STANDARD CONTRACTUAL CLAUSES — EXECUTION-READY PACKAGE

STANDARD CONTRACTUAL CLAUSES — EXECUTION-READY PACKAGE
Pursuant to Commission Implementing Decision (EU) 2021/914 of 4 June 2021
Appendix to the Data Processing Agreement between Meridian Federal Savings Bank and Skybridge Fintech Ltd. dated February 5, 2026
Date of Package: February 5, 2026
Target Signing Date: February 15, 2026
This Standard Contractual Clauses execution-ready package, including all modules, annexes, schedules, party descriptions, transfer descriptions, technical and organisational measures, sub-processor lists, and signature pages, forms an integral part of the execution version of the Data Processing Agreement dated February 5, 2026, by and between Meridian Federal Savings Bank, as Controller, and Skybridge Fintech Ltd., as Processor, and is appended thereto.
The parties intend that this package be executed together with, and incorporated into, the Data Processing Agreement. The Standard Contractual Clauses contained herein are intended to provide appropriate safeguards for transfers of personal data subject to Regulation (EU) 2016/679 from the European Union and European Economic Area to third countries, including the United States.
The following modules are included in this package:
1.  Module 2 — Controller-to-Processor: Meridian Federal Savings Bank to Skybridge Fintech Ltd.
2.  Module 3 — Processor-to-Sub-processor: Skybridge Fintech Ltd. to Osprey Cloud Infrastructure, Inc.
3.  Module 3 — Processor-to-Sub-processor: Skybridge Fintech Ltd. to Skybridge Fintech Europe B.V.
For all modules included in this package, the parties select the law of the Netherlands as the governing law of the Standard Contractual Clauses pursuant to Clause 17.
Preamble and Recitals Applicable to All Modules
These Standard Contractual Clauses are adopted pursuant to Commission Implementing Decision (EU) 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council.
The clauses are intended to provide appropriate safeguards within the meaning of Article 46(2)(c) of Regulation (EU) 2016/679, the General Data Protection Regulation, for transfers of personal data from the European Union and the European Economic Area to third countries, including the United States.
These Standard Contractual Clauses supplement and are appended to the Data Processing Agreement dated February 5, 2026, between Meridian Federal Savings Bank, as Controller, and Skybridge Fintech Ltd., as Processor. The parties acknowledge that the Data Processing Agreement governs the processing of personal data by Skybridge Fintech Ltd. on behalf of Meridian Federal Savings Bank in connection with the SBF Core platform and related services, including payment processing, anti-fraud analytics, regulatory reporting, infrastructure hosting, support, engineering, and compliance functions.
Skybridge Fintech Ltd. has self-certified under the EU-U.S. Data Privacy Framework, Certification ID DPF-2025-03912, effective July 1, 2025. The parties acknowledge that such certification supplements, but does not replace, these Standard Contractual Clauses, the Transfer Impact Assessment, or any supplementary measures adopted in connection with transfers of personal data to the United States.
The parties have conducted a Transfer Impact Assessment consistent with the judgment of the Court of Justice of the European Union in Data Protection Commissioner v Kestrel Services Inc. Ireland Ltd and Maximillian Schrems, Case C-311/18, commonly referred to as Schrems II. The Transfer Impact Assessment considered the nature of the personal data, the purposes of processing, the jurisdictions involved, the technical and organisational measures implemented, applicable laws and practices in the United States, and supplementary measures designed to protect personal data from unauthorised access, disclosure, alteration, or loss.
Unless otherwise defined in this package, capitalized terms used herein shall have the meanings ascribed to them in the Data Processing Agreement. Terms defined in Regulation (EU) 2016/679, including “personal data,” “processing,” “controller,” “processor,” “sub-processor,” “data subject,” “personal data breach,” and “supervisory authority,” shall have the meanings given to them in Regulation (EU) 2016/679.
SECTION I — MODULE 2 — CONTROLLER-TO-PROCESSOR
Meridian Federal Savings Bank → Skybridge Fintech Ltd.
Parties to Module 2
Data Exporter — Controller
Full legal name: Meridian Federal Savings Bank
Address: 900 Broad Street, Suite 1200, Newark, New Jersey 07102, United States
Entity type: Federally chartered savings bank, FDIC-insured; OCC Charter number 14-2238
Contact persons: Andrea Sokolov, Chief Compliance Officer Marcus Tibaldi, Vice President, Third-Party Risk Management
Role: Meridian Federal Savings Bank acts as Controller. Meridian determines the purposes and means of processing personal data relating to its accountholders, authorized signers, beneficial owners, and employees. For purposes of this Module 2, Meridian is the data exporter.
Data Importer — Processor
Full legal name: Skybridge Fintech Ltd.
Address: 4100 Silverside Road, Suite 310, Wilmington, Delaware 19810, United States
Entity type: Delaware corporation, C-corporation
Contact persons: Thomas Elridge, General Counsel / Chief Privacy Officer Rebecca Muñoz, Chief Information Security Officer
Role: Skybridge Fintech Ltd. acts as Processor. Skybridge processes personal data on behalf of Meridian through the SBF Core platform, including for payment processing, fraud detection, anti-fraud analytics, and regulatory reporting.
EU-U.S. Data Privacy Framework certification: Skybridge Fintech Ltd. is self-certified under the EU-U.S. Data Privacy Framework, Certification ID DPF-2025-03912.
Clause 1 — Purpose and Scope
The purpose of this Module 2 is to ensure compliance with Article 28(3) and Article 28(4) of Regulation (EU) 2016/679 and to provide appropriate safeguards for transfers of personal data from data subjects located in the European Union or European Economic Area to Skybridge Fintech Ltd., a processor established in a third country, namely the United States.
This Module 2 applies to the transfer of personal data relating to approximately 3,200 EU-resident Meridian accountholders, including expatriate and dual-resident account holders, whose personal data is processed through the SBF Core platform. The scope of processing includes personal data transferred or otherwise made available from the European Union to the United States for the provision of SBF Core services under the Data Processing Agreement and the related SaaS subscription agreement.
The clauses apply to all personal data described in Annex I.B and to all processing operations performed by Skybridge Fintech Ltd. on behalf of Meridian Federal Savings Bank in connection with the relevant services.
Clause 2 — Effect and Invariability of the Clauses
The parties acknowledge and agree that these clauses set out appropriate safeguards, including enforceable data subject rights and effective legal remedies, for the transfer and processing of personal data subject to Regulation (EU) 2016/679.
The clauses shall not be modified except as permitted under Commission Implementing Decision (EU) 2021/914. The parties have selected the appropriate module, completed the annexes, identified the parties and transfers, and added supplementary safeguards where permitted and appropriate. No provision of this package shall be interpreted as varying or contradicting the Standard Contractual Clauses in a manner that would prejudice the rights of data subjects or the effectiveness of the safeguards provided under the clauses.
Additional contractual provisions in the Data Processing Agreement may apply to the extent they do not contradict, dilute, or impair the protections provided by these clauses.
Clause 3 — Third-Party Beneficiaries
Data subjects may invoke and enforce these clauses as third-party beneficiaries to the extent provided by the Standard Contractual Clauses. This includes EU-resident Meridian accountholders whose personal data is transferred to, accessed by, or processed by Skybridge Fintech Ltd. in connection with the SBF Core platform.
The parties acknowledge that approximately 3,200 EU-resident Meridian accountholders are expected to be within the population of data subjects whose personal data is subject to this Module 2. This estimate does not limit the application of the clauses to other data subjects whose personal data may fall within the scope of the transfer.
Clause 4 — Interpretation
These clauses shall be interpreted in light of the provisions and objectives of Regulation (EU) 2016/679. Where these clauses use terms defined in Regulation (EU) 2016/679, those terms shall have the same meaning as under that Regulation.
Any ambiguity shall be resolved in a manner that preserves the validity and effectiveness of the clauses as a transfer mechanism under Article 46 of Regulation (EU) 2016/679 and Commission Implementing Decision (EU) 2021/914.
Clause 5 — Hierarchy
In the event of any contradiction between these Standard Contractual Clauses and any other agreement between the parties, including the Data Processing Agreement, the SaaS subscription agreement, any order form, schedule, security exhibit, service level agreement, or other contractual documentation, these Standard Contractual Clauses shall prevail.
This hierarchy applies only to the extent necessary to resolve the contradiction and shall not affect provisions of the Data Processing Agreement that provide additional safeguards or impose stricter obligations on Skybridge Fintech Ltd., provided such provisions do not conflict with these clauses.
Clause 6 — Description of the Transfer(s)
The details of the transfer are set out in Annex I.B of this package. Those details include the categories of data subjects, categories of personal data, sensitive data, frequency of transfer, nature of processing, purposes of processing, retention period, and identification of sub-processors.
The parties also cross-reference Schedule A of the Data Processing Agreement, which describes the subject matter, duration, nature, and purpose of the processing, the types of personal data, and categories of data subjects in connection with Skybridge’s provision of SBF Core services to Meridian.
Clause 7 — Docking Clause
The parties include the optional docking clause. Additional entities may accede to this Module 2 as data exporter or data importer, as applicable, with the agreement of the existing parties and by completing and signing the relevant accession documentation and annexes.
No accession shall reduce the rights of data subjects or the obligations of the existing parties under this Module 2. Any acceding party shall be bound by the clauses as if it had been an original party to the relevant module.
Clause 8 — Data Protection Safeguards
Clause 8.1 — Instructions
Skybridge Fintech Ltd. shall process personal data only on documented instructions from Meridian Federal Savings Bank, including with regard to transfers of personal data to a third country or an international organisation, unless required to do so by applicable law.
The documented instructions are set forth in the Data Processing Agreement, its Schedules, the applicable statement of work or order form, and this Standard Contractual Clauses package. Skybridge shall promptly inform Meridian if, in Skybridge’s opinion, an instruction infringes Regulation (EU) 2016/679 or other applicable Union or Member State data protection law.
Clause 8.2 — Purpose Limitation
Skybridge shall process personal data only for the specific purposes described in Annex I.B and in Schedule A of the Data Processing Agreement. Those purposes are limited to:
1.  payment processing through SBF Core;
2.  anti-fraud analytics, including fraud detection, risk scoring, and anomaly detection;
3.  regulatory reporting and related banking compliance functions;
4.  support, maintenance, and security of the SBF Core platform; and
5.  activities reasonably necessary to provide the contracted services to Meridian.
Skybridge shall not process personal data for its own independent commercial purposes, advertising, sale, cross-context behavioral profiling, or any purpose incompatible with Meridian’s documented instructions.
Clause 8.3 — Transparency
Skybridge shall make available to Meridian, upon request, a copy of these Standard Contractual Clauses, including any supplements, annexes, and descriptions of technical and organisational measures.
Where required by law or reasonably necessary to respond to a data subject inquiry, Meridian may make relevant portions of the clauses available to data subjects, provided that commercially sensitive information, security-sensitive information, and confidential business information may be redacted to the extent permitted by applicable law and without impairing data subject rights.
Clause 8.4 — Accuracy
Taking into account the nature of the processing and the information available to Skybridge, Skybridge shall take reasonable steps to ensure that personal data processed on behalf of Meridian is accurate and, where necessary, kept up to date.
Where Skybridge becomes aware that personal data received from Meridian or processed on Meridian’s behalf is inaccurate or obsolete, Skybridge shall promptly inform Meridian. Skybridge shall cooperate with Meridian to erase, correct, or restrict the relevant personal data in accordance with Meridian’s documented instructions.
Clause 8.5 — Duration of Processing and Erasure or Return
Skybridge shall process personal data for the duration of the SaaS subscription agreement between Meridian and Skybridge, which has a five-year term, unless earlier terminated or extended in accordance with its terms.
Upon expiration or termination of the services, Skybridge shall return or delete personal data within 90 days, at Meridian’s election and in accordance with the Data Processing Agreement, unless retention is required by applicable law. If Skybridge is legally required to retain certain personal data, Skybridge shall continue to protect such data in accordance with these clauses and shall not process it except as required by applicable law.
Clause 8.6 — Security of Processing
Skybridge shall implement and maintain technical and organisational measures designed to ensure a level of security appropriate to the risk. The measures are described in Annex II and include, at a minimum:
1.  encryption at rest using AES-256 for personal data stored in SBF Core and on Osprey Cloud infrastructure;
2.  encryption in transit using TLS 1.2 or higher for all data transmissions among Meridian, Skybridge, Osprey Cloud, and Skybridge Fintech Europe B.V.;
3.  multi-factor authentication for administrative access;
4.  role-based access controls and least-privilege access;
5.  annual penetration testing conducted by Ironvault Security Group LLC;
6.  an annual SOC 2 Type II audit conducted by Graystone & Ketchum LLP, with the current report covering the period from October 1, 2024 through September 15, 2025; and
7.  incident response procedures as set forth in Schedule D of the Data Processing Agreement.
Skybridge shall maintain incident response procedures appropriate for the nature of the services and the sensitivity of the personal data. Schedule D of the Data Processing Agreement governs operational escalation, breach investigation, customer notification, and coordination with Meridian regarding regulatory reporting obligations.
Clause 8.7 — Sensitive Data
The transfer may involve sensitive or high-risk categories of data, including Social Security numbers and anti-fraud behavioral biometric data such as keystroke dynamics and mouse movement patterns. Although these data categories may not in all cases constitute special categories of personal data under Article 9 of Regulation (EU) 2016/679, the parties treat them as sensitive for purposes of contractual safeguards and applicable U.S. state privacy laws, including the California Consumer Privacy Act as amended by the California Privacy Rights Act and the New Jersey Data Privacy Act S3377.
Skybridge shall apply additional restrictions and safeguards to such data, including encryption, strict access controls, purpose limitation to fraud detection and related banking compliance functions, logging of privileged access, and minimisation of access to personnel with a documented need to know.
Clause 8.8 — Onward Transfers
Skybridge shall not disclose or transfer personal data to any third party except as permitted by these clauses, Clause 9, the Data Processing Agreement, and Meridian’s documented instructions.
Onward transfers to sub-processors are permitted only where Skybridge complies with Clause 9 and imposes on the sub-processor data protection obligations equivalent to those imposed on Skybridge under these clauses. Current authorised sub-processors are:
1.  Osprey Cloud Infrastructure, Inc., providing IaaS/PaaS hosting; and
2.  Skybridge Fintech Europe B.V., providing EU personal data processing, engineering, customer support, and compliance functions.
Skybridge shall ensure that Module 3 Standard Contractual Clauses are in place for sub-processing arrangements requiring such clauses.
Clause 8.9 — Documentation and Compliance
Skybridge shall make available to Meridian all information necessary to demonstrate compliance with these clauses and the Data Processing Agreement. Skybridge shall allow for and contribute to audits, including inspections, conducted by Meridian or another auditor mandated by Meridian, subject to reasonable confidentiality, security, and operational safeguards.
The parties agree that audit rights shall be exercised consistently with the Data Processing Agreement. Unless required by a regulator, supervisory authority, or applicable law, Meridian may conduct an audit no more than once in any 12-month period and shall provide at least 30 days’ advance written notice. The parties agree that Skybridge’s SOC 2 Type II report shall serve as the primary audit mechanism, supplemented by security questionnaires, remediation summaries, and reasonable follow-up inquiries.
Nothing in this Clause 8.9 limits access rights of banking regulators or supervisory authorities, including the Office of the Comptroller of the Currency, the Federal Deposit Insurance Corporation, the Consumer Financial Protection Bureau, or the Autoriteit Persoonsgegevens, where such access is required by applicable law or regulatory expectations.
Clause 9 — Use of Sub-processors
The parties select Option 2 — General Written Authorisation.
Meridian grants Skybridge general written authorisation to engage the sub-processors listed in Annex III. Skybridge shall specifically inform Meridian in writing of any intended additions or replacements of sub-processors at least 30 days before such changes become effective.
Meridian shall have the right to object to any proposed sub-processor change within the notice period on reasonable data protection, security, regulatory, or operational grounds. If Meridian objects and the parties cannot resolve the objection through good-faith discussions, Meridian may terminate the affected services and the relevant Standard Contractual Clauses as to the affected processing.
Skybridge shall impose on each sub-processor the same data protection obligations as those set out in these clauses, including through Module 3 Standard Contractual Clauses where applicable. Skybridge shall remain fully liable to Meridian for the performance of each sub-processor’s obligations.
The current authorised sub-processors are:
1.  Osprey Cloud Infrastructure, Inc. — IaaS/PaaS hosting in US-East, Ashburn, Virginia, and EU, Frankfurt, Germany; and
2.  Skybridge Fintech Europe B.V. — EU personal data processing in Amsterdam, Netherlands.
Clause 10 — Data Subject Rights
Skybridge shall deal promptly and appropriately with inquiries and requests from data subjects relating to the processing of personal data under these clauses. To the extent Skybridge receives a data subject request directly, Skybridge shall promptly notify Meridian unless prohibited by applicable law.
Skybridge shall assist Meridian in fulfilling Meridian’s obligations to respond to requests by data subjects under Regulation (EU) 2016/679, including requests for access, rectification, erasure, restriction, portability, and objection. Such assistance shall include reasonable technical and organisational support, retrieval of relevant records, correction or deletion upon documented instruction, and information reasonably necessary for Meridian to verify and respond to the request.
The authorised contact point at Skybridge for data subject rights matters is:
Thomas Elridge General Counsel / Chief Privacy Officer Skybridge Fintech Ltd. 4100 Silverside Road, Suite 310 Wilmington, Delaware 19810
Clause 11 — Redress
Skybridge shall inform data subjects, in a transparent and readily accessible manner, of a contact point authorised to handle complaints relating to processing under these clauses, where Skybridge is required to do so under the Standard Contractual Clauses or applicable law.
Skybridge shall deal promptly with complaints received from data subjects and shall cooperate with Meridian in investigating and resolving such complaints. The parties shall seek amicable resolution where appropriate and without prejudice to the rights of data subjects.
Data subjects retain the right to lodge a complaint with a competent supervisory authority and to seek judicial remedies in accordance with Regulation (EU) 2016/679 and the Standard Contractual Clauses.
Clause 12 — Liability
Each party shall be liable to data subjects for damages caused by its breach of these clauses. Where more than one party is responsible for damage caused to a data subject as a result of a breach of these clauses, the responsible parties shall be jointly and severally liable to the data subject, without prejudice to rights of contribution among the parties.
As between Meridian and Skybridge, liability is subject to the liability provisions of the Data Processing Agreement, including the applicable cap equal to the greater of $5.0 million or two times the trailing-12-month fees paid by Meridian to Skybridge. For Meridian, based on annual contract value of $2.74 million, this cap is currently $5.48 million.
The liability cap does not limit data subjects’ rights under Regulation (EU) 2016/679 or these clauses to the extent such limitation would be impermissible under applicable law.
Clause 13 — Supervision
The competent supervisory authority for this Module 2 is the Autoriteit Persoonsgegevens, the Dutch Data Protection Authority.
The parties designate the Autoriteit Persoonsgegevens based on the Netherlands establishment of Skybridge Fintech Europe B.V., Skybridge’s EU establishment within the transfer architecture. Skybridge agrees to submit to the jurisdiction of and cooperate with the competent supervisory authority in any procedure aimed at ensuring compliance with these clauses.
Clause 14 — Local Laws and Practices Affecting Compliance
The parties warrant that they have no reason to believe that the laws and practices in the United States applicable to Skybridge prevent Skybridge from fulfilling its obligations under these clauses.
In providing this warranty, the parties have considered, among other factors:
1.  the nature and volume of the transferred personal data;
2.  the purposes of processing through SBF Core;
3.  the sensitivity of the data, including Social Security numbers and behavioral biometric data;
4.  Skybridge’s EU-U.S. Data Privacy Framework self-certification, Certification ID DPF-2025-03912;
5.  supplementary technical and organisational measures, including encryption, access controls, logging, and pseudonymisation where applicable;
6.  the likelihood and potential scope of access by U.S. public authorities;
7.  available legal remedies and transparency mechanisms; and
8.  the Transfer Impact Assessment conducted by Calderwood & Harkness LLP dated December 8, 2025.
Skybridge shall promptly notify Meridian if Skybridge has reason to believe that it is or has become subject to laws or practices that would prevent it from complying with these clauses. Upon such notification, Meridian may suspend transfers, require additional safeguards, or terminate the affected processing as provided in Clause 16.
Clause 15 — Obligations of the Data Importer in Case of Access by Public Authorities
Clause 15.1 — Notification
Skybridge shall promptly notify Meridian of any legally binding request by a public authority, including judicial, law enforcement, intelligence, or regulatory authorities, for disclosure of personal data transferred under these clauses, unless prohibited by applicable law.
If Skybridge is prohibited from notifying Meridian, Skybridge shall use its best efforts to obtain a waiver of the prohibition, with a view to communicating as much information as possible as soon as possible. Skybridge shall document its efforts and make such documentation available to Meridian where legally permitted.
Clause 15.2 — Review of Legality and Data Minimisation
Skybridge shall review the legality of any request for disclosure, including whether the requesting authority has proper jurisdiction and whether the request is valid, binding, proportionate, and sufficiently specific. Where Skybridge concludes that reasonable grounds exist to challenge the request, Skybridge shall challenge it or seek appropriate relief, including narrowing, modification, protective treatment, or judicial review, as applicable.
Skybridge shall disclose only the minimum amount of personal data legally required and shall take reasonable steps to prevent overbroad, indiscriminate, or disproportionate disclosure.
Clause 15.3 — Transparency
To the extent legally permitted, Skybridge shall provide Meridian with aggregate information concerning requests received from public authorities. Such information may include the number of requests, types of requesting authorities, categories of data requested, and outcomes of requests.
Skybridge shall not be required to provide information where doing so is prohibited by applicable law, but shall use reasonable efforts to provide transparency in a manner that does not violate such law.
Clause 16 — Non-compliance and Termination
Skybridge shall promptly inform Meridian if Skybridge is unable to comply with these clauses for any reason.
Where Meridian becomes aware that Skybridge is in breach of these clauses or is unable to comply with them, Meridian may suspend the transfer of personal data until compliance is restored or the contract is terminated. Meridian may terminate the affected processing where Skybridge is in substantial or persistent breach of these clauses, fails to cure such breach within a reasonable period, or is unable to comply with the clauses.
Upon termination, Skybridge shall return or delete personal data within 90 days, unless retention is required by applicable law. Any retained data shall remain subject to the protections of these clauses for so long as retained.
Clause 17 — Governing Law
These clauses shall be governed by the law of the Netherlands.
The law of the Netherlands is selected as the law of the EU Member State in which Skybridge Fintech Europe B.V., the EU establishment of Skybridge within the transfer architecture, is established.
Clause 18 — Choice of Forum and Jurisdiction
Any dispute arising from these clauses shall be resolved by the courts of the Netherlands.
Data subjects may also bring legal proceedings before the courts of the Member State in which the data subject has habitual residence, as provided by the Standard Contractual Clauses and Regulation (EU) 2016/679.
SECTION II — MODULE 3 — PROCESSOR-TO-SUB-PROCESSOR
Skybridge Fintech Ltd. → Osprey Cloud Infrastructure, Inc.
Parties to Module 3 — Skybridge to Osprey Cloud
Data Exporter — Processor
Full legal name: Skybridge Fintech Ltd.
Address: 4100 Silverside Road, Suite 310, Wilmington, Delaware 19810, United States
Entity type: Delaware corporation, C-corporation
Contact persons: Thomas Elridge, General Counsel / Chief Privacy Officer Rebecca Muñoz, Chief Information Security Officer
Role: Skybridge Fintech Ltd. acts as Processor. Skybridge transfers personal data to Osprey Cloud Infrastructure, Inc. for infrastructure hosting, storage, compute, network, and disaster recovery services supporting SBF Core.
Data Importer — Sub-processor
Full legal name: Osprey Cloud Infrastructure, Inc.
Address: 2200 Campus Drive, San Jose, California 95131, United States
Entity type: Delaware corporation
Contact person: Martin Cho, Chief Executive Officer, or Osprey Cloud’s designated privacy contact
Role: Osprey Cloud Infrastructure, Inc. acts as Sub-processor. Osprey provides IaaS/PaaS hosting for SBF Core.
Data center locations: US-East, Ashburn, Virginia; EU, Frankfurt, Germany; and US-East secondary availability zone, Ashburn, Virginia, for disaster recovery.
Existing DPA: Skybridge–Osprey Cloud Data Processing Agreement dated March 1, 2024, including Module 3 Standard Contractual Clauses for processor-to-sub-processor transfers.
Clause 1 — Purpose and Scope
The purpose of this Module 3 is to provide appropriate safeguards for the onward transfer of personal data from Skybridge, as Processor, to Osprey Cloud, as Sub-processor, in connection with infrastructure hosting and processing services used to support SBF Core.
This Module 3 applies to EU-resident personal data processed through SBF Core and hosted, stored, transmitted, backed up, replicated, or otherwise processed on Osprey Cloud infrastructure. The scope includes data processing in Osprey Cloud’s US-East region in Ashburn, Virginia, Osprey Cloud’s EU region in Frankfurt, Germany, and Osprey Cloud’s US-East secondary availability zone used for disaster recovery.
Clause 2 — Effect and Invariability of the Clauses
These clauses provide appropriate safeguards, enforceable data subject rights, and effective legal remedies for transfers of personal data from Skybridge to Osprey Cloud.
The clauses shall not be modified except to select the appropriate module, complete the annexes, identify the parties and transfers, or add supplementary safeguards that do not contradict or prejudice the Standard Contractual Clauses.
Clause 3 — Third-Party Beneficiaries
Data subjects, including approximately 3,200 EU-resident Meridian accountholders, may invoke and enforce these clauses as third-party beneficiaries to the extent provided under the Standard Contractual Clauses.
The rights of data subjects are not limited by the processor-to-sub-processor nature of this relationship.
Clause 4 — Interpretation
These clauses shall be interpreted consistently with Regulation (EU) 2016/679 and Commission Implementing Decision (EU) 2021/914.
Terms used in these clauses that are defined under Regulation (EU) 2016/679 shall have the meanings given to them under that Regulation.
Clause 5 — Hierarchy
In the event of a contradiction between these clauses and any other agreement between Skybridge and Osprey Cloud, including the Skybridge–Osprey Cloud Data Processing Agreement dated March 1, 2024, these clauses shall prevail.
Additional obligations in the Skybridge–Osprey Cloud Data Processing Agreement may apply to the extent they do not conflict with these clauses.
Clause 6 — Description of the Transfer(s)
The details of the transfer to Osprey Cloud are set out in Annex I.B. The nature of processing includes infrastructure hosting, data storage, compute services, networking, backup, replication, monitoring, and disaster recovery.
The relevant data locations are:
1.  Osprey Cloud US-East, Ashburn, Virginia, as the primary infrastructure region;
2.  Osprey Cloud EU, Frankfurt, Germany, as an EU infrastructure region; and
3.  Osprey Cloud US-East secondary availability zone, Ashburn, Virginia, for disaster recovery.
Clause 7 — Docking Clause
The docking clause is included. Additional entities may accede to this Module 3 as data exporter or data importer with the agreement of Skybridge, Osprey Cloud, and, where required under the Data Processing Agreement, Meridian.
No accession shall reduce the protections afforded to data subjects under this Module 3.
Clause 8 — Data Protection Safeguards
Clause 8.1 — Instructions
Osprey Cloud shall process personal data only on documented instructions from Skybridge. Skybridge’s instructions to Osprey Cloud shall be consistent with Meridian’s instructions to Skybridge under the Data Processing Agreement and Module 2.
Osprey Cloud shall promptly inform Skybridge if, in Osprey Cloud’s opinion, an instruction infringes Regulation (EU) 2016/679 or other applicable data protection law.
Clause 8.2 — Purpose Limitation
Osprey Cloud shall process personal data only for hosting and infrastructure services in support of SBF Core, including storage, compute, networking, resiliency, monitoring, backup, and disaster recovery.
Osprey Cloud shall not process personal data for its own purposes or for any purpose unrelated to the provision of contracted infrastructure services.
Clause 8.3 — Transparency
Osprey Cloud shall make available to Skybridge information necessary to demonstrate compliance with this Module 3, including applicable security documentation, audit summaries, certifications, and information regarding relevant sub-processing activities.
Skybridge may provide relevant information to Meridian to enable Meridian to satisfy its compliance and regulatory obligations.
Clause 8.4 — Accuracy
Taking into account the nature of infrastructure hosting services, Osprey Cloud shall not alter personal data except as instructed by Skybridge or as necessary to provide the contracted services.
Where Osprey Cloud becomes aware of corruption, loss, integrity failure, or other condition affecting the accuracy or integrity of hosted personal data, Osprey Cloud shall promptly notify Skybridge and cooperate in remediation.
Clause 8.5 — Duration of Processing and Erasure or Return
Processing by Osprey Cloud shall continue for the duration of the Skybridge–Osprey Cloud Data Processing Agreement dated March 1, 2024, as may be renewed, extended, or replaced.
Upon termination or expiration of the relevant services, Osprey Cloud shall return or delete personal data in accordance with the Skybridge–Osprey Cloud Data Processing Agreement, subject to any legal retention obligations. Any retained data shall remain protected in accordance with this Module 3.
Clause 8.6 — Security of Processing
Osprey Cloud shall implement and maintain technical and organisational measures appropriate to the risk and consistent with Annex II. Such measures shall include physical data center security, network segmentation, access controls, encryption at rest, encryption in transit, monitoring, logging, vulnerability management, and resiliency controls.
Osprey Cloud shall maintain SOC 2 Type II or equivalent audit reports and make them available to Skybridge under appropriate confidentiality restrictions. Skybridge may provide relevant excerpts, assurance letters, or reports to Meridian and its regulators where required by the overarching Data Processing Agreement or applicable law.
Clause 8.7 — Sensitive Data
Osprey Cloud may host, transmit, store, or otherwise process sensitive or high-risk data, including Social Security numbers and behavioral biometric data such as keystroke dynamics and mouse movement patterns.
Osprey Cloud shall apply additional safeguards to such data, including encryption, network and tenant isolation, privileged-access controls, logging, and restrictions on personnel access. Osprey Cloud shall not access the contents of personal data except as necessary to provide infrastructure services, maintain security, troubleshoot incidents, or comply with lawful and valid instructions from Skybridge.
Clause 8.8 — Onward Transfers
Osprey Cloud shall not further sub-process personal data without prior written authorisation from Skybridge and without compliance with Meridian’s general authorisation framework under Module 2.
Any further onward transfer or sub-processing shall be subject to contractual obligations equivalent to those imposed by this Module 3 and, where required, appropriate transfer safeguards under Chapter V of Regulation (EU) 2016/679.
Clause 8.9 — Documentation and Compliance
Osprey Cloud shall make available to Skybridge information necessary to demonstrate compliance with this Module 3. Osprey Cloud shall cooperate with audits and assessments consistent with the Skybridge–Osprey Cloud Data Processing Agreement and the overarching Meridian Data Processing Agreement.
Audit procedures shall be implemented in a manner that protects the security and confidentiality of Osprey Cloud systems and other customers’ data, while preserving Skybridge’s and Meridian’s ability to verify compliance and respond to regulatory obligations.
Clause 9 — Use of Sub-processors
The parties select Option 2 — General Written Authorisation.
Osprey Cloud may engage further sub-processors only in accordance with the Skybridge–Osprey Cloud Data Processing Agreement, this Module 3, and Skybridge’s documented instructions. Osprey Cloud shall provide at least 30 days’ prior notice of any intended addition or replacement of further sub-processors, enabling Skybridge to notify Meridian and allowing Meridian to exercise its objection rights under Module 2.
Osprey Cloud shall impose data protection obligations on any further sub-processor that are equivalent to those imposed on Osprey Cloud under this Module 3. Osprey Cloud remains liable to Skybridge for the performance of further sub-processors.
Clause 10 — Data Subject Rights
Osprey Cloud shall assist Skybridge in responding to data subject requests forwarded by Meridian. Such assistance shall be proportionate to Osprey Cloud’s role as an infrastructure provider and may include locating, exporting, deleting, restoring, or restricting data within the hosted environment at Skybridge’s instruction.
Osprey Cloud shall not respond directly to data subjects unless instructed by Skybridge or required by applicable law.
Clause 11 — Redress
Osprey Cloud shall cooperate with Skybridge and Meridian in the investigation and resolution of complaints relating to processing under this Module 3.
Data subjects retain their rights to lodge complaints with a competent supervisory authority and to seek judicial remedies as provided under Regulation (EU) 2016/679 and the Standard Contractual Clauses.
Clause 12 — Liability
Each party shall be liable for damages caused by its breach of this Module 3 in accordance with the Standard Contractual Clauses.
Osprey Cloud’s liability to data subjects shall be determined in accordance with the clauses and applicable law. Where multiple parties are responsible for damage caused to a data subject, liability shall be joint and several to the extent required by the Standard Contractual Clauses.
Clause 13 — Supervision
The competent supervisory authority for this Module 3 is the Autoriteit Persoonsgegevens, the Dutch Data Protection Authority.
Osprey Cloud agrees to cooperate with the competent supervisory authority in any procedure aimed at ensuring compliance with this Module 3.
Clause 14 — Local Laws and Practices Affecting Compliance
Osprey Cloud warrants that it has no reason to believe that the laws and practices in the United States applicable to it prevent it from fulfilling its obligations under this Module 3.
The parties have considered supplementary measures, the Transfer Impact Assessment conducted by Calderwood & Harkness LLP dated December 8, 2025, and the architecture of Osprey Cloud’s US-East and EU data center regions. The Frankfurt, Germany region provides an EU data localisation option for EU personal data where configured by Skybridge.
Osprey Cloud shall promptly notify Skybridge if it becomes aware of any law, practice, order, or circumstance that prevents or materially impairs its ability to comply with this Module 3.
Clause 15 — Obligations in Case of Access by Public Authorities
Osprey Cloud shall promptly notify Skybridge of any legally binding request by a public authority for disclosure of personal data processed under this Module 3, unless prohibited by applicable law.
If Osprey Cloud is prohibited from notifying Skybridge, it shall use best efforts to obtain a waiver of the prohibition. Osprey Cloud shall review the legality of any request, challenge the request where reasonable grounds exist, and disclose only the minimum amount of personal data legally required.
To the extent legally permitted, Osprey Cloud shall provide Skybridge with aggregate transparency information concerning public authority requests, including number, type, categories of data requested, and outcomes.
Clause 16 — Non-compliance and Termination
Osprey Cloud shall promptly inform Skybridge if it is unable to comply with this Module 3.
Skybridge may suspend transfers to Osprey Cloud or terminate the affected processing if Osprey Cloud is in breach of this Module 3 or cannot comply with it. Upon termination, Osprey Cloud shall return or delete personal data in accordance with the Skybridge–Osprey Cloud Data Processing Agreement and applicable law.
Clause 17 — Governing Law
These clauses shall be governed by the law of the Netherlands.
Clause 18 — Choice of Forum and Jurisdiction
Any dispute arising from this Module 3 shall be resolved by the courts of the Netherlands.
Data subjects may also bring proceedings before the courts of the Member State in which the data subject has habitual residence.
SECTION III — MODULE 3 — PROCESSOR-TO-SUB-PROCESSOR
Skybridge Fintech Ltd. → Skybridge Fintech Europe B.V.
Parties to Module 3 — Skybridge to SBF Europe
Data Exporter — Processor
Full legal name: Skybridge Fintech Ltd.
Address: 4100 Silverside Road, Suite 310, Wilmington, Delaware 19810, United States
Entity type: Delaware corporation, C-corporation
Contact person: Thomas Elridge, General Counsel / Chief Privacy Officer
Role: Skybridge Fintech Ltd. acts as Processor. Skybridge transfers personal data to its EU affiliate for EU data processing, customer support, engineering, and compliance activities supporting SBF Core.
Data Importer — Sub-processor
Full legal name: Skybridge Fintech Europe B.V.
Address: Keizersgracht 482, 1017 EG Amsterdam, Netherlands
Entity type: Besloten vennootschap, Dutch private limited liability company, B.V.
KvK number: 82104593
Contact person: Lena Vogt, Managing Director
Role: Skybridge Fintech Europe B.V. acts as Sub-processor. It processes EU personal data for Skybridge customers and performs EU affiliate support, engineering, and compliance functions.
Employees: 14 employees, consisting of 8 engineers, 4 support personnel, and 2 compliance personnel.
Registration: Registered with the Autoriteit Persoonsgegevens.
Note on Transfer Direction
Skybridge Fintech Europe B.V. is established in the Netherlands, within the European Union. This Module 3 is included to address the processor-to-sub-processor relationship between Skybridge and SBF Europe and to provide comprehensive contractual coverage for the data flow architecture.
Although transfers from the United States to the Netherlands may not present the same Chapter V transfer issue as transfers from the EEA to the United States, this Module 3 is included to address reverse or onward flows of personal data that may occur, including processed data returned from the United States to the European Union and personal data originating from U.S. processing that is further processed by SBF Europe.
Clause 1 — Purpose and Scope
The purpose of this Module 3 is to provide appropriate safeguards for the onward transfer of personal data from Skybridge, as Processor, to SBF Europe, as Sub-processor, in connection with EU personal data processing services.
This Module 3 applies to personal data processed by SBF Europe in connection with SBF Core, including data relating to EU-resident Meridian accountholders and other data subjects whose personal data is processed through the platform.
Clause 2 — Effect and Invariability of the Clauses
These clauses provide contractual safeguards, enforceable data subject rights, and effective legal remedies in connection with the processing relationship between Skybridge and SBF Europe.
The clauses shall not be modified except as permitted by Commission Implementing Decision (EU) 2021/914, including module selection, annex completion, party identification, transfer description, and supplementary safeguards.
Clause 3 — Third-Party Beneficiaries
EU-resident Meridian accountholders, estimated at approximately 3,200 individuals, may invoke and enforce this Module 3 as third-party beneficiaries to the extent provided by the Standard Contractual Clauses.
Clause 4 — Interpretation
This Module 3 shall be interpreted in a manner consistent with Regulation (EU) 2016/679. Terms defined under Regulation (EU) 2016/679 shall have the same meaning when used in this Module 3.
Clause 5 — Hierarchy
In the event of any contradiction between this Module 3 and any other agreement or intra-group arrangement between Skybridge and SBF Europe, this Module 3 shall prevail.
Additional provisions may apply to the extent they provide greater protection or do not conflict with this Module 3.
Clause 6 — Description of the Transfer(s)
The details of the processing by SBF Europe are set out in Annex I.B. The nature of processing includes EU personal data processing, customer support, engineering support, application maintenance, compliance support, regulatory response support, and related operational functions for EU-resident accountholder data.
Processing is conducted primarily at SBF Europe’s office located at Keizersgracht 482, 1017 EG Amsterdam, Netherlands, and through secure Skybridge systems approved for such processing.
Clause 7 — Docking Clause
The docking clause is included. Additional entities may accede to this Module 3 as data exporter or data importer with the agreement of Skybridge, SBF Europe, and, where required, Meridian.
Clause 8 — Data Protection Safeguards
Clause 8.1 — Instructions
SBF Europe shall process personal data only on documented instructions from Skybridge. Skybridge’s instructions to SBF Europe shall be consistent with Meridian’s documented instructions to Skybridge under the Data Processing Agreement.
SBF Europe shall promptly inform Skybridge if, in SBF Europe’s opinion, an instruction infringes Regulation (EU) 2016/679 or other applicable Union or Member State data protection law.
Clause 8.2 — Purpose Limitation
SBF Europe shall process personal data only for EU data processing, customer support, engineering, compliance, and related functions necessary to support SBF Core.
SBF Europe shall not process personal data for its own independent purposes or for any purpose incompatible with Skybridge’s documented instructions.
Clause 8.3 — Transparency
SBF Europe shall make available to Skybridge information necessary to demonstrate compliance with this Module 3. Skybridge may provide relevant information to Meridian as required under the Data Processing Agreement and Module 2.
Clause 8.4 — Accuracy
SBF Europe shall take reasonable steps to preserve the accuracy and integrity of personal data processed on behalf of Skybridge. Where SBF Europe becomes aware that personal data is inaccurate, corrupted, or incomplete, it shall notify Skybridge and cooperate in remediation.
Clause 8.5 — Duration of Processing and Erasure or Return
Processing by SBF Europe shall be coterminous with the Data Processing Agreement and the SaaS subscription agreement between Meridian and Skybridge, plus any applicable post-termination return or deletion period.
Upon termination or expiration of the relevant services, SBF Europe shall return or delete personal data within 90 days, unless retention is required by applicable law. Retained data shall remain protected in accordance with this Module 3 and Regulation (EU) 2016/679.
Clause 8.6 — Security of Processing
SBF Europe shall maintain technical and organisational security measures consistent with Skybridge’s security standards and Annex II.
Such measures include secure access controls, role-based permissions, multi-factor authentication, encryption in transit, endpoint protection, logging, personnel confidentiality obligations, incident reporting procedures, and access-controlled premises at Keizersgracht 482, Amsterdam.
Clause 8.7 — Sensitive Data
SBF Europe may process sensitive or high-risk data categories, including Social Security numbers for EU dual-resident accountholders and behavioral biometric data such as keystroke dynamics and mouse movement patterns.
SBF Europe shall apply the same safeguards required of Skybridge, including encryption, least-privilege access, purpose limitation, logging, secure handling, and restrictions on access to personnel with a documented business need.
Clause 8.8 — Onward Transfers
SBF Europe shall not engage further sub-processors or otherwise disclose personal data to third parties without prior authorisation from Skybridge and in accordance with Meridian’s general authorisation framework under Module 2.
Any further processing shall be subject to appropriate contractual safeguards and, where applicable, valid transfer mechanisms under Chapter V of Regulation (EU) 2016/679.
Clause 8.9 — Documentation and Compliance
SBF Europe shall maintain documentation sufficient to demonstrate compliance with this Module 3, including records of processing, access logs, security controls, training records, and evidence of compliance with Skybridge policies.
SBF Europe shall cooperate with Skybridge, Meridian, and competent supervisory authorities in connection with audits, inquiries, data subject requests, and regulatory reviews.
Clause 9 — Use of Sub-processors
The parties select Option 2 — General Written Authorisation.
SBF Europe may engage additional sub-processors only with prior authorisation from Skybridge and subject to the Controller’s general authorisation framework. SBF Europe shall provide at least 30 days’ prior notice to Skybridge before engaging any additional sub-processor, enabling Skybridge to provide notice to Meridian and allow Meridian to object.
SBF Europe shall impose on any authorised further sub-processor data protection obligations equivalent to those imposed under this Module 3.
Clause 10 — Data Subject Rights
SBF Europe shall assist Skybridge in responding to data subject requests forwarded by Meridian, including requests for access, rectification, erasure, restriction, portability, and objection.
SBF Europe shall not respond directly to data subjects unless instructed by Skybridge or required by applicable law.
Clause 11 — Redress
SBF Europe shall cooperate with Skybridge and Meridian in addressing complaints from data subjects relating to processing under this Module 3.
Data subjects retain the right to lodge a complaint with a competent supervisory authority and to seek judicial remedies under Regulation (EU) 2016/679 and the Standard Contractual Clauses.
Clause 12 — Liability
Each party shall be liable for damages caused by its breach of this Module 3 in accordance with the Standard Contractual Clauses.
Where more than one party is responsible for damage caused to a data subject, the responsible parties shall be jointly and severally liable to the extent required by the Standard Contractual Clauses and applicable law.
Clause 13 — Supervision
The competent supervisory authority for this Module 3 is the Autoriteit Persoonsgegevens, the Dutch Data Protection Authority.
SBF Europe is registered with the Autoriteit Persoonsgegevens and agrees to cooperate with the supervisory authority in any procedure aimed at ensuring compliance with this Module 3.
Clause 14 — Local Laws and Practices Affecting Compliance
SBF Europe is established in the Netherlands, and Regulation (EU) 2016/679 applies directly to its processing activities.
For personal data processed within the Netherlands or elsewhere in the European Union, no third-country transfer concern arises solely from SBF Europe’s processing location. This clause is included for completeness with respect to any data flows between the United States and the Netherlands and any personal data originating from U.S. processing that is further processed by SBF Europe.
SBF Europe has no reason to believe that applicable laws or practices prevent it from complying with this Module 3.
Clause 15 — Obligations in Case of Access by Public Authorities
To the extent SBF Europe receives a legally binding request from a public authority for personal data processed under this Module 3, SBF Europe shall promptly notify Skybridge unless prohibited by applicable law.
SBF Europe shall review the legality of any such request, challenge it where reasonable grounds exist, and disclose only the minimum amount of personal data legally required. To the extent legally permitted, SBF Europe shall provide Skybridge with aggregate transparency information regarding such requests.
These obligations apply to the extent of any U.S.-origin data processed by SBF Europe and to all other personal data processed under this Module 3.
Clause 16 — Non-compliance and Termination
SBF Europe shall promptly inform Skybridge if it is unable to comply with this Module 3.
Skybridge may suspend transfers to SBF Europe or terminate the affected processing if SBF Europe breaches this Module 3 or is unable to comply with it. Upon termination, SBF Europe shall return or delete personal data within 90 days, unless retention is required by applicable law.
Clause 17 — Governing Law
These clauses shall be governed by the law of the Netherlands.
Clause 18 — Choice of Forum and Jurisdiction
Any dispute arising from this Module 3 shall be resolved by the courts of the Netherlands.
ANNEX I — DESCRIPTION OF TRANSFER
Annex I.A — List of Parties
Module 2 Parties
Module 3 Parties — Skybridge to Osprey Cloud
Module 3 Parties — Skybridge to SBF Europe
Annex I.B — Description of Transfer
Categories of Data Subjects
The personal data transferred under the modules may relate to the following categories of data subjects:
1.  Meridian Federal Savings Bank accountholders, including retail and small-business accountholders, approximately 412,000 total;
2.  authorized signers on Meridian accounts;
3.  beneficial owners associated with Meridian accounts or small-business customers;
4.  Meridian employees whose data passes through SBF Core; and
5.  EU-resident data subjects, including approximately 3,200 Meridian accountholders with EU residency, expatriate status, or dual-resident accounts.
Categories of Personal Data Transferred
The categories of personal data transferred include:
1.  full name;
2.  date of birth;
3.  Social Security number;
4.  taxpayer identification number;
5.  account numbers, including checking, savings, and loan account numbers;
6.  routing numbers;
7.  transaction amounts and metadata;
8.  IP addresses;
9.  device identifiers;
10.  geolocation data at city level;
11.  email addresses;
12.  phone numbers; and
13.  anti-fraud behavioral biometric data, including keystroke dynamics and mouse movement patterns.
Sensitive Data.  The parties identify the following data as sensitive or high-risk for purposes of these clauses and applicable U.S. state privacy laws:
1.  Social Security numbers, classified as sensitive under applicable U.S. state privacy laws, including the California Consumer Privacy Act as amended by the California Privacy Rights Act and the New Jersey Data Privacy Act S3377; and
2.  behavioral biometric data, including keystroke dynamics and mouse movement patterns, classified as sensitive under applicable U.S. state privacy laws.
Additional restrictions and safeguards apply under Clause 8.7 of each relevant module, including encryption using AES-256 at rest, TLS 1.2 or higher in transit, strict access controls, role-based permissions, least-privilege access, logging, and purpose limitation to fraud detection and related security or compliance functions.
Frequency of Transfer
Transfers occur on a continuous and real-time basis as Meridian transactions are processed through SBF Core.
The platform processes approximately 18.6 million transactions per month.
Nature of Processing
The nature of processing includes:
1.  payment processing, including real-time transaction processing and settlement;
2.  anti-fraud analytics, including fraud detection, risk scoring, behavioral analysis, and anomaly detection;
3.  regulatory reporting, including generation and submission support for reports required by banking regulators;
4.  infrastructure hosting and data storage by Osprey Cloud Infrastructure, Inc.; and
5.  EU data processing, engineering support, customer support, and compliance functions by Skybridge Fintech Europe B.V.
Purpose(s) of the Data Transfer and Further Processing
The purposes of the data transfer and further processing are:
1.  to enable Skybridge to provide the SBF Core SaaS platform services to Meridian under the five-year SaaS subscription agreement;
2.  to support the commercial arrangement with annual contract value of $2.74 million and total contract value of $13.7 million;
3.  to host and process data on Osprey Cloud infrastructure in US-East, Ashburn, Virginia, and EU, Frankfurt, Germany;
4.  to provide resiliency and disaster recovery through Osprey Cloud’s US-East secondary availability zone in Ashburn, Virginia;
5.  to process EU personal data through SBF Europe in Amsterdam, Netherlands; and
6.  to perform security, compliance, customer support, maintenance, and engineering functions necessary to provide SBF Core.
Period of Data Retention and Deletion
Personal data shall be processed for the duration of the SaaS subscription agreement, which has a five-year term.
Following termination or expiration, personal data shall be retained for up to 90 days for return or deletion, except where retention is required by applicable law. Any personal data retained after termination due to legal requirements shall remain subject to the protections of the applicable clauses and the Data Processing Agreement.
Transfers to Sub-processors — Subject Matter, Nature, and Duration
Osprey Cloud Infrastructure, Inc. provides IaaS/PaaS hosting of the SBF Core application and related data, including data storage, compute, networking, availability, backup, monitoring, and disaster recovery. Processing is continuous for the duration of the Skybridge–Osprey Cloud Data Processing Agreement dated March 1, 2024, as renewed or replaced. Data centers are located in Ashburn, Virginia, as the primary US-East region; Frankfurt, Germany, as the EU region; and Ashburn, Virginia, as the US-East secondary availability zone for disaster recovery.
Skybridge Fintech Europe B.V. provides EU personal data processing, engineering, customer support, and compliance services. Processing is continuous for the duration of SBF Europe’s services to Skybridge and is conducted at Keizersgracht 482, 1017 EG Amsterdam, Netherlands, and through approved secure systems.
Annex I.C — Competent Supervisory Authority
The competent supervisory authority for all modules is the Autoriteit Persoonsgegevens, the Dutch Data Protection Authority.
The basis for this designation is that Skybridge Fintech Europe B.V., the EU establishment of Skybridge within the transfer architecture, is registered in the Netherlands under KvK number 82104593.
ANNEX II — TECHNICAL AND ORGANISATIONAL MEASURES INCLUDING TECHNICAL AND ORGANISATIONAL MEASURES TO ENSURE THE SECURITY OF THE DATA
Introduction
This Annex II describes the technical and organisational measures implemented by Skybridge Fintech Ltd. and requ