CONFIDENTIAL — ATTORNEY WORK PRODUCT — FOR SETTLEMENT PURPOSES ONLY
CALDERWOOD & HARKNESS LLP 1735 Market Street, Suite 2800 Philadelphia, PA 19103
Matter No.: 1009-00004
VIA ELECTRONIC MAIL AND SECURE FILE TRANSFER
Constance Liu, Esq., Partner Blackwell, Raines & Stoddard LLP 200 Park Avenue, 31st Floor New York, NY 10166
**Re: Data Processing Agreement — Bank-Grade Template — * Meridian Federal Savings Bank / Skybridge Fintech Ltd.*
Dear Ms. Liu:
Enclosed for your review and consideration is the of the Data Processing Agreement between Meridian Federal Savings Bank and Skybridge Fintech Ltd. This draft reflects We look forward to receiving your client's comments at your earliest convenience, with a target execution date of February 15, 2026.
Very truly yours,
Calderwood & Harkness LLP
DATA PROCESSING AGREEMENT
**Bank-Grade Template — **
Prepared by: Calderwood & Harkness LLP, 1735 Market Street, Suite 2800, Philadelphia, PA 19103 Matter No.: 1009-00004 Transmitted to: Blackwell, Raines & Stoddard LLP, 200 Park Avenue, 31st Floor, New York, NY 10166
Attn: Constance Liu, Partner
CONFIDENTIAL — ATTORNEY WORK PRODUCT — FOR SETTLEMENT PURPOSES
Right-click to update Table of Contents
DATA PROCESSING AGREEMENT
This Data Processing Agreement (this "DPA" or this "Agreement") is entered into as of _____, 2026 (the "Effective Date") (target Effective Date: February 15, 2026), by and between:
MERIDIAN FEDERAL SAVINGS BANK, a federally chartered savings bank organized under the laws of the United States, OCC Charter No. 14-2238, FDIC-insured (FDIC Certificate No. 34871), with its principal office located at 900 Broad Street, Suite 1200, Newark, New Jersey 07102 (hereinafter referred to as the "Controller" or the "Bank");
and
SKYBRIDGE FINTECH LTD., a corporation organized under the laws of the State of Delaware, with its principal office located at 4100 Silverside Road, Suite 310, Wilmington, Delaware 19810 (hereinafter referred to as the "Processor" or the "Service Provider").
Controller and Processor are each referred to herein as a "Party" and collectively as the "Parties."
RECITALS
WHEREAS, Controller has entered into, or will concurrently enter into, that certain Software-as-a-Service Subscription Agreement (the "Subscription Agreement") with Processor for access to and use of the SBF Core platform, Processor's proprietary cloud-based software platform providing real-time payment processing, anti-fraud analytics, and regulatory reporting services;
WHEREAS, in connection with the performance of the Subscription Agreement, Processor will process certain Personal Data on behalf of Controller, and this DPA sets forth the obligations of the Parties with respect to the processing and protection of such Personal Data by Processor on behalf of Controller;
WHEREAS, Controller is a federally chartered savings bank subject to the supervisory authority and oversight of the Office of the Comptroller of the Currency ("OCC"), the Federal Deposit Insurance Corporation ("FDIC"), and the Consumer Financial Protection Bureau ("CFPB"), and the Parties intend for this DPA to comply in all respects with OCC Bulletin 2023-17 (Third-Party Relationships: Risk Management Guidance), the Gramm-Leach-Bliley Act ("GLBA"), Regulation P (12 CFR Part 1016), the General Data Protection Regulation (Regulation (EU) 2016/679) ("GDPR"), the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA/CPRA"), the New Jersey Data Privacy Act (NJ S3377), and all other applicable federal, state, and international data protection laws and regulations;
WHEREAS, the Parties acknowledge that Controller maintains approximately 3,200 accountholders who are residents of the European Economic Area, thereby necessitating compliance with the GDPR and the implementation of appropriate transfer mechanisms for the lawful transfer of EU Data to the United States;
WHEREAS, this DPA is incorporated into and forms an integral part of the Subscription Agreement; and in the event of any conflict or inconsistency between the terms of this DPA and the terms of the Subscription Agreement with respect to the processing and protection of Personal Data, the terms of this DPA shall control and prevail;
NOW, THEREFORE, in consideration of the mutual covenants and agreements herein contained, and for other good and valuable consideration, the receipt and sufficiency of which are hereby acknowledged, the Parties agree as follows:
ARTICLE 1 — DEFINITIONS
For purposes of this DPA, the following terms shall have the meanings set forth below. Capitalized terms used but not defined in this DPA shall have the meanings ascribed to them in the Subscription Agreement.
1.1 "Applicable Data Protection Laws" means all laws, statutes, regulations, ordinances, rules, directives, and binding guidance applicable to the processing of Personal Data under this DPA, including but not limited to: (a) the Gramm-Leach-Bliley Act (15 U.S.C. §§ 6801–6809) and its implementing regulations, including Regulation P (12 CFR Part 1016); (b) the FDIC/OCC Computer-Security Incident Notification Rule (12 CFR Part 53); (c) OCC Bulletin 2023-17 (Third-Party Relationships: Risk Management Guidance); (d) the General Data Protection Regulation (Regulation (EU) 2016/679); (e) the California Consumer Privacy Act, as amended by the California Privacy Rights Act (Cal. Civ. Code §§ 1798.100–1798.199.100); (f) the New Jersey Data Privacy Act (NJ S3377); (g) any other applicable federal, state, or international data protection, data privacy, data security, or data breach notification laws; and (h) any binding regulatory guidance, orders, or directives issued by Regulators with jurisdiction over either Party.
1.2 "Controller" means Meridian Federal Savings Bank, in its capacity as the entity that, alone or jointly with others, determines the purposes and means of the processing of Personal Data under this DPA.
1.3 "Data Subject" means an identified or identifiable natural person whose Personal Data is processed under this DPA. An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, identification number, location data, online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.
1.4 "DPIA" means a Data Protection Impact Assessment as required under Article 35 of the GDPR or under analogous provisions of Applicable Data Protection Laws, including any assessment of the impact of the envisaged processing operations on the protection of Personal Data.
1.5 "EU Data" means Personal Data of Data Subjects who are residents of the European Economic Area (including the member states of the European Union, Iceland, Liechtenstein, and Norway) that is processed under this DPA.
1.6 "GDPR" means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), as may be amended, supplemented, or superseded from time to time.
1.7 "GLBA" means the Gramm-Leach-Bliley Act (15 U.S.C. §§ 6801–6809) and its implementing regulations, including but not limited to Regulation P (12 CFR Part 1016), the Interagency Guidelines Establishing Information Security Standards, and any successor regulations or guidance.
1.8 "Personal Data" means any information relating to an identified or identifiable natural person that is processed by Processor on behalf of Controller pursuant to or in connection with the Subscription Agreement. For purposes of this DPA, Personal Data includes: (a) "nonpublic personal information" as defined under GLBA and Regulation P; (b) "personal information" as defined under the CCPA/CPRA (Cal. Civ. Code § 1798.140(v)); (c) "personal data" as defined under Article 4(1) of the GDPR; and (d) any equivalent term as defined under other Applicable Data Protection Laws. Personal Data processed under this DPA is further described in Schedule A (Description of Processing).
1.9 "Personal Data Breach" means a of or access to, Personal Data transmitted, stored, or otherwise processed by Processor or its Sub-processors in connection with this DPA. For purposes of this definition, a Personal Data Breach shall be deemed equivalent to a "security incident" as defined under the FDIC/OCC Computer-Security Incident Notification Rule (12 CFR Part 53), a "notification incident" under applicable banking regulations, and a "breach of the security of the system" under applicable state data breach notification statutes.
1.10 "Processor" means Skybridge Fintech Ltd., in its capacity as the entity that processes Personal Data on behalf of Controller in accordance with the terms and conditions of this DPA and the Subscription Agreement.
1.11 "Processing" / "Process" means any operation or set of operations which is performed on Personal Data or on sets of Personal Data, whether or not by automated means, including but not limited to collection, recording, organization, structuring, storage, adaptation, alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment, combination, restriction, erasure, or destruction.
1.12 "Regulator" means any governmental, supervisory, regulatory, or quasi-regulatory authority with jurisdiction over Controller or Processor with respect to the subject matter of this DPA, including without limitation: (a) the Office of the Comptroller of the Currency (OCC); (b) the Federal Deposit Insurance Corporation (FDIC); (c) the Consumer Financial Protection Bureau (CFPB); (d) the Securities and Exchange Commission (SEC); (e) state banking regulators, including the New Jersey Department of Banking and Insurance; (f) state attorneys general; European data protection supervisory authorities, including the Autoriteit Persoonsgegevens (Netherlands Data Protection Authority); and any other governmental authority with competent jurisdiction.
1.13 "SBF Core" means Processor's proprietary software-as-a-service platform known as "SBF Core," which provides real-time payment processing, anti-fraud analytics (including behavioral biometric analysis), and regulatory reporting functionality, as further described in the Subscription Agreement.
1.14 "Sensitive Data" means Personal Data that is classified as sensitive, special category, or requiring heightened protection under Applicable Data Protection Laws, including without limitation: (a) Social Security numbers; (b) taxpayer identification numbers; (c) financial account numbers (when combined with access credentials); (d) behavioral biometric data (including keystroke dynamics and mouse movement patterns); "special categories of personal data" as defined under Article 9 of the GDPR; and any equivalent category under other Applicable Data Protection Laws.
1.15 "Standard Contractual Clauses" or "SCCs" means the standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679, as annexed to the European Commission Implementing Decision (EU) 2021/914 of 4 June 2021, and as appended to this DPA in the SCC package, including all Annexes thereto.
1.16 "Sub-processor" means any third party (including but not limited to affiliates and subsidiaries of Processor) engaged by Processor, or by any subsequent Sub-processor of Processor, to process Personal Data on behalf of Controller in connection with this DPA. For the avoidance of doubt, Sub-processors include both entities that have direct access to Personal Data and entities that provide infrastructure or hosting services through which Personal Data is stored or transmitted.
1.17 "Subscription Agreement" means the SaaS Subscription Agreement entered into between Controller and Processor for the provision of access to and use of the SBF Core platform, as such agreement may be amended from time to time in accordance with its terms.
1.18 "Technical and Organizational Measures" or "TOMs" means the technical and organizational security measures implemented by Processor and described in Schedule B (Security Measures) and SCC Annex II, designed to protect Personal Data against unauthorized or unlawful processing and against accidental loss, destruction, or damage.
ARTICLE 2 — SCOPE AND PURPOSE OF PROCESSING
2.1 Scope. This DPA applies to all processing of Personal Data by Processor on behalf of Controller in connection with the Subscription Agreement. The subject matter, duration, nature and purpose of processing, types of Personal Data, and categories of Data Subjects are described in detail in Schedule A (Description of Processing) attached hereto and incorporated herein by reference. In the event of any inconsistency between the body of this DPA and Schedule A, the more protective provision (from the standpoint of Data Subject rights and Controller's obligations) shall prevail.
2.2 Categories of Data Subjects. The Data Subjects whose Personal Data is processed under this DPA include the following categories of natural persons:
(a) Meridian accountholders, including both retail (consumer) accountholders and small-business accountholders;
(b) Authorized signers on Meridian accounts;
(c) Beneficial owners of Meridian accounts, as identified through Controller's customer due diligence and beneficial ownership verification processes;
(d) Meridian employees whose data is transmitted through or processed by SBF Core in connection with the services provided under the Subscription Agreement.
As of the date of this DPA, the approximate number of Data Subjects is four hundred twelve thousand (412,000), which includes approximately three thousand two hundred (3,200) accountholders who are residents of the European Economic Area. The Parties acknowledge that these figures are estimates and may fluctuate over the term of this DPA. Processor shall promptly notify Controller if it becomes aware that the volume of Data Subjects has increased by more than twenty-five percent (25%) above the estimate provided herein, as such increase may trigger additional compliance obligations.
2.3 Categories of Personal Data. The categories of Personal Data processed under this DPA include, without limitation:
(a) Full legal name (first, middle, last);
(b) Date of birth;
(c) Social Security number (SSN);
(d) Taxpayer identification number (TIN);
(e) Financial account numbers, including checking account numbers, savings account numbers, and loan account numbers;
(f) Bank routing numbers;
(g) Transaction amounts and transaction metadata (including date, time, merchant category codes, and authorization codes);
(h) Internet Protocol (IP) addresses;
(i) Device identifiers (including mobile device identifiers and browser fingerprints);
(j) Geolocation data (city-level);
(k) Email addresses;
(l) Telephone numbers;
(m) Anti-fraud behavioral biometric data, including keystroke dynamics and mouse movement patterns.
The Parties acknowledge that certain categories of Personal Data described above constitute Sensitive Data as defined in Section 1.14 and are subject to heightened protection requirements under Applicable Data Protection Laws. Processor shall implement additional safeguards for Sensitive Data as described in Schedule B (Security Measures).
2.4 Processing Purpose. Processor shall process Personal Data solely for the following purposes, each in connection with the performance of Processor's obligations under the Subscription Agreement:
(a) Payment Processing: Facilitating, authorizing, settling, and reconciling payment transactions initiated by or on behalf of Controller's accountholders through the SBF Core platform;
(b) Anti-Fraud Analytics: Analyzing transaction data, behavioral biometric data, device identifiers, and other relevant data points to identify, prevent, and report potentially fraudulent activity, in support of Controller's fraud prevention and Bank Secrecy Act / Anti-Money Laundering (BSA/AML) compliance obligations;
(c) Regulatory Reporting: Generating reports and data extracts as necessary to support Controller's regulatory reporting obligations, including but not limited to Suspicious Activity Reports (SARs), Currency Transaction Reports (CTRs), and other reports required by Applicable Data Protection Laws and banking regulations.
Processor shall not process Personal Data for any purpose other than those specified in this Section 2.4 and as further described in Schedule A, except as otherwise expressly instructed in writing by Controller or as required by applicable law.
2.5 Processing Volume. As of the date of this DPA, the estimated volume of transactions processed through SBF Core on behalf of Controller is approximately eighteen million six hundred thousand (18,600,000) transactions per month. The Parties acknowledge that transaction volumes may vary from month to month and may increase over the term of the Subscription Agreement. Changes in transaction volume shall not, in and of themselves, constitute a modification of the processing activities described herein, but Processor shall promptly notify Controller of any material changes in processing infrastructure or architecture necessitated by significant increases in transaction volume.
2.6 Processor as Service Provider under GLBA. Processor expressly acknowledges and agrees that, in its capacity as a provider of services to Controller under the Subscription Agreement, Processor qualifies as a "service provider" as that term is used in the GLBA (15 U.S.C. § 6802(e)) and Regulation P (12 CFR Part 1016). Processor shall comply with all applicable requirements imposed on service providers under the GLBA and its implementing regulations, including the requirement to safeguard the security and confidentiality of Controller's nonpublic personal information, to protect against anticipated threats or hazards to the security or integrity of such information, and to protect against unauthorized access to or use of such information that could result in substantial harm or inconvenience to any customer of Controller.
2.7 Processor's Role. Processor shall process Personal Data only in its capacity as a processor (as that term is defined under the GDPR), a service provider (as that term is defined under the CCPA/CPRA, Cal. Civ. Code § 1798.140(ag)), and a service provider under the GLBA. Processor shall not process Personal Data for any purpose other than as instructed by Controller in accordance with this DPA or as required by applicable law. Processor shall not combine Personal Data received from or on behalf of Controller with personal data received from any other source or collected in connection with any other relationship, except as expressly permitted by Controller in writing or as required by applicable law.
ARTICLE 3 — CONTROLLER INSTRUCTIONS AND PROCESSOR OBLIGATIONS
3.1 Processing on Instructions. Processor shall process Personal Data only on and in accordance with documented instructions from Controller, including with respect to transfers of Personal Data to a third country or an international organization, unless Processor is required to do so by applicable law of the European Union or the law of a Member State to which Processor is subject. In such a case, Processor shall inform Controller of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest. Processor shall not process Personal Data in a manner that is inconsistent with Controller's instructions.
3.2 Documented Instructions. The Subscription Agreement, this DPA (including all Schedules hereto), the SCC package appended hereto, and any subsequent written instructions provided by Controller to Processor in accordance with the terms hereof shall constitute Controller's complete and final documented instructions to Processor regarding the processing of Personal Data (collectively, "Controller Instructions"). Processor shall maintain a register of all Controller Instructions received. If Processor reasonably believes that any instruction received from Controller infringes Applicable Data Protection Laws, Processor shall promptly notify Controller of such belief and shall not be required to carry out the instruction until Controller has confirmed or modified the instruction. Such notification shall not relieve Processor of its obligations under Applicable Data Protection Laws.
3.3 Confidentiality Obligation. Processor shall ensure that all natural persons authorized to process Personal Data on behalf of Controller, including Processor's employees, contractors, temporary staff, and agents, have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality before being granted access to Personal Data. Processor shall maintain and enforce appropriate access controls to ensure that Personal Data is accessible only to those personnel who require such access for the performance of the services under the Subscription Agreement. Processor shall maintain records of all personnel with access to Controller's Personal Data and shall make such records available to Controller upon reasonable request.
3.4 Restriction on Use. Processor shall not:
(a) Sell Personal Data, as the term "sell" is defined under the CCPA/CPRA (Cal. Civ. Code § 1798.140(ad)) or any other Applicable Data Protection Law;
(b) Retain, use, or disclose Personal Data for any commercial purpose other than providing the services specified in the Subscription Agreement and as described in this DPA, including but not limited to profiling, targeted advertising, data analytics for Processor's own purposes, or the development, improvement, or enhancement of Processor's products or services (unless such processing is performed using aggregated and fully de-identified data that cannot reasonably be used to identify any Data Subject and Controller has provided prior written consent);
(c) Retain, use, or disclose Personal Data outside the direct business relationship between Processor and Controller, including sharing Personal Data with any third party other than approved Sub-processors in accordance with Article 5 of this DPA;
(d) Share Personal Data within the meaning of the CCPA/CPRA (Cal. Civ. Code § 1798.140(ah)) for cross-context behavioral advertising or any analogous purpose
Processor hereby certifies that it understands and will comply with the restrictions set forth in this Section 3.4. This certification constitutes a representation upon which Controller relies in entering into this DPA.
ARTICLE 4 — SECURITY MEASURES
4.1 Technical and Organizational Measures. Processor shall implement and maintain, at its own expense, the Technical and Organizational Measures described in Schedule B (Security Measures), which are designed to ensure a level of security appropriate to the risk presented by the processing of Personal Data under this DPA, taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing, as well as the risk of varying likelihood and severity for the rights and freedoms of Data Subjects. Such measures shall include, as appropriate, the measures referred to in Article 32(1) of the GDPR, including:
(a) The pseudonymization and encryption of Personal Data;
(b) The ability to ensure the ongoing confidentiality, integrity, availability, and resilience of processing systems and services;
(c) The ability to restore the availability and access to Personal Data in a timely manner in the event of a physical or technical incident;
(d) A process for regularly testing, assessing, and evaluating the effectiveness of the Technical and Organizational Measures for ensuring the security of the processing.
4.2 Specific Security Controls. Without limiting the generality of Section 4.1 or the requirements set forth in Schedule B, Processor shall, at a minimum, implement and maintain the following specific security controls at all times during the term of this DPA:
(a) Encryption at Rest: All Personal Data stored by Processor or its Sub-processors shall be encrypted at rest using the Advanced Encryption Standard with a key length of 256 bits (AES-256), or an equivalent or stronger encryption standard as may be approved by Controller in writing;
(b) Encryption in Transit: All Personal Data transmitted by or to Processor over public or untrusted networks shall be encrypted in transit using Transport Layer Security (TLS) version 1.2 or higher, with cipher suites that conform to industry best practices as published by NIST and the Internet Engineering Task Force (IETF);
(c) Multi-Factor Authentication (MFA): Multi-factor authentication shall be required for all administrative, privileged, and remote access to systems, applications, and infrastructure that process, store, or transmit Personal Data;
(d) Annual Penetration Testing: Processor shall engage an independent, qualified third-party security firm to conduct penetration testing of the SBF Core platform and related infrastructure at least once per calendar year. As of the date of this DPA, Processor's penetration testing provider is Ironvault Security Group LLC, 11710 Plaza America Drive, Suite 400, Reston, Virginia 20190. Processor shall provide Controller with an executive summary of the results of each penetration test, together with a remediation plan and timeline for any critical or high-severity findings, within thirty (30) days following the completion of the test;
(e) SOC 2 Type II Report: Processor shall maintain a current SOC 2 Type II report issued by an independent auditing firm. As of the date of this DPA, Processor's SOC 2 Type II report is issued by Graystone & Ketchum LLP, and the most recent report covers the twelve-month period from October 1, 2024 through September 15, 2025. Processor shall provide a copy of the most recent SOC 2 Type II report to Controller in accordance with Section 4.3;
(f) Incident Response Plan: Processor shall maintain a documented, tested, and regularly updated incident response plan that includes procedures for the identification, containment, investigation, remediation, and escalation of Personal Data Breaches, and that is aligned with the requirements of Article 7 (Personal Data Breach Notification) and Schedule D (Data Breach Notification Procedures);
(g) Employee Security Awareness Training: Processor shall provide mandatory security awareness training to all employees who have access to Personal Data, upon hiring and at least annually thereafter. Such training shall cover, at a minimum, information security policies, phishing and social engineering awareness, data handling and classification procedures, and incident reporting obligations
4.3 SOC 2 Certification. Processor shall maintain a current SOC 2 Type II certification at all times during the term of this DPA. Processor shall provide a copy of the most recent SOC 2 Type II report to Controller upon written request, provided that Controller shall not make such a request more frequently than once per twelve (12)-month period. In the event that Processor's SOC 2 Type II report identifies any material control deficiencies or exceptions, Processor shall promptly notify Controller and shall provide Controller with a written remediation plan, including timelines, within fifteen (15) business days of issuance of the report. Processor shall implement such remediation plan in a timely manner and shall provide Controller with evidence of remediation upon request.
4.4 Continuous Improvement. Processor shall periodically (and at least annually) review and update its Technical and Organizational Measures in light of changes in technology, the evolving threat landscape, regulatory requirements, and Applicable Data Protection Laws. Processor shall notify Controller in advance of any material changes to its TOMs that could adversely affect the security posture of the SBF Core platform or the protection of Personal Data, and shall obtain Controller's prior written approval before implementing any such change. For the avoidance of doubt, updates to TOMs that enhance security protections without reducing the level of protection afforded to Personal Data shall not require Controller's prior approval, but shall be communicated to Controller in writing within a reasonable time.
ARTICLE 5 — SUB-PROCESSING
5.1 General Written Authorization. Controller hereby provides Processor with general written authorization to engage Sub-processors to process Personal Data on behalf of Controller in connection with the Subscription Agreement, subject to compliance with the requirements set forth in this Article 5. This authorization is contingent upon Processor's full compliance with the notice, objection, flow-down, and due diligence requirements described herein.
5.2 Approved Sub-processors. As of the Effective Date, Controller authorizes the following Sub-processors to process Personal Data on behalf of Controller, as further described in Schedule C (Approved Sub-processor List):
(a) Osprey Cloud Infrastructure, Inc. ("Osprey Cloud"), a Delaware corporation, with its principal office at 2200 Campus Drive, San Jose, California 95131. Osprey Cloud provides infrastructure-as-a-service (IaaS) and platform-as-a-service (PaaS) hosting services for the SBF Core platform. Data center regions utilized for Controller's Personal Data are: US-East (Ashburn, Virginia) and EU (Frankfurt, Germany). Processor has entered into a data processing agreement with Osprey Cloud dated March 1, 2024, which includes Module 3 Standard Contractual Clauses (Processor-to-Sub-processor) for the transfer of EU Data.
(b) Skybridge Fintech Europe B.V. ("SBF Europe"), a private limited liability company (besloten vennootschap met beperkte aansprakelijkheid) organized under the laws of the Netherlands, with its registered office at Keizersgracht 482, 1017 EG Amsterdam, Netherlands (KvK No. 82104593). SBF Europe is a wholly owned subsidiary of Processor and performs EU personal data processing operations, including localized anti-fraud analytics and regulatory reporting for EU-resident Data Subjects. SBF Europe's Managing Director is Lena Vogt. As of the date of this DPA, SBF Europe employs fourteen (14) personnel: eight (8) software engineers, four (4) customer support specialists, and two (2) compliance officers.
5.3 Prior Notice of New Sub-processors. Processor shall provide Controller with at least thirty (30) days' prior written notice before engaging any new Sub-processor or materially changing the processing activities of, or replacing, an existing Sub-processor. Such notice shall be provided in writing (which may include email to the notice addresses specified in Section 17.6) and shall include, at a minimum:
(a) The name, legal entity type, and principal office address of the proposed Sub-processor;
(b) A description of the processing activities to be performed by the proposed Sub-processor;
(c) The categories of Personal Data to be processed by the proposed Sub-processor;
(d) The location(s) at which the proposed Sub-processor will process Personal Data; and
(e) Information regarding the proposed Sub-processor's relevant security certifications, data protection compliance posture, and any existing contractual arrangements between Processor and the proposed Sub-processor.
5.4 Controller's Right to Object. Controller shall have a period of thirty (30) days from receipt of the notice described in Section 5.3 (the "Objection Period") within which to object to the proposed new or replacement Sub-processor. Any objection by Controller must be based on reasonable grounds related to data protection, including but not limited to concerns regarding the Sub-processor's security posture, compliance with Applicable Data Protection Laws, geographic location, or regulatory risk. If Controller provides a timely written objection during the Objection Period, the following procedures shall apply:
(a) The Parties shall discuss the objection in good faith and Processor shall use commercially reasonable efforts to propose an alternative arrangement that addresses Controller's concerns, which may include replacing the proposed Sub-processor, modifying the scope of the Sub-processor's processing activities, or implementing additional safeguards;
(b) If the Parties are unable to reach a mutually acceptable resolution within thirty (30) days following Controller's objection (or such longer period as the Parties may agree in writing), Controller may terminate the affected portion of the Subscription Agreement (i.e., the services that would be performed using the objected-to Sub-processor) without penalty, termination fee, or early termination charge, effective upon thirty (30) days' written notice to Processor;
(c) For the avoidance of doubt, during the period of any objection and related discussions, Processor shall not engage the proposed Sub-processor to process Controller's Personal Data.
5.5 Flow-Down Obligations. Processor shall impose on each Sub-processor, by way of a written agreement (which may include a data processing addendum, data processing agreement, or equivalent contractual instrument), data protection obligations that are no less protective of Personal Data than the obligations imposed on Processor under this DPA. Without limiting the foregoing, such written agreement shall include, at a minimum, obligations relating to:
(a) Processing Personal Data only on documented instructions from Processor (on behalf of Controller);
(b) Confidentiality obligations for all personnel authorized to process Personal Data;
(c) Implementation and maintenance of appropriate Technical and Organizational Measures;
(d) Notification of Personal Data Breaches in accordance with timeframes and procedures consistent with Article 7 of this DPA;
(e) Audit rights for Processor (and, where applicable, Controller and Regulators);
(f) Deletion or return of Personal Data upon termination or expiration of the Sub-processing engagement; and
(g) Compliance with Applicable Data Protection Laws, including data transfer requirements.
Processor shall remain fully liable to Controller for the performance of each Sub-processor's obligations under this DPA and the applicable sub-processing agreement. Any failure by a Sub-processor to comply with its data protection obligations shall be deemed a failure by Processor to comply with its obligations under this DPA.
5.6 Sub-processor Due Diligence. Prior to engaging any Sub-processor, Processor shall conduct appropriate due diligence to assess the Sub-processor's ability to meet the data protection requirements of this DPA. Such due diligence shall include, at a minimum, review of the Sub-processor's: (a) information security policies and practices; (b) relevant certifications (including SOC 2, ISO 27001, or equivalent); (c) compliance with Applicable Data Protection Laws; (d) prior data breach history; and (e) financial stability and business continuity capabilities. Processor shall conduct periodic reassessments of each Sub-processor's compliance at intervals of no less than once per calendar year and shall promptly notify Controller of any material deficiencies identified.
5.7 OCC Bulletin 2023-17 Compliance. Processor acknowledges that Controller is required under OCC Bulletin 2023-17 (Third-Party Relationships: Risk Management Guidance) to maintain appropriate oversight of sub-contractors engaged by its critical third-party service providers. Processor shall cooperate with Controller's sub-contractor oversight activities as reasonably requested by Controller, including by: (a) providing information regarding Sub-processors' security and compliance posture; (b) facilitating Controller's access to Sub-processor audit reports and certifications; and (c) promptly notifying Controller of any material adverse events or regulatory actions affecting any Sub-processor's ability to protect Personal Data.
ARTICLE 6 — DATA SUBJECT RIGHTS
6.1 Cooperation with Data Subject Requests. Processor shall, taking into account the nature of the processing and the information available to Processor, assist Controller by implementing appropriate technical and organizational measures, insofar as this is possible, for the fulfilment of Controller's obligation to respond to requests from Data Subjects exercising their rights under Applicable Data Protection Laws. Such rights include, without limitation:
(a) The right of access to Personal Data (GDPR Article 15; CCPA/CPRA Cal. Civ. Code § 1798.110);
(b) The right to rectification of inaccurate Personal Data (GDPR Article 16);
(c) The right to erasure ("right to be forgotten") (GDPR Article 17; CCPA/CPRA Cal. Civ. Code § 1798.105);
(d) The right to restriction of processing (GDPR Article 18);
(e) The right to data portability (GDPR Article 20);
(f) The right to object to processing (GDPR Article 21);
(g) The right to opt out of the sale or sharing of personal information (CCPA/CPRA Cal. Civ. Code § 1798.120); and
(h) Any analogous rights under other Applicable Data Protection Laws, including the New Jersey Data Privacy Act (NJ S3377).
Processor shall maintain the technical capability to search, retrieve, export, modify, and delete Personal Data in response to Data Subject requests in a format and manner that enables Controller to comply with its obligations under Applicable Data Protection Laws in a timely fashion.
6.2 Notification to Controller. If Processor receives a request directly from a Data Subject relating to Controller's Personal Data, Processor shall promptly, and in any event within business days of receipt, forward such request to Controller and shall not respond to the Data Subject's request except on Controller's documented instructions, unless Processor is required to respond by applicable law. In the event that Processor is required by applicable law to respond directly to a Data Subject request, Processor shall notify Controller of such requirement and the substance of the response provided, to the extent permitted by applicable law.
6.3 Costs. Processor shall provide reasonable cooperation and assistance in connection with Data Subject requests at no additional charge to Controller, to the extent that such cooperation and assistance can be accomplished through the standard functionality of the SBF Core platform and Processor's existing systems and processes. If a Data Subject request requires material customization, development effort, or manual intervention beyond the standard functionality of the SBF Core platform, the Parties shall discuss in good faith the allocation of costs associated with such effort, and any agreed-upon costs shall be documented in writing prior to Processor commencing such work.
ARTICLE 7 — PERSONAL DATA BREACH NOTIFICATION
7.1 Notification Obligation. Processor shall notify Controller without undue delay, and in no event later than forty-eight (48) hours, after Processor or any of its Sub-processors becomes aware of a Personal Data Breach affecting Controller's Personal Data. For purposes of this Section, Processor shall be deemed to have become "aware" of a Personal Data Breach at the time at which Processor has a reasonable degree of certainty that a security incident has occurred that has compromised the confidentiality, integrity, or availability of Controller's Personal Data. Such notification shall be made to Controller's Chief Compliance Officer, Andrea Sokolov, and VP of Third-Party Risk Management, Marcus Tibaldi, in accordance with the escalation procedures set forth in Schedule D (Data Breach Notification Procedures).
7.2 Content of Notification. The initial notification provided pursuant to Section 7.1 shall include, to the extent such information is then reasonably available to Processor:
(a) A description of the nature of the Personal Data Breach, including, where possible, the categories and approximate number of Data Subjects concerned and the categories and approximate number of Personal Data records concerned;
(b) The name, title, and contact details (including email address and telephone number) of Processor's primary data protection contact, which as of the date of this DPA is:
(i) CISO: Rebecca Muñoz, Chief Information Security Officer, Skybridge Fintech Ltd., rmuñoz@skybridgefintech.com, (302) 555-7841; and
(ii) General Counsel / Chief Privacy Officer: Thomas Elridge, General Counsel and Chief Privacy Officer, Skybridge Fintech Ltd., telridge@skybridgefintech.com, (302) 555-7900;
(c) A description of the likely consequences of the Personal Data Breach, including an assessment of the risk to the rights and freedoms of affected Data Subjects;
(d) A description of the measures taken or proposed to be taken by Processor to address the Personal Data Breach, including, where appropriate, measures to contain the breach, mitigate its possible adverse effects, and prevent recurrence
7.3 Follow-Up Information. If it is not possible to provide all of the information described in Section 7.2 at the time of the initial notification, Processor shall provide such information in phases without undue delay as it becomes available. Processor shall provide updates to Controller at least once every twenty-four (24) hours during the initial investigation phase until the scope and impact of the Personal Data Breach have been reasonably determined, and thereafter at such intervals as Controller may reasonably request.
7.4 Escalation Matrix. Processor and Controller agree to the following escalation matrix for Personal Data Breach notifications, as further detailed in Schedule D:
Processor-Side Escalation:
(a) CISO Rebecca Muñoz (primary contact, first responder);
(b) General Counsel / Chief Privacy Officer Thomas Elridge (secondary contact, legal and regulatory coordination);
Controller-Side Escalation:
(c) Chief Compliance Officer Andrea Sokolov (primary Controller contact);
(d) VP, Third-Party Risk Management Marcus Tibaldi (secondary Controller contact, operational coordination).
Processor shall ensure that the individuals identified in the escalation matrix are reachable twenty-four (24) hours per day, seven (7) days per week, three hundred sixty-five (365) days per year, through designated emergency contact channels as specified in Schedule D.
7.5 Cooperation. Processor shall cooperate fully with Controller and shall take all commercially reasonable steps to assist Controller in: (a) investigating the nature, scope, and impact of the Personal Data Breach; (b) identifying affected Data Subjects and Personal Data records; (c) remediating the vulnerability or condition that gave rise to the Personal Data Breach; (d) mitigating the effects of the Personal Data Breach on affected Data Subjects; and (e) complying with Controller's notification obligations to Regulators and Data Subjects under Applicable Data Protection Laws, including without limitation the thirty-six (36)-hour notification obligation to primary federal regulators under the FDIC/OCC Computer-Security Incident Notification Rule (12 CFR Part 53), the seventy-two (72)-hour notification obligation to supervisory authorities under Article 33 of the GDPR, and any applicable state data breach notification statutes. Processor acknowledges that Controller's ability to meet the thirty-six (36)-hour bank-to-regulator notification deadline under 12 CFR Part 53 is dependent upon Processor's timely compliance with the forty-eight (48)-hour notification obligation set forth in Section 7.1.
7.6 No Unauthorized Disclosure. Processor shall not inform any third party of a Personal Data Breach affecting Controller's Personal Data without Controller's prior written consent, unless Processor is required to do so by applicable law. If Processor is required by applicable law to notify a third party (including a Regulator) of a Personal Data Breach, Processor shall, to the extent permitted by law, notify Controller of such requirement in advance and coordinate with Controller regarding the timing, content, and recipients of such notification. Processor shall not make any public statements, press releases, or other external communications regarding a Personal Data Breach affecting Controller's Personal Data without Controller's prior written approval of the timing and content of such communications.
7.7 Documentation. Processor shall document all Personal Data Breaches, including the facts relating to the breach, its effects, and the remedial action taken. Such documentation shall be maintained in a format that enables Controller to comply with its obligations under Article 33(5) of the GDPR and analogous requirements under Applicable Data Protection Laws. Processor shall make such documentation available to Controller upon request, and shall retain such documentation for a period of not less than seven (7) years following the date of the Personal Data Breach.
ARTICLE 8 — DATA PROTECTION IMPACT ASSESSMENTS AND PRIOR CONSULTATION
8.1 DPIA Cooperation. Processor shall provide reasonable assistance to Controller in conducting Data Protection Impact Assessments relating to Controller's use of the services provided under the Subscription Agreement, to the extent that Controller does not otherwise have access to the relevant information, and taking into account the nature of the processing and the information available to Processor. Such assistance may include providing: (a) descriptions of the processing operations performed by Processor; (b) information regarding the Technical and Organizational Measures implemented by Processor; (c) data flow diagrams and system architecture documentation; (d) information regarding Sub-processors and the locations of processing; and (e) such other information as Controller may reasonably request to assess the impact of the processing on the rights and freedoms of Data Subjects.
8.2 Prior Consultation. Processor shall provide reasonable assistance to Controller in connection with any prior consultation with a supervisory authority pursuant to Article 36 of the GDPR or analogous provisions of Applicable Data Protection Laws, including by providing information, documentation, and access to Processor's personnel as may be reasonably requested by Controller or required by the supervisory authority. Processor shall cooperate in good faith with Controller to address any concerns raised by a supervisory authority in the course of such prior consultation.
ARTICLE 9 — INTERNATIONAL DATA TRANSFERS
9.1 Data Locations. Processor shall process Personal Data under this DPA at the following locations, and shall not transfer, access, or process Personal Data at any other location without Controller's prior written authorization:
(a) Primary Data Center: Osprey Cloud US-East data center located in Ashburn, Virginia, United States;
(b) Secondary / EU Data Center and Processing Location: Osprey Cloud EU data center located in Frankfurt, Germany, and the SBF Europe office located in Amsterdam, Netherlands;
(c) Disaster Recovery: Osprey Cloud US-East secondary availability zone located in Ashburn, Virginia, United States.
Processor shall maintain documentation of all locations at which Personal Data is processed and shall update such documentation promptly upon any change. Any change in the locations of processing shall be subject to the prior notice and objection procedures set forth in Article 5 (Sub-Processing), to the extent applicable.
9.2 Standard Contractual Clauses. To the extent that the processing of Personal Data under this DPA involves a transfer of EU Data to a country outside the European Economic Area that has not been the subject of an adequacy decision by the European Commission pursuant to Article 45 of the GDPR, the Parties agree to enter into and be bound by the Standard Contractual Clauses as set forth in the SCC package appended to this DPA. The applicable SCC modules are as follows:
(a) Module 2 (Controller-to-Processor): Meridian Federal Savings Bank (data exporter / Controller) transfers EU Data to Skybridge Fintech Ltd. (data importer / Processor) for processing in the United States;
(b) Module 3 (Processor-to-Sub-processor): Skybridge Fintech Ltd. (data exporter / Processor) transfers EU Data to Osprey Cloud Infrastructure, Inc. (data importer / Sub-processor) for hosting and infrastructure services in the United States;
(c) Module 3 (Processor-to-Sub-processor): Skybridge Fintech Ltd. (data exporter / Processor) transfers EU Data to Skybridge Fintech Europe B.V. (data importer / Sub-processor) for EU-localized processing operations in the Netherlands.
The executed SCC modules, together with the completed Annexes I, II, and III, are appended to this DPA and incorporated herein by reference.
9.3 SCC Governing Law. The Standard Contractual Clauses appended to this DPA shall be governed by the law of the Netherlands, as the Member State in which Processor maintains its EU establishment (Skybridge Fintech Europe B.V., Amsterdam, Netherlands), in accordance with Clause 17 of the SCCs. Any disputes arising under or in connection with the SCCs shall be resolved before the courts of the Netherlands, in accordance with Clause 18 of the SCCs.
9.4 EU-US Data Privacy Framework. Processor represents that it has self-certified under the EU-US Data Privacy Framework administered by the U.S. Department of Commerce (Certification ID: DPF-2025-03912), effective as of July 1, 2025. Processor shall maintain such self-certification in good standing throughout the term of this DPA, and shall promptly notify Controller of any change in the status of such self-certification, including any withdrawal, suspension, or revocation. The Parties acknowledge and agree that Processor's self-certification under the EU-US Data Privacy Framework supplements but does not replace or supersede the Standard Contractual Clauses appended to this DPA, and that the SCCs shall remain in full force and effect regardless of the status of Processor's Data Privacy Framework self-certification.
9.5 Transfer Impact Assessment. Processor shall cooperate with Controller in conducting transfer impact assessments as required under the Court of Justice of the European Union's decision in Data Protection Commissioner v. Kestrel Services Inc. Ireland Limited and Maximillian Schrems (Case C-311/18, "Schrems II") and related regulatory guidance issued by the European Data Protection Board (EDPB) and applicable supervisory authorities, including EDPB Recommendations 01/2020 (as adopted on June 18, 2021) on measures that supplement transfer tools to ensure compliance with the EU level of protection of personal data. Such cooperation shall include providing information regarding the laws and practices of the destination country that may impact the effectiveness of the SCCs, and Processor's assessment of the extent to which it is or may be subject to government access requests.
9.6 Supplementary Measures. In addition to the Standard Contractual Clauses and Data Privacy Framework self-certification, Processor has implemented the following supplementary technical and organizational measures to safeguard EU Data in connection with international data transfers:
(a) AES-256 encryption at rest for all EU Data stored in the United States;
(b) TLS 1.2 or higher encryption in transit for all EU Data transmitted between the EU and the United States;
(c) Multi-factor authentication (MFA) for all administrative access to systems containing EU Data;
(d) Strict access controls limiting access to EU Data to authorized personnel who have been vetted through background checks and have executed confidentiality agreements;
(e) Data minimization practices to limit the transfer of EU Data to the minimum necessary for the performance of the services;
(f) Processor's policy of challenging any government access request for EU Data that is overbroad, disproportionate, or otherwise contrary to EU law, and of notifying Controller of any such request to the extent permitted by law.
9.7 SCC Annexes. The SCC Annexes I (Description of Transfer), II (Technical and Organizational Measures), and III (List of Sub-processors) are appended to the SCC package and are incorporated into this DPA by reference. In the event of any conflict between the SCC Annexes and the Schedules to this DPA, the SCC Annexes shall prevail to the extent required by the SCCs and Applicable Data Protection Laws.
ARTICLE 10 — AUDIT RIGHTS
10.1 Right to Audit. shall have the right to audit, examine, and inspect Processor's compliance with the terms and conditions of this DPA, including Processor's Technical and Organizational Measures, processing activities, records of processing, Sub-processor management, and compliance with Applicable Data Protection Laws, subject to the conditions and procedures set forth in this Article 10.
10.2 Frequency. Controller may conduct no more than one (1) audit per twelve (12)-month period during the term of this DPA. Notwithstanding the foregoing, Controller may conduct additional audits beyond the one-per-year limitation if any of the following circumstances arise:
(a) A Personal Data Breach has occurred involving Controller's Personal Data;
(b) A Regulator has initiated an inquiry, examination, or investigation that requires Controller to obtain information or access to Processor's systems or facilities;
(c) Controller has a reasonable, good-faith belief that Processor is materially non-compliant with the terms of this DPA; or
(d) A material change in Applicable Data Protection Laws imposes new audit or examination requirements on Controller with respect to its service providers
10.3 Notice. Controller shall provide Processor with at least thirty (30) days' advance written notice of any planned audit, except in the case of a Regulator-directed audit or examination, in which case Controller shall provide such notice as is required or permitted by the Regulator. The notice shall specify the proposed scope, timing, and duration of the audit, as well as the identity and qualifications of any third-party auditors who will participate in the audit. Processor may require third-party auditors to execute non-disclosure agreements before commencing any audit activities.
10.4 SOC 2 as Primary Audit Mechanism. The Parties agree that Processor may satisfy Controller's audit request (under Section 10.2, in the absence of the triggering events described in Sections 10.2(a) through by providing Controller with the following documentation: