ANNEX I TO THE STANDARD CONTRACTUAL CLAUSES
Description of Transfer
(All Modules).
EXECUTION VERSION
This Annex I is appended to and forms an integral part of the Data Processing Agreement dated February 5, 2026 (the "DPA"), entered into between Meridian Federal Savings Bank ("Controller" or "Meridian") and Skybridge Fintech Ltd. ("Processor" or "Skybridge"), and the Standard Contractual Clauses incorporated therein pursuant to the European Commission Implementing Decision (EU) 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council (the "SCCs"). This Execution Version was finalized on January 15, 2026. The governing law of the SCCs is the law of the Netherlands, as designated pursuant to Clause 17 of the SCCs.
INTRODUCTORY NOTE
This Annex I applies to all SCC Modules incorporated into the DPA as follows:
1. Module 2 (Controller-to-Processor): Meridian Federal Savings Bank (Controller / Data Exporter) → Skybridge Fintech Ltd. (Processor / Data Importer). This module governs the transfer of personal data from Meridian, acting as Controller within the meaning of Regulation (EU) 2016/679, to Skybridge, acting as Processor on behalf of Meridian, in connection with Skybridge's provision of the SBF Core SaaS platform.
2. Module 3 (Processor-to-Sub-processor): Skybridge Fintech Ltd. (Processor / Data Exporter) → Osprey Cloud Infrastructure, Inc. (Sub-processor / Data Importer). This module governs the onward transfer of personal data from Skybridge, acting as Processor, to Osprey Cloud Infrastructure, Inc., acting as Sub-processor, in connection with the provision of infrastructure-as-a-service and platform-as-a-service hosting for the SBF Core platform.
3. Module 3 (Processor-to-Sub-processor): Skybridge Fintech Ltd. (Processor / Data Exporter) → Skybridge Fintech Europe B.V. (Sub-processor / Data Importer). This module governs the onward transfer of personal data from Skybridge, acting as Processor, to its wholly owned EU subsidiary, Skybridge Fintech Europe B.V., acting as Sub-processor, in connection with the localized processing of EU personal data for Meridian's EU-resident accountholders.
Where details differ by module, module-specific descriptions are provided in the separate sub-sections below. Unless otherwise indicated, defined terms used in this Annex I shall have the meanings ascribed to them in the DPA or the SCCs, as applicable.
A. LIST OF PARTIES
The parties to the SCCs are identified below for each applicable Module.
A.1 — Module 2 (Controller-to-Processor): Meridian → Skybridge
Data Exporter. Name: Meridian Federal Savings Bank
Address: 900 Broad Street, Suite 1200, Newark, New Jersey 07102, United States of America
Contact person's name, position, and contact details:
Marcus Tibaldi, Vice President, Third-Party Risk Management
Email: m.tibaldi@meridianfsb.com
Andrea Sokolov, Chief Compliance Officer
Email: a.sokolov@meridianfsb.com
Activities relevant to the data transferred under these Clauses: Meridian Federal Savings Bank is a federally chartered savings bank, insured by the Federal Deposit Insurance Corporation (FDIC) and operating under Office of the Comptroller of the Currency (OCC) Charter No. 14-2238. Meridian provides retail and small-business banking services, including deposit accounts, consumer and small-business lending, and electronic payment services, to approximately 412,000 accountholders across the states of New Jersey, New York, Pennsylvania, and Connecticut. Approximately 3,200 of Meridian's accountholders are EU-resident, expatriate, or dual-resident individuals. In connection with its digital transformation initiative, Meridian is migrating its payment processing, fraud detection, and regulatory reporting functions to the SBF Core SaaS platform operated by Skybridge Fintech Ltd., necessitating the transfer of personal data of its accountholders to Skybridge for processing in accordance with Meridian's documented instructions.
Role (controller/processor): Controller (within the meaning of Regulation (EU) 2016/679)
Signature and date:
MERIDIAN FEDERAL SAVINGS BANK
By: ________
Name: Marcus Tibaldi
Title: Vice President, Third-Party Risk Management
Date: ________
By: ________
Name: Andrea Sokolov
Title: Chief Compliance Officer
Date: ________
Data Importer. Name: Skybridge Fintech Ltd.
Address: 4100 Silverside Road, Suite 310, Wilmington, Delaware 19810, United States of America
Contact person's name, position, and contact details:
Thomas Elridge, General Counsel / Chief Privacy Officer
Email: t.elridge@skybridgefintech.com
Rebecca Muñoz, Chief Information Security Officer (CISO)
Email: r.munoz@skybridgefintech.com
Activities relevant to the data transferred under these Clauses: Skybridge Fintech Ltd. is a Delaware-incorporated financial technology software-as-a-service company that develops and operates the SBF Core platform, a cloud-based solution for real-time payment processing, anti-fraud analytics, and regulatory reporting designed for FDIC-insured banks and credit unions. Skybridge processes personal data of its bank clients' end customers (i.e., accountholders) as a Processor on behalf of Controller in connection with the provision of the SBF Core platform services pursuant to the SaaS subscription agreement between Meridian and Skybridge. Skybridge does not determine the purposes or means of processing; rather, it processes personal data solely in accordance with the documented instructions of the Controller.
Role (controller/processor): Processor (within the meaning of Regulation (EU) 2016/679)
EU-US Data Privacy Framework self-certification: Skybridge Fintech Ltd. maintains an active self-certification under the EU-US Data Privacy Framework (Certification ID: DPF-2025-03912), self-certified as of July 1, 2025. The SCCs serve as the primary transfer mechanism for the international transfers of personal data described herein; the Data Privacy Framework certification is maintained as a supplementary safeguard and does not supersede or replace the obligations set forth in the SCCs.
Signature and date:
SKYBRIDGE FINTECH LTD.
By: ________
Name: Thomas Elridge
Title: General Counsel / Chief Privacy Officer
Date: ________
By: ________
Name: Rebecca Muñoz
Title: Chief Information Security Officer
Date: ________
A.2 — Module 3 (Processor-to-Sub-processor): Skybridge → Osprey Cloud
Data Exporter. Name: Skybridge Fintech Ltd.
Address: 4100 Silverside Road, Suite 310, Wilmington, Delaware 19810, United States of America
Contact person's name, position, and contact details:
Thomas Elridge, General Counsel / Chief Privacy Officer
Email: t.elridge@skybridgefintech.com
Rebecca Muñoz, Chief Information Security Officer (CISO)
Email: r.munoz@skybridgefintech.com
Activities relevant to the data transferred under these Clauses: In its capacity as Processor on behalf of Meridian Federal Savings Bank (Controller), Skybridge processes personal data of Controller's accountholders via the SBF Core platform. In order to operate the SBF Core platform, Skybridge engages Osprey Cloud Infrastructure, Inc. as its infrastructure-as-a-service (IaaS) and platform-as-a-service (PaaS) sub-processor for hosting infrastructure, including computational processing, data storage, backup, and disaster recovery services. The engagement of Osprey Cloud as a sub-processor has been authorized by the Controller pursuant to the DPA.
Role (controller/processor): Processor
Signature and date:
SKYBRIDGE FINTECH LTD.
By: ________
Name: Thomas Elridge
Title: General Counsel / Chief Privacy Officer
Date: ________
Data Importer. Name: Osprey Cloud Infrastructure, Inc.
Address: 2200 Campus Drive, San Jose, California 95131, United States of America
Contact person's name, position, and contact details:
Martin Cho, Chief Executive Officer
Email: m.cho@ospreycloud.com
Privacy and data protection inquiries to be directed to the Osprey Cloud Privacy Office pursuant to the terms of the existing Skybridge–Osprey Cloud Data Processing Agreement dated March 1, 2024 (privacy@ospreycloud.com).
Activities relevant to the data transferred under these Clauses: Osprey Cloud Infrastructure, Inc. is the primary IaaS/PaaS provider hosting the SBF Core platform. Osprey Cloud operates multiple data center regions relevant to the processing described herein, including: (i) a US-East data center region located in Ashburn, Virginia; (ii) an EU data center region located in Frankfurt, Germany; and (iii) a disaster recovery facility at a US-East secondary availability zone also located in Ashburn, Virginia. Osprey Cloud provides infrastructure-level services including server hosting, data storage, network management, backup, and disaster recovery, and does not access, modify, or analyze the content of personal data except as strictly necessary to provide such hosting and infrastructure services.
Role (controller/processor): Sub-processor
Signature and date:
OSPREY CLOUD INFRASTRUCTURE, INC.
By: ________
Name: Martin Cho
Title: Chief Executive Officer
Date: ________
A.3 — Module 3 (Processor-to-Sub-processor): Skybridge → SBF Europe
Data Exporter. Name: Skybridge Fintech Ltd.
Address: 4100 Silverside Road, Suite 310, Wilmington, Delaware 19810, United States of America
Contact person's name, position, and contact details:
Thomas Elridge, General Counsel / Chief Privacy Officer
Email: t.elridge@skybridgefintech.com
Rebecca Muñoz, Chief Information Security Officer (CISO)
Email: r.munoz@skybridgefintech.com
Activities relevant to the data transferred under these Clauses: In its capacity as Processor on behalf of Meridian Federal Savings Bank (Controller), Skybridge processes personal data of Controller's accountholders via the SBF Core platform. Skybridge engages its wholly owned EU subsidiary, Skybridge Fintech Europe B.V. ("SBF Europe"), as a sub-processor for the processing of EU personal data pertaining to Meridian accountholders who are EU-resident, expatriate, or dual-resident individuals. The engagement of SBF Europe as a sub-processor has been authorized by the Controller pursuant to the DPA.
Role (controller/processor): Processor
Signature and date:
SKYBRIDGE FINTECH LTD.
By: ________
Name: Thomas Elridge
Title: General Counsel / Chief Privacy Officer
Date: ________
Data Importer. Name: Skybridge Fintech Europe B.V.
Address: Keizersgracht 482, 1017 EG Amsterdam, the Netherlands
KvK (Chamber of Commerce) number: 82104593
Contact person's name, position, and contact details:
Lena Vogt, Managing Director
Email: l.vogt@skybridgefintech.eu
Activities relevant to the data transferred under these Clauses: Skybridge Fintech Europe B.V. is a Dutch private limited liability company (besloten vennootschap met beperkte aansprakelijkheid) and a wholly owned subsidiary of Skybridge Fintech Ltd. SBF Europe processes EU personal data on behalf of Skybridge for Skybridge's banking customers with European accountholders, including Meridian's approximately 3,200 EU-resident accountholders. SBF Europe is registered with the Autoriteit Persoonsgegevens (Netherlands Data Protection Authority). SBF Europe employs fourteen (14) staff members, consisting of eight (8) engineers, four (4) customer support personnel, and two (2) compliance professionals, all based in Amsterdam.
Role (controller/processor): Sub-processor
Signature and date:
SKYBRIDGE FINTECH EUROPE B.V.
By: ________
Name: Lena Vogt
Title: Managing Director
Date: ________
B. DESCRIPTION OF TRANSFER
The following sections describe the subject matter, nature, purpose, categories of data subjects, categories of personal data, any sensitive data, the frequency of transfer, the retention period, and (where applicable) the details of onward transfers to sub-processors for each Module.
B.1 — Module 2 (Controller-to-Processor): Meridian → Skybridge
Categories of Data Subjects Whose Personal Data Is Transferred. The personal data transferred concerns the following categories of data subjects:
• Meridian Federal Savings Bank retail accountholders. This category encompasses approximately 412,000 individual accountholders, of whom approximately 3,200 are EU-resident, expatriate, or dual-resident individuals. Retail accountholders include holders of checking accounts, savings accounts, certificates of deposit, and consumer loan accounts.
• Meridian small-business accountholders. This category includes sole proprietors, partnerships, limited liability companies, and other small-business entities that maintain business deposit accounts, business lines of credit, or commercial loan accounts with Meridian, and the natural persons associated with such accounts.
• Authorized signers on Meridian accounts. This category includes individuals who are not the primary accountholder but who have been designated as authorized signers with authority to transact on one or more Meridian accounts.
• Beneficial owners of Meridian accounts. This category includes natural persons identified as beneficial owners of Meridian accounts pursuant to applicable Customer Due Diligence (CDD) and beneficial ownership regulations, including 31 C.F.R. § 1010.230.
• Meridian employees whose data passes through SBF Core in connection with the services. This category includes Meridian employees whose personal data is incidentally processed through the SBF Core platform in connection with the provision of the services, including, for example, employee identifiers associated with internal transaction approvals, audit trails, or regulatory reporting workflows.
Categories of Personal Data Transferred. The following categories of personal data are transferred from Meridian to Skybridge in connection with the SBF Core platform services:
• Full name (first name, middle name or initial, last name, and any suffixes)
• Date of birth
• Social Security number (SSN)
• Taxpayer identification number (TIN), including individual TINs and employer identification numbers (EINs) for small-business accountholders
• Account numbers (checking, savings, and loan account numbers)
• Routing numbers (ABA routing transit numbers)
• Transaction amounts and transaction metadata (including transaction date, time, type, merchant category code, and settlement status)
• IP addresses (IPv4 and IPv6 addresses associated with online and mobile banking sessions)
• Device identifiers (including mobile device identifiers, browser fingerprints, and hardware tokens)
• Geolocation data (city-level geolocation derived from IP addresses and, where available, GPS coordinates provided by the data subject's device)
• Email addresses
• Phone numbers (including mobile and landline telephone numbers)
• Anti-fraud behavioral biometric data, specifically keystroke dynamics (typing cadence, key press duration, and inter-key timing intervals) and mouse movement patterns (velocity, trajectory, and click behavior), collected in connection with online and mobile banking sessions for fraud detection purposes
Sensitive Data Transferred (if applicable) and Applied Restrictions or Safeguards. The transfers described in this Annex I include the following categories of data that are classified as sensitive under applicable law:
Social Security numbers (SSNs): Social Security numbers are classified as sensitive personal information under applicable United States state privacy laws, including the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA, Cal. Civ. Code §§ 1798.100–1798.199.100) and the New Jersey Data Privacy Act (S3377, effective January 15, 2026). The following restrictions and safeguards are applied to all SSN data transferred to Skybridge:
(a) AES-256 encryption at rest within the SBF Core platform and all associated storage systems;
(b) TLS 1.2 or higher encryption for all data in transit between Meridian and Skybridge systems, and between Skybridge systems and sub-processor systems;
(c) Multi-factor authentication (MFA) required for all administrative access to systems and databases containing SSN data;
(d) Access to SSN data is restricted on a need-to-know basis and is limited to authorized personnel who require such access to perform their assigned duties in connection with the services;
(e) SOC 2 Type II controls, as further described in Annex II (Technical and Organizational Measures), are maintained by Skybridge and independently audited on an annual basis.
Behavioral biometric data (keystroke dynamics, mouse movement patterns): Behavioral biometric data consisting of keystroke dynamics and mouse movement patterns is classified as sensitive biometric information under applicable United States state privacy laws. This data is collected solely for anti-fraud analytics purposes and is not used for the identification of natural persons outside of the anti-fraud context. The following restrictions and safeguards are applied:
(a) The same encryption and access control measures described above for SSN data apply equally to behavioral biometric data;
(b) Behavioral biometric data is processed only for fraud detection purposes, including the generation of anomaly scores and behavioral risk profiles, and is not repurposed for any other use;
(c) Behavioral biometric data is not used for the identification of natural persons outside of the anti-fraud context and is not shared with third parties for marketing, advertising, or profiling purposes unrelated to fraud detection.
Note regarding GDPR Article 9 special categories: The transfers described in this Annex I are not expected to routinely include special categories of data within the meaning of Article 9 of Regulation (EU) 2016/679, including data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, data concerning health, or data concerning a natural person's sex life or sexual orientation. To the extent that any such data is incidentally included in transaction metadata, free-text fields, or other unstructured data elements, the same technical and organizational safeguards described above shall apply. In the event that Controller becomes aware that special categories of data are being systematically transferred, Controller shall promptly notify Processor so that additional safeguards may be implemented as appropriate.
Frequency of the Transfer. Data transfers from Meridian to Skybridge occur on a continuous, real-time basis in connection with the payment processing and fraud detection services provided through the SBF Core platform. Approximately 18.6 million transactions are processed per month through the SBF Core platform, with each transaction generating a corresponding data transfer containing the personal data elements described above.
In addition to real-time transaction processing, batch transfers of personal data are conducted on a periodic basis in connection with regulatory reporting functions. These batch transfers occur on daily, weekly, and monthly cycles as required by applicable regulatory frameworks, including OCC and FDIC examination and reporting requirements, Bank Secrecy Act / Anti-Money Laundering (BSA/AML) reporting obligations, and Consumer Financial Protection Bureau (CFPB) data collection requirements.
Nature of the Processing. The processing of personal data by Skybridge in connection with the SBF Core platform services encompasses the following processing operations: collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, alignment or combination, restriction, erasure, and destruction of personal data.
Specifically, the processing includes:
• Real-time payment transaction processing: Authorization, settlement, and clearing support for payment transactions initiated by or on behalf of Meridian's accountholders, including debit card transactions, ACH transfers, wire transfers, and peer-to-peer payments.
• Anti-fraud analytics and scoring: Real-time analysis of transaction data and behavioral biometric data to detect and prevent fraudulent activity, including behavioral biometric analysis (keystroke dynamics and mouse movement pattern analysis), transaction pattern analysis, velocity checks, and anomaly scoring using machine learning models.
• Regulatory reporting compilation and submission support: Compilation, formatting, and preparation of data for reports required by the OCC, FDIC, CFPB, and other applicable federal and state regulators, including Call Reports, Suspicious Activity Reports (SARs), and Currency Transaction Reports (CTRs).
• Data hosting and storage: Hosting and storage of personal data on cloud infrastructure provided by Osprey Cloud Infrastructure, Inc., as further described in Section B.2 below.
Purpose(s) of the Data Transfer and Further Processing. The personal data is transferred from Meridian to Skybridge, and further processed by Skybridge, solely for the purpose of Skybridge's provision of the SBF Core SaaS platform services to Meridian pursuant to the SaaS subscription agreement entered into between the parties, as supplemented by the DPA. The specific purposes for which personal data is transferred and processed are as follows:
(a) Real-time payment processing: Transaction authorization, settlement, and clearing support for payment transactions initiated by or on behalf of Meridian's accountholders.
(b) Anti-fraud analytics and detection: Behavioral biometric analysis, transaction pattern analysis, anomaly scoring, and related fraud detection and prevention functions designed to protect Meridian and its accountholders from unauthorized or fraudulent transactions.
(c) Regulatory reporting: Compilation, formatting, and preparation of data for reports required by the OCC, FDIC, CFPB, and other applicable federal and state regulatory authorities, in accordance with Controller's documented instructions.
Skybridge does not process personal data for any purpose independent of Controller's documented instructions. Skybridge acts solely as a Processor on behalf of Controller and does not determine the purposes or essential means of processing. Any change in the purposes or scope of processing requires prior written authorization from Controller.
Period for Which the Personal Data Will Be Retained, or, if That Is Not Possible, the Criteria Used to Determine That Period. Personal data transferred to Skybridge shall be retained for the duration of the SaaS subscription agreement between Meridian and Skybridge, which has an initial term of five (5) years commencing on the effective date of the SaaS subscription agreement.
Following the termination or expiration of the SaaS subscription agreement, Skybridge shall retain personal data for a period of up to ninety (90) calendar days (the "Post-Termination Retention Period"), during which period Controller may request the return of all personal data in a structured, commonly used, and machine-readable format, or the secure deletion of all personal data, by providing written instructions to Skybridge.
Following the expiration of the ninety (90)-day Post-Termination Retention Period, Skybridge shall delete all personal data in its possession and in the possession of its sub-processors, and shall certify such deletion in writing to Controller, unless retention of specific personal data is required by applicable law. Specific legal retention obligations under, inter alia, the Gramm-Leach-Bliley Act (GLBA), the Bank Secrecy Act / Anti-Money Laundering (BSA/AML) regulations, or applicable federal or state tax regulations may require the retention of certain personal data beyond the ninety (90)-day Post-Termination Retention Period. To the extent such legal retention obligations apply, Skybridge shall retain only the minimum personal data necessary to satisfy such obligations and shall delete such data promptly upon the expiration of the applicable legal retention period.
For Transfers to Sub-processors, Also Specify Subject Matter, Nature, and Duration of the Processing. Transfer to Osprey Cloud Infrastructure, Inc.:
Subject matter: Hosting and infrastructure services for the SBF Core platform, including server hosting, data storage, network connectivity, computational processing, backup, and disaster recovery.
Nature: Infrastructure-level processing, consisting of the storage, backup, disaster recovery, and computational processing of personal data on Osprey Cloud's IaaS/PaaS infrastructure. Osprey Cloud does not access, modify, or analyze the content of personal data except as strictly necessary to provide hosting and infrastructure services.
Duration: Co-terminus with the SaaS subscription agreement between Meridian and Skybridge, plus the ninety (90)-day Post-Termination Retention Period described above. This onward transfer is governed by the existing Skybridge–Osprey Cloud Data Processing Agreement dated March 1, 2024, as may be amended from time to time.
Transfer to Skybridge Fintech Europe B.V.:
Subject matter: Processing of EU personal data pertaining to Meridian accountholders with EU residency (approximately 3,200 data subjects), including data processing, engineering support, customer support, and compliance functions.
Nature: Application-layer processing of EU personal data, including data processing operations necessary to support the SBF Core platform for EU-resident accountholders, engineering support (bug fixes, feature development, and performance optimization for EU-specific platform functions), customer support for EU-resident accountholders, and compliance functions (GDPR compliance monitoring, data subject rights request processing, and regulatory coordination with the Autoriteit Persoonsgegevens). These functions are performed by SBF Europe's fourteen (14) staff members located in Amsterdam.
Duration: Co-terminus with the SaaS subscription agreement between Meridian and Skybridge, plus the ninety (90)-day Post-Termination Retention Period described above.
B.2 — Module 3 (Processor-to-Sub-processor): Skybridge → Osprey Cloud
Categories of Data Subjects Whose Personal Data Is Transferred. The categories of data subjects whose personal data is transferred from Skybridge to Osprey Cloud are the same as those described in Section B.1 above, namely: Meridian Federal Savings Bank retail accountholders (including EU-resident, expatriate, and dual-resident individuals), Meridian small-business accountholders, authorized signers on Meridian accounts, beneficial owners of Meridian accounts, and Meridian employees whose data passes through the SBF Core platform in connection with the services.
Categories of Personal Data Transferred. The categories of personal data transferred from Skybridge to Osprey Cloud are the same as those described in Section B.1 above, namely: full name, date of birth, Social Security number (SSN), taxpayer identification number (TIN), account numbers (checking, savings, and loan), routing numbers, transaction amounts and transaction metadata, IP addresses, device identifiers, geolocation data (city-level), email addresses, phone numbers, and anti-fraud behavioral biometric data (keystroke dynamics and mouse movement patterns).
Sensitive Data Transferred (if applicable) and Applied Restrictions or Safeguards. The sensitive data categories and associated safeguards are the same as those described in Section B.1 above. In addition to the safeguards maintained by Skybridge, Osprey Cloud implements the following technical and organizational measures with respect to sensitive data:
(a) AES-256 encryption at rest within Osprey Cloud's data storage systems, including primary and disaster recovery environments;
(b) TLS 1.2 or higher encryption for all data in transit within and between Osprey Cloud's data center regions;
(c) Physical security controls at the US-East data center region (Ashburn, Virginia) and the EU data center region (Frankfurt, Germany), including 24/7 on-site security personnel, multi-factor physical access controls (biometric and badge-based), CCTV monitoring, and environmental controls (fire suppression, climate control, and uninterruptible power supply);
(d) Logical access controls consistent with SOC 2 Type II standards, including role-based access controls, mandatory multi-factor authentication for administrative access, and regular access reviews.
Frequency of the Transfer. Data transfers from Skybridge to Osprey Cloud occur on a continuous, real-time basis, mirroring the frequency of data transfers between Meridian and Skybridge described in Section B.1 above. Approximately 18.6 million transactions per month are processed through the SBF Core platform, and the personal data associated with each such transaction is transmitted to and stored on Osprey Cloud's infrastructure in real time.
Nature of the Processing. The processing performed by Osprey Cloud is limited to infrastructure-level processing, consisting of:
• Storage of personal data on Osprey Cloud's IaaS/PaaS infrastructure;
• Hosting of the SBF Core platform application and associated databases;
• Computational processing necessary to support the operation of the SBF Core platform;
• Backup of personal data in accordance with Skybridge's backup and retention policies;
• Disaster recovery services, including replication of data to the US-East secondary availability zone (Ashburn, Virginia) for business continuity purposes.
Osprey Cloud does not access, modify, or analyze the content of personal data except as strictly necessary to provide hosting and infrastructure services. Osprey Cloud personnel do not have routine access to unencrypted personal data, and access to encrypted data stores is limited to authorized infrastructure operations personnel on a need-to-know basis for the purpose of maintaining the availability, integrity, and security of the hosting infrastructure.
Purpose(s) of the Data Transfer and Further Processing. The personal data is transferred from Skybridge to Osprey Cloud solely for the purpose of enabling Osprey Cloud to provide cloud hosting and infrastructure services necessary for Skybridge's operation of the SBF Core platform. The data center locations utilized for the processing are as follows:
(a) Primary data center: US-East region, Ashburn, Virginia, United States of America;
(b) EU data center: Frankfurt, Germany (utilized for processing of EU personal data and for the provision of low-latency services to EU-based data subjects);
(c) Disaster recovery: US-East secondary availability zone, Ashburn, Virginia, United States of America.
Osprey Cloud does not process personal data for any purpose other than the provision of hosting and infrastructure services as described herein and in accordance with the terms of the Skybridge–Osprey Cloud DPA dated March 1, 2024.
Retention Period. Personal data transferred to Osprey Cloud shall be retained for a period that is co-terminus with the Skybridge–Meridian SaaS subscription agreement, plus the ninety (90)-day Post-Termination Retention Period described in Section B.1 above. Following the expiration of the Post-Termination Retention Period, Osprey Cloud shall delete all personal data in its possession in accordance with Skybridge's documented instructions and the terms of the Skybridge–Osprey Cloud Data Processing Agreement dated March 1, 2024. Osprey Cloud shall certify such deletion in writing to Skybridge upon request.
B.3 — Module 3 (Processor-to-Sub-processor): Skybridge → SBF Europe
Categories of Data Subjects Whose Personal Data Is Transferred. The personal data transferred from Skybridge to SBF Europe pertains to a subset of the data subjects described in Section B.1 above. Specifically, the data subjects are:
• Meridian Federal Savings Bank accountholders who are EU-resident, expatriate, or dual-resident individuals (approximately 3,200 data subjects);
• Any authorized signers or beneficial owners associated with the accounts of such EU-resident data subjects.
Categories of Personal Data Transferred. The categories of personal data transferred from Skybridge to SBF Europe are the same categories as those described in Section B.1 above, limited to data pertaining to EU-resident data subjects as identified above. This includes: full name, date of birth, Social Security number (SSN), taxpayer identification number (TIN), account numbers (checking, savings, and loan), routing numbers, transaction amounts and transaction metadata, IP addresses, device identifiers, geolocation data (city-level), email addresses, phone numbers, and anti-fraud behavioral biometric data (keystroke dynamics and mouse movement patterns).
Sensitive Data Transferred (if applicable) and Applied Restrictions or Safeguards. The sensitive data categories and associated safeguards are the same as those described in Section B.1 above. SBF Europe maintains its own technical and organizational security measures, consistent with the measures described in Annex II (Technical and Organizational Measures), including AES-256 encryption at rest, TLS 1.2 or higher encryption in transit, multi-factor authentication for administrative access, role-based access controls, and physical security measures at SBF Europe's Amsterdam office. SBF Europe's security measures are subject to periodic review and audit by Skybridge's information security team.