AES-256) or an equivalent or stronger encryption standard. (b) Data in Transit. All Cust

Section 3.3 — Access Controls (a) Provider shall restrict access to Customer Data to those Provider personnel who have a legitimate business need to access such data in order to perform the services under the MSA. Provider shall enforce the principle of least privilege, ensuring that each authorized individual has access only to the minimum amount of Customer Data necessary to perform his or her assigned duties. (b)

Section 3.4 — Security Certifications (a) Provider shall maintain its SOC 2 Type II certification throughout the term of the MSA. Provider shall undergo an annual SOC 2 Type II audit covering the trust service criteria relevant to the services provided under the MSA, conducted by an independent third-party auditor reasonably acceptable to Customer. (b) Provider shall maintain its ISO 27001 certification throughout th

ARTICLE 4 — DATA RESIDENCY AND TRANSFER RESTRICTIONS

Section 4.1 — Data Residency (a) All Customer Data shall be stored and processed exclusively within the continental United States. Provider's hosting infrastructure for the SkyComply™ platform is provided by Orion Cloud Services, Inc. ("Orion Cloud"), Provider's Approved Subprocessor as set forth in Section 6.1 and Schedule B of this DPA, and is located in the US-East (Virginia) and US-West (Oregon) regions only. (b)

Section 4.2 — Prohibition on Cross-Border Transfers (a) No Customer Data shall be accessed, viewed, processed, stored, or transmitted from any location outside of the continental United States by Provider personnel, Subprocessors, or any third party, without Customer's prior written consent. This prohibition applies to all forms of access, including remote access, VPN access, and any access through web-based portals

ARTICLE 5 — SECURITY INCIDENT NOTIFICATION AND RESPONSE

Section 5.1 — Notification Obligation (a) Provider shall notify Customer of any confirmed Security Incident affecting Customer Data as promptly as possible, and in any event within the timeframe specified in the Security Exhibit (Exhibit B to the MSA) following Provider's discovery of, or Provider's having reasonable grounds to believe that, such Security Incident has occurred. The Security Exhibit sets forth the neg

Section 5.2 — Content of Notification Notification of a Security Incident shall include, to the extent known or reasonably ascertainable at the time of notification, the following information: (a) A description of the nature and scope of the Security Incident, including the systems, services, and infrastructure affected; (b) The categories and approximate volume of Customer Data records affected or potentially affect

Section 5.3 — Cooperation and Remediation (a) Provider shall cooperate fully with Customer in investigating and remediating any Security Incident, including by making available Provider's relevant personnel, records, systems, and facilities. Provider shall designate a dedicated incident response team for each Security Incident and shall participate in joint calls and meetings with Customer's incident response team as

Section 5.4 — Regulatory Notification Provider acknowledges that Customer is subject to regulatory notification obligations with respect to significant security incidents, including obligations to notify the OCC, the Federal Reserve, and the FDIC in accordance with applicable law and regulatory guidance, including the Computer-Security Incident Notification Requirements (12 C.F.R. Part 53). Provider shall cooperate f

Section 6.1 — Approved Subprocessors (a) Customer acknowledges and approves the following Subprocessor(s) as of the Effective Date of this DPA: (b) Orion Cloud Services, Inc. is a Delaware corporation with its principal office at 4500 Great America Parkway, Santa Clara, CA 95054. Provider represents that Orion Cloud maintains SOC 2 Type II and ISO 27001 certifications, and that Orion Cloud's platform service level ag

Section 6.2 — Advance Notice of New Subprocessors (a) Provider shall provide Customer with no less than thirty (30) days' advance written notice before engaging any new Subprocessor that will Process Customer Data in connection with the services under the MSA. Such notice shall be delivered to Customer's designated data protection contact identified in Section 10.2 of this DPA. (b) The notice required under Section 6

Section 6.3 — Customer's Right to Object (a) Customer shall have a reasonable right to object to the engagement of any proposed new Subprocessor by providing written notice to Provider within fifteen (15) business days of Customer's receipt of Provider's notice under Section 6.2. Any such objection shall set forth in reasonable detail the grounds for Customer's objection. (b) Customer's objection must be based on rea

Section 6.4 — Subprocessor Obligations (a) Prior to any Subprocessor commencing the Processing of Customer Data, Provider shall enter into a written agreement with such Subprocessor that imposes data protection, data security, and confidentiality obligations that are no less protective of Customer Data than the obligations imposed on Provider under this DPA and the Security Exhibit. (b) Provider shall ensure that eac

Section 6.5 — Subprocessor Changes (a) Provider shall maintain a current and accurate list of all Subprocessors Processing Customer Data, which shall be made available to Customer promptly upon request and in any event within five (5) business days of Customer's request. (b) Any material change to the scope, nature, or location of Processing performed by an existing Approved Subprocessor shall be treated as a new Sub

Section 7.1 — Audit Right (a) Customer shall have the right to audit Provider's compliance with this DPA and the Security Exhibit no more than once per calendar year during the term of the MSA, upon no less than thirty (30) business days' prior written notice to Provider. This limitation on frequency shall not apply to audits conducted in response to a Security Incident or where required by Customer's banking regulat

Section 7.2 — On-Site Audits (a) On-site audits of Provider's facilities and systems shall be permitted only upon Customer's demonstration of a material security concern, including without limitation a Security Incident, a material finding in a SOC 2 Type II report, a regulatory requirement, or Customer's reasonable belief that Provider is not in compliance with its obligations under this DPA or the Security Exhibit.

Section 7.3 — Regulatory Examination (a) Provider acknowledges that Customer's federal banking regulators, including the OCC, the Federal Reserve, and the FDIC, have the right under applicable law, including the Bank Service Company Act (12 U.S.C. § 1867), OCC Bulletin 2013-29, and the Interagency Guidance on Third-Party Relationships: Risk Management (June 6, 2023), to examine the services Provider performs for Cust

Section 7.4 — Third-Party Security Assessments (a) Customer may commission third-party security assessments, including vulnerability assessments and penetration testing, of Provider's systems and infrastructure used to Process Customer Data, as set forth in and subject to the terms, conditions, and limitations of the Security Exhibit (Exhibit B to the MSA). Such assessments shall be coordinated in advance with Provid

ARTICLE 8 — DATA RETENTION, EXPORT, AND DESTRUCTION

Section 8.1 — Data Retention During Term (a) Provider shall retain Customer Data for the duration of the MSA term, including any renewal terms, and any applicable transition period, in accordance with Customer's Processing instructions and Applicable Data Protection Laws. Provider shall maintain Customer Data in a manner that ensures its availability, integrity, and confidentiality throughout the retention period. (b

Section 8.2 — Data Export Upon Termination or Expiration (a) Upon termination or expiration of the MSA for any reason, Provider shall make all Customer Data available for export by Customer in a machine-readable format within thirty (30) days following the effective date of termination or expiration (the "Export Period"). During the Export Period, Provider shall maintain Customer Data in accordance with this DPA and

Section 8.3 — Certified Destruction (a) Following the expiration of the thirty (30)-day Export Period and Customer's written confirmation of successful receipt of exported Customer Data (or, in the absence of such confirmation, the expiration of an additional thirty (30)-day period following the end of the Export Period during which Customer has not retrieved the data), Provider shall irreversibly delete and destroy

Section 8.4 — Subprocessor Data Destruction (a) Provider shall ensure that each of its Subprocessors, including Orion Cloud Services, Inc., complies with the data export and destruction obligations set forth in this Article 8 with respect to any Customer Data in such Subprocessor's possession or control. Provider's agreements with its Subprocessors shall include contractual obligations consistent with this Article 8.

ARTICLE 9 — DATA SUBJECT RIGHTS AND COOPERATION

Section 9.1 — Assistance with Data Subject Requests (a) Provider shall provide reasonable cooperation and assistance to Customer in responding to requests from data subjects (including Customer's banking customers, account holders, and other individuals whose PII is included in Customer Data) exercising rights under Applicable Data Protection Laws, including without limitation rights of access, correction, deletion,

Section 9.2 — Regulatory Cooperation (a) Provider shall cooperate with Customer in responding to inquiries, examinations, investigations, enforcement actions, or requests for information from banking regulators, law enforcement agencies, or other governmental authorities regarding the Processing of Customer Data under this DPA and the MSA. (b) Provider shall make available to Customer, upon reasonable request, all in

ARTICLE 10 — PROVIDER PERSONNEL

Section 10.1 — Personnel Obligations Provider shall ensure that all of its personnel (including employees, contractors, and temporary workers) who are authorized to Process Customer Data: (a) Have undergone background checks consistent with FFIEC guidelines, including criminal background checks, verification of employment history, and such other screening as may be required by Customer and set forth in the Security E

Section 10.2 — Designated Contacts The following individuals are designated as the primary contacts for data protection matters under this DPA: Provider's Designated Data Protection Contact: Amara Okafor, Chief Information Security Officer Skybridge Fintech Ltd. 1400 Concord Pike, Suite 320 Wilmington, DE 19803 Customer's Designated Data Protection Contact: Sandra Petrov, Head of Financial Crimes & Compliance Meridia

ARTICLE 11 — LIABILITY AND INDEMNIFICATION

Section 11.1 — Cross-Reference to MSA (a) The indemnification, liability cap, and limitation of liability provisions set forth in the MSA shall apply to this DPA and to all claims arising out of or relating to the Processing of Customer Data, except as expressly modified or supplemented by this DPA. (b) For the avoidance of doubt, Provider's obligations with respect to the unauthorized access, disclosure, use, altera

Section 11.2 — Provider Liability for Subprocessors Provider shall be directly liable to Customer for any breach of this DPA, the Security Exhibit, or the MSA caused by the acts or omissions of any of Provider's Subprocessors with respect to Customer Data, to the same extent and in the same manner as if such breach were committed by Provider directly. This liability shall apply regardless of whether the Subprocessor

ARTICLE 12 — TERM AND SURVIVAL

Section 12.1 — Term This DPA shall become effective as of the Effective Date of the MSA and shall remain in full force and effect for the duration of the MSA, including any renewal terms, and for such additional period as Provider retains any Customer Data in its possession or control, whether pursuant to Article 8 of this DPA, applicable law, or otherwise.

Section 12.2 — Survival The obligations of the Parties under the following provisions of this DPA shall survive the termination or expiration of this DPA and the MSA: Article 5 (Security Incident Notification and Response), Article 7 (Audit Rights), Article 8 (Data Retention, Export, and Destruction), Article 9 (Data Subject Rights and Cooperation), Article 11 (Liability and Indemnification), and this Article 12 (Ter

ARTICLE 13 — GENERAL PROVISIONS

Section 13.1 — Governing Law This DPA shall be governed by and construed in accordance with the laws of the State of Delaware, without regard to its conflict of laws principles or rules that would require or permit the application of the laws of any other jurisdiction.

Section 13.2 — Dispute Resolution Any dispute, controversy, or claim arising out of or relating to this DPA, including the breach, termination, or validity hereof, shall be resolved in accordance with the dispute resolution provisions of the MSA, including: (a) mandatory executive escalation to senior officers of each Party for a period of not less than fifteen (15) business days; (b) if not resolved through executiv

Section 13.3 — Amendments This DPA may not be amended, modified, or supplemented except by a written instrument duly executed by authorized representatives of both Parties. No course of dealing, course of performance, or usage of trade shall operate to modify the terms of this DPA. For the avoidance of doubt, email or other informal correspondence between the Parties shall not constitute a written amendment to this D

Section 13.4 — Entire Agreement This DPA, together with the MSA and all exhibits, schedules, and order forms attached thereto or incorporated therein by reference (including the SLA Exhibit (Exhibit A), the Security Exhibit (Exhibit B), this DPA (Exhibit C), and the Acceptable Use Policy (Exhibit D)), constitutes the entire agreement between the Parties with respect to the Processing of Customer Data and supersedes a

Section 13.5 — Severability If any provision of this DPA is held to be invalid, illegal, or unenforceable by a court of competent jurisdiction, such provision shall be modified to the minimum extent necessary to make it valid, legal, and enforceable while preserving the original intent of the Parties. If such modification is not possible, such provision shall be severed from this DPA, and the remaining provisions sha

Section 13.6 — Notices (a) All notices, requests, demands, and other communications required or permitted under this DPA shall be in writing and shall be delivered in accordance with the notice provisions set forth in the MSA. (b) Notices relating to data protection matters, including Security Incident notifications, Subprocessor notices, and audit requests, shall be directed to the designated data protection contact

Section 13.7 — Counterparts This DPA may be executed in two or more counterparts, each of which shall be deemed an original and all of which together shall constitute one and the same instrument. Execution and delivery of this DPA by electronic signature (including PDF, Brightwater Software, or similar electronic signature technology) shall be deemed to have the same legal effect as delivery of an original executed c

1. Encryption • Data at Rest: AES-256 encryption for all Customer Data stored on Provider's systems or the systems of its Approved Subprocessors. • Data in Transit: TLS 1.2 or higher for all Customer Data transmitted over public or untrusted networks. • Key Management: Provider-managed hardware security modules (HSMs), FIPS 140-2 Level 3 validated, with Customer option for bring-your-own-key (BYOK) integration as des

2. Access Controls • Role-based access controls (RBAC) aligned to the principle of least privilege. • Multi-factor authentication (MFA) required for all access to systems containing Customer Data. • Quarterly access reviews to verify continued appropriateness of access permissions. • Automated de-provisioning of access for terminated or reassigned personnel within twenty-four (24) hours.

3. Background Checks • FFIEC-consistent background checks for all Provider personnel with access to Customer Data, including criminal background checks, employment history verification, and education verification, completed prior to access being granted.

4. Certifications • SOC 2 Type II certification, with annual audits performed by an independent third-party auditor. • ISO 27001 certification, with triennial recertification audits and annual surveillance audits. • Current certifications as of the Effective Date are described in Section 3.1(c) of this DPA.