DATA PROCESSING AGREEMENT
Execution Version
February 5, 2026
between
MERIDIAN FEDERAL SAVINGS BANK ("Controller")
and
SKYBRIDGE FINTECH LTD. ("Processor")
This Data Processing Agreement is entered into concurrently with and as a supplement to the SaaS Subscription Agreement between the parties dated as of the date hereof (the "Principal Agreement"). Target signing date: February 15, 2026.
Right-click to update Table of Contents
RECITALS
WHEREAS:
A. Meridian Federal Savings Bank is a federally chartered savings bank, insured by the Federal Deposit Insurance Corporation ("FDIC"), operating under Office of the Comptroller of the Currency ("OCC") Charter Number 14-2238, with its principal offices located at 900 Broad Street, Suite 1200, Newark, New Jersey 07102. Controller maintains approximately 412,000 accountholders across forty-seven (47) retail branch locations in the States of New Jersey, New York, Pennsylvania, and Connecticut, with total assets of approximately $6.1 billion and total deposits of approximately $4.3 billion as of the date hereof.
B. Skybridge Fintech Ltd. is a Delaware C-corporation, headquartered at 4100 Silverside Road, Suite 310, Wilmington, Delaware 19810, engaged in the business of providing software-as-a-service ("SaaS") based real-time payment processing, anti-fraud analytics, and regulatory reporting software, marketed and delivered through its proprietary platform known as "SBF Core," to FDIC-insured banks and credit unions throughout the United States.
C. Controller has entered into a five (5)-year SaaS subscription agreement with Processor for the use of the SBF Core platform (the "Principal Agreement"), with an annual contract value of Two Million Seven Hundred Forty Thousand United States Dollars ($2,740,000) and a total contract value of Thirteen Million Seven Hundred Thousand United States Dollars ($13,700,000).
D. In connection with performing the services described in and contemplated by the Principal Agreement, Processor will process personal data belonging to or relating to Controller's accountholders, authorized signers on accounts, beneficial owners of accounts, and certain employees of Controller, in each case on behalf of and at the direction of Controller.
E. Controller is classified as a data controller, and Processor is classified as a data processor, under applicable data protection laws. With respect to approximately 3,200 European Union-resident accountholders whose personal data will be processed through SBF Core, Regulation (EU) 2016/679 (the "General Data Protection Regulation" or "GDPR") applies to the processing activities contemplated hereunder.
F. The parties wish to establish their respective obligations regarding data processing, security, breach notification, sub-processor management, audit rights, and cross-border data transfers, in order to satisfy the requirements of all applicable laws and regulations, including without limitation the Gramm-Leach-Bliley Act ("GLBA") and its implementing regulations, OCC Bulletin 2023-17 (Third-Party Relationships: Risk Management Guidance), the FDIC/OCC Computer-Security Incident Notification Rule (12 CFR Part 53), the GDPR, the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA/CPRA"), the New Jersey Data Privacy Act (S3377), and Controller's Third-Party Risk Management ("TPRM") program and related policies and procedures.
G. The parties intend this Data Processing Agreement, together with all Schedules and Appendices attached hereto, to be appended to and to form an integral part of the Principal Agreement.
NOW, THEREFORE, in consideration of the mutual covenants and agreements set forth herein, and for other good and valuable consideration, the receipt and sufficiency of which are hereby acknowledged, the parties agree as follows:
ARTICLE 1 — DEFINITIONS
As used in this DPA, the following terms shall have the meanings set forth below. Capitalized terms used but not defined in this DPA shall have the meanings assigned to them in the Principal Agreement.
1.1 "Applicable Data Protection Laws" means all federal, state, and international laws, regulations, rules, orders, and regulatory guidance applicable to the processing of Personal Data under this DPA, including without limitation: (a) the Gramm-Leach-Bliley Act, 15 U.S.C. §§ 6801–6809, and its implementing regulations, including Regulation P (12 CFR Part 1016); (b) Regulation (EU) 2016/679 (the General Data Protection Regulation or "GDPR"); (c) the California Consumer Privacy Act, Cal. Civ. Code §§ 1798.100–1798.199.100, as amended by the California Privacy Rights Act of 2020 ("CCPA/CPRA"); (d) the New Jersey Data Privacy Act (NJ S3377, effective January 15, 2026); (e) OCC Bulletin 2023-17 (Third-Party Relationships: Risk Management Guidance); and (f) the FDIC/OCC Computer-Security Incident Notification Rule (12 CFR Part 53), in each case as amended, supplemented, or replaced from time to time.
1.2 "Controller" means Meridian Federal Savings Bank, a federally chartered savings bank, and its successors and assigns.
1.3 "Data Subject" means an identified or identifiable natural person whose Personal Data is processed under this DPA. An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.
1.4 "DPA" means this Data Processing Agreement, including all Schedules and Appendices attached hereto, as may be amended from time to time in accordance with Section 15.4.
1.5 "DPIA" means a Data Protection Impact Assessment as described in Article 35 of the GDPR, or an equivalent assessment required under other Applicable Data Protection Laws, including the New Jersey Data Privacy Act (NJ S3377).
1.6 "EU Data" means Personal Data relating to Data Subjects who are residents of a Member State of the European Union or the European Economic Area. As of the date hereof, EU Data includes Personal Data relating to approximately 3,200 Meridian accountholders who are EU residents.
1.7 "GDPR" means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, as may be amended or supplemented from time to time.
1.8 "GLBA" means the Gramm-Leach-Bliley Act, 15 U.S.C. §§ 6801–6809, and its implementing regulations, including without limitation Regulation P (12 CFR Part 1016) and the Interagency Guidelines Establishing Information Security Standards.
1.9 "Personal Data" means any information relating to an identified or identifiable Data Subject that is processed by Processor on behalf of Controller in connection with the Principal Agreement and the Services. For the avoidance of doubt, Personal Data includes "nonpublic personal information" as defined under GLBA and Regulation P, "personal information" as defined under CCPA/CPRA, and "personal data" as defined under the GDPR and the New Jersey Data Privacy Act.
1.10 "Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data transmitted, stored, or otherwise processed by Processor or its Sub-processors. For the avoidance of doubt, a Personal Data Breach includes a "notification incident" as defined under 12 CFR Part 53 and a "security breach" as defined under applicable state breach notification laws.
1.11 "Principal Agreement" means the SaaS Subscription Agreement between Controller and Processor for the SBF Core platform, entered into concurrently herewith, as may be amended from time to time.
1.12 "Processor" means Skybridge Fintech Ltd., a Delaware C-corporation, and its successors and assigns.
1.13 "Regulatory Authority" means any governmental, regulatory, or supervisory body or authority with jurisdiction over Controller or Processor with respect to the matters addressed in this DPA, including without limitation the Office of the Comptroller of the Currency ("OCC"), the Federal Deposit Insurance Corporation ("FDIC"), the Consumer Financial Protection Bureau ("CFPB"), the Federal Trade Commission ("FTC"), and European Union data protection supervisory authorities (including the Autoriteit Persoonsgegevens in the Netherlands).
1.14 "SCCs" or "Standard Contractual Clauses" means the standard contractual clauses for the transfer of personal data to third countries adopted by the European Commission pursuant to Commission Implementing Decision (EU) 2021/914 of 4 June 2021, as annexed to this DPA as Appendix 1, and as may be amended, supplemented, or replaced by subsequent decisions of the European Commission.
1.15 "Sensitive Data" means Personal Data that is classified as "sensitive" under Applicable Data Protection Laws. As applicable to the processing activities contemplated by this DPA, Sensitive Data includes Social Security numbers, taxpayer identification numbers, and behavioral biometric data (including keystroke dynamics and mouse movement patterns), each of which is classified as sensitive personal information under CCPA/CPRA and NJ S3377.
1.16 "Services" means the payment processing, anti-fraud analytics (including behavioral biometric analysis), and regulatory reporting services provided by Processor to Controller through the SBF Core platform, as more fully described in the Principal Agreement.
1.17 "SOC 2 Type II Report" means a Service Organization Controls report prepared in accordance with the standards promulgated by the American Institute of Certified Public Accountants ("AICPA"), specifically the Trust Services Criteria for Security, Availability, Processing Integrity, Confidentiality, and Privacy (as applicable), covering a minimum observation period of six (6) months.
1.18 "Sub-processor" means any third party (other than an employee of Processor) engaged by Processor, or by any Sub-processor of Processor, to process Personal Data on behalf of Controller in connection with the Services.
1.19 "TPRM" means Third-Party Risk Management, including Controller's policies, procedures, and programs for the oversight of third-party service providers in accordance with OCC Bulletin 2023-17, FDIC guidance, and FFIEC guidance on technology service providers.
ARTICLE 2 — SCOPE AND PURPOSE OF PROCESSING
2.1 Subject Matter of Processing. Processor shall process Personal Data solely for the purpose of providing the Services under the Principal Agreement. The processing activities to be performed by Processor are limited to the following:
(a) Real-Time Payment Processing. Processing of transaction data, account data, and related Personal Data to facilitate the initiation, authorization, clearing, and settlement of payments through SBF Core on behalf of Controller and its accountholders;
(b) Anti-Fraud Analytics and Behavioral Biometric Analysis. Analysis of transaction patterns, device data, IP addresses, geolocation data, and behavioral biometric data (including keystroke dynamics and mouse movement patterns) to detect, prevent, and report potentially fraudulent activity in connection with Controller's accounts and transactions; and
(c) Regulatory Reporting. Compilation, formatting, and delivery of reports and data required by Controller for compliance with regulatory reporting obligations, including suspicious activity reports, currency transaction reports, and other reports required by Applicable Data Protection Laws and banking regulations.
Processor shall not process Personal Data for any purpose other than as set forth in this Section 2.1, except as required by applicable law or as otherwise instructed by Controller in writing.
2.2 Categories of Data Subjects. The categories of Data Subjects whose Personal Data will be processed by Processor under this DPA are as follows, and are further described in Schedule A:
(a) Meridian retail and small-business accountholders, comprising approximately 412,000 individuals as of the date hereof;
(b) Authorized signers on Meridian accounts who are not themselves accountholders;
(c) Beneficial owners of Meridian accounts, as identified pursuant to Controller's Customer Identification Program and beneficial ownership verification procedures; and
(d) Meridian employees whose Personal Data passes through SBF Core in connection with the Services (including, for example, employees who initiate or authorize transactions or who access SBF Core for administrative purposes).
The foregoing categories include approximately 3,200 Data Subjects who are residents of a Member State of the European Union or the European Economic Area, whose Personal Data constitutes EU Data as defined in Section 1.6.
2.3 Categories of Personal Data. The categories of Personal Data processed by Processor under this DPA are as follows, and are further described in Schedule A:
(a) Full name (first, middle, last);
(b) Date of birth;
(c) Social Security number;
(d) Taxpayer identification number;
(e) Account numbers (checking, savings, and loan);
(f) Routing numbers;
(g) Transaction amounts and transaction metadata (including timestamps, merchant category codes, and transaction descriptions);
(h) Internet Protocol (IP) addresses;
(i) Device identifiers (including mobile device identifiers, browser fingerprints, and hardware identifiers);
(j) Geolocation data (city-level);
(k) Email addresses;
(l) Phone numbers; and
(m) Behavioral biometric data, including keystroke dynamics and mouse movement patterns.
2.4 Volume. Processor processes approximately 18.6 million transactions per month through SBF Core on behalf of Controller. The parties acknowledge that transaction volumes may fluctuate over time and that the foregoing figure represents an approximate baseline as of the date hereof.
2.5 Data Locations. Personal Data processed under this DPA shall be stored and processed at the following locations:
(a) Primary (United States): Osprey Cloud Infrastructure, Inc. US-East region data center located in Ashburn, Virginia;
(b) Secondary (European Union): Osprey Cloud Infrastructure, Inc. EU region data center located in Frankfurt, Germany, and the premises of Skybridge Fintech Europe B.V. located at Keizersgracht 482, 1017 EG Amsterdam, Netherlands; and
(c) Disaster Recovery: Osprey Cloud Infrastructure, Inc. US-East secondary availability zone located in Ashburn, Virginia.
Processor shall not process or store Personal Data at any location other than those identified in this Section 2.5 without the prior written consent of Controller, except as may be necessary to engage an approved Sub-processor in accordance with Article 5 or as required by applicable law.
2.6 Duration. Processing of Personal Data under this DPA shall continue for the duration of the Principal Agreement (a five (5)-year term commencing on the effective date of the Principal Agreement) plus the post-termination data retention period described in Article 10, during which Processor shall return or delete Personal Data in accordance with Controller's instructions.
ARTICLE 3 — CONTROLLER OBLIGATIONS
3.1 Lawful Basis. Controller represents and warrants that it has established and will maintain a lawful basis for providing Personal Data to Processor for processing in connection with the Services. With respect to EU Data, Controller represents that it has identified and documented an appropriate legal basis for processing under Article 6 of the GDPR (and, where applicable, Article 9 of the GDPR). With respect to Personal Data subject to GLBA, Controller represents that the disclosure of nonpublic personal information to Processor is made in accordance with the exceptions set forth in Regulation P (12 CFR Part 1016) for disclosures to service providers. With respect to Sensitive Data subject to CCPA/CPRA and NJ S3377, Controller represents that it has obtained any required consents or has otherwise established a lawful basis for the processing of such data.
3.2 Instructions. Controller shall provide documented, lawful instructions to Processor regarding the processing of Personal Data. The Principal Agreement, this DPA, and any written instructions provided by Controller to Processor from time to time shall constitute Controller's documented instructions for the purposes of Article 28(3)(a) of the GDPR and equivalent provisions under other Applicable Data Protection Laws. Controller acknowledges that Processor is not obligated to assess the lawfulness of Controller's instructions but shall inform Controller if, in Processor's opinion, an instruction infringes Applicable Data Protection Laws.
3.3 Compliance with Privacy Notices. Controller shall ensure that its privacy notices, disclosures, and policies provided to Data Subjects adequately and accurately disclose the use of Processor as a service provider and the nature of the processing activities performed by Processor on Controller's behalf. Controller shall update its privacy notices as necessary to reflect any material changes in processing activities under this DPA. Controller is solely responsible for the content, accuracy, and legal sufficiency of its privacy notices.
3.4 Regulatory Compliance. Controller is solely responsible for its own compliance with GLBA, Regulation P (12 CFR Part 1016), OCC supervisory requirements, FDIC requirements, and all other Applicable Data Protection Laws to the extent such compliance is not delegated to Processor under this DPA. Without limiting the foregoing, Controller acknowledges and agrees that it bears the primary responsibility to notify its primary federal regulator of "notification incidents" within thirty-six (36) hours as required under the FDIC/OCC Computer-Security Incident Notification Rule (12 CFR Part 53), and that Processor's obligations under Article 6 of this DPA are intended to support, but do not substitute for, Controller's own regulatory notification obligations.
ARTICLE 4 — PROCESSOR OBLIGATIONS
4.1 Processing on Instructions. Processor shall process Personal Data only on the basis of documented instructions from Controller, including with respect to transfers of Personal Data to a third country or an international organization, unless Processor is required to do so by applicable law to which Processor is subject. In such case, Processor shall inform Controller of that legal requirement before processing, unless the applicable law prohibits such notification on important grounds of public interest. Processor shall immediately inform Controller if, in Processor's opinion, an instruction from Controller infringes Applicable Data Protection Laws.
4.2 Confidentiality. Processor shall ensure that all natural persons authorized to process Personal Data on Processor's behalf, including employees, contractors, and agents, have committed themselves to enforceable obligations of confidentiality or are under an appropriate statutory obligation of confidentiality. Processor shall ensure that access to Personal Data is limited to those individuals who need access to fulfill Processor's obligations under the Principal Agreement and this DPA. The obligations of confidentiality set forth in this Section 4.2 shall survive the termination or expiration of this DPA.
4.3 Security Measures. Processor shall implement and maintain, throughout the term of this DPA, the technical and organizational security measures described in Schedule B, which the parties have assessed as appropriate to ensure a level of security commensurate with the risk to the rights and freedoms of Data Subjects, taking into account the state of the art, the costs of implementation, the nature, scope, context, and purposes of processing, and the likelihood and severity of risk. Without limiting the generality of the foregoing, the security measures maintained by Processor shall include, at a minimum:
(a) SOC 2 Type II Certification. Processor shall maintain a current SOC 2 Type II report issued by an independent, nationally recognized audit firm, covering the Trust Services Criteria applicable to the Services;
(b) Encryption at Rest. All Personal Data stored by Processor shall be encrypted at rest using AES-256 encryption or an equivalent or stronger encryption standard;
(c) Encryption in Transit. All Personal Data transmitted by or to Processor shall be encrypted in transit using TLS 1.2 or higher;
(d) Multi-Factor Authentication. Multi-factor authentication ("MFA") shall be required for all administrative and privileged access to SBF Core and its underlying infrastructure;
(e) Annual Penetration Testing. Processor shall engage an independent third-party security firm (currently Ironvault Security Group LLC) to conduct penetration testing of SBF Core and its supporting infrastructure at least annually, and shall make the results and associated remediation plans available to Controller upon request; and
(f) Incident Response Plan. Processor shall maintain a documented incident response plan that is tested at least annually through tabletop exercises or simulated incident scenarios.
Processor shall promptly notify Controller of any material changes to the security measures described in Schedule B. Processor shall not materially reduce the overall level of security provided to Personal Data without the prior written consent of Controller.
4.4 GLBA Service Provider Obligations. Processor acknowledges and agrees that it qualifies as a "service provider" within the meaning of the Gramm-Leach-Bliley Act and Regulation P (12 CFR Part 1016). Processor shall comply with all safeguarding requirements applicable to service providers with respect to the nonpublic personal information of Controller's customers, including without limitation the requirements set forth in the Interagency Guidelines Establishing Information Security Standards and the FTC Safeguards Rule (16 CFR Part 314), to the extent applicable. Processor shall not use or disclose nonpublic personal information received from Controller for any purpose other than performing the Services under the Principal Agreement.
4.5 Assistance with Data Subject Rights. Processor shall, taking into account the nature of the processing, assist Controller by appropriate technical and organizational measures, insofar as this is possible, in fulfilling Controller's obligation to respond to requests from Data Subjects exercising their rights under Applicable Data Protection Laws. Such rights include, without limitation:
(a) The right of access (including under Article 15 of the GDPR and CCPA/CPRA);
(b) The right to rectification (including under Article 16 of the GDPR);
(c) The right to erasure or deletion (including under Article 17 of the GDPR and CCPA/CPRA);
(d) The right to data portability (including under Article 20 of the GDPR);
(e) The right to restriction of processing (including under Article 18 of the GDPR);
(f) The right to object to processing (including under Article 21 of the GDPR); and
(g) The right to opt out of the sale or sharing of personal information and the right to limit the use and disclosure of sensitive personal information under CCPA/CPRA and the New Jersey Data Privacy Act (NJ S3377).
Processor shall promptly notify Controller if Processor receives a request directly from a Data Subject and shall not respond to such request directly unless authorized by Controller in writing or required to do so by applicable law.
4.6 DPIA Cooperation. Processor shall provide reasonable assistance to Controller in conducting Data Protection Impact Assessments and in carrying out prior consultations with Regulatory Authorities, as required under Articles 35 and 36 of the GDPR or equivalent requirements under the New Jersey Data Privacy Act (NJ S3377) or other Applicable Data Protection Laws, at Controller's reasonable request and taking into account the nature of processing and the information available to Processor. Controller shall reimburse Processor for reasonable costs incurred by Processor in providing such assistance, to the extent such assistance exceeds Processor's standard obligations under this DPA.
4.7 Records of Processing Activities. Processor shall maintain records of all categories of processing activities carried out on behalf of Controller, as required under Article 30(2) of the GDPR. Such records shall include: (a) the name and contact details of Processor and of Controller; (b) the categories of processing carried out on behalf of Controller; (c) where applicable, transfers of Personal Data to a third country or international organization, including identification of the third country or international organization and the transfer mechanism relied upon; and (d) where possible, a general description of the technical and organizational security measures referred to in Article 32(1) of the GDPR. Processor shall make such records available to Controller and to any Regulatory Authority upon request.
4.8 Compliance Cooperation. Processor shall cooperate with Controller's Third-Party Risk Management ("TPRM") program in accordance with the requirements of OCC Bulletin 2023-17 (Third-Party Relationships: Risk Management Guidance) and related FFIEC guidance. Without limiting the generality of the foregoing, Processor shall provide Controller with such information, documentation, certifications, and responses to due-diligence questionnaires as Controller may reasonably request in connection with Controller's ongoing monitoring and oversight of Processor as a critical third-party service provider, including information relating to Processor's financial condition, operational resilience, business continuity planning, and compliance with Applicable Data Protection Laws. Processor acknowledges that Controller's regulators may require Controller to perform enhanced due diligence and ongoing monitoring of Processor, and Processor agrees to support such activities in a timely and cooperative manner.
ARTICLE 5 — SUB-PROCESSORS
5.1 General Written Authorization. Controller hereby grants Processor a general written authorization, in accordance with Article 28(2) of the GDPR, to engage Sub-processors to process Personal Data on behalf of Controller in connection with the Services, subject to and in accordance with the requirements set forth in this Article 5. Processor shall not engage any Sub-processor other than as permitted by this Article 5.
5.2 Approved Sub-processors. The following Sub-processors are approved by Controller as of the effective date of this DPA and are listed in Schedule C:
(a) Osprey Cloud Infrastructure, Inc., 2200 Campus Drive, San Jose, California 95131, providing infrastructure-as-a-service ("IaaS") and platform-as-a-service ("PaaS") hosting services. Osprey Cloud operates the US-East data center region located in Ashburn, Virginia, and the EU data center region located in Frankfurt, Germany. Processor and Osprey Cloud have entered into a Data Processing Agreement dated March 1, 2024, which includes Module 3 Standard Contractual Clauses for the transfer of EU Data.
(b) Skybridge Fintech Europe B.V., Keizersgracht 482, 1017 EG Amsterdam, Netherlands, Kamer van Koophandel (KvK) registration number 82104593, providing EU personal data processing services. Skybridge Fintech Europe B.V. employs fourteen (14) individuals (eight (8) engineers, four (4) support personnel, and two (2) compliance personnel), under the direction of Managing Director Lena Vogt, and is registered with the Autoriteit Persoonsgegevens as a data processor.
5.3 Prior Notice of New Sub-processors. Processor shall provide Controller with at least thirty (30) days' prior written notice before engaging any new Sub-processor or replacing any existing Sub-processor listed in Schedule C. Such notice shall include the name, registered address, and principal place of business of the proposed Sub-processor, the country or countries in which the proposed Sub-processor will process Personal Data, a description of the processing activities to be performed by the proposed Sub-processor, and the data protection safeguards the proposed Sub-processor will implement. Processor shall update Schedule C to reflect any approved additions or replacements.
5.4 Controller's Right to Object. Controller may object in writing to the appointment of a new or replacement Sub-processor within the thirty (30)-day notice period described in Section 5.3, provided that such objection is based on reasonable grounds related to data protection or the security of Personal Data. If Controller delivers a timely written objection, the parties shall discuss the objection in good faith and Processor shall use commercially reasonable efforts to address Controller's concerns, which may include proposing an alternative Sub-processor or implementing additional safeguards. If the parties are unable to resolve the objection within fifteen (15) business days following Controller's delivery of the objection notice, Controller may, at its sole discretion, terminate the processing activities affected by the proposed Sub-processor appointment, or terminate the Principal Agreement in its entirety, in either case without penalty, early termination fee, or other charge.
5.5 Flow-Down Obligations. Processor shall impose on each Sub-processor, by way of a written contract or other legally binding instrument, data protection obligations that are no less protective of Personal Data than the obligations imposed on Processor under this DPA, including without limitation obligations relating to confidentiality, security measures (consistent with Schedule B), Personal Data Breach notification, audit rights, and data return and deletion. Processor shall ensure that each sub-processing agreement provides Controller with the right (directly or through Processor) to audit the Sub-processor's compliance with its data protection obligations.
5.6 Liability for Sub-processors. Processor shall remain fully liable to Controller for the performance of each Sub-processor's obligations under the applicable sub-processing agreement. Where a Sub-processor fails to fulfill its data protection obligations, Processor shall be liable to Controller for the acts and omissions of such Sub-processor as if they were the acts and omissions of Processor itself. For the avoidance of doubt, the existing Skybridge–Osprey Cloud Data Processing Agreement dated March 1, 2024 (which includes Module 3 Standard Contractual Clauses for the transfer of EU Data from Processor to Osprey Cloud) meets the requirements of this Section 5.5 and Section 5.6 as of the effective date.
5.7 OCC Oversight. Processor acknowledges that OCC Bulletin 2023-17 requires Controller to maintain oversight of critical sub-contractors and fourth parties that have access to or process Controller's data. Processor shall reasonably cooperate with Controller in facilitating such oversight, including by providing Controller with reasonable access to information regarding Processor's Sub-processors and by assisting Controller in conducting due diligence on Sub-processors as part of Controller's TPRM program. Processor shall include in its sub-processing agreements provisions that require Sub-processors to cooperate with reasonable due-diligence and oversight requests from Controller or Controller's regulators.
ARTICLE 6 — PERSONAL DATA BREACH NOTIFICATION
6.1 Notification Timeline. Processor shall notify Controller of any Personal Data Breach without undue delay and in no event later than forty-eight (48) hours after Processor becomes aware of such Personal Data Breach. For purposes of this Section 6.1, Processor shall be deemed to have become "aware" of a Personal Data Breach at the point at which Processor has a reasonable degree of certainty that a security incident has occurred that has resulted in the compromise of Personal Data. Processor shall use all reasonable efforts to identify and investigate potential Personal Data Breaches promptly upon becoming aware of any circumstances that may give rise to a Personal Data Breach.
6.2 Content of Notification. The notification provided by Processor to Controller under Section 6.1 shall include, to the extent reasonably available at the time of notification:
(a) A description of the nature of the Personal Data Breach, including, where possible, the categories and approximate number of Data Subjects affected and the categories and approximate volume of Personal Data records affected;
(b) The name and contact details of Processor's designated point of contact for purposes of the Personal Data Breach, which as of the effective date shall be Rebecca Muñoz, Chief Information Security Officer (CISO), or Thomas Elridge, General Counsel and Chief Privacy Officer (CPO);
(c) A description of the likely consequences of the Personal Data Breach, including an assessment of the risk to the rights and freedoms of affected Data Subjects;
(d) A description of the measures taken or proposed to be taken by Processor to address the Personal Data Breach, including, where appropriate, measures to mitigate its possible adverse effects; and
(e) Any other information reasonably necessary to enable Controller to assess the scope and severity of the Personal Data Breach and to fulfill its own notification obligations under Applicable Data Protection Laws.
6.3 Escalation Matrix. The escalation matrix for Personal Data Breach notification shall be as further described in Schedule D. Notification shall be escalated as follows:
Internal Escalation (within Processor):
(i) Initial detection and triage: CISO Rebecca Muñoz;
(ii) Escalation to legal and privacy: General Counsel / Chief Privacy Officer Thomas Elridge;
(iii) Executive escalation (as warranted by severity): CEO Nadia Karimova.
External Notification (from Processor to Controller):
(iv) Processor shall deliver breach notification to Controller's Chief Compliance Officer, Andrea Sokolov, at Meridian Federal Savings Bank, 900 Broad Street, Suite 1200, Newark, NJ 07102; and
(v) Processor shall simultaneously deliver a copy of such notification to Controller's Vice President, Third-Party Risk Management, Marcus Tibaldi, at the same address.
6.4 Cooperation. Processor shall cooperate fully with Controller in investigating and remediating any Personal Data Breach, including by providing supplemental information as it becomes available, preserving and making available forensic evidence, and assisting Controller in meeting Controller's own notification obligations under Applicable Data Protection Laws. The parties specifically acknowledge that Controller is subject to a thirty-six (36)-hour notification obligation to its primary federal regulator under the FDIC/OCC Computer-Security Incident Notification Rule (12 CFR Part 53), and Processor shall provide all reasonable assistance to enable Controller to comply with such obligation, including by expediting the provision of information necessary for Controller to assess whether a "notification incident" has occurred.
6.5 No Self-Disclosure. Processor shall not notify any third party — including Data Subjects, Regulatory Authorities, law enforcement agencies, credit bureaus, or media outlets — of a Personal Data Breach affecting Controller's Personal Data without Controller's prior written consent, except to the extent that such notification is required by applicable law. In the event that Processor is required by applicable law to make such a notification, Processor shall, to the extent legally permitted, provide Controller with advance notice and an opportunity to review and comment on the proposed notification before it is issued.
6.6 Detailed Procedures. Detailed breach notification procedures, including contact information, notification templates, and response protocols, are set forth in Schedule D attached hereto.
ARTICLE 7 — AUDIT RIGHTS
7.1 Right to Audit. Controller, or a qualified independent third-party auditor designated by Controller and reasonably acceptable to Processor, shall have the right to audit Processor's compliance with this DPA and the security measures described in Schedule B. The exercise of audit rights under this Section 7.1 shall be subject to the following conditions:
(a) Controller shall provide Processor with at least thirty (30) days' advance written notice of an intended audit, which notice shall describe the scope and objectives of the proposed audit;
(b) Audits shall occur no more than once in any twelve (12)-month period; provided, however, that this limitation shall not apply to audits triggered by a confirmed Personal Data Breach, a reasonably suspected Personal Data Breach, or a Regulatory Authority inquiry, investigation, or examination relating to Processor's processing of Controller's Personal Data;
(c) Audits shall be conducted at Controller's sole expense, including the fees of any third-party auditor engaged by Controller; and
(d) Audits shall be conducted during Processor's normal business hours (Monday through Friday, 9:00 AM to 5:00 PM Eastern Time, excluding federal holidays) and shall be conducted in a manner that does not unreasonably interfere with Processor's business operations or the delivery of Services to Controller or other customers.
Controller's third-party auditor shall be required to execute a non-disclosure agreement with Processor, in a form reasonably satisfactory to Processor, prior to commencing any audit.
7.2 SOC 2 Type II as Primary Mechanism. Processor may satisfy Controller's audit requests in the first instance by making available its most recent SOC 2 Type II report and by providing written responses to Controller's supplemental due-diligence questionnaires. As of the effective date, Processor's SOC 2 Type II report is issued by Graystone & Ketchum LLP, an independent audit firm located at 300 Delaware Avenue, Suite 700, Wilmington, Delaware 19801 (lead engagement partner: Sandra Clearfield). The current SOC 2 Type II report covers the audit period from October 1, 2024 through September 15, 2025. If the SOC 2 Type II report and Processor's supplemental questionnaire responses do not reasonably address Controller's specific audit objectives or concerns, Controller may proceed to conduct an on-site audit in accordance with and subject to the conditions set forth in Section 7.1.
7.3 Regulatory Access. Nothing in this Article 7 shall limit, restrict, or otherwise impair the right of any Regulatory Authority — including the OCC, FDIC, CFPB, and EU data protection supervisory authorities — to examine, audit, inspect, or obtain information from Processor regarding the Services, Processor's operations, or Processor's compliance with Applicable Data Protection Laws, as required or authorized by applicable law, regulation, or supervisory guidance, including without limitation OCC Bulletin 2023-17 and FFIEC guidance on technology service providers. Processor shall cooperate fully and in a timely manner with any such regulatory examination, audit, inspection, or information request, at no additional cost or charge to Controller. Processor shall promptly notify Controller of any regulatory examination or inquiry that relates to or may affect the processing of Controller's Personal Data, to the extent that such notification is permitted by law.
7.4 Confidentiality of Audit Findings. Any audit findings, reports, work papers, and information obtained by Controller or its designated auditor in the course of an audit conducted under this Article 7 shall be treated as Processor's confidential information and shall be subject to the confidentiality obligations set forth in Article 13 of this DPA, except to the extent that disclosure is required by Applicable Data Protection Laws, regulatory requirements, or valid legal process.
ARTICLE 8 — CROSS-BORDER DATA TRANSFERS AND STANDARD CONTRACTUAL CLAUSES
8.1 EU Data Transfers. To the extent that Processor, or any Sub-processor engaged by Processor, processes EU Data outside the territory of the European Economic Area ("EEA"), such transfer shall be effected in compliance with Chapter V of the GDPR and shall be subject to the Standard Contractual Clauses appended to this DPA as Appendix 1. No transfer of EU Data to a country outside the EEA that has not received an adequacy decision from the European Commission shall take place except pursuant to the SCCs or another legally recognized transfer mechanism under the GDPR.
8.2 SCC Modules. The following Modules of the Standard Contractual Clauses, adopted pursuant to European Commission Implementing Decision (EU) 2021/914 of 4 June 2021, are incorporated into and form an integral part of this DPA:
(a) Module 2 (Controller-to-Processor): Applicable to the transfer of EU Data from Meridian Federal Savings Bank (as data exporter and Controller) to Skybridge Fintech Ltd. (as data importer and Processor), where Processor processes EU Data at its facilities and through its systems located in the United States;
(b) Module 3 (Processor-to-Sub-processor): Applicable to the onward transfer of EU Data from Skybridge Fintech Ltd. (as data exporter and Processor) to Osprey Cloud Infrastructure, Inc. (as data importer and Sub-processor), where Osprey Cloud processes EU Data at its US-East data center located in Ashburn, Virginia; and
(c) Module 3 (Processor-to-Sub-processor): Applicable to the transfer of EU Data from Skybridge Fintech Ltd. (as data exporter and Processor) to Skybridge Fintech Europe B.V. (as data importer and Sub-processor), where Skybridge Fintech Europe B.V. processes EU Data at its premises in Amsterdam, Netherlands.
8.3 SCC Governing Law. The Standard Contractual Clauses appended to this DPA shall be governed by the law of the Netherlands (the Member State in which Skybridge Fintech Europe B.V., Processor's EU establishment, is located), in accordance with Clause 17 of the SCCs (Option 1). The courts of the Netherlands shall have jurisdiction over disputes arising under the SCCs, in accordance with Clause 18 of the SCCs.
8.4 Annexes. The following Annexes to the Standard Contractual Clauses are attached hereto as part of Appendix 1 and are incorporated by reference into this DPA:
(a) Annex I — Description of Transfer (including identification of the parties, description of the transfer, competent supervisory authority);
(b) Annex II — Technical and Organizational Measures (including measures designed to ensure the security of EU Data during and after transfer); and
(c) Annex III — List of Sub-processors (including the Sub-processors authorized to process EU Data and the nature of their processing activities).
8.5 EU-US Data Privacy Framework. Processor represents that it has self-certified under the EU-US Data Privacy Framework ("DPF") administered by the International Trade Administration of the U.S. Department of Commerce, Certification ID: DPF-2025-03912, effective as of July 1, 2025. Such self-certification supplements, but does not replace, the Standard Contractual Clauses as the transfer mechanism for EU Data under this DPA. Processor shall maintain its DPF self-certification throughout the term of this DPA. In the event that Processor's DPF self-certification lapses, is withdrawn, or is invalidated by a court of competent jurisdiction, the SCCs shall remain the primary transfer mechanism for EU Data.
8.6 Transfer Impact Assessment. Processor has conducted a Transfer Impact Assessment ("TIA") in connection with the Standard Contractual Clauses, evaluating the laws and practices of the United States as they relate to the processing of EU Data by Processor and its US-based Sub-processors, and assessing the effectiveness of the supplementary measures implemented by Processor. Processor shall update the TIA as necessary to reflect material changes in US surveillance laws, guidance from European data protection supervisory authorities (including the European Data Protection Board), or other material developments affecting the level of protection afforded to EU Data. Processor shall make the current TIA available to Controller upon written request within ten (10) business days of such request.
8.7 Conflict. In the event of any conflict or inconsistency between the provisions of this DPA and the provisions of the Standard Contractual Clauses appended hereto, the Standard Contractual Clauses shall prevail with respect to the processing and transfer of EU Data. The parties acknowledge that the SCCs are intended to provide a minimum level of data protection that cannot be diminished by the other provisions of this DPA or the Principal Agreement.
ARTICLE 9 — INDEMNIFICATION
9.1 Processor Indemnification Obligation. Processor shall defend, indemnify, and hold harmless Controller and its affiliates, and their respective officers, directors, employees, agents, successors, and assigns (collectively, the "Controller Indemnified Parties") from and against any and all third-party claims, demands, suits, actions, proceedings, investigations, fines, penalties, damages, losses, costs, liabilities, and expenses (including reasonable attorneys' fees and costs of litigation or regulatory proceedings) arising out of or relating to Processor's breach of this DPA, including without limitation:
(a) Any unauthorized processing, accidental or unlawful loss, destruction, alteration, or disclosure of Personal Data caused by or attributable to Processor, its employees, contractors, agents, or its Sub-processors;
(b) Processor's failure to implement or maintain the security measures described in Schedule B, or Processor's failure to comply with the security-related obligations set forth in Article 4 of this DPA;
(c) Regulatory fines and penalties imposed on Controller or any Controller Indemnified Party by a Regulatory Authority, to the extent that such fines or penalties arise from or are attributable to Processor's breach of its obligations under this DPA, and to the extent that indemnification for such fines or penalties is permissible under applicable law; and
(d) Claims brought by Data Subjects or other third parties arising from Processor's breach of Applicable Data Protection Laws in connection with Processor's processing of Personal Data under this DPA, including claims for damages under Article 82 of the GDPR, claims under CCPA/CPRA, and claims under the New Jersey Data Privacy Act (NJ S3377).
9.2 Indemnification Procedures. The indemnification obligations set forth in this Article 9 are subject to the following procedural requirements:
(a) Prompt Notice. The indemnified party shall promptly notify the indemnifying party in writing of any claim, demand, suit, or proceeding for which indemnification is sought; provided, however, that a failure to provide prompt notice shall not relieve the indemnifying party of its indemnification obligations except to the extent that the indemnifying party is materially prejudiced by such failure;
(b) Cooperation. The indemnified party shall provide reasonable cooperation to the indemnifying party in the defense and resolution of any such claim, at the indemnifying party's expense; and
(c) Control of Defense. The indemnified party shall grant the indemnifying party sole control of the defense and settlement of any such claim; provided, however, that any settlement or resolution that (i) imposes obligations on the indemnified party (other than obligations that are fully indemnified by the indemnifying party), (ii) admits liability or fault on behalf of the indemnified party, or (iii) does not include an unconditional release of all claims against the indemnified party, shall require the prior written consent of the indemnified party, which consent shall not be unreasonably withheld, conditioned, or delayed.
9.3 Liability Cap. The indemnification obligations of Processor under this Article 9 shall be subject to the limitation of liability set forth in Article 11, except as otherwise provided in Section 11.2 (Exclusions from Cap).
ARTICLE 10 — DATA RETENTION, RETURN, AND DELETION
10.1 During Term. During the term of the Principal Agreement, Processor shall retain Personal Data only to the extent necessary to perform the Services and shall not retain Personal Data for longer than is reasonably necessary for such purpose. Processor shall implement data minimization practices consistent with Applicable Data Protection Laws and shall periodically review the Personal Data it holds to ensure that retention remains necessary and proportionate.
10.2 Post-Termination. Upon the expiration or termination of the Principal Agreement (for any reason), Processor shall, at Controller's election and in accordance with Controller's written instructions:
(a) Return. Return all Personal Data in Processor's possession (and in the possession of its Sub-processors) to Controller in a commercially reasonable, machine-readable format, together with all copies thereof; or
(b) Deletion. Securely delete all Personal Data in Processor's possession (and in the possession of its Sub-processors), including all copies, backups, and archival copies, using methods consistent with industry best practices and NIST SP 800-88 (Guidelines for Media Sanitization) or equivalent standards.
Controller shall provide its election and written instructions to Processor within thirty (30) days following the effective date of termination or expiration. If Controller fails to provide instructions within such thirty (30)-day period, Processor shall securely delete all Personal Data in accordance with Section 10.2(b).
10.3 Retention Period. Processor shall complete the return or deletion of all Personal Data (as elected by Controller) within ninety (90) days following the effective date of termination or expiration of the Principal Agreement. During such ninety (90)-day period, the terms of this DPA shall continue to apply to any Personal Data retained by Processor.
10.4 Certification of Deletion. Upon completion of the deletion of Personal Data in accordance with Section 10.2(b), Processor shall provide Controller with a written certification, signed by an authorized officer of Processor (at the level of Vice President or above), confirming that all Personal Data has been securely deleted from Processor's systems and the systems of its Sub-processors, including all backups and archival copies, in accordance with this Article 10.
10.5 Legal Hold Exception. Notwithstanding the foregoing provisions of this Article 10, Processor may retain Personal Data to the extent and for the period required by applicable law, regulation, regulatory order, or legal hold obligation, provided that:
(a) Processor promptly notifies Controller in writing of such requirement, identifying the specific legal or regulatory basis for retention and the categories and approximate volume of Personal Data affected;
(b) Processor limits the processing of retained Personal Data solely to the purpose mandated by the applicable legal or regulatory requirement;
(c) Processor continues to apply appropriate technical and organizational security measures to the retained Personal Data; and
(d) Processor securely deletes the retained Personal Data promptly upon the expiration of the applicable legal or regulatory retention period.
ARTICLE 11 — LIMITATION OF LIABILITY
11.1 Liability Cap. Subject to Section 11.2, the aggregate liability of Processor to Controller under this DPA (including under Article 9 — Indemnification) for all claims arising out of or relating to this DPA shall not exceed the greater of:
(a) Five Million United States Dollars ($5,000,000); or
(b) Two (2) times the fees actually paid by Controller to Processor under the Principal Agreement in the twelve (12)-month period immediately preceding the first event giving rise to the applicable claim.
As of the effective date and based on Controller's annual contract value of $2,740,000, the liability cap calculated under clause (b) above equals $5,480,000 (2 × $2,740,000), which exceeds the $5,000,000 floor set forth in clause (a). Accordingly, the initial liability cap applicable to Processor under this Section 11.1 is $5,480,000. The liability cap shall be recalculated on each anniversary of the effective date based on the fees actually paid by Controller to Processor during the preceding twelve (12)-month period.
11.2 Exclusions from Cap. The liability cap set forth in Section 11.1 shall not apply to:
(a) Liability that cannot be limited or excluded under applicable law, including mandatory liability provisions under the GDPR;
(b) Processor's obligations under the Standard Contractual Clauses appended to this DPA, including liability to Data Subjects under Clause 12 of the SCCs;
(c) Claims arising from Processor's willful misconduct or gross negligence in the processing of Personal Data; and
(d) Claims arising from Processor's breach of its obligations under Article 6 (Personal Data Breach Notification) to the extent such breach results from Processor's willful failure to notify Controller within the timeframe specified therein.
11.3 Exclusion of Consequential Damages. Except with respect to (a) Processor's indemnification obligations under Article 9, (b) Processor's breach of its confidentiality obligations under Article 13, and (c) claims arising from Processor's willful misconduct or gross negligence, neither party shall be liable to the other party for any indirect, incidental, special, consequential, or punitive damages, or for any loss of profits, revenue, business opportunities, goodwill, or data, however caused and regardless of the theory of liability (whether in contract, tort, strict liability, or otherwise), even if such party has been advised of the possibility of such damages.
11.4 Relationship to Principal Agreement. The limitation of liability set forth in this Article 11 is separate from, and in addition to, any limitation of liability set forth in the Principal Agreement. The aggregate liability of Processor under this DPA shall not reduce, and shall not be reduced by, any liability of Processor under the Principal Agreement, and vice versa, unless the Principal Agreement expressly provides otherwise.
ARTICLE 12 — INSURANCE
12.1 Coverage Requirement. Processor shall maintain, at its own expense, throughout the term of this DPA and for a period of two (2) years following the expiration or termination of this DPA, technology errors and omissions and cyber-liability insurance coverage with the following minimum limits:
(a) Per-Occurrence Limit: Not less than Ten Million United States Dollars ($10,000,000) per occurrence; and
(b) Aggregate Limit: Not less than Twenty Million United States Dollars ($20,000,000) in the aggregate.
Such insurance shall cover, at a minimum, claims arising from: (i) errors, omissions, and negligent acts in the provision of the Services; (ii) security breaches and unauthorized access to or disclosure of Personal Data; (iii) notification costs, credit monitoring, and identity theft remediation services; (iv) regulatory defense costs, fines, and penalties (to the extent insurable); and (v) business interruption losses resulting from a covered security event.
12.2 Current Coverage. As of the effective date, Processor maintains a Technology Errors & Omissions and Cyber Liability insurance policy issued by Bastion Mutual Insurance Company, policy number CYB-2025-04821, brokered by Kestrel Risk Advisors LLC, with a per-occurrence limit of $10,000,000 and an aggregate limit of $20,000,000. The current policy period is January 1, 2025 through December 31, 2025. Processor represents that the renewal process for the 2026 policy period is in progress and that Processor expects to maintain coverage at or above the minimum limits specified in Section 12.1 upon renewal.
12.3 Evidence of Insurance. Processor shall provide Controller with a certificate of insurance evidencing the required coverage promptly upon Controller's request, upon each policy renewal, and upon any material change to coverage. Such certificate shall name Controller as an additional insured and shall include a provision requiring the insurer to provide Controller with at least thirty (30) days' advance written notice of any cancellation, non-renewal, or material reduction in coverage.
12.4 No Limitation on Obligations. The maintenance of insurance coverage as required by this Article 12 shall not relieve Processor of any of its obligations under this DPA and shall not limit Processor's liability under this DPA or the Principal Agreement. In the event that Processor's insurance coverage is insufficient to cover a claim, Processor shall remain fully liable for the difference.
ARTICLE 13 — CONFIDENTIALITY