1008-00010 · Lumos Analytics Inc · Memos & Analyses

gdpr-data-transfer-compliance-memo.docx DOCUMENT Funds

20 / 36 ← → ✕

MEMORANDUM

PRIVILEGED & CONFIDENTIAL — ATTORNEY-CLIENT PRIVILEGE / ATTORNEY WORK PRODUCT

To: Daniel Ostroff, VP, Legal & Compliance, Lumos Analytics Inc.

From: Leila Nazari, Associate, Calderwood & Harkness LLP; with input from Alistair Drummond, Partner, Thornbridge Whitaker LLP

Date: March 15, 2024

Re: GDPR / UK GDPR Data Transfer Compliance Analysis — Lumos Prism™ EMEA Channel Reseller Program Agreement with Meridian Data Solutions GmbH

Matter No.: 1008-00010

Right-click to update Table of Contents

I. Executive Summary

This memorandum analyzes the compliance of the proposed EMEA distribution arrangement for the Lumos Prism™ AI-driven financial analytics and risk-modeling SaaS platform with Regulation (EU) 2016/679 (the "GDPR"), the UK General Data Protection Regulation (the "UK GDPR," as retained EU law under the European Union (Withdrawal) Act 2018), and the Data Protection Act 2018 (the "DPA 2018"). The distribution arrangement is governed by the Channel Reseller Program Agreement (the "Agreement") between Lumos Analytics Inc. ("Lumos"), a Delaware C-Corporation headquartered at 4700 Sandhill Road, Suite 300, Palo Alto, CA 94304, and Meridian Data Solutions GmbH ("Meridian" or "Meridian GmbH"), a company organized under the laws of Germany (GmbH) with registered offices at Leopoldstraße 78, 80802 München, Germany (Amtsgericht München, HRB 274581).

The scope of this analysis encompasses the Data Processing Agreement attached as Exhibit C to the Agreement (the "DPA"), the Standard Contractual Clauses incorporated therein pursuant to Commission Implementing Decision (EU) 2021/914 (Module Two — Controller-to-Processor) (the "SCCs"), the data localization architecture utilizing the Frankfurt am Main, Germany data center operated by Stratos Cloud Services AG ("Stratos"), the sub-processor management framework, and the Transfer Impact Assessment ("TIA") considerations arising from the cross-border transfer of personal data from the European Economic Area ("EEA") and the United Kingdom to the United States.

Overall Conclusion. Based on our review of the Agreement, the DPA, the incorporated SCCs and UK International Data Transfer Addendum, the data localization commitments, and the supplementary technical, organizational, and contractual measures described herein, we conclude that the data processing framework, as structured, achieves compliance with the GDPR, the UK GDPR, and the DPA 2018. This conclusion is subject to certain ongoing compliance obligations and monitoring requirements outlined in Section X of this memorandum, including annual reassessment of the Transfer Impact Assessment, monitoring of the EU-U.S. Data Privacy Framework, completion of a Data Protection Impact Assessment for AI-driven processing activities, and ongoing sub-processor management.

The Agreement has an aggregate total contract value ("TCV") of $30,000,000 over a five-year initial term commencing April 1, 2024, and ending March 31, 2029. The EMEA Territory, as defined in Exhibit A to the Agreement, encompasses all countries within Europe (including the United Kingdom), the Middle East, and Africa.

Meridian has designated two pre-approved sub-distributors for specific territories within the EMEA region: (i) Meridian Data Solutions UK Ltd ("Meridian UK"), a company incorporated in England and Wales with registered offices at 14 Fenchurch Place, London EC3M 5AJ (Companies House No. 12847391), authorized for the United Kingdom and Ireland; and (ii) Meridian Data Solutions SARL ("Meridian France"), a société à responsabilité limitée organized under the laws of France with registered offices at 27 Rue de la Boétie, 75008 Paris (SIREN 912 483 057), authorized for France, Belgium, Luxembourg, and French-speaking Switzerland. The data protection implications of these sub-distributor arrangements are addressed in Section VI.C below.

This memorandum was prepared by Calderwood & Harkness LLP, 801 South Figueroa Street, Suite 4200, Los Angeles, CA 90017, in coordination with Thornbridge Whitaker LLP, 22 Bishopsgate, London EC2N 4BQ. Thornbridge Whitaker serves as UK and EU regulatory and data-protection counsel to Lumos and has provided substantive input on UK GDPR considerations, SCC implementation, and Transfer Impact Assessment methodology, as reflected throughout this memorandum.

II. Background and Transaction Overview

A. The Parties and Their Roles Under Data Protection Law

A clear delineation of the roles of the parties under data protection law is essential to determining the applicable obligations, the appropriate transfer mechanisms, and the contractual requirements under Articles 26 and 28 of the GDPR. The roles of the parties in this transaction are as follows:

Lumos Analytics Inc. Lumos is the developer, licensor, and SaaS provider of the Lumos Prism™ platform, an AI-driven financial analytics and risk-modeling tool that enables enterprise users to analyze financial data, generate risk assessments, and produce predictive models. Lumos processes personal data of EMEA end users through the platform's cloud-based infrastructure. Under the data protection framework established by the DPA, Lumos acts in a dual capacity: (i) as a data controller with respect to certain categories of personal data that Lumos processes for its own purposes, including account registration data, billing and payment information, and platform usage analytics collected for product improvement and internal business intelligence purposes; and (ii) as a data processor (or, in the layered scenario described below, a sub-processor) with respect to end-user financial analytics data that is uploaded to and processed through the Lumos Prism™ platform on behalf of Meridian's end-user customers. The distinction between these two capacities is material, as the obligations incumbent upon Lumos and the transfer mechanisms applicable to the personal data differ depending on which role Lumos occupies with respect to the data in question.

Meridian Data Solutions GmbH. Meridian is the authorized non-exclusive reseller for the EMEA Territory. As the entity with the direct contractual relationship with EMEA end-user customers, Meridian occupies a complex position under data protection law. Meridian acts as a data controller vis-à-vis its own end-user customer relationships — that is, with respect to the personal data that Meridian collects, manages, and uses for its own commercial purposes, including customer relationship management, billing, sales, and marketing activities. Additionally, Meridian functions as an intermediary in the data processing chain, receiving personal data from end-user customers and passing that data through to Lumos for processing on the Lumos Prism™ platform. In certain configurations, Meridian may itself be characterized as a data processor acting on behalf of its end-user customers (who are the ultimate controllers of the financial analytics data they upload to the platform), with Lumos acting as Meridian's sub-processor. The DPA addresses both of these scenarios to ensure comprehensive coverage.

End Users. The end users are enterprises in the EMEA Territory that subscribe to the Lumos Prism™ platform through Meridian's reseller channel. Each end user may itself be a data controller with respect to the personal data it uploads to the platform for analytics processing. This is particularly the case where end users upload financial data pertaining to their own customers, employees, or other natural persons. The end-user customer's controller status triggers its own set of GDPR obligations, including the requirement to provide appropriate privacy notices, obtain lawful bases for processing, and ensure that any onward transfers of personal data to processors and sub-processors are governed by compliant contractual terms. The Docking Clause (Clause 7 of the SCCs) has been included to allow end-user customers to accede as additional data exporters under the SCCs.

Nature of Personal Data Processed. The categories of personal data processed through the Lumos Prism™ platform in connection with the EMEA reseller arrangement include the following: (i) financial analytics data, including financial data points, risk-modeling inputs, and analytical outputs generated by the platform's AI models; (ii) user account credentials, including names, email addresses, job titles, and login information of individuals authorized by end-user customers to access the platform; (iii) usage telemetry, including records of platform interactions, feature utilization metrics, session data, and device identifiers; (iv) customer contact information maintained by Meridian in connection with its reseller activities; and (v) potentially sensitive financial data of end-user clients, such as creditworthiness indicators, transaction histories, and risk-scoring outputs. The sensitivity and volume of these data categories underscore the importance of the compliance framework analyzed in this memorandum.

B. Contractual Framework

The data protection compliance framework is embedded within a broader contractual structure consisting of the following principal documents:

Channel Reseller Program Agreement. The Agreement was executed on March 22, 2024, with an effective date of April 1, 2024. The Agreement grants Meridian a non-exclusive right to market, promote, and resell subscriptions to the Lumos Prism™ platform throughout the EMEA Territory for an initial term of five years (April 1, 2024, through March 31, 2029). The Agreement provides for automatic renewal for successive one-year periods unless either party provides at least ninety (90) days' prior written notice of non-renewal (with the initial non-renewal notice deadline of December 31, 2028). The governing law of the main Agreement is the law of the State of California, with disputes subject to the exclusive jurisdiction of the state and federal courts located in Santa Clara County, California.

Exhibit C — Data Processing Agreement. The DPA governs the processing of personal data in connection with the reseller arrangement and sets forth the obligations of Lumos as a processor (and, where applicable, sub-processor) in accordance with Article 28 of the GDPR. The DPA is a critical component of the compliance framework and is analyzed in detail in Section III of this memorandum. Notably, the DPA provides that, notwithstanding the governing law of the main Agreement, the DPA itself is subject to the laws of the EU Member State in which the data exporter is established — specifically, the laws of Germany for transfers from Meridian GmbH, and the laws of England and Wales for transfers from Meridian UK. This dual governing law structure reflects best practices in cross-border data processing arrangements and ensures that the DPA is enforceable under the legal system most closely connected to the data protection rights at issue.

Standard Contractual Clauses. The SCCs adopted pursuant to Commission Implementing Decision (EU) 2021/914 of June 4, 2021, are incorporated into the DPA for the purpose of governing cross-border transfers of personal data from the EEA and the UK to the United States. The parties have selected Module Two (Controller-to-Processor) as the primary module for the Meridian-to-Lumos data transfer. The SCCs are supplemented by the UK International Data Transfer Addendum (Version B1.0) for transfers from the United Kingdom. The SCC analysis is set forth in Section IV below.

Exhibit E — Service Level Agreement. The SLA establishes Stratos Cloud Services AG's performance obligations with respect to the Frankfurt data center infrastructure, including a 99.95% uptime commitment, scheduled maintenance windows, incident response times, and service credit mechanisms. While the SLA is not itself a data protection instrument, it is relevant to the assessment of the technical and organizational measures underpinning the data processing framework.

C. Regulatory Counsel Involvement

Given the cross-border nature of the transaction and the complexity of the applicable data protection regulatory framework, Lumos has engaged specialized regulatory and data-protection counsel on both sides of the Atlantic. Thornbridge Whitaker LLP, acting through Alistair Drummond (Partner), has been engaged as UK and EU regulatory and data-protection counsel to Lumos. Thornbridge Whitaker has provided substantive input on UK GDPR considerations, the implementation and completion of the SCCs and UK International Data Transfer Addendum, the Transfer Impact Assessment methodology, and the analysis of UK-specific adequacy and transfer issues set forth in Section IX of this memorandum. Mr. Drummond's contributions are integrated throughout this memorandum and are identified where specific UK/EU regulatory judgment is reflected.

Meridian has been represented in the negotiation of the DPA by Kessler Hartmann Rechtsanwälte PartG mbB, acting through Dr. Stefan Kessler (Partner) and Laura Pfeiffer (Associate). Dr. Kessler and Ms. Pfeiffer negotiated the DPA terms on Meridian's behalf, including the scope of processing, sub-processor management provisions, audit rights, and the completion of the SCC annexes. The DPA reflects the agreed-upon positions of both parties as of the execution date of March 22, 2024.

III. Data Processing Agreement (Exhibit C) — Key Provisions

This Section provides a detailed analysis of the key provisions of the DPA and their alignment with the requirements of Article 28 of the GDPR and corresponding provisions of the UK GDPR.

A. Scope and Subject Matter of Processing

Article 28(3) of the GDPR requires that any processing carried out by a processor on behalf of a controller be governed by a contract or other legal act that sets out the subject matter and duration of the processing, the nature and purpose of the processing, the type of personal data, and the categories of data subjects. The DPA satisfies these requirements as follows:

Categories of Data Subjects. The DPA identifies the following categories of data subjects whose personal data will be processed through the Lumos Prism™ platform: (i) employees and authorized personnel of end-user customers who access and use the platform; (ii) end-user administrators who manage organizational accounts and user permissions within the platform; and (iii) financial data subjects — natural persons whose financial information, transaction data, creditworthiness indicators, or other personal data is uploaded to the platform by end-user customers for analytics and risk-modeling purposes. This third category is potentially the most sensitive and voluminous, as the Lumos Prism™ platform is designed to ingest and analyze large datasets containing financial information about individuals.

Categories of Personal Data. The DPA specifies the following categories of personal data subject to processing: names, email addresses, job titles, and other professional contact information of end-user personnel; login credentials and authentication data; IP addresses and device identifiers; financial data points, including but not limited to income data, credit histories, loan balances, payment records, and investment portfolios; risk-modeling inputs provided by end-user customers; risk-modeling outputs and analytical results generated by the platform's AI algorithms; and platform usage logs capturing session data, feature interactions, and user behavior within the platform. The breadth of these categories reflects the comprehensive nature of the Lumos Prism™ platform's analytics capabilities.

Purpose of Processing. The DPA defines the purpose of processing as the provision of AI-driven financial analytics and risk-modeling services via the Lumos Prism™ SaaS platform, including data ingestion, storage, processing, analysis, model execution, output generation, and the delivery of results to end-user customers through the platform's interface and APIs. Processing for any purpose not explicitly authorized in the DPA is prohibited unless Lumos receives prior documented instructions from the data exporter.

Duration. The duration of processing under the DPA is co-terminus with the Channel Reseller Program Agreement. The initial term runs from April 1, 2024, through March 31, 2029, subject to automatic renewal for successive one-year periods unless one party provides at least ninety (90) days' prior written notice of non-renewal by December 31, 2028 (or by September 30 of any subsequent renewal year). Upon termination or expiration of the DPA, the data deletion and return provisions described in Section III.C below become operative.

B. Controller-Processor Relationships

The DPA addresses the multi-layered data processing relationships that arise in the reseller model with appropriate specificity. The primary data flow contemplated by the Agreement involves a three-tier structure:

Primary Relationship. The most common configuration will involve the end-user customer acting as the data controller (determining the purposes and means of processing by uploading financial data to the platform), Meridian acting as either a controller or processor depending on the specific use case, and Lumos acting as a processor or sub-processor. Specifically:

(a) Scenario 1 — Meridian as Controller / Lumos as Processor. In this scenario, Meridian acts as a data controller with respect to the personal data it collects and manages in connection with its reseller activities (e.g., customer account data, billing information, marketing data), and Lumos processes such data as Meridian's processor. This is the scenario addressed by Module Two of the SCCs (Controller-to-Processor), which governs the transfer of personal data from Meridian as the data exporter to Lumos as the data importer.

(b) Scenario 2 — End User as Controller / Meridian as Processor / Lumos as Sub-Processor. In this layered scenario, the end-user customer is the ultimate data controller, Meridian acts as a processor on behalf of the end user (to the extent it handles end-user data in the course of the reseller relationship), and Lumos acts as a sub-processor engaged by Meridian's processor. The DPA contains provisions addressing this layered relationship, including requirements for Meridian to ensure that its end-user customer agreements contain adequate data processing terms and that end-user customers are informed of and consent to Lumos's engagement as a sub-processor.

The DPA addresses both scenarios to ensure that, regardless of the characterization of Meridian's role in a given use case, the contractual framework satisfies the requirements of Article 28 of the GDPR. In both scenarios, Lumos processes personal data only on documented instructions from the data exporter (whether that is Meridian acting in its own right as controller or Meridian passing through instructions from the end-user customer controller).

C. Data Protection Obligations of Lumos as Processor

The DPA imposes upon Lumos the full suite of processor obligations required by Article 28(3) of the GDPR. These obligations are summarized below:

Processing on Documented Instructions. Consistent with Article 28(3)(a) of the GDPR, Lumos is required to process personal data only on documented instructions from the data exporter, including with regard to transfers of personal data to a third country. The DPA specifies that the Agreement and the DPA themselves constitute the data exporter's initial documented instructions, and that any additional instructions must be provided in writing and agreed upon by the parties. If Lumos believes that an instruction infringes the GDPR or other applicable data protection law, it must inform the data exporter immediately.

Confidentiality. Lumos must ensure that all persons authorized to process personal data under the DPA have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality. This obligation extends to Lumos employees, contractors, and agents who access personal data in the course of performing services under the Agreement.

Technical and Organizational Security Measures. Pursuant to Article 32 of the GDPR, Lumos is required to implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing, as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons. The DPA specifies the following measures, which are further detailed in Annex II to the SCCs:

• Encryption of personal data at rest using AES-256 encryption and in transit using TLS 1.2 or higher;

• Role-based access controls with multi-factor authentication for all personnel accessing EMEA customer data;

• Pseudonymization capabilities enabling the separation of directly identifying information from analytical datasets;

• Regular penetration testing conducted by qualified independent third-party security firms, with results shared with Meridian upon request;

• SOC 2 Type II compliance, with annual audit reports made available to Meridian under appropriate confidentiality protections;

• Intrusion detection and prevention systems;

• Regular vulnerability scanning and patch management protocols; and

• Business continuity and disaster recovery plans with defined recovery time objectives and recovery point objectives.

Sub-Processor Engagement. Lumos may not engage a sub-processor without the prior specific or general written authorization of the data exporter. The DPA employs the general authorization model with an objection mechanism: Lumos must provide Meridian with at least thirty (30) days' prior written notice before engaging any new sub-processor or replacing an existing sub-processor. During that thirty-day period, Meridian has the right to object on reasonable data-protection grounds, as described in Section VI below.

Assistance with Data Subject Requests. Lumos is required to assist Meridian (and, through Meridian, its end-user customers) in fulfilling the data exporter's obligation to respond to requests from data subjects exercising their rights under Articles 15 through 22 of the GDPR, including the rights of access, rectification, erasure, restriction of processing, data portability, objection, and the right not to be subject to automated individual decision-making. Lumos must implement appropriate technical measures to enable the efficient fulfillment of data subject requests, including data export functionality, targeted deletion capabilities, and the ability to restrict processing of specific datasets.

Assistance with Security and Regulatory Obligations. Lumos must assist the data exporter with its obligations under Articles 32 through 36 of the GDPR, including obligations relating to the security of processing, breach notification, data protection impact assessments, and prior consultation with supervisory authorities. This assistance obligation is particularly relevant in the context of the DPIA recommendation set forth in Section VIII.C below.

Data Deletion or Return. Upon termination or expiration of the DPA, Lumos must, at the data exporter's election, delete or return all personal data processed under the DPA and delete existing copies, unless EU or Member State law requires further storage of the personal data. The DPA specifies a sixty (60) day period following termination during which the data exporter may request data return in a structured, commonly used, machine-readable format. After expiration of this period, Lumos will proceed with secure deletion and provide a written certification of deletion upon request.

Audit Rights. Meridian (and, where applicable, its end-user customers) is entitled to conduct audits, including inspections, of Lumos's processing activities to verify compliance with the DPA. Lumos must make available to the data exporter all information necessary to demonstrate compliance with the obligations laid down in Article 28 of the GDPR and must allow for and contribute to audits conducted by the data exporter or an independent auditor mandated by the data exporter. The DPA provides that audits shall be conducted with reasonable advance notice (not less than thirty (30) business days), during normal business hours, and in a manner that does not unreasonably disrupt Lumos's operations. Lumos may satisfy audit requests by providing current SOC 2 Type II audit reports, penetration testing results, and other relevant compliance documentation, provided that on-site inspections remain available if such documentation does not adequately address the data exporter's concerns.

D. Data Breach Notification

The DPA contains robust data breach notification provisions aligned with the requirements of Article 33 of the GDPR. Lumos is required to notify Meridian without undue delay and in any event within seventy-two (72) hours of becoming aware of a personal data breach affecting personal data processed under the DPA. This seventy-two-hour timeline mirrors the timeline within which the data controller is required to notify the competent supervisory authority under Article 33(1) of the GDPR, ensuring that the processor's notification to the controller occurs sufficiently early to enable the controller to meet its own regulatory notification obligations.

The breach notification provided by Lumos must include, to the extent such information is available at the time of notification: (i) the nature of the personal data breach, including the categories and approximate number of data subjects concerned and the categories and approximate number of personal data records concerned; (ii) the name and contact details of Lumos's data protection contact from whom more information can be obtained; (iii) the likely consequences of the personal data breach; and (iv) the measures taken or proposed to be taken by Lumos to address the personal data breach, including, where appropriate, measures to mitigate its possible adverse effects. Where it is not possible to provide all such information simultaneously, the information may be provided in phases without undue further delay.

The DPA further requires Lumos to cooperate with Meridian in investigating, remediating, and mitigating the effects of any personal data breach, and to document all personal data breaches in a breach register, including the facts relating to the breach, its effects, and the remedial action taken. This documentation obligation aligns with Article 33(5) of the GDPR.

E. International Data Transfers

The DPA explicitly addresses the cross-border transfer of personal data from the EEA and the United Kingdom to the United States, which occurs as a consequence of Lumos's U.S.-based operations and personnel accessing EMEA data. Section 8 of the DPA specifies that such transfers are governed by the Standard Contractual Clauses incorporated as an appendix to the DPA, supplemented by the UK International Data Transfer Addendum for transfers originating from the United Kingdom. The detailed analysis of the SCCs and related transfer mechanisms is set forth in Section IV of this memorandum.

F. Data Protection Officer

The DPA designates the following points of contact for data protection matters:

• Lumos Analytics Inc.: Daniel Ostroff, VP, Legal & Compliance, 4700 Sandhill Road, Suite 300, Palo Alto, CA 94304; email: dostroff@lumosanalytics.com; telephone: +1 (650) 555-0147.

• Meridian Data Solutions GmbH: Dr. Anneliese Brandt, General Counsel, Leopoldstraße 78, 80802 München, Germany; email: a.brandt@meridiandata.de; telephone: +49 89 555 0234.

While Lumos has not appointed a formal Data Protection Officer under Article 37 of the GDPR (as it is not established in the EU and the applicability of the DPO requirement to U.S.-based processors is the subject of ongoing regulatory guidance), Daniel Ostroff serves as Lumos's primary contact for all data protection inquiries, regulatory correspondence, and supervisory authority interactions related to the EMEA processing activities. Meridian GmbH, as an entity established in the EU, should assess independently whether it is required to appoint a DPO under Article 37 based on the nature and scale of its processing activities.

IV. Standard Contractual Clauses — Module Two (Controller-to-Processor)

A. Legal Basis for Cross-Border Data Transfers

The transfer of personal data from the EEA or the United Kingdom to a third country that has not been recognized as providing an adequate level of data protection requires the implementation of appropriate safeguards under Chapter V of the GDPR (Articles 44–49) or the corresponding provisions of the UK GDPR. The United States has historically presented challenges in this regard, as underscored by the Court of Justice of the European Union's landmark decision in Data Protection Commissioner v. Kestrel Services Inc. Ireland Limited and Maximillian Schrems (Case C-311/18, July 16, 2020) ("Schrems II"), which invalidated the EU-U.S. Privacy Shield framework on the basis that U.S. surveillance laws, particularly FISA Section 702 and Executive Order 12333, did not provide protections essentially equivalent to those guaranteed by the GDPR.

Following Schrems II, the European Commission adopted new Standard Contractual Clauses pursuant to Commission Implementing Decision (EU) 2021/914 of June 4, 2021, which became the primary contractual mechanism for legitimizing data transfers to third countries lacking an adequacy determination. Subsequently, on July 10, 2023, the European Commission adopted an adequacy decision for the EU-U.S. Data Privacy Framework ("DPF"), which provides a new adequacy-based transfer mechanism for personal data transferred to U.S. organizations that have self-certified under the DPF. The DPF adequacy decision was based in significant part on the enhanced safeguards introduced by Executive Order 14086 (October 7, 2022), which imposes necessity and proportionality requirements on U.S. Signals intelligence activities and establishes a new redress mechanism through the Data Protection Review Court ("DPRC").

Notwithstanding the availability of the DPF as a transfer mechanism, the DPA incorporates the SCCs as a belt-and-suspenders approach to ensure continuity and legal certainty in the event that the DPF is challenged or invalidated — a possibility that remains realistic given that the individual who brought the Schrems I and Schrems II challenges has publicly indicated an intention to challenge the DPF. By maintaining the SCCs as the primary contractual transfer mechanism and supplementing them with the DPF (to the extent Lumos self-certifies), the parties ensure that an adequate safeguard remains in place regardless of the fate of the DPF adequacy decision.

For transfers from the United Kingdom, the analysis proceeds along a parallel but distinct track. The UK Extension to the EU-U.S. Data Privacy Framework, which became effective on October 12, 2023, provides a DPF-based adequacy mechanism for UK-to-U.S. transfers. In addition, the UK ICO's International Data Transfer Addendum to the EU SCCs (the "UK IDTA" or "UK Addendum") provides a contractual mechanism analogous to the SCCs for UK-originating transfers. Both mechanisms are employed in the DPA to ensure comprehensive coverage.

B. Module Selection

The parties have selected Module Two (Controller-to-Processor) of the SCCs as the appropriate module for the primary data flow, in which Meridian, acting as a data controller and data exporter established in the EEA or UK, transfers personal data to Lumos, acting as a data processor and data importer established in the United States. This module selection is consistent with the controller-processor relationship established under the DPA, as described in Section III.B above.

The following clause-by-clause analysis addresses the key provisions of the SCCs as completed and incorporated into the DPA:

Clause 7 — Docking Clause. The Docking Clause has been included in the SCCs to allow end-user customers to accede to the SCCs as additional data exporters. This is an important structural feature given the three-tier data processing relationship described in Section III.B above. By including the Docking Clause, the parties ensure that end-user customers who are themselves data controllers can directly benefit from the protections of the SCCs without the need to negotiate and execute separate SCC agreements with Lumos. An end-user customer seeking to accede must complete the relevant annexes and provide its agreement to be bound by the SCCs in the form attached to the DPA. The Docking Clause also provides flexibility for future expansion of the EMEA reseller program to additional end-user customers.

Clause 8 — Data Protection Safeguards. Clause 8 sets out the core data protection obligations of the data importer (Lumos), including the obligation to process personal data only on documented instructions from the data exporter, to implement appropriate technical and organizational measures, and to assist the data exporter in meeting its obligations under the GDPR. The substance of these obligations mirrors the processing obligations established in the DPA (as described in Section III.C above), ensuring consistency between the contractual and SCC-based frameworks. This parallelism is intentional and reflects the EDPB's recommendation that SCC obligations be consistent with the underlying data processing agreement.

Clause 9 — Use of Sub-Processors. The parties have selected Option 2 (general written authorization) under Clause 9. Under this option, the data importer (Lumos) has the data exporter's general authorization to engage sub-processors, subject to the requirement that Lumos provide the data exporter with written notice of any intended changes to its list of sub-processors (addition or replacement) at least thirty (30) days in advance, thereby giving the data exporter a reasonable opportunity to object to such changes before the engagement of the new sub-processor. If the data exporter objects on reasonable grounds, the parties must endeavor to resolve the objection in good faith. The sub-processor management framework is described in further detail in Section VI below.

Clause 10 — Data Subject Rights. Clause 10 requires the data importer (Lumos) to assist the data exporter in responding to requests from data subjects seeking to exercise their rights under the GDPR, including the rights of access, rectification, erasure, restriction, portability, and objection. This obligation is consistent with and reinforces the corresponding provision in the DPA, as described in Section III.C above. Lumos has implemented platform features that facilitate the fulfillment of data subject requests, including data export tools, deletion mechanisms, and the ability to restrict processing of individual data records.

Clause 11 — Redress. Clause 11 provides data subjects with redress mechanisms, including the right to lodge complaints with the data exporter, the data importer, and the competent supervisory authority. Data subjects are also entitled to invoke the SCCs as third-party beneficiaries and to bring claims against the data exporter or data importer for breaches of the SCCs. This provision ensures that EMEA data subjects have meaningful access to remedies in the event of a data protection violation.

Clause 13 — Supervision. The competent supervisory authority for the purposes of the SCCs is determined by the location of the data exporter. For transfers from Meridian GmbH (established in Bavaria, Germany), the competent supervisory authority is the Bayerisches Landesamt für Datenschutzaufsicht ("BayLDA"), the Bavarian Data Protection Authority, located in Ansbach, Germany. For transfers from Meridian UK (established in England), the competent supervisory authority is the UK Information Commissioner's Office ("ICO"), located at Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. The DPA identifies these authorities in the relevant annexes and provides for the cooperation of the data importer with the competent supervisory authority in accordance with the applicable regulatory framework.

Clause 14 — Local Laws and Practices Affecting Compliance. Clause 14 requires the parties to warrant that they have no reason to believe that the laws and practices in the third country of destination (the United States) applicable to the processing of personal data by the data importer, including any requirements to disclose personal data or measures authorizing access by public authorities, prevent the data importer from fulfilling its obligations under the SCCs. This clause is addressed through the Transfer Impact Assessment set forth in Section V of this memorandum, which evaluates U.S. surveillance laws and practices and the supplementary measures implemented to mitigate any identified risks.

Clause 15 — Obligations of the Data Importer in Case of Government Access Requests. Clause 15 imposes specific transparency and challenge obligations on the data importer (Lumos) in the event it receives a legally binding request from a public authority (including judicial authorities) for disclosure of personal data transferred under the SCCs. Lumos commits to: (i) notify the data exporter of such request promptly, unless prohibited from doing so under the law of the requesting authority (in which case Lumos will use best efforts to obtain a waiver of the prohibition); (ii) challenge the request if there are reasonable grounds to consider it unlawful, including by seeking interim measures with a view to suspending the effects of the request until the competent judicial authority has decided on its merits; and (iii) provide the minimum amount of information permissible when responding to a request for disclosure, based on a reasonable interpretation of the request. These commitments are reinforced by the contractual measures described in Section V.C below.

Clause 17 — Governing Law. Consistent with the requirements of Module Two, the SCCs are governed by the law of the EU Member State in which the data exporter is established. For EEA transfers from Meridian GmbH, the governing law is the law of Germany. For UK transfers from Meridian UK, the SCCs (as modified by the UK IDTA) are governed by the law of England and Wales. This dual governing law structure ensures that data subjects can invoke the SCCs under a legal system that has jurisdiction over the data exporter.

Clause 18 — Choice of Forum and Jurisdiction. Any dispute arising under the SCCs shall be resolved by the courts of the country in which the data exporter is established. For EEA transfers, the competent courts are the courts of Munich, Germany. For UK transfers, the competent courts are the courts of England and Wales. These forum selection provisions ensure that data subjects and data exporters have access to a judicial forum within their own jurisdiction.

C. UK International Data Transfer Addendum (IDTA)

The UK GDPR requires a separate transfer mechanism for transfers of personal data from the United Kingdom to third countries that have not been recognized as providing an adequate level of protection. Following Brexit, the EU SCCs do not automatically apply to transfers from the UK, and the UK ICO has issued the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses (Version B1.0), which came into force on March 21, 2022 (the "UK Addendum" or "IDTA"). The UK Addendum modifies the EU SCCs to ensure that they function as appropriate safeguards for transfers governed by the UK GDPR.

The UK Addendum has been incorporated into Exhibit C of the Agreement. Part 1 of the UK Addendum, comprising Tables 1 through 4, has been completed with the following information:

• Table 1 — Parties: Meridian Data Solutions UK Ltd, acting through its Director, Katarina Voss, as the UK data exporter; Lumos Analytics Inc. as the data importer. Contact details, key contact persons, and data protection officer/contact information have been specified.

• Table 2 — Selected SCCs, Modules, and Selected Clauses: Module Two (Controller-to-Processor) has been selected, consistent with the EEA SCC module selection.

• Table 3 — Appendix Information: Cross-references the information contained in Annexes I, II, and III to the SCCs, including the list of parties, description of transfer, technical and organizational measures, and sub-processor list.

• Table 4 — Ending the Addendum When the Approved Addendum Changes: The parties have selected the approach that, if the ICO issues a revised Approved Addendum, the parties will work together in good faith to adopt the revised version, but neither party may end the Addendum solely by reason of the ICO's issuance of a revised version.

The Approved Addendum ensures that the SCCs, as modified by the UK Addendum, provide appropriate safeguards for transfers of personal data from the United Kingdom to the United States within the meaning of Article 46(1) of the UK GDPR. The UK Addendum takes precedence over the EU SCCs to the extent of any inconsistency, and it is designed to be interpreted in a manner consistent with the UK GDPR and the DPA 2018.

D. Annexes to the SCCs

The SCCs are accompanied by three annexes, which together provide the substantive detail required for the SCCs to function as a complete transfer mechanism:

Annex I — List of Parties and Description of Transfer. Annex I identifies the data exporter(s) and data importer, describes the categories of data subjects and categories of personal data transferred, specifies the frequency of transfer (continuous, as the platform processes data on an ongoing basis), the nature and purpose of processing, the retention period (co-terminus with the Agreement, subject to the deletion/return provisions of the DPA), and the competent supervisory authority (BayLDA for EEA transfers; ICO for UK transfers).

Annex II — Technical and Organizational Security Measures. Annex II sets forth the technical and organizational measures implemented by the data importer (Lumos) to protect the transferred personal data, including: AES-256 encryption at rest; TLS 1.2 or higher encryption in transit; role-based access control protocols with multi-factor authentication; intrusion detection and prevention systems; regular penetration testing by independent third parties; incident response procedures with defined escalation paths and response times; business continuity and disaster recovery plans with geographically redundant EU-based backups; SOC 2 Type II certification, with annual audit reports available to the data exporter; and employee and contractor security awareness training programs. These measures are designed to meet the requirements of Article 32 of the GDPR and to provide the supplementary safeguards contemplated by the EDPB's Recommendations 01/2020.

Annex III — List of Pre-Approved Sub-Processors. Annex III identifies the sub-processors that the data importer has been authorized to engage as of the effective date of the SCCs. The pre-approved sub-processor list is discussed in Section VI below.

V. Transfer Impact Assessment (TIA)

A. Purpose and Methodology

Clause 14 of the SCCs requires that the parties represent and warrant that they have no reason to believe that the laws and practices in the third country of destination applicable to the processing of personal data by the data importer prevent the data importer from fulfilling its obligations under the SCCs. To substantiate this warranty, the parties must conduct a Transfer Impact Assessment evaluating the laws of the third country — in this case, the United States — and their potential impact on the protection of transferred personal data.

The TIA set forth in this Section has been prepared in accordance with the methodology recommended by the European Data Protection Board ("EDPB") in its Recommendations 01/2020 on measures that supplement transfer tools to ensure compliance with the EU level of protection of personal data (adopted in final form on June 18, 2021). The EDPB's six-step methodology encompasses: (1) identification of the transfers; (2) verification of the transfer tool relied upon; (3) assessment of the laws of the third country; (4) identification and adoption of supplementary measures; (5) procedural steps to implement supplementary measures; and (6) re-evaluation at appropriate intervals. Steps 1 and 2 have been addressed in Sections III and IV of this memorandum, respectively. Steps 3 through 5 are addressed in this Section. Step 6 is addressed in Section V.D (Ongoing Monitoring) and in the Recommendations set forth in Section X.

B. Assessment of U.S. Legal Framework

The following U.S. legal instruments have been identified as potentially relevant to the processing of EMEA personal data by Lumos and have been assessed for their impact on the adequacy of protection:

FISA Section 702 (50 U.S.C. § 1881a). Section 702 of the Foreign intelligence Surveillance Act authorizes the U.S. government to conduct targeted surveillance of non-U.S. persons reasonably believed to be located outside the United States for the purpose of acquiring foreign intelligence information. Surveillance under Section 702 is conducted through directives issued to U.S.-based electronic communication service providers, requiring them to provide the government with specified communications or data. Section 702 is relevant to this analysis because EMEA end-user data processed by Lumos — a U.S.-based entity — may fall within the scope of Section 702 collection, particularly where the data subjects are non-U.S. persons located outside the United States. However, it is important to note that Section 702 authorizes only targeted collection directed at specific individuals or identifiers; it does not authorize indiscriminate bulk collection of data. Moreover, Executive Order 14086 (discussed below) has introduced significant new limitations on Section 702 collection.

Executive Order 14086 (October 7, 2022). Signed by President Biden on October 7, 2022, Executive Order 14086 ("Enhancing Safeguards for United States signals intelligence Activities") establishes enhanced safeguards for U.S. Signals intelligence activities, including activities conducted under FISA Section 702 and Executive Order 12333. The key elements of EO 14086 include: (i) a requirement that signals intelligence activities be conducted only in pursuit of defined legitimate objectives and only to the extent that such activities are necessary and proportionate to the validated intelligence priority; (ii) specific prohibitions on the use of signals intelligence to suppress dissent, discriminate on the basis of protected characteristics, or gain commercial advantage; and (iii) the establishment of a multi-layered redress mechanism consisting of the Civil Liberties Protection Officer of the Office of the Director of National intelligence ("CLPO") and the Data Protection Review Court ("DPRC"), an independent body with binding decision-making authority. EO 14086 underpins the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework and represents a material improvement over the legal landscape that existed at the time of the Schrems II decision. The DPRC, in particular, addresses one of the core deficiencies identified by the CJEU in Schrems II — the absence of an independent redress mechanism for EU data subjects.

Clarifying Lawful Overseas Use of Data Act (CLOUD Act). The CLOUD Act, enacted in 2018, amends the Stored Communications Act (18 U.S.C. § 2713) to require U.S.-based service providers to comply with lawful orders for the disclosure of electronic communications and stored data, regardless of whether such data is stored within or outside the United States. The CLOUD Act is relevant because Lumos, as a U.S.-incorporated entity, is subject to its provisions even with respect to data stored in the Frankfurt data center. However, the CLOUD Act also includes mechanisms for service providers to challenge disclosure orders that conflict with the laws of a qualifying foreign government, and it provides for executive agreements between the U.S. and foreign governments to facilitate mutual legal assistance while respecting the sovereignty of the foreign jurisdiction. The risk posed by the CLOUD Act is mitigated by Lumos's contractual commitment, set forth in Clause 15 of the SCCs and reinforced in the DPA, to: (i) challenge overbroad or unlawful requests for disclosure; (ii) seek interim measures to suspend the effects of a disclosure order pending judicial review; (iii) provide only the minimum amount of information permissible; and (iv) notify the data exporter to the extent legally permissible.

Assessment Conclusion. Having assessed the U.S. legal framework in light of the EDPB's Recommendations 01/2020, the principles articulated by the CJEU in Schrems II, and the enhanced safeguards introduced by Executive Order 14086, we conclude that, with the supplementary measures described in Section V.C in place, the risk of disproportionate government access to EMEA personal data transferred to Lumos in the United States is effectively mitigated. The combination of: (a) the necessity and proportionality requirements imposed by EO 14086; (b) the independent redress mechanism provided by the DPRC; (c) the technical measures described below (including data localization in Frankfurt and encryption); (d) the organizational measures limiting U.S. personnel access; and (e) the contractual commitments under the SCCs collectively provides a level of protection essentially equivalent to that guaranteed by the GDPR. This conclusion is consistent with the European Commission's adequacy finding for the EU-U.S. Data Privacy Framework, although the parties are not relying exclusively on the DPF as a transfer mechanism.

C. Supplementary Measures

In accordance with the EDPB's Recommendations 01/2020, the following supplementary measures have been identified and implemented to reinforce the protections provided by the SCCs:

Technical Measures.

(a) Data Localization. EMEA customer data is localized in the Frankfurt am Main, Germany data center operated by Stratos Cloud Services AG (Bahnhofstrasse 42, 8001 Zürich, Switzerland; EMEA data center located in Frankfurt am Main, Germany). Production data, backup data, and disaster recovery replicas are all maintained within EU-based infrastructure. This data localization architecture minimizes the exposure of EMEA personal data to U.S. jurisdiction, as the data does not reside on U.S.-based servers.

(b) Encryption. All EMEA customer data is encrypted at rest using AES-256 encryption and in transit using TLS 1.2 or higher. With respect to end-user-encrypted content data, Lumos does not hold the decryption keys; the keys are managed exclusively by the end-user customer or Meridian (as applicable). This technical architecture ensures that even in the event of a compelled disclosure, the disclosed data would be unintelligible without the decryption keys, which are not within Lumos's possession or control for end-user-encrypted content.

(c) Access Controls. Access to EMEA customer data by Lumos personnel is governed by role-based access controls with multi-factor authentication. All access is logged and auditable.

Organizational Measures.

(a) Restricted U.S. Access. Strict access controls limit U.S.-based Lumos personnel's ability to access EMEA customer data. Access is granted only on a need-to-know basis for specific, documented purposes (e.g., troubleshooting, platform maintenance, support requests), and all access events are logged and subject to periodic review.

(b) Training. Lumos personnel who may access EMEA customer data receive mandatory data protection training covering the GDPR, the SCCs, the restrictions on government access, and the procedures for handling law enforcement and intelligence agency requests.

(c) Privacy Contact. Lumos has designated Daniel Ostroff, VP, Legal & Compliance, as its primary data protection contact, with responsibility for receiving and responding to government access requests and coordinating with the data exporter.

Contractual Measures.

(a) SCC Clause 15 Commitments. As described in Section IV.B above, Lumos has committed under Clause 15 of the SCCs to transparency and challenge obligations in the event of government access requests, including the obligation to notify the data exporter, challenge unlawful requests, and minimize disclosure.

(b) Additional Contractual Commitments. The DPA includes a specific provision whereby Lumos commits to notify the data exporter of any legally binding request for disclosure by a public authority (including law enforcement and intelligence agencies) and to challenge such requests where there are reasonable grounds to consider them unlawful or disproportionate. Lumos further commits to provide the data exporter with aggregate statistics on government access requests received (to the extent permitted by law) on an annual basis.

D. Ongoing Monitoring

The TIA is not a one-time exercise but must be reassessed at appropriate intervals and in response to material changes in the legal landscape. We recommend that Lumos and Meridian conduct annual reassessments of the TIA, with the first scheduled reassessment to occur no later than April 1, 2025. The reassessment should be triggered earlier than the annual schedule if any of the following events occurs: (i) a successful legal challenge to the EU-U.S. Data Privacy Framework or a withdrawal of the European Commission's adequacy decision; (ii) material changes in U.S. surveillance legislation, including amendments to FISA Section 702 or modifications to Executive Order 14086; (iii) guidance from the EDPB, the European Commission, or the UK ICO that materially affects the assessment of U.S. legal protections; or (iv) a material change in Lumos's technical architecture or data processing practices that alters the risk profile.

Calderwood & Harkness LLP and Thornbridge Whitaker LLP will continue to monitor relevant legal and regulatory developments and will advise Lumos on any required updates to the transfer mechanism or supplementary measures. In particular, we note that FISA Section 702 is subject to periodic reauthorization by the U.S. Congress and that any future reauthorization legislation may include amendments that affect the TIA assessment.

VI. Sub-Processor Management

A. Pre-Approved Sub-Processors (Annex III to the DPA)

Annex III to the DPA identifies the following pre-approved sub-processor as of the effective date of the Agreement:

Stratos Cloud Services AG provides the cloud infrastructure hosting services for all EMEA customer data processed through the Lumos Prism™ platform. Because the Stratos EMEA data center is located in Frankfurt am Main, Germany — within the EEA — the processing of EMEA customer data by Stratos does not constitute a transfer to a third country, and no onward transfer issue arises for EEA-originating data. Although Stratos is a Swiss-incorporated entity, the European Commission has recognized Switzerland as providing an adequate level of data protection (Commission Decision 2000/518/EC, as confirmed by subsequent review), and in any event the relevant data processing occurs at the Frankfurt facility within the EEA.

Annex III is maintained as a living document by Lumos and will be updated to reflect any additions or changes to the sub-processor list in accordance with the notification and objection mechanism described below. The current version of Annex III will be made available to Meridian upon request and will be provided proactively in connection with any proposed changes.

B. Notification and Objection Mechanism

The sub-processor management framework in the DPA reflects best practices and the requirements of Clause 9 (Option 2) of the SCCs. The key elements of this framework are as follows:

Prior Written Notice. Lumos is required to provide Meridian with no less than thirty (30) days' prior written notice before engaging any new sub-processor or replacing an existing sub-processor. The notice must identify the proposed sub-processor, describe the processing activities to be performed, identify the location(s) of processing, and confirm that the sub-processor has agreed to data protection obligations no less protective than those in the DPA.

Right to Object. Meridian has the right to object to the engagement of a new or replacement sub-processor on reasonable data-protection grounds. An objection must be submitted in writing within the thirty-day notice period and must state the specific data-protection grounds for the objection. Upon receipt of an objection, the parties must endeavor in good faith to resolve the matter within an additional thirty (30) day period through reasonable means, which may include the implementation of additional safeguards, the selection of an alternative sub-processor, or modifications to the scope of the sub-processor's processing activities.

Termination Right. If the parties are unable to resolve an objection within the thirty-day resolution period, Meridian may terminate the DPA (and the affected processing activities) upon written notice to Lumos. This termination right is a critical protection for the data exporter and ensures that Meridian retains meaningful control over the sub-processor chain.

Sub-Processor Agreements. Lumos is required to enter into a written agreement with each sub-processor that imposes data protection obligations no less protective than those set forth in the DPA. The sub-processor agreement must, at a minimum, include obligations relating to: processing on documented instructions; confidentiality; security measures; cooperation with audits; data breach notification; data deletion or return upon termination; and compliance with applicable data protection laws. Lumos remains fully liable to Meridian for the performance of each sub-processor's obligations.

C. Sub-Distributor Data Processing Implications

Meridian Data Solutions UK Ltd and Meridian Data Solutions SARL are pre-approved sub-distributors under Exhibit B to the Agreement, authorized to market and resell Lumos Prism™ subscriptions in their respective territories (UK and Ireland for Meridian UK; France, Belgium, Luxembourg, and French-speaking Switzerland for Meridian France). These sub-distributors may also act as data controllers or data processors in their respective territories, depending on the nature of their interactions with end-user customers and the personal data they handle.

Meridian GmbH, as the primary contracting party under the Agreement, bears responsibility for ensuring that its sub-distributors comply with applicable data protection laws — including the GDPR (for Meridian France) and the UK GDPR (for Meridian UK) — and are bound by data processing terms consistent with Exhibit C. This responsibility arises from Meridian GmbH's obligations as a data controller and from the general principle that a controller must ensure that processors and sub-processors within its chain are subject to adequate contractual and organizational safeguards.

Recommendation. We recommend that Meridian GmbH execute back-to-back Data Processing Agreements with Meridian UK and Meridian France that flow down the obligations contained in Exhibit C. These back-to-back DPAs should mirror the substantive provisions of Exhibit C, including the processing restrictions, security obligations, sub-processor management provisions, data breach notification requirements, and audit rights. The back-to-back DPAs should also incorporate the relevant SCCs and, in the case of Meridian UK, the UK IDTA, to the extent that personal data flows between Meridian GmbH and its sub-distributors constitute restricted transfers under the GDPR or UK GDPR. Calderwood & Harkness and T

MEMORANDUM
PRIVILEGED & CONFIDENTIAL — ATTORNEY-CLIENT PRIVILEGE / ATTORNEY WORK PRODUCT
To: Daniel Ostroff, VP, Legal & Compliance, Lumos Analytics Inc.
From: Leila Nazari, Associate, Calderwood & Harkness LLP; with input from Alistair Drummond, Partner, Thornbridge Whitaker LLP
Date: March 15, 2024
Re: GDPR / UK GDPR Data Transfer Compliance Analysis — Lumos Prism™ EMEA Channel Reseller Program Agreement with Meridian Data Solutions GmbH
Matter No.: 1008-00010
Right-click to update Table of Contents
I. Executive Summary
This memorandum analyzes the compliance of the proposed EMEA distribution arrangement for the Lumos Prism™ AI-driven financial analytics and risk-modeling SaaS platform with Regulation (EU) 2016/679 (the "GDPR"), the UK General Data Protection Regulation (the "UK GDPR," as retained EU law under the European Union (Withdrawal) Act 2018), and the Data Protection Act 2018 (the "DPA 2018"). The distribution arrangement is governed by the Channel Reseller Program Agreement (the "Agreement") between Lumos Analytics Inc. ("Lumos"), a Delaware C-Corporation headquartered at 4700 Sandhill Road, Suite 300, Palo Alto, CA 94304, and Meridian Data Solutions GmbH ("Meridian" or "Meridian GmbH"), a company organized under the laws of Germany (GmbH) with registered offices at Leopoldstraße 78, 80802 München, Germany (Amtsgericht München, HRB 274581).
The scope of this analysis encompasses the Data Processing Agreement attached as Exhibit C to the Agreement (the "DPA"), the Standard Contractual Clauses incorporated therein pursuant to Commission Implementing Decision (EU) 2021/914 (Module Two — Controller-to-Processor) (the "SCCs"), the data localization architecture utilizing the Frankfurt am Main, Germany data center operated by Stratos Cloud Services AG ("Stratos"), the sub-processor management framework, and the Transfer Impact Assessment ("TIA") considerations arising from the cross-border transfer of personal data from the European Economic Area ("EEA") and the United Kingdom to the United States.
Overall Conclusion. Based on our review of the Agreement, the DPA, the incorporated SCCs and UK International Data Transfer Addendum, the data localization commitments, and the supplementary technical, organizational, and contractual measures described herein, we conclude that the data processing framework, as structured, achieves compliance with the GDPR, the UK GDPR, and the DPA 2018. This conclusion is subject to certain ongoing compliance obligations and monitoring requirements outlined in Section X of this memorandum, including annual reassessment of the Transfer Impact Assessment, monitoring of the EU-U.S. Data Privacy Framework, completion of a Data Protection Impact Assessment for AI-driven processing activities, and ongoing sub-processor management.
The Agreement has an aggregate total contract value ("TCV") of $30,000,000 over a five-year initial term commencing April 1, 2024, and ending March 31, 2029. The EMEA Territory, as defined in Exhibit A to the Agreement, encompasses all countries within Europe (including the United Kingdom), the Middle East, and Africa.
Meridian has designated two pre-approved sub-distributors for specific territories within the EMEA region: (i) Meridian Data Solutions UK Ltd ("Meridian UK"), a company incorporated in England and Wales with registered offices at 14 Fenchurch Place, London EC3M 5AJ (Companies House No. 12847391), authorized for the United Kingdom and Ireland; and (ii) Meridian Data Solutions SARL ("Meridian France"), a société à responsabilité limitée organized under the laws of France with registered offices at 27 Rue de la Boétie, 75008 Paris (SIREN 912 483 057), authorized for France, Belgium, Luxembourg, and French-speaking Switzerland. The data protection implications of these sub-distributor arrangements are addressed in Section VI.C below.
This memorandum was prepared by Calderwood & Harkness LLP, 801 South Figueroa Street, Suite 4200, Los Angeles, CA 90017, in coordination with Thornbridge Whitaker LLP, 22 Bishopsgate, London EC2N 4BQ. Thornbridge Whitaker serves as UK and EU regulatory and data-protection counsel to Lumos and has provided substantive input on UK GDPR considerations, SCC implementation, and Transfer Impact Assessment methodology, as reflected throughout this memorandum.
II. Background and Transaction Overview
A. The Parties and Their Roles Under Data Protection Law
A clear delineation of the roles of the parties under data protection law is essential to determining the applicable obligations, the appropriate transfer mechanisms, and the contractual requirements under Articles 26 and 28 of the GDPR. The roles of the parties in this transaction are as follows:
Lumos Analytics Inc. Lumos is the developer, licensor, and SaaS provider of the Lumos Prism™ platform, an AI-driven financial analytics and risk-modeling tool that enables enterprise users to analyze financial data, generate risk assessments, and produce predictive models. Lumos processes personal data of EMEA end users through the platform's cloud-based infrastructure. Under the data protection framework established by the DPA, Lumos acts in a dual capacity: (i) as a data controller with respect to certain categories of personal data that Lumos processes for its own purposes, including account registration data, billing and payment information, and platform usage analytics collected for product improvement and internal business intelligence purposes; and (ii) as a data processor (or, in the layered scenario described below, a sub-processor) with respect to end-user financial analytics data that is uploaded to and processed through the Lumos Prism™ platform on behalf of Meridian's end-user customers. The distinction between these two capacities is material, as the obligations incumbent upon Lumos and the transfer mechanisms applicable to the personal data differ depending on which role Lumos occupies with respect to the data in question.
Meridian Data Solutions GmbH. Meridian is the authorized non-exclusive reseller for the EMEA Territory. As the entity with the direct contractual relationship with EMEA end-user customers, Meridian occupies a complex position under data protection law. Meridian acts as a data controller vis-à-vis its own end-user customer relationships — that is, with respect to the personal data that Meridian collects, manages, and uses for its own commercial purposes, including customer relationship management, billing, sales, and marketing activities. Additionally, Meridian functions as an intermediary in the data processing chain, receiving personal data from end-user customers and passing that data through to Lumos for processing on the Lumos Prism™ platform. In certain configurations, Meridian may itself be characterized as a data processor acting on behalf of its end-user customers (who are the ultimate controllers of the financial analytics data they upload to the platform), with Lumos acting as Meridian's sub-processor. The DPA addresses both of these scenarios to ensure comprehensive coverage.
End Users. The end users are enterprises in the EMEA Territory that subscribe to the Lumos Prism™ platform through Meridian's reseller channel. Each end user may itself be a data controller with respect to the personal data it uploads to the platform for analytics processing. This is particularly the case where end users upload financial data pertaining to their own customers, employees, or other natural persons. The end-user customer's controller status triggers its own set of GDPR obligations, including the requirement to provide appropriate privacy notices, obtain lawful bases for processing, and ensure that any onward transfers of personal data to processors and sub-processors are governed by compliant contractual terms. The Docking Clause (Clause 7 of the SCCs) has been included to allow end-user customers to accede as additional data exporters under the SCCs.
Nature of Personal Data Processed. The categories of personal data processed through the Lumos Prism™ platform in connection with the EMEA reseller arrangement include the following: (i) financial analytics data, including financial data points, risk-modeling inputs, and analytical outputs generated by the platform's AI models; (ii) user account credentials, including names, email addresses, job titles, and login information of individuals authorized by end-user customers to access the platform; (iii) usage telemetry, including records of platform interactions, feature utilization metrics, session data, and device identifiers; (iv) customer contact information maintained by Meridian in connection with its reseller activities; and (v) potentially sensitive financial data of end-user clients, such as creditworthiness indicators, transaction histories, and risk-scoring outputs. The sensitivity and volume of these data categories underscore the importance of the compliance framework analyzed in this memorandum.
B. Contractual Framework
The data protection compliance framework is embedded within a broader contractual structure consisting of the following principal documents:
Channel Reseller Program Agreement. The Agreement was executed on March 22, 2024, with an effective date of April 1, 2024. The Agreement grants Meridian a non-exclusive right to market, promote, and resell subscriptions to the Lumos Prism™ platform throughout the EMEA Territory for an initial term of five years (April 1, 2024, through March 31, 2029). The Agreement provides for automatic renewal for successive one-year periods unless either party provides at least ninety (90) days' prior written notice of non-renewal (with the initial non-renewal notice deadline of December 31, 2028). The governing law of the main Agreement is the law of the State of California, with disputes subject to the exclusive jurisdiction of the state and federal courts located in Santa Clara County, California.
Exhibit C — Data Processing Agreement. The DPA governs the processing of personal data in connection with the reseller arrangement and sets forth the obligations of Lumos as a processor (and, where applicable, sub-processor) in accordance with Article 28 of the GDPR. The DPA is a critical component of the compliance framework and is analyzed in detail in Section III of this memorandum. Notably, the DPA provides that, notwithstanding the governing law of the main Agreement, the DPA itself is subject to the laws of the EU Member State in which the data exporter is established — specifically, the laws of Germany for transfers from Meridian GmbH, and the laws of England and Wales for transfers from Meridian UK. This dual governing law structure reflects best practices in cross-border data processing arrangements and ensures that the DPA is enforceable under the legal system most closely connected to the data protection rights at issue.
Standard Contractual Clauses. The SCCs adopted pursuant to Commission Implementing Decision (EU) 2021/914 of June 4, 2021, are incorporated into the DPA for the purpose of governing cross-border transfers of personal data from the EEA and the UK to the United States. The parties have selected Module Two (Controller-to-Processor) as the primary module for the Meridian-to-Lumos data transfer. The SCCs are supplemented by the UK International Data Transfer Addendum (Version B1.0) for transfers from the United Kingdom. The SCC analysis is set forth in Section IV below.
Exhibit E — Service Level Agreement. The SLA establishes Stratos Cloud Services AG's performance obligations with respect to the Frankfurt data center infrastructure, including a 99.95% uptime commitment, scheduled maintenance windows, incident response times, and service credit mechanisms. While the SLA is not itself a data protection instrument, it is relevant to the assessment of the technical and organizational measures underpinning the data processing framework.
C. Regulatory Counsel Involvement
Given the cross-border nature of the transaction and the complexity of the applicable data protection regulatory framework, Lumos has engaged specialized regulatory and data-protection counsel on both sides of the Atlantic. Thornbridge Whitaker LLP, acting through Alistair Drummond (Partner), has been engaged as UK and EU regulatory and data-protection counsel to Lumos. Thornbridge Whitaker has provided substantive input on UK GDPR considerations, the implementation and completion of the SCCs and UK International Data Transfer Addendum, the Transfer Impact Assessment methodology, and the analysis of UK-specific adequacy and transfer issues set forth in Section IX of this memorandum. Mr. Drummond's contributions are integrated throughout this memorandum and are identified where specific UK/EU regulatory judgment is reflected.
Meridian has been represented in the negotiation of the DPA by Kessler Hartmann Rechtsanwälte PartG mbB, acting through Dr. Stefan Kessler (Partner) and Laura Pfeiffer (Associate). Dr. Kessler and Ms. Pfeiffer negotiated the DPA terms on Meridian's behalf, including the scope of processing, sub-processor management provisions, audit rights, and the completion of the SCC annexes. The DPA reflects the agreed-upon positions of both parties as of the execution date of March 22, 2024.
III. Data Processing Agreement (Exhibit C) — Key Provisions
This Section provides a detailed analysis of the key provisions of the DPA and their alignment with the requirements of Article 28 of the GDPR and corresponding provisions of the UK GDPR.
A. Scope and Subject Matter of Processing
Article 28(3) of the GDPR requires that any processing carried out by a processor on behalf of a controller be governed by a contract or other legal act that sets out the subject matter and duration of the processing, the nature and purpose of the processing, the type of personal data, and the categories of data subjects. The DPA satisfies these requirements as follows:
Categories of Data Subjects. The DPA identifies the following categories of data subjects whose personal data will be processed through the Lumos Prism™ platform: (i) employees and authorized personnel of end-user customers who access and use the platform; (ii) end-user administrators who manage organizational accounts and user permissions within the platform; and (iii) financial data subjects — natural persons whose financial information, transaction data, creditworthiness indicators, or other personal data is uploaded to the platform by end-user customers for analytics and risk-modeling purposes. This third category is potentially the most sensitive and voluminous, as the Lumos Prism™ platform is designed to ingest and analyze large datasets containing financial information about individuals.
Categories of Personal Data. The DPA specifies the following categories of personal data subject to processing: names, email addresses, job titles, and other professional contact information of end-user personnel; login credentials and authentication data; IP addresses and device identifiers; financial data points, including but not limited to income data, credit histories, loan balances, payment records, and investment portfolios; risk-modeling inputs provided by end-user customers; risk-modeling outputs and analytical results generated by the platform's AI algorithms; and platform usage logs capturing session data, feature interactions, and user behavior within the platform. The breadth of these categories reflects the comprehensive nature of the Lumos Prism™ platform's analytics capabilities.
Purpose of Processing. The DPA defines the purpose of processing as the provision of AI-driven financial analytics and risk-modeling services via the Lumos Prism™ SaaS platform, including data ingestion, storage, processing, analysis, model execution, output generation, and the delivery of results to end-user customers through the platform's interface and APIs. Processing for any purpose not explicitly authorized in the DPA is prohibited unless Lumos receives prior documented instructions from the data exporter.
Duration. The duration of processing under the DPA is co-terminus with the Channel Reseller Program Agreement. The initial term runs from April 1, 2024, through March 31, 2029, subject to automatic renewal for successive one-year periods unless one party provides at least ninety (90) days' prior written notice of non-renewal by December 31, 2028 (or by September 30 of any subsequent renewal year). Upon termination or expiration of the DPA, the data deletion and return provisions described in Section III.C below become operative.
B. Controller-Processor Relationships
The DPA addresses the multi-layered data processing relationships that arise in the reseller model with appropriate specificity. The primary data flow contemplated by the Agreement involves a three-tier structure:
Primary Relationship. The most common configuration will involve the end-user customer acting as the data controller (determining the purposes and means of processing by uploading financial data to the platform), Meridian acting as either a controller or processor depending on the specific use case, and Lumos acting as a processor or sub-processor. Specifically:
(a) Scenario 1 — Meridian as Controller / Lumos as Processor. In this scenario, Meridian acts as a data controller with respect to the personal data it collects and manages in connection with its reseller activities (e.g., customer account data, billing information, marketing data), and Lumos processes such data as Meridian's processor. This is the scenario addressed by Module Two of the SCCs (Controller-to-Processor), which governs the transfer of personal data from Meridian as the data exporter to Lumos as the data importer.
(b) Scenario 2 — End User as Controller / Meridian as Processor / Lumos as Sub-Processor. In this layered scenario, the end-user customer is the ultimate data controller, Meridian acts as a processor on behalf of the end user (to the extent it handles end-user data in the course of the reseller relationship), and Lumos acts as a sub-processor engaged by Meridian's processor. The DPA contains provisions addressing this layered relationship, including requirements for Meridian to ensure that its end-user customer agreements contain adequate data processing terms and that end-user customers are informed of and consent to Lumos's engagement as a sub-processor.
The DPA addresses both scenarios to ensure that, regardless of the characterization of Meridian's role in a given use case, the contractual framework satisfies the requirements of Article 28 of the GDPR. In both scenarios, Lumos processes personal data only on documented instructions from the data exporter (whether that is Meridian acting in its own right as controller or Meridian passing through instructions from the end-user customer controller).
C. Data Protection Obligations of Lumos as Processor
The DPA imposes upon Lumos the full suite of processor obligations required by Article 28(3) of the GDPR. These obligations are summarized below:
Processing on Documented Instructions. Consistent with Article 28(3)(a) of the GDPR, Lumos is required to process personal data only on documented instructions from the data exporter, including with regard to transfers of personal data to a third country. The DPA specifies that the Agreement and the DPA themselves constitute the data exporter's initial documented instructions, and that any additional instructions must be provided in writing and agreed upon by the parties. If Lumos believes that an instruction infringes the GDPR or other applicable data protection law, it must inform the data exporter immediately.
Confidentiality. Lumos must ensure that all persons authorized to process personal data under the DPA have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality. This obligation extends to Lumos employees, contractors, and agents who access personal data in the course of performing services under the Agreement.
Technical and Organizational Security Measures. Pursuant to Article 32 of the GDPR, Lumos is required to implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing, as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons. The DPA specifies the following measures, which are further detailed in Annex II to the SCCs:
•  Encryption of personal data at rest using AES-256 encryption and in transit using TLS 1.2 or higher;
•  Role-based access controls with multi-factor authentication for all personnel accessing EMEA customer data;
•  Pseudonymization capabilities enabling the separation of directly identifying information from analytical datasets;
•  Regular penetration testing conducted by qualified independent third-party security firms, with results shared with Meridian upon request;
•  SOC 2 Type II compliance, with annual audit reports made available to Meridian under appropriate confidentiality protections;
•  Intrusion detection and prevention systems;
•  Regular vulnerability scanning and patch management protocols; and
•  Business continuity and disaster recovery plans with defined recovery time objectives and recovery point objectives.
Sub-Processor Engagement. Lumos may not engage a sub-processor without the prior specific or general written authorization of the data exporter. The DPA employs the general authorization model with an objection mechanism: Lumos must provide Meridian with at least thirty (30) days' prior written notice before engaging any new sub-processor or replacing an existing sub-processor. During that thirty-day period, Meridian has the right to object on reasonable data-protection grounds, as described in Section VI below.
Assistance with Data Subject Requests. Lumos is required to assist Meridian (and, through Meridian, its end-user customers) in fulfilling the data exporter's obligation to respond to requests from data subjects exercising their rights under Articles 15 through 22 of the GDPR, including the rights of access, rectification, erasure, restriction of processing, data portability, objection, and the right not to be subject to automated individual decision-making. Lumos must implement appropriate technical measures to enable the efficient fulfillment of data subject requests, including data export functionality, targeted deletion capabilities, and the ability to restrict processing of specific datasets.
Assistance with Security and Regulatory Obligations. Lumos must assist the data exporter with its obligations under Articles 32 through 36 of the GDPR, including obligations relating to the security of processing, breach notification, data protection impact assessments, and prior consultation with supervisory authorities. This assistance obligation is particularly relevant in the context of the DPIA recommendation set forth in Section VIII.C below.
Data Deletion or Return. Upon termination or expiration of the DPA, Lumos must, at the data exporter's election, delete or return all personal data processed under the DPA and delete existing copies, unless EU or Member State law requires further storage of the personal data. The DPA specifies a sixty (60) day period following termination during which the data exporter may request data return in a structured, commonly used, machine-readable format. After expiration of this period, Lumos will proceed with secure deletion and provide a written certification of deletion upon request.
Audit Rights. Meridian (and, where applicable, its end-user customers) is entitled to conduct audits, including inspections, of Lumos's processing activities to verify compliance with the DPA. Lumos must make available to the data exporter all information necessary to demonstrate compliance with the obligations laid down in Article 28 of the GDPR and must allow for and contribute to audits conducted by the data exporter or an independent auditor mandated by the data exporter. The DPA provides that audits shall be conducted with reasonable advance notice (not less than thirty (30) business days), during normal business hours, and in a manner that does not unreasonably disrupt Lumos's operations. Lumos may satisfy audit requests by providing current SOC 2 Type II audit reports, penetration testing results, and other relevant compliance documentation, provided that on-site inspections remain available if such documentation does not adequately address the data exporter's concerns.
D. Data Breach Notification
The DPA contains robust data breach notification provisions aligned with the requirements of Article 33 of the GDPR. Lumos is required to notify Meridian without undue delay and in any event within seventy-two (72) hours of becoming aware of a personal data breach affecting personal data processed under the DPA. This seventy-two-hour timeline mirrors the timeline within which the data controller is required to notify the competent supervisory authority under Article 33(1) of the GDPR, ensuring that the processor's notification to the controller occurs sufficiently early to enable the controller to meet its own regulatory notification obligations.
The breach notification provided by Lumos must include, to the extent such information is available at the time of notification: (i) the nature of the personal data breach, including the categories and approximate number of data subjects concerned and the categories and approximate number of personal data records concerned; (ii) the name and contact details of Lumos's data protection contact from whom more information can be obtained; (iii) the likely consequences of the personal data breach; and (iv) the measures taken or proposed to be taken by Lumos to address the personal data breach, including, where appropriate, measures to mitigate its possible adverse effects. Where it is not possible to provide all such information simultaneously, the information may be provided in phases without undue further delay.
The DPA further requires Lumos to cooperate with Meridian in investigating, remediating, and mitigating the effects of any personal data breach, and to document all personal data breaches in a breach register, including the facts relating to the breach, its effects, and the remedial action taken. This documentation obligation aligns with Article 33(5) of the GDPR.
E. International Data Transfers
The DPA explicitly addresses the cross-border transfer of personal data from the EEA and the United Kingdom to the United States, which occurs as a consequence of Lumos's U.S.-based operations and personnel accessing EMEA data. Section 8 of the DPA specifies that such transfers are governed by the Standard Contractual Clauses incorporated as an appendix to the DPA, supplemented by the UK International Data Transfer Addendum for transfers originating from the United Kingdom. The detailed analysis of the SCCs and related transfer mechanisms is set forth in Section IV of this memorandum.
F. Data Protection Officer
The DPA designates the following points of contact for data protection matters:
•  Lumos Analytics Inc.: Daniel Ostroff, VP, Legal & Compliance, 4700 Sandhill Road, Suite 300, Palo Alto, CA 94304; email: dostroff@lumosanalytics.com; telephone: +1 (650) 555-0147.
•  Meridian Data Solutions GmbH: Dr. Anneliese Brandt, General Counsel, Leopoldstraße 78, 80802 München, Germany; email: a.brandt@meridiandata.de; telephone: +49 89 555 0234.
While Lumos has not appointed a formal Data Protection Officer under Article 37 of the GDPR (as it is not established in the EU and the applicability of the DPO requirement to U.S.-based processors is the subject of ongoing regulatory guidance), Daniel Ostroff serves as Lumos's primary contact for all data protection inquiries, regulatory correspondence, and supervisory authority interactions related to the EMEA processing activities. Meridian GmbH, as an entity established in the EU, should assess independently whether it is required to appoint a DPO under Article 37 based on the nature and scale of its processing activities.
IV. Standard Contractual Clauses — Module Two (Controller-to-Processor)
A. Legal Basis for Cross-Border Data Transfers
The transfer of personal data from the EEA or the United Kingdom to a third country that has not been recognized as providing an adequate level of data protection requires the implementation of appropriate safeguards under Chapter V of the GDPR (Articles 44–49) or the corresponding provisions of the UK GDPR. The United States has historically presented challenges in this regard, as underscored by the Court of Justice of the European Union's landmark decision in Data Protection Commissioner v. Kestrel Services Inc. Ireland Limited and Maximillian Schrems (Case C-311/18, July 16, 2020) ("Schrems II"), which invalidated the EU-U.S. Privacy Shield framework on the basis that U.S. surveillance laws, particularly FISA Section 702 and Executive Order 12333, did not provide protections essentially equivalent to those guaranteed by the GDPR.
Following Schrems II, the European Commission adopted new Standard Contractual Clauses pursuant to Commission Implementing Decision (EU) 2021/914 of June 4, 2021, which became the primary contractual mechanism for legitimizing data transfers to third countries lacking an adequacy determination. Subsequently, on July 10, 2023, the European Commission adopted an adequacy decision for the EU-U.S. Data Privacy Framework ("DPF"), which provides a new adequacy-based transfer mechanism for personal data transferred to U.S. organizations that have self-certified under the DPF. The DPF adequacy decision was based in significant part on the enhanced safeguards introduced by Executive Order 14086 (October 7, 2022), which imposes necessity and proportionality requirements on U.S. Signals intelligence activities and establishes a new redress mechanism through the Data Protection Review Court ("DPRC").
Notwithstanding the availability of the DPF as a transfer mechanism, the DPA incorporates the SCCs as a belt-and-suspenders approach to ensure continuity and legal certainty in the event that the DPF is challenged or invalidated — a possibility that remains realistic given that the individual who brought the Schrems I and Schrems II challenges has publicly indicated an intention to challenge the DPF. By maintaining the SCCs as the primary contractual transfer mechanism and supplementing them with the DPF (to the extent Lumos self-certifies), the parties ensure that an adequate safeguard remains in place regardless of the fate of the DPF adequacy decision.
For transfers from the United Kingdom, the analysis proceeds along a parallel but distinct track. The UK Extension to the EU-U.S. Data Privacy Framework, which became effective on October 12, 2023, provides a DPF-based adequacy mechanism for UK-to-U.S. transfers. In addition, the UK ICO's International Data Transfer Addendum to the EU SCCs (the "UK IDTA" or "UK Addendum") provides a contractual mechanism analogous to the SCCs for UK-originating transfers. Both mechanisms are employed in the DPA to ensure comprehensive coverage.
B. Module Selection
The parties have selected Module Two (Controller-to-Processor) of the SCCs as the appropriate module for the primary data flow, in which Meridian, acting as a data controller and data exporter established in the EEA or UK, transfers personal data to Lumos, acting as a data processor and data importer established in the United States. This module selection is consistent with the controller-processor relationship established under the DPA, as described in Section III.B above.
The following clause-by-clause analysis addresses the key provisions of the SCCs as completed and incorporated into the DPA:
Clause 7 — Docking Clause. The Docking Clause has been included in the SCCs to allow end-user customers to accede to the SCCs as additional data exporters. This is an important structural feature given the three-tier data processing relationship described in Section III.B above. By including the Docking Clause, the parties ensure that end-user customers who are themselves data controllers can directly benefit from the protections of the SCCs without the need to negotiate and execute separate SCC agreements with Lumos. An end-user customer seeking to accede must complete the relevant annexes and provide its agreement to be bound by the SCCs in the form attached to the DPA. The Docking Clause also provides flexibility for future expansion of the EMEA reseller program to additional end-user customers.
Clause 8 — Data Protection Safeguards. Clause 8 sets out the core data protection obligations of the data importer (Lumos), including the obligation to process personal data only on documented instructions from the data exporter, to implement appropriate technical and organizational measures, and to assist the data exporter in meeting its obligations under the GDPR. The substance of these obligations mirrors the processing obligations established in the DPA (as described in Section III.C above), ensuring consistency between the contractual and SCC-based frameworks. This parallelism is intentional and reflects the EDPB's recommendation that SCC obligations be consistent with the underlying data processing agreement.
Clause 9 — Use of Sub-Processors. The parties have selected Option 2 (general written authorization) under Clause 9. Under this option, the data importer (Lumos) has the data exporter's general authorization to engage sub-processors, subject to the requirement that Lumos provide the data exporter with written notice of any intended changes to its list of sub-processors (addition or replacement) at least thirty (30) days in advance, thereby giving the data exporter a reasonable opportunity to object to such changes before the engagement of the new sub-processor. If the data exporter objects on reasonable grounds, the parties must endeavor to resolve the objection in good faith. The sub-processor management framework is described in further detail in Section VI below.
Clause 10 — Data Subject Rights. Clause 10 requires the data importer (Lumos) to assist the data exporter in responding to requests from data subjects seeking to exercise their rights under the GDPR, including the rights of access, rectification, erasure, restriction, portability, and objection. This obligation is consistent with and reinforces the corresponding provision in the DPA, as described in Section III.C above. Lumos has implemented platform features that facilitate the fulfillment of data subject requests, including data export tools, deletion mechanisms, and the ability to restrict processing of individual data records.
Clause 11 — Redress. Clause 11 provides data subjects with redress mechanisms, including the right to lodge complaints with the data exporter, the data importer, and the competent supervisory authority. Data subjects are also entitled to invoke the SCCs as third-party beneficiaries and to bring claims against the data exporter or data importer for breaches of the SCCs. This provision ensures that EMEA data subjects have meaningful access to remedies in the event of a data protection violation.
Clause 13 — Supervision. The competent supervisory authority for the purposes of the SCCs is determined by the location of the data exporter. For transfers from Meridian GmbH (established in Bavaria, Germany), the competent supervisory authority is the Bayerisches Landesamt für Datenschutzaufsicht ("BayLDA"), the Bavarian Data Protection Authority, located in Ansbach, Germany. For transfers from Meridian UK (established in England), the competent supervisory authority is the UK Information Commissioner's Office ("ICO"), located at Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. The DPA identifies these authorities in the relevant annexes and provides for the cooperation of the data importer with the competent supervisory authority in accordance with the applicable regulatory framework.
Clause 14 — Local Laws and Practices Affecting Compliance. Clause 14 requires the parties to warrant that they have no reason to believe that the laws and practices in the third country of destination (the United States) applicable to the processing of personal data by the data importer, including any requirements to disclose personal data or measures authorizing access by public authorities, prevent the data importer from fulfilling its obligations under the SCCs. This clause is addressed through the Transfer Impact Assessment set forth in Section V of this memorandum, which evaluates U.S. surveillance laws and practices and the supplementary measures implemented to mitigate any identified risks.
Clause 15 — Obligations of the Data Importer in Case of Government Access Requests. Clause 15 imposes specific transparency and challenge obligations on the data importer (Lumos) in the event it receives a legally binding request from a public authority (including judicial authorities) for disclosure of personal data transferred under the SCCs. Lumos commits to: (i) notify the data exporter of such request promptly, unless prohibited from doing so under the law of the requesting authority (in which case Lumos will use best efforts to obtain a waiver of the prohibition); (ii) challenge the request if there are reasonable grounds to consider it unlawful, including by seeking interim measures with a view to suspending the effects of the request until the competent judicial authority has decided on its merits; and (iii) provide the minimum amount of information permissible when responding to a request for disclosure, based on a reasonable interpretation of the request. These commitments are reinforced by the contractual measures described in Section V.C below.
Clause 17 — Governing Law. Consistent with the requirements of Module Two, the SCCs are governed by the law of the EU Member State in which the data exporter is established. For EEA transfers from Meridian GmbH, the governing law is the law of Germany. For UK transfers from Meridian UK, the SCCs (as modified by the UK IDTA) are governed by the law of England and Wales. This dual governing law structure ensures that data subjects can invoke the SCCs under a legal system that has jurisdiction over the data exporter.
Clause 18 — Choice of Forum and Jurisdiction. Any dispute arising under the SCCs shall be resolved by the courts of the country in which the data exporter is established. For EEA transfers, the competent courts are the courts of Munich, Germany. For UK transfers, the competent courts are the courts of England and Wales. These forum selection provisions ensure that data subjects and data exporters have access to a judicial forum within their own jurisdiction.
C. UK International Data Transfer Addendum (IDTA)
The UK GDPR requires a separate transfer mechanism for transfers of personal data from the United Kingdom to third countries that have not been recognized as providing an adequate level of protection. Following Brexit, the EU SCCs do not automatically apply to transfers from the UK, and the UK ICO has issued the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses (Version B1.0), which came into force on March 21, 2022 (the "UK Addendum" or "IDTA"). The UK Addendum modifies the EU SCCs to ensure that they function as appropriate safeguards for transfers governed by the UK GDPR.
The UK Addendum has been incorporated into Exhibit C of the Agreement. Part 1 of the UK Addendum, comprising Tables 1 through 4, has been completed with the following information:
•  Table 1 — Parties: Meridian Data Solutions UK Ltd, acting through its Director, Katarina Voss, as the UK data exporter; Lumos Analytics Inc. as the data importer. Contact details, key contact persons, and data protection officer/contact information have been specified.
•  Table 2 — Selected SCCs, Modules, and Selected Clauses: Module Two (Controller-to-Processor) has been selected, consistent with the EEA SCC module selection.
•  Table 3 — Appendix Information: Cross-references the information contained in Annexes I, II, and III to the SCCs, including the list of parties, description of transfer, technical and organizational measures, and sub-processor list.
•  Table 4 — Ending the Addendum When the Approved Addendum Changes: The parties have selected the approach that, if the ICO issues a revised Approved Addendum, the parties will work together in good faith to adopt the revised version, but neither party may end the Addendum solely by reason of the ICO's issuance of a revised version.
The Approved Addendum ensures that the SCCs, as modified by the UK Addendum, provide appropriate safeguards for transfers of personal data from the United Kingdom to the United States within the meaning of Article 46(1) of the UK GDPR. The UK Addendum takes precedence over the EU SCCs to the extent of any inconsistency, and it is designed to be interpreted in a manner consistent with the UK GDPR and the DPA 2018.
D. Annexes to the SCCs
The SCCs are accompanied by three annexes, which together provide the substantive detail required for the SCCs to function as a complete transfer mechanism:
Annex I — List of Parties and Description of Transfer. Annex I identifies the data exporter(s) and data importer, describes the categories of data subjects and categories of personal data transferred, specifies the frequency of transfer (continuous, as the platform processes data on an ongoing basis), the nature and purpose of processing, the retention period (co-terminus with the Agreement, subject to the deletion/return provisions of the DPA), and the competent supervisory authority (BayLDA for EEA transfers; ICO for UK transfers).
Annex II — Technical and Organizational Security Measures. Annex II sets forth the technical and organizational measures implemented by the data importer (Lumos) to protect the transferred personal data, including: AES-256 encryption at rest; TLS 1.2 or higher encryption in transit; role-based access control protocols with multi-factor authentication; intrusion detection and prevention systems; regular penetration testing by independent third parties; incident response procedures with defined escalation paths and response times; business continuity and disaster recovery plans with geographically redundant EU-based backups; SOC 2 Type II certification, with annual audit reports available to the data exporter; and employee and contractor security awareness training programs. These measures are designed to meet the requirements of Article 32 of the GDPR and to provide the supplementary safeguards contemplated by the EDPB's Recommendations 01/2020.
Annex III — List of Pre-Approved Sub-Processors. Annex III identifies the sub-processors that the data importer has been authorized to engage as of the effective date of the SCCs. The pre-approved sub-processor list is discussed in Section VI below.
V. Transfer Impact Assessment (TIA)
A. Purpose and Methodology
Clause 14 of the SCCs requires that the parties represent and warrant that they have no reason to believe that the laws and practices in the third country of destination applicable to the processing of personal data by the data importer prevent the data importer from fulfilling its obligations under the SCCs. To substantiate this warranty, the parties must conduct a Transfer Impact Assessment evaluating the laws of the third country — in this case, the United States — and their potential impact on the protection of transferred personal data.
The TIA set forth in this Section has been prepared in accordance with the methodology recommended by the European Data Protection Board ("EDPB") in its Recommendations 01/2020 on measures that supplement transfer tools to ensure compliance with the EU level of protection of personal data (adopted in final form on June 18, 2021). The EDPB's six-step methodology encompasses: (1) identification of the transfers; (2) verification of the transfer tool relied upon; (3) assessment of the laws of the third country; (4) identification and adoption of supplementary measures; (5) procedural steps to implement supplementary measures; and (6) re-evaluation at appropriate intervals. Steps 1 and 2 have been addressed in Sections III and IV of this memorandum, respectively. Steps 3 through 5 are addressed in this Section. Step 6 is addressed in Section V.D (Ongoing Monitoring) and in the Recommendations set forth in Section X.
B. Assessment of U.S. Legal Framework
The following U.S. legal instruments have been identified as potentially relevant to the processing of EMEA personal data by Lumos and have been assessed for their impact on the adequacy of protection:
FISA Section 702 (50 U.S.C. § 1881a). Section 702 of the Foreign intelligence Surveillance Act authorizes the U.S. government to conduct targeted surveillance of non-U.S. persons reasonably believed to be located outside the United States for the purpose of acquiring foreign intelligence information. Surveillance under Section 702 is conducted through directives issued to U.S.-based electronic communication service providers, requiring them to provide the government with specified communications or data. Section 702 is relevant to this analysis because EMEA end-user data processed by Lumos — a U.S.-based entity — may fall within the scope of Section 702 collection, particularly where the data subjects are non-U.S. persons located outside the United States. However, it is important to note that Section 702 authorizes only targeted collection directed at specific individuals or identifiers; it does not authorize indiscriminate bulk collection of data. Moreover, Executive Order 14086 (discussed below) has introduced significant new limitations on Section 702 collection.
Executive Order 14086 (October 7, 2022). Signed by President Biden on October 7, 2022, Executive Order 14086 ("Enhancing Safeguards for United States signals intelligence Activities") establishes enhanced safeguards for U.S. Signals intelligence activities, including activities conducted under FISA Section 702 and Executive Order 12333. The key elements of EO 14086 include: (i) a requirement that signals intelligence activities be conducted only in pursuit of defined legitimate objectives and only to the extent that such activities are necessary and proportionate to the validated intelligence priority; (ii) specific prohibitions on the use of signals intelligence to suppress dissent, discriminate on the basis of protected characteristics, or gain commercial advantage; and (iii) the establishment of a multi-layered redress mechanism consisting of the Civil Liberties Protection Officer of the Office of the Director of National intelligence ("CLPO") and the Data Protection Review Court ("DPRC"), an independent body with binding decision-making authority. EO 14086 underpins the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework and represents a material improvement over the legal landscape that existed at the time of the Schrems II decision. The DPRC, in particular, addresses one of the core deficiencies identified by the CJEU in Schrems II — the absence of an independent redress mechanism for EU data subjects.
Clarifying Lawful Overseas Use of Data Act (CLOUD Act). The CLOUD Act, enacted in 2018, amends the Stored Communications Act (18 U.S.C. § 2713) to require U.S.-based service providers to comply with lawful orders for the disclosure of electronic communications and stored data, regardless of whether such data is stored within or outside the United States. The CLOUD Act is relevant because Lumos, as a U.S.-incorporated entity, is subject to its provisions even with respect to data stored in the Frankfurt data center. However, the CLOUD Act also includes mechanisms for service providers to challenge disclosure orders that conflict with the laws of a qualifying foreign government, and it provides for executive agreements between the U.S. and foreign governments to facilitate mutual legal assistance while respecting the sovereignty of the foreign jurisdiction. The risk posed by the CLOUD Act is mitigated by Lumos's contractual commitment, set forth in Clause 15 of the SCCs and reinforced in the DPA, to: (i) challenge overbroad or unlawful requests for disclosure; (ii) seek interim measures to suspend the effects of a disclosure order pending judicial review; (iii) provide only the minimum amount of information permissible; and (iv) notify the data exporter to the extent legally permissible.
Assessment Conclusion. Having assessed the U.S. legal framework in light of the EDPB's Recommendations 01/2020, the principles articulated by the CJEU in Schrems II, and the enhanced safeguards introduced by Executive Order 14086, we conclude that, with the supplementary measures described in Section V.C in place, the risk of disproportionate government access to EMEA personal data transferred to Lumos in the United States is effectively mitigated. The combination of: (a) the necessity and proportionality requirements imposed by EO 14086; (b) the independent redress mechanism provided by the DPRC; (c) the technical measures described below (including data localization in Frankfurt and encryption); (d) the organizational measures limiting U.S. personnel access; and (e) the contractual commitments under the SCCs collectively provides a level of protection essentially equivalent to that guaranteed by the GDPR. This conclusion is consistent with the European Commission's adequacy finding for the EU-U.S. Data Privacy Framework, although the parties are not relying exclusively on the DPF as a transfer mechanism.
C. Supplementary Measures
In accordance with the EDPB's Recommendations 01/2020, the following supplementary measures have been identified and implemented to reinforce the protections provided by the SCCs:
Technical Measures.
(a) Data Localization. EMEA customer data is localized in the Frankfurt am Main, Germany data center operated by Stratos Cloud Services AG (Bahnhofstrasse 42, 8001 Zürich, Switzerland; EMEA data center located in Frankfurt am Main, Germany). Production data, backup data, and disaster recovery replicas are all maintained within EU-based infrastructure. This data localization architecture minimizes the exposure of EMEA personal data to U.S. jurisdiction, as the data does not reside on U.S.-based servers.
(b) Encryption. All EMEA customer data is encrypted at rest using AES-256 encryption and in transit using TLS 1.2 or higher. With respect to end-user-encrypted content data, Lumos does not hold the decryption keys; the keys are managed exclusively by the end-user customer or Meridian (as applicable). This technical architecture ensures that even in the event of a compelled disclosure, the disclosed data would be unintelligible without the decryption keys, which are not within Lumos's possession or control for end-user-encrypted content.
(c) Access Controls. Access to EMEA customer data by Lumos personnel is governed by role-based access controls with multi-factor authentication. All access is logged and auditable.
Organizational Measures.
(a) Restricted U.S. Access. Strict access controls limit U.S.-based Lumos personnel's ability to access EMEA customer data. Access is granted only on a need-to-know basis for specific, documented purposes (e.g., troubleshooting, platform maintenance, support requests), and all access events are logged and subject to periodic review.
(b) Training. Lumos personnel who may access EMEA customer data receive mandatory data protection training covering the GDPR, the SCCs, the restrictions on government access, and the procedures for handling law enforcement and intelligence agency requests.
(c) Privacy Contact. Lumos has designated Daniel Ostroff, VP, Legal & Compliance, as its primary data protection contact, with responsibility for receiving and responding to government access requests and coordinating with the data exporter.
Contractual Measures.
(a) SCC Clause 15 Commitments. As described in Section IV.B above, Lumos has committed under Clause 15 of the SCCs to transparency and challenge obligations in the event of government access requests, including the obligation to notify the data exporter, challenge unlawful requests, and minimize disclosure.
(b) Additional Contractual Commitments. The DPA includes a specific provision whereby Lumos commits to notify the data exporter of any legally binding request for disclosure by a public authority (including law enforcement and intelligence agencies) and to challenge such requests where there are reasonable grounds to consider them unlawful or disproportionate. Lumos further commits to provide the data exporter with aggregate statistics on government access requests received (to the extent permitted by law) on an annual basis.
D. Ongoing Monitoring
The TIA is not a one-time exercise but must be reassessed at appropriate intervals and in response to material changes in the legal landscape. We recommend that Lumos and Meridian conduct annual reassessments of the TIA, with the first scheduled reassessment to occur no later than April 1, 2025. The reassessment should be triggered earlier than the annual schedule if any of the following events occurs: (i) a successful legal challenge to the EU-U.S. Data Privacy Framework or a withdrawal of the European Commission's adequacy decision; (ii) material changes in U.S. surveillance legislation, including amendments to FISA Section 702 or modifications to Executive Order 14086; (iii) guidance from the EDPB, the European Commission, or the UK ICO that materially affects the assessment of U.S. legal protections; or (iv) a material change in Lumos's technical architecture or data processing practices that alters the risk profile.
Calderwood & Harkness LLP and Thornbridge Whitaker LLP will continue to monitor relevant legal and regulatory developments and will advise Lumos on any required updates to the transfer mechanism or supplementary measures. In particular, we note that FISA Section 702 is subject to periodic reauthorization by the U.S. Congress and that any future reauthorization legislation may include amendments that affect the TIA assessment.
VI. Sub-Processor Management
A. Pre-Approved Sub-Processors (Annex III to the DPA)
Annex III to the DPA identifies the following pre-approved sub-processor as of the effective date of the Agreement:
Stratos Cloud Services AG provides the cloud infrastructure hosting services for all EMEA customer data processed through the Lumos Prism™ platform. Because the Stratos EMEA data center is located in Frankfurt am Main, Germany — within the EEA — the processing of EMEA customer data by Stratos does not constitute a transfer to a third country, and no onward transfer issue arises for EEA-originating data. Although Stratos is a Swiss-incorporated entity, the European Commission has recognized Switzerland as providing an adequate level of data protection (Commission Decision 2000/518/EC, as confirmed by subsequent review), and in any event the relevant data processing occurs at the Frankfurt facility within the EEA.
Annex III is maintained as a living document by Lumos and will be updated to reflect any additions or changes to the sub-processor list in accordance with the notification and objection mechanism described below. The current version of Annex III will be made available to Meridian upon request and will be provided proactively in connection with any proposed changes.
B. Notification and Objection Mechanism
The sub-processor management framework in the DPA reflects best practices and the requirements of Clause 9 (Option 2) of the SCCs. The key elements of this framework are as follows:
Prior Written Notice. Lumos is required to provide Meridian with no less than thirty (30) days' prior written notice before engaging any new sub-processor or replacing an existing sub-processor. The notice must identify the proposed sub-processor, describe the processing activities to be performed, identify the location(s) of processing, and confirm that the sub-processor has agreed to data protection obligations no less protective than those in the DPA.
Right to Object. Meridian has the right to object to the engagement of a new or replacement sub-processor on reasonable data-protection grounds. An objection must be submitted in writing within the thirty-day notice period and must state the specific data-protection grounds for the objection. Upon receipt of an objection, the parties must endeavor in good faith to resolve the matter within an additional thirty (30) day period through reasonable means, which may include the implementation of additional safeguards, the selection of an alternative sub-processor, or modifications to the scope of the sub-processor's processing activities.
Termination Right. If the parties are unable to resolve an objection within the thirty-day resolution period, Meridian may terminate the DPA (and the affected processing activities) upon written notice to Lumos. This termination right is a critical protection for the data exporter and ensures that Meridian retains meaningful control over the sub-processor chain.
Sub-Processor Agreements. Lumos is required to enter into a written agreement with each sub-processor that imposes data protection obligations no less protective than those set forth in the DPA. The sub-processor agreement must, at a minimum, include obligations relating to: processing on documented instructions; confidentiality; security measures; cooperation with audits; data breach notification; data deletion or return upon termination; and compliance with applicable data protection laws. Lumos remains fully liable to Meridian for the performance of each sub-processor's obligations.
C. Sub-Distributor Data Processing Implications
Meridian Data Solutions UK Ltd and Meridian Data Solutions SARL are pre-approved sub-distributors under Exhibit B to the Agreement, authorized to market and resell Lumos Prism™ subscriptions in their respective territories (UK and Ireland for Meridian UK; France, Belgium, Luxembourg, and French-speaking Switzerland for Meridian France). These sub-distributors may also act as data controllers or data processors in their respective territories, depending on the nature of their interactions with end-user customers and the personal data they handle.
Meridian GmbH, as the primary contracting party under the Agreement, bears responsibility for ensuring that its sub-distributors comply with applicable data protection laws — including the GDPR (for Meridian France) and the UK GDPR (for Meridian UK) — and are bound by data processing terms consistent with Exhibit C. This responsibility arises from Meridian GmbH's obligations as a data controller and from the general principle that a controller must ensure that processors and sub-processors within its chain are subject to adequate contractual and organizational safeguards.
Recommendation. We recommend that Meridian GmbH execute back-to-back Data Processing Agreements with Meridian UK and Meridian France that flow down the obligations contained in Exhibit C. These back-to-back DPAs should mirror the substantive provisions of Exhibit C, including the processing restrictions, security obligations, sub-processor management provisions, data breach notification requirements, and audit rights. The back-to-back DPAs should also incorporate the relevant SCCs and, in the case of Meridian UK, the UK IDTA, to the extent that personal data flows between Meridian GmbH and its sub-distributors constitute restricted transfers under the GDPR or UK GDPR. Calderwood & Harkness and T

MEMORANDUM

Record

Parties

Dates

Amounts