STANDARD CONTRACTUAL CLAUSES (PROCESSOR)

STANDARD CONTRACTUAL CLAUSES (PROCESSOR)
MODULE 2: CONTROLLER-TO-PROCESSOR
Pursuant to EU Commission Implementing Decision (EU) 2021/914 of 4 June 2021
DRAFT — Prepared December 12, 2025
Prepared by: Alan Burke, Calderwood & Harkness LLP, 1735 Market Street, Suite 2800, Philadelphia, PA 19103
Matter Number: 1009-00004
Status: Draft — for review and negotiation; to be appended to the Data Processing Agreement between Meridian Federal Savings Bank (Controller) and Skybridge Fintech Ltd. (Processor). Target execution date: February 15, 2026.
Right-click to update Table of Contents
PREAMBLE
These Standard Contractual Clauses (hereinafter referred to as the "SCCs" or the "Clauses") are entered into by and between the following parties:
Data Exporter (Controller):
Meridian Federal Savings Bank, a federally chartered savings bank organized and existing under the laws of the United States of America, insured by the Federal Deposit Insurance Corporation ("FDIC"), operating under Office of the Comptroller of the Currency ("OCC") Charter No. 14-2238, with its principal office located at 900 Broad Street, Suite 1200, Newark, New Jersey 07102 (hereinafter referred to as the "Data Exporter" or "Controller").
Data Importer (Processor):
Skybridge Fintech Ltd., a Delaware C-corporation organized and existing under the laws of the State of Delaware, with its principal office located at 4100 Silverside Road, Suite 310, Wilmington, Delaware 19810 (hereinafter referred to as the "Data Importer" or "Processor").
Each a "party"; together the "parties."
WHEREAS, the Data Exporter and the Data Importer (together, the "parties") have agreed to enter into these Standard Contractual Clauses in order to adduce adequate safeguards with respect to the protection of privacy and the fundamental rights and freedoms of individuals for the transfer of personal data from the Data Exporter, which is subject to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (the "General Data Protection Regulation" or "GDPR"), to the Data Importer, which is established in a third country — specifically, the United States of America — that does not, except as provided under the EU-US Data Privacy Framework, ensure an adequate level of data protection within the meaning of Article 45 of the GDPR;
WHEREAS, these Clauses apply to the transfer of personal data as specified in Annex I.B hereto, and the categories of data subjects, categories of personal data, the nature and purpose of the processing, and the duration of the processing are each described in detail in Annex I.B;
WHEREAS, these Clauses constitute Module 2 (Controller-to-Processor) of the standard contractual clauses adopted by the European Commission pursuant to Implementing Decision (EU) 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council, as published in the Official Journal of the European Union (OJ L 199, 7.6.2021, p. 31–61);
WHEREAS, these SCCs are appended to and form an integral part of the Data Processing Agreement between the parties dated on or about February 15, 2026 (the "Data Processing Agreement" or "DPA"), and shall be read in conjunction with the terms and conditions set forth therein, provided that in the event of any conflict between these Clauses and the Data Processing Agreement, these Clauses shall prevail to the extent of such conflict;
WHEREAS, the Data Importer has self-certified under the EU-US Data Privacy Framework established by the European Commission's adequacy decision of 10 July 2023, under Certification ID: DPF-2025-03912, effective as of July 1, 2025, which self-certification supplements but does not replace these SCCs, and provides additional protections with respect to the transfer of personal data from the European Union to the United States, including binding commitments regarding limitations on government access to personal data;
NOW, THEREFORE, the parties hereby agree to the following Standard Contractual Clauses:
SECTION I — GENERAL PROVISIONS
Clause 1 — Purpose and Scope
(a) The purpose of these Standard Contractual Clauses is to ensure compliance with the requirements of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (General Data Protection Regulation), and specifically Article 46(2)(c) thereof, for the transfer of personal data to a third country.
(b) These Clauses set out appropriate safeguards, including enforceable data subject rights and effective legal remedies, pursuant to Article 46(2)(c) and, with respect to data transfers from controllers to processors and/or from processors to sub-processors, pursuant to Articles 28(3) and (4) of Regulation (EU) 2016/679.
(c) These Clauses apply with respect to the transfer of personal data from the Data Exporter, Meridian Federal Savings Bank, acting in its capacity as a controller within the meaning of Article 4(7) of Regulation (EU) 2016/679, to the Data Importer, Skybridge Fintech Ltd., acting in its capacity as a processor within the meaning of Article 4(8) of Regulation (EU) 2016/679, as further detailed in Annex I to these Clauses.
(d) The module applicable to these Clauses is Module 2 — Transfer controller to processor. The parties confirm that Module 2 is the appropriate module given that the Data Exporter is a controller determining the purposes and means of the processing of personal data, and the Data Importer is a processor processing personal data on behalf of the Data Exporter.
(e) The Annexes to these Clauses, including Annex I (Description of Transfer), Annex II (Technical and Organisational Measures), and Annex III (List of Sub-Processors), form an integral part of these Clauses and shall be binding upon the parties in the same manner as the body of the Clauses themselves.
Clause 2 — Effect and Invariability of the Clauses
(a) These Clauses set out appropriate safeguards, including enforceable data subject rights and effective legal remedies, for the transfer of personal data by the Data Exporter to the Data Importer. These Clauses may not be modified by the parties, except:
(i) to select the appropriate Module in accordance with the options provided by the European Commission's Implementing Decision (EU) 2021/914;
(ii) to add or update information in the Annexes to these Clauses, including to reflect changes in the categories of personal data transferred, the identity of sub-processors, or the technical and organisational measures implemented by the Data Importer; or
(iii) to add additional safeguards that are not inconsistent with these Clauses and that do not, directly or indirectly, detract from the fundamental rights or freedoms of data subjects.
(b) These Clauses are without prejudice to, and do not derogate from, the rights and obligations of the parties arising under Regulation (EU) 2016/679. To the extent that any provision of these Clauses is inconsistent with a right or obligation arising under the GDPR, the GDPR shall prevail.
Clause 3 — Third-Party Beneficiaries
(a) Data subjects may invoke and enforce these Clauses, as third-party beneficiaries, against the Data Exporter and/or the Data Importer, with the following exceptions:
(i) Clause 1, paragraph (b);
(ii) Clause 2, paragraph (a);
(iii) Clause 3;
(iv) Clause 4;
(v) Clause 5;
(vi) Clause 6, paragraphs (a) through (f);
(vii) Clause 7;
(viii) Clause 8, including all sub-provisions thereof as applicable under Module 2 (Clauses 8.1 through 8.9);
(ix) Clause 9, paragraphs (a) through (e);
(x) Clause 10;
(xi) Clause 11;
(xii) Clause 12, paragraphs (a) through (d);
(xiii) Clause 13;
(xiv) Clause 14, paragraphs (a) through (e);
(xv) Clause 15;
(xvi) Clause 16, paragraphs (a) through (e);
(xvii) Clause 17;
(xviii) Clause 18.
(b) Paragraph (a) is without prejudice to the rights of data subjects under Regulation (EU) 2016/679.
Clause 4 — Interpretation
(a) Where these Clauses use terms that are defined in Regulation (EU) 2016/679, those terms shall have the same meaning as in the Regulation. This includes, without limitation, the terms "personal data," "special categories of personal data," "processing," "controller," "processor," "data subject," "supervisory authority," "personal data breach," "third country," and "appropriate safeguards."
(b) These Clauses shall be read and interpreted in the light of the provisions of Regulation (EU) 2016/679, and in a manner consistent therewith.
(c) These Clauses shall not be interpreted in a way that conflicts with rights and obligations provided for in Regulation (EU) 2016/679.
(d) Where these Clauses contain references to provisions of the law of a Member State that has transposed the GDPR into national law, such references shall be construed as references to the corresponding provision of that Member State's national implementing legislation as in effect from time to time.
Clause 5 — Hierarchy
(a) In the event of a contradiction between these Clauses and the provisions of any related agreements between the parties existing at the time these Clauses are agreed or entered into thereafter — including, without limitation, the Data Processing Agreement dated on or about February 15, 2026, the Master SaaS Subscription Agreement, and any amendments, exhibits, schedules, or order forms appended thereto — these Clauses shall prevail to the extent of such contradiction.
(b) In the event of a contradiction between these Clauses and Regulation (EU) 2016/679, the GDPR shall prevail. Nothing in these Clauses shall be interpreted as diminishing or restricting the rights of data subjects or the obligations of controllers and processors under the GDPR.
SECTION II — OBLIGATIONS OF THE PARTIES
Clause 6 — Description of the Transfer(s)
(a) The details of the transfer(s) of personal data, and in particular the categories of personal data that are transferred and the purpose(s) for which they are transferred, are specified in Annex I.B to these Clauses.
(b) Without limiting the generality of paragraph (a), the parties confirm that the transfer involves the following principal elements, each of which is described in greater detail in Annex I.B:
(i) Categories of data subjects: Approximately 3,200 EU-resident accountholders of Meridian Federal Savings Bank, including retail and small-business accountholders, authorized signers on Meridian accounts, beneficial owners of Meridian accounts, and Meridian employees whose personal data passes through the SBF Core platform operated by the Data Importer.
(ii) Categories of personal data: Full name, date of birth, Social Security number ("SSN"), taxpayer identification number ("TIN"), account numbers (checking, savings, and loan), routing numbers, transaction amounts and metadata, IP addresses, device identifiers, geolocation data (city-level), email addresses, phone numbers, and anti-fraud behavioral biometric data (including keystroke dynamics and mouse movement patterns).
(iii) Sensitive data: Social Security numbers and behavioral biometric data (keystroke dynamics and mouse movement patterns) are included in the transfer and are subject to the enhanced safeguards described in Annex I.B and Annex II.
(iv) Frequency of transfer: The transfer is continuous and operates in real time. Meridian processes approximately 18.6 million transactions per month through the SBF Core platform. The proportion of transactions relating to EU-resident data subjects is proportionate to the approximately 3,200 EU-resident accountholders out of Meridian's total base of approximately 412,000 accountholders.
(v) Processing purposes: Real-time payment processing, anti-fraud analytics and detection, and regulatory reporting via the SBF Core platform.
(vi) Retention period: Personal data shall be retained for the duration of the SaaS subscription agreement plus ninety (90) days following termination thereof for the purpose of orderly data return or deletion, except as required by applicable law.
(c) The parties shall update Annex I.B from time to time to reflect any material changes to the description of the transfer, and any such updates shall be documented in writing and signed by both parties.
Clause 7 — Docking Clause
(a) The parties elect to include the optional docking clause as set forth in this Clause 7, in order to permit future clients of the Data Importer, including but not limited to other financial institutions, to accede to these Clauses without requiring the negotiation and execution of a separate and independent set of Standard Contractual Clauses.
[Note for negotiation: The inclusion of the Docking Clause is subject to confirmation during negotiations. Its inclusion is recommended to facilitate template reuse with future Skybridge bank clients. Deletion of this clause will not affect the validity of the remaining Clauses.]
(b) An entity that is not a party to these Clauses may, with the agreement of all existing parties, accede to these Clauses at any time, either as a data exporter or as a data importer, by completing the Appendix and executing Annex I.A.
(c) The acceding entity shall have no rights or obligations arising under these Clauses from the period prior to becoming a party. Upon accession, the acceding entity shall become a party to these Clauses and shall have the rights and obligations of a data exporter or data importer, as applicable, as specified in the completed Annex I.A.
(d) The accession of a new party pursuant to this Clause 7 shall not affect the rights and obligations of the existing parties under these Clauses.
Clause 8 — Data Protection Safeguards
The Data Importer warrants and undertakes to comply with the following data protection safeguards, which are specific to Module 2 (Controller-to-Processor):
Clause 8.1 — Instructions
(a) The Data Importer shall process the personal data only on documented instructions from the Data Exporter. The Data Exporter may issue such instructions throughout the duration of the contract.
(b) The Data Importer shall immediately inform the Data Exporter if it is unable to follow those instructions. Where the Data Importer is required by the law of the country of destination or any other applicable law to process the personal data otherwise than on instructions from the Data Exporter, including disclosures of personal data to a public authority, the Data Importer shall inform the Data Exporter of that legal requirement before carrying out the processing, unless the law in question prohibits such notification on important grounds of public interest.
(c) The Data Exporter warrants that it has made reasonable efforts to determine that the Data Importer is able to satisfy its obligations under these Clauses, taking into account the nature and scope of the processing, the categories of personal data transferred, and the technical and organisational measures implemented by the Data Importer as described in Annex II.
(d) Subsequent instructions shall be given by the Data Exporter throughout the duration of the contract. Such instructions shall always be documented in writing, including by electronic means, and shall be retained by both parties for the duration of the contract and for a period of three (3) years thereafter.
Clause 8.2 — Purpose Limitation
(a) The Data Importer shall process the personal data only for the specific purpose(s) of the transfer, as set out in Annex I.B to these Clauses. Specifically, the Data Importer shall process the personal data solely for the purposes of:
(i) real-time payment processing on behalf of the Data Exporter;
(ii) anti-fraud analytics and detection via the SBF Core platform; and
(iii) regulatory reporting in compliance with the Data Exporter's obligations under applicable law, including the Gramm-Leach-Bliley Act ("GLBA"), and requirements of the OCC, the FDIC, and the Consumer Financial Protection Bureau ("CFPB").
(b) The Data Importer may process the personal data for another purpose only upon prior instruction from the Data Exporter, which instruction shall be documented in writing.
Clause 8.3 — Transparency
(a) Upon request by a data subject, the Data Exporter shall make a copy of these Clauses, including the Annexes as completed by the parties, available to the data subject free of charge. The Data Exporter shall provide such copy within a reasonable period of time and in any event no later than thirty (30) days following receipt of the data subject's request.
(b) To the extent necessary to protect business secrets or other confidential information, including the personal data of other data subjects or information subject to legal privilege, the Data Exporter may redact part of the text of the Annexes prior to sharing a copy with the requesting data subject. However, the Data Exporter shall provide a meaningful summary of any redacted portions where the data subject would otherwise not be able to understand the content of the Clauses or exercise his or her rights thereunder.
(c) Upon request, the parties shall provide the data subject with the reasons for any redactions, to the extent possible without revealing the redacted information. This obligation shall be without prejudice to the Data Exporter's obligations under Articles 13 and 14 of the GDPR.
Clause 8.4 — Accuracy
(a) If the Data Importer becomes aware that the personal data it has received is inaccurate, or has become outdated, it shall inform the Data Exporter without undue delay. In such case, the Data Importer shall cooperate with the Data Exporter to erase or rectify the inaccurate or outdated data.
(b) The Data Importer shall implement reasonable technical and organisational measures to ensure the ongoing accuracy of the personal data it processes, including by maintaining appropriate processes for data quality assurance within the SBF Core platform.
Clause 8.5 — Duration of Processing and Erasure or Return of Data
(a) Processing by the Data Importer shall only take place for the duration specified in Annex I.B. The processing period shall consist of the term of the SaaS subscription agreement between the parties (five years, commencing upon execution of the Data Processing Agreement) plus a period of ninety (90) days following termination or expiration of such agreement (the "Post-Termination Period").
(b) After the end of the provision of the processing services, and upon expiration of the Post-Termination Period, the Data Importer shall, at the choice of the Data Exporter:
(i) delete all personal data processed on behalf of the Data Exporter and certify to the Data Exporter in writing that it has done so, specifying the date of deletion and the categories of data deleted; or
(ii) return all personal data to the Data Exporter in a commonly used, machine-readable format and delete all existing copies in the Data Importer's possession, and certify to the Data Exporter in writing that it has done so.
(c) The foregoing obligation shall not apply to the extent that the Data Importer is required by Union or Member State law or the law of the country of destination to retain the personal data for a longer period, in which case the Data Importer shall inform the Data Exporter of such requirement and shall process the retained data only for the purpose(s) required by law.
(d) The ninety (90) day Post-Termination Period shall be used exclusively for the orderly return or deletion of personal data and shall not be used for any new processing activities.
(e) Until the personal data is deleted or returned in accordance with this Clause 8.5, the Data Importer shall continue to ensure full compliance with these Clauses.
Clause 8.6 — Security of Processing
(a) The Data Importer and, during transmission, the Data Exporter shall implement appropriate technical and organisational measures to ensure the security of the personal data, including protection against a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, the personal data (hereinafter "personal data breach"). In assessing the appropriate level of security, the parties shall take due account of the state of the art, the costs of implementation, the nature, scope, context, and purpose(s) of processing, and the risks involved in the processing for the data subjects. The parties shall in particular consider having recourse to encryption or pseudonymisation, including during transmission, where the purpose of processing can be fulfilled in that manner.
(b) The Data Importer has implemented and shall maintain during the term of these Clauses the technical and organisational measures set out in Annex II. Such measures include, without limitation, the following:
(i) AES-256 encryption at rest for all personal data stored on the SBF Core platform and associated infrastructure;
(ii) TLS 1.2 or higher encryption in transit for all transmissions of personal data between the Data Exporter and the Data Importer, and between the Data Importer and its sub-processors;
(iii) multi-factor authentication ("MFA") required for all administrative access to systems processing personal data;
(iv) annual penetration testing conducted by an independent third-party security firm, currently Ironvault Security Group LLC, located at 11710 Plaza America Drive, Suite 400, Reston, Virginia 20190;
(v) SOC 2 Type II certification, with the most recent report issued by Graystone & Ketchum LLP, an independent certified public accounting firm located at 300 Delaware Avenue, Suite 700, Wilmington, Delaware 19801 (Lead Partner: Sandra Clearfield), for the audit period October 1, 2024 through September 15, 2025.
(c) The Data Importer shall grant access to the personal data to members of its personnel only to the extent strictly necessary for the implementation, management, and monitoring of the contract. The Data Importer shall enforce the principle of least privilege with respect to access to personal data.
(d) The Data Importer shall ensure that persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality. Such confidentiality obligations shall survive the termination of the individual's engagement with the Data Importer.
Clause 8.7 — Sensitive Data
(a) Where the transfer involves personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data, or biometric data for the purpose of uniquely identifying a natural person, data concerning health, or data concerning a natural person's sex life or sexual orientation, or data relating to criminal convictions and offences (hereinafter "sensitive data" or "special categories of data"), the Data Importer shall apply the specific restrictions and/or additional safeguards described in Annex I.B and Annex II.
(b) The parties acknowledge and confirm that the transfer of personal data under these Clauses includes the following categories of sensitive data:
(i) Behavioral biometric data: Keystroke dynamics and mouse movement patterns collected for anti-fraud analytics purposes. Such data constitutes biometric data for the purpose of uniquely identifying a natural person within the meaning of Article 9(1) of the GDPR.
(ii) Social Security numbers: While Social Security numbers are not categorised as special categories of data under Article 9 of the GDPR, they are treated as sensitive personal data by the parties in recognition of the heightened risk of harm associated with their unauthorised disclosure.
(c) In addition to the general security measures described in Clause 8.6 and Annex II, the Data Importer shall apply the following specific restrictions and additional safeguards with respect to the sensitive data identified in paragraph (b):
(i) enhanced encryption, including AES-256 encryption at rest and TLS 1.2+ encryption in transit, with dedicated encryption keys for sensitive data fields;
(ii) role-based access controls restricting access to sensitive data to only those personnel with a documented business need;
(iii) segregated storage of sensitive data within the SBF Core platform infrastructure;
(iv) pseudonymisation of EU data subject identifiers, including Social Security numbers, where technically feasible and consistent with the purposes of processing.
Clause 8.8 — Onward Transfers
(a) The Data Importer shall only disclose the personal data to a third party on documented instructions from the Data Exporter. Data disclosed to sub-processors engaged by the Data Importer in accordance with Clause 9 shall be subject to the terms and conditions set forth therein.
(b) Onward transfers to sub-processors are governed by Clause 9 of these Clauses. Any onward transfer to a third party other than a sub-processor shall require the prior written consent of the Data Exporter and shall be subject to appropriate safeguards, including, where applicable, Standard Contractual Clauses or an adequacy decision of the European Commission.
(c) The Data Importer has self-certified under the EU-US Data Privacy Framework under Certification ID DPF-2025-03912, effective July 1, 2025. The Data Importer's self-certification under the DPF serves as a supplementary safeguard for onward transfers of personal data within the United States, but does not replace the obligations set forth in these Clauses.
Clause 8.9 — Documentation and Compliance
(a) The Data Importer shall promptly and adequately deal with enquiries from the Data Exporter that relate to the processing of personal data under these Clauses. The Data Importer shall respond to such enquiries within ten (10) business days of receipt, or within such shorter period as may be reasonably required under the circumstances.
(b) The parties shall be able to demonstrate compliance with these Clauses. In particular, the Data Importer shall keep appropriate documentation regarding the processing activities carried out on behalf of the Data Exporter.
(c) The Data Importer shall make available to the Data Exporter all information necessary to demonstrate compliance with the obligations set out in these Clauses and shall allow for and contribute to audits, including inspections, conducted by the Data Exporter or another auditor mandated by the Data Exporter.
(d) The Data Exporter, or its mandated auditor, and/or the Data Exporter's regulators — including, without limitation, the Office of the Comptroller of the Currency ("OCC"), the Federal Deposit Insurance Corporation ("FDIC"), and the Consumer Financial Protection Bureau ("CFPB") — may conduct audits of the Data Importer with respect to the Data Importer's compliance with these Clauses, subject to the following terms:
(i) The Data Exporter shall provide no fewer than thirty (30) days' advance written notice to the Data Importer of any intended audit, specifying the proposed scope, duration, and start date of the audit.
(ii) Audits shall be conducted no more than once during any twelve (12) month period, unless an additional audit is triggered by (A) a personal data breach involving the personal data transferred under these Clauses; (B) a regulatory inquiry or examination by the OCC, FDIC, CFPB, or any European data protection supervisory authority; or (C) reasonable grounds to believe that the Data Importer is in material non-compliance with these Clauses.
(iii) Audits shall be conducted at the Data Exporter's expense, unless the audit reveals a material breach of these Clauses by the Data Importer, in which case the Data Importer shall bear the reasonable costs of the audit.
(iv) The Data Importer shall cooperate fully with the audit and shall provide the auditor with access to all relevant facilities, equipment, records, and personnel during normal business hours.
(v) All audit findings and results shall be treated as confidential information of both parties.
(e) The Data Importer may satisfy audit requests under paragraph (d) by providing its current SOC 2 Type II report (most recent: issued September 15, 2025, by Graystone & Ketchum LLP, for the audit period October 1, 2024 through September 15, 2025) together with supplemental questionnaire responses addressing any additional matters within the scope of the audit request. The provision of such report and responses shall not, however, preclude the Data Exporter's right to conduct an on-site audit in accordance with paragraph (d).
(f) The Data Importer shall immediately inform the Data Exporter if, in its opinion, an instruction from the Data Exporter infringes the GDPR or other applicable Union or Member State data protection provisions. In such case, the Data Importer shall be entitled to suspend the execution of the relevant instruction until it is confirmed or modified by the Data Exporter.
Clause 9 — Use of Sub-processors
Clause 9(a) — General Written Authorization
The parties have selected OPTION 2 — GENERAL WRITTEN AUTHORIZATION under this Clause 9.
(i) The Data Exporter hereby provides general written authorization to the Data Importer for the engagement of sub-processors from the agreed list set forth in Annex III to these Clauses. As of the date of these Clauses, the approved sub-processors are: (1) Osprey Cloud Infrastructure, Inc.; and (2) Skybridge Fintech Europe B.V.
(ii) The Data Importer shall specifically inform the Data Exporter in writing of any intended changes to the list of sub-processors set forth in Annex III through the addition or replacement of sub-processors at least thirty (30) days in advance of the proposed engagement of any new or replacement sub-processor, thereby giving the Data Exporter sufficient time to be able to object to such changes prior to the engagement of the sub-processor(s).
(iii) The Data Importer shall provide the Data Exporter with the information necessary to enable the Data Exporter to exercise its right to object, including, at a minimum, the name and address of the proposed sub-processor, a description of the processing activities to be performed by the sub-processor, the location(s) where the processing will take place, and the safeguards to be implemented by the sub-processor.
(iv) The Data Exporter may object to the appointment of a new sub-processor within thirty (30) days of receiving the notice described in paragraph (ii). If the Data Exporter objects on reasonable grounds related to data protection, the parties shall engage in good-faith discussions for a period not to exceed fifteen (15) days to resolve the objection. If the parties are unable to resolve the objection within such period, the Data Exporter may terminate these Clauses with respect to the processing activities to be performed by the proposed sub-processor, without prejudice to the Data Exporter's right to terminate the Data Processing Agreement in accordance with its terms.
Clause 9(b) — Written Contract with Sub-processor
(i) Where the Data Importer engages a sub-processor to carry out specific processing activities on behalf of the Data Exporter, it shall do so by way of a written contract (including a data processing agreement) that provides for, in substance, the same data protection obligations as those binding on the Data Importer under these Clauses, including with respect to third-party beneficiary rights for data subjects. The parties agree that, by complying with this Clause, the Data Importer fulfils its obligations under Clause 8.8.
(ii) The Data Importer shall ensure that the sub-processor agreement includes, at a minimum, provisions addressing: the subject matter and duration of the processing; the nature and purpose of the processing; the type of personal data and categories of data subjects; the obligations and rights of the Data Importer as the engaging party; and appropriate technical and organisational measures to ensure the security of the personal data.
(iii) The following sub-processor agreements are currently in effect:
(A) Skybridge–Osprey Cloud Infrastructure, Inc. Data Processing Agreement, dated March 1, 2024, which includes Standard Contractual Clauses Module 3 (Processor-to-Sub-processor) as an appendix thereto.
(B) Standard Contractual Clauses Module 3 (Processor-to-Sub-processor): Skybridge Fintech Ltd. → Osprey Cloud Infrastructure, Inc., which is a separate document being drafted concurrently with these Clauses and will form part of the complete SCC execution package.
(C) Standard Contractual Clauses Module 3 (Processor-to-Sub-processor): Skybridge Fintech Ltd. → Skybridge Fintech Europe B.V., which is a separate document being drafted concurrently with these Clauses and will form part of the complete SCC execution package.
Clause 9(c) — Sub-processor Obligations
(i) The Data Importer shall ensure that the sub-processor complies with the obligations to which the Data Importer is subject pursuant to these Clauses and Regulation (EU) 2016/679, including with respect to the security of processing, the limitation of purpose, data subject rights, and the restrictions on onward transfers.
(ii) The Data Importer shall, upon the Data Exporter's request, provide the Data Exporter with a copy of any sub-processor agreement entered into pursuant to Clause 9(b), together with any subsequent amendments thereto. To the extent necessary to protect business secrets or other confidential information (including personal data), the Data Importer may redact the text of the agreement prior to sharing a copy, but shall provide a meaningful summary of any redacted portions.
Clause 9(d) — Liability for Sub-processors
(i) The Data Importer shall remain fully responsible to the Data Exporter for the performance of the sub-processor's obligations under its sub-processor agreement. The Data Importer's liability under this Clause 9(d) is joint and several with the sub-processor to the extent permitted by applicable law.
(ii) The Data Importer shall notify the Data Exporter of any failure by the sub-processor to fulfil its data protection obligations under the sub-processor agreement without undue delay after becoming aware of such failure.
Clause 9(e) — Approved Sub-processors
As of the date of these Clauses, the following sub-processors have been approved by the Data Exporter and are listed in Annex III:
1. Osprey Cloud Infrastructure, Inc.
•  Address: 2200 Campus Drive, San Jose, California 95131
•  Description of processing: IaaS/PaaS hosting of the SBF Core platform; storage and processing of personal data
•  Data center regions: US-East (Ashburn, Virginia) and EU (Frankfurt, Germany)
•  Existing DPA: Skybridge–Osprey Cloud DPA dated March 1, 2024 (includes Module 3 SCCs)
2. Skybridge Fintech Europe B.V.
•  Address: Keizersgracht 482, 1017 EG Amsterdam, Netherlands
•  KvK (Chamber of Commerce) number: 82104593
•  Managing Director: Lena Vogt
•  Employees: 14 (8 engineers, 4 support, 2 compliance)
•  Description of processing: Processing of EU personal data for Skybridge customers; engineering, support, and compliance functions
•  Relationship: Wholly-owned subsidiary / affiliate of Skybridge Fintech Ltd.
Clause 10 — Data Subject Rights
(a) The Data Importer shall promptly notify the Data Exporter of any request it has received directly from a data subject relating to the processing of his or her personal data under these Clauses. The Data Importer shall provide the Data Exporter with sufficient details of the request to enable the Data Exporter to respond, including the identity of the data subject (to the extent disclosed), the nature of the request, and the date of receipt.
(b) The Data Importer shall not respond to such request itself unless it has been authorised to do so by the Data Exporter in writing. Where the Data Exporter instructs the Data Importer to respond to a data subject request on its behalf, the Data Importer shall do so in accordance with the Data Exporter's instructions and within the timeframes prescribed by the GDPR.
(c) The Data Importer shall assist the Data Exporter in fulfilling its obligations to respond to data subjects' requests for the exercise of their rights under the GDPR, including rights of:
(i) access to personal data (Article 15 GDPR);
(ii) rectification of inaccurate personal data (Article 16 GDPR);
(iii) erasure of personal data ("right to be forgotten") (Article 17 GDPR);
(iv) restriction of processing (Article 18 GDPR);
(v) data portability (Article 20 GDPR); and
(vi) objection to processing (Article 21 GDPR).
(d) In fulfilling its obligations under this Clause 10, the Data Importer shall comply with the instructions from the Data Exporter and the time limits set out in the GDPR, including the obligation to respond to data subject requests without undue delay and in any event within one (1) month of receipt of the request, subject to any permissible extensions.
Clause 11 — Redress
(a) The Data Importer shall inform data subjects in a transparent and easily accessible format, through its website or by individual notification, of a contact point authorised to handle complaints. As of the date of these Clauses, the designated contact point is:
Thomas Elridge, General Counsel / Chief Privacy Officer Skybridge Fintech Ltd. 4100 Silverside Road, Suite 310 Wilmington, DE 19810
Email: privacy@skybridgefintech.com
(b) The Data Importer shall deal promptly and in good faith with any complaints or requests received from data subjects relating to the processing of their personal data under these Clauses. The Data Importer shall acknowledge receipt of each complaint within five (5) business days and shall provide a substantive response within thirty (30) days, unless the complexity of the complaint justifies a longer response period.
(c) Data subjects who believe their rights under these Clauses have not been adequately addressed may also lodge a complaint with the competent supervisory authority in accordance with Clause 13 of these Clauses.
Clause 12 — Liability
(a) Each party shall be liable to the data subject(s), and the data subject(s) shall be entitled to receive compensation, for any material or non-material damages that the party causes the data subject(s) by any breach of these Clauses.
(b) The Data Importer agrees that if the data subject is not able to bring a claim for compensation against the Data Exporter arising out of a breach of these Clauses because the Data Exporter has factually disappeared, or has ceased to exist in law, or has become insolvent, the Data Importer agrees that the data subject may issue a claim against the Data Importer as if it were the Data Exporter, unless any successor entity has assumed the entire legal obligations of the Data Exporter by contract or by operation of law, in which case the data subject can enforce its rights against such entity.
(c) The Data Importer may not invoke the conduct of a sub-processor to avoid its own liability under these Clauses.
(d) Where more than one party is responsible for any damage caused to the data subject as a result of a breach of these Clauses, all responsible parties shall be jointly and severally liable, and the data subject is entitled to bring an action in court against any or all of such parties.
(e) The parties agree that if one party is held liable under paragraph (d) for damages caused by the other party, it shall be entitled to claim back from the other party that part of the compensation corresponding to the other party's responsibility for the damage.
(f) The Data Importer may not invoke the conduct of the Data Exporter or a sub-processor to avoid its own liability.
[Note for negotiation: The parties should note that the liability provisions of these Clauses operate in addition to, and separately from, the liability cap provisions set forth in Section 10 of the Data Processing Agreement (which cap Skybridge's aggregate liability at the greater of $5,000,000 or two times (2×) the trailing twelve-month fees paid by Meridian under the SaaS subscription agreement; for Meridian, as of the date of these Clauses, this amount is $5,480,000). Pursuant to well-established guidance from EU data protection authorities, the SCC liability provisions may not be contractually limited vis-à-vis data subjects. Accordingly, the DPA liability cap applies as between the parties, but does not apply to claims brought directly by data subjects under these Clauses.]
Clause 13 — Supervision
(a) The competent supervisory authority with responsibility for ensuring compliance by the Data Exporter with Regulation (EU) 2016/679 as regards the data transfer shall be the Autoriteit Persoonsgegevens (Dutch Data Protection Authority), as the supervisory authority of the Member State in which the Data Importer's EU establishment, Skybridge Fintech Europe B.V., is located.
[Note for negotiation: The selection of the Autoriteit Persoonsgegevens (Dutch DPA) as the competent supervisory authority is to be confirmed during negotiation with Kevin Ostrowski (Meridian) and Thomas Elridge (Skybridge). The Netherlands is the appropriate jurisdiction given that (i) SBF Europe B.V. is established in Amsterdam and serves as the Data Importer's relevant EU presence; (ii) the governing law of these Clauses is the law of the Netherlands (Clause 17); and (iii) in the alternative, the authority of the Member State where the affected data subjects reside may also have jurisdiction. The parties may also wish to consider whether any EU-resident data subjects are concentrated in a specific Member State that would warrant designation of a different supervisory authority.]
(b) The Data Exporter agrees to submit itself to the jurisdiction of, and cooperate with, the competent supervisory authority identified in paragraph (a) in any procedures aimed at ensuring compliance with these Clauses. In particular, the Data Exporter agrees to respond to enquiries, submit to audits, and comply with the measures adopted by the supervisory authority, including remedial and compensatory measures. The Data Exporter shall provide written confirmation of such submission to the Data Importer upon execution of these Clauses.
(c) The Data Importer agrees to cooperate with the competent supervisory authority and abide by its decisions on all issues related to compliance with these Clauses. The Data Importer agrees to submit to audits by the competent supervisory authority covering the processing activities covered by these Clauses.
(d) The parties agree that the data subject may, as an alternative to lodging a complaint with the competent supervisory authority, refer the matter to a court of competent jurisdiction in the Netherlands in accordance with Clause 18.
SECTION III — LOCAL LAWS AND OBLIGATIONS IN CASE OF ACCESS BY PUBLIC AUTHORITIES
Clause 14 — Local Laws and Practices Affecting Compliance with the Clauses
Clause 14(a) — Warranties
(i) The parties warrant that they have no reason to believe that the laws and practices in the third country of destination — the United States of America — applicable to the processing of the personal data by the Data Importer, including any requirements to disclose personal data or measures authorising access by public authorities, prevent the Data Importer from fulfilling its obligations under these Clauses. This warranty is based on the understanding that laws and practices that respect the essence of the fundamental rights and freedoms of individuals and do not exceed what is necessary and proportionate in a democratic society to safeguard one of the objectives listed in Article 23(1) of Regulation (EU) 2016/679 are not in contradiction with these Clauses.
(ii) The parties acknowledge the importance of the Court of Justice of the European Union's judgment in Case C-311/18 (Data Protection Commissioner v. Kestrel Services Inc. Ireland and Maximillian Schrems), commonly known as "Schrems II," and have taken into account the principles established therein in entering into these Clauses.
(iii) In support of the warranty set forth in paragraph (i), the parties rely upon the Transfer Impact Assessment prepared by Calderwood & Harkness LLP, dated December 8, 2025 (the "TIA"), which assessed the laws and practices of the United States of America as they relate to the transfer of personal data under these Clauses. The TIA concluded that the supplementary measures adopted by the parties — including AES-256 encryption at rest, TLS 1.2+ encryption in transit, multi-factor authentication for administrative access, annual penetration testing, SOC 2 Type II certification, and the Data Importer's self-certification under the EU-US Data Privacy Framework — adequately address the risks of United States government access to the personal data transferred under these Clauses.
Clause 14(b) — Relevant Legislation and Practices
The parties declare that, in particular with regard to the laws and practices of the United States of America, the following elements were taken into account in the assessment under Clause 14(a):
(i) Applicable legislation and practices (including those requiring disclosure of data to public authorities or authorising access by such authorities):
(A) Foreign intelligence Surveillance Act ("FISA"), Section 702: Section 702 of FISA authorises the United States government to target non-US persons reasonably believed to be located outside the United States to acquire foreign intelligence information. The parties note that FISA Section 702 is directed at "electronic communication service providers" as defined in 50 U.S.C. § 1881(b)(4). Skybridge Fintech Ltd. is not a telecommunications carrier, an electronic communication service provider, a remote computing service, or any other type of entity subject to directives under Section 702. Accordingly, the risk that Skybridge would be subject to mass surveillance access under Section 702 is assessed as low.
(B) Executive Order 12333: Executive Order 12333 authorises US intelligence agencies to collect foreign intelligence information. The parties note that Executive Order 14086, signed on October 7, 2022, substantially reformed the framework governing signals intelligence activities under E.O. 12333 by establishing principles of necessity and proportionality for signals intelligence collection and by creating the Data Protection Review Court to adjudicate complaints from individuals in qualifying states and regional economic integration organisations (including the European Union).
(C) USA PATRIOT Act: The USA PATRIOT Act (Pub. L. 107-56) expanded the authority of US law enforcement and intelligence agencies to obtain records and other tangible things through orders issued by the Foreign intelligence Surveillance Court. The parties note that certain provisions of the PATRIOT Act, including Section 215, expired on March 15, 2020, and that the remaining provisions are subject to judicial oversight by the FISA Court.
(ii) Assessment: Based on the analysis conducted in the TIA, and taking into account the nature of the personal data transferred, the purposes of the processing, and the Data Importer's status as a financial technology company (rather than a telecommunications carrier or electronic communications service provider), the parties have concluded that the risk of governmental access to the personal data transferred under these Clauses is low.
(iii) EU-US Data Privacy Framework: The Data Importer has self-certified under the EU-US Data Privacy Framework under Certification ID DPF-2025-03912, effective July 1, 2025. The DPF was established by the European Commission's adequacy decision of 10 July 2023, which determined that the United States ensures an adequate level of protection for personal data transferred from the EU to organisations in the United States that have self-certified under the DPF. The Data Importer's DPF self-certification provides additional safeguards, including binding commitments regarding limitations on government access to personal data and the availability of redress mechanisms for EU data subjects.
(iv) Applicable supervisory oversight mechanisms: The parties note the existence of the following oversight mechanisms in the United States:
(A) the Privacy and Civil Liberties Oversight Board ("PCLOB");
(B) the Foreign intelligence Surveillance Court ("FISA Court");
(C) the Data Protection Review Court, established pursuant to Executive Order 14086 and implementing regulations issued by the Attorney General (28 C.F.R. Part 201); and
(D) the Inspectors General of the relevant intelligence community agencies.
(v) Relevant published reports or case law: The parties have reviewed relevant publicly available reports and case law regarding access by public authorities in the United States, including the annual transparency reports published by the Office of the Director of National intelligence, the PCLOB's reports on the implementation of Section 702, and the CJEU's judgment in Case C-311/18 (Schrems II).
Clause 14(c) — Review Obligation
The Data Importer warrants that, in carrying out the assessment under Clause 14(b), it has made its best efforts to provide the Data Exporter with relevant information regarding the laws and practices of the United States applicable to the processing of personal data under these Clauses. The Data Importer agrees that it will continue to cooperate with the Data Exporter in ensuring compliance with these Clauses, including by promptly providing any additional information that may be necessary or helpful for the Data Exporter's ongoing assessment of the adequacy of the safeguards established by these Clauses. The Data Importer confirms that it is not aware of any laws or practices that would prevent it from fulfilling its obligations under these Clauses.
Clause 14(d) — Notification of Changes
(i) The Data Importer agrees to notify the Data Exporter promptly if, after having agreed to these Clauses, and for the duration of the contract, it has reason to believe that it is or has become subject to laws or practices not in line with the requirements under Clause 14(a), including following a change in the laws of the country of destination or a measure (such as a disclosure request) indicating an application of such laws in practice that is not in line with the requirements in Clause 14(a).
(ii) Following a notification pursuant to paragraph (i), or if the Data Exporter otherwise has reason to believe that the Data Importer can no longer fulfil its obligations under these Clauses, the Data Exporter shall promptly identify appropriate measures — such as technical or organisational measures to ensure the security and confidentiality of the personal data — to be adopted by the Data Exporter and/or the Data Importer to address the situation. The Data Exporter shall suspend the data transfer if it considers that no appropriate safeguards for such transfer can be ensured, or if instructed to do so by the competent supervisory authority.
(iii) If the Data Exporter decides to suspend or terminate the transfer of personal data pursuant to paragraph (ii), it shall notify the Data Importer in writing, and the Data Importer shall promptly delete or return all personal data transferred under these Clauses in accordance with Clause 8.5.
Clause 14(e) — Supplementary Measures
The parties have identified the following supplementary measures to address the findings of the Transfer Impact Assessment dated December 8, 2025, and to provide additional safeguards for the transfer of personal data under these Clauses:
(i) AES-256 encryption at rest for all personal data stored on the SBF Core platform and associated infrastructure, including on all Osprey Cloud Infrastructure, Inc. servers and storage systems;
(ii) TLS 1.2+ encryption in transit for all transmissions of personal data, including transmissions between the Data Exporter and the Data Importer, between the Data Importer and its sub-processors, and within the Data Importer's internal networks;
(iii) Multi-factor authentication for all administrative access to systems processing EU personal data, including all access to the SBF Core platform's administrative console, database management interfaces, and encryption key management systems;
(iv) Annual penetration testing conducted by Ironvault Security Group LLC, an independent third-party security firm, with results shared with the Data Exporter upon request and subject to appropriate confidentiality protections;
(v) SOC 2 Type II certification issued by Graystone & Ketchum LLP, with the most recent report covering the audit period October 1, 2024 through September 15, 2025;
(vi) EU-US Data Privacy Framework self-certification (Certification ID: DPF-2025-03912, effective July 1, 2025), which imposes binding obligations on the Data Importer regarding the processing of personal data transferred from the EU and provides EU data subjects with redress mechanisms, including the Data Protection Review Court;
(vii) Pseudonymisation of EU data subject identifiers where technically feasible, including the replacement of direct identifiers (such as names and Social Security numbers) with pseudonymous tokens for processing within the SBF Core platform, with the mapping table maintained separately and subject to additional access controls.
Clause 15 — Obligations of the Data Importer in Case of Access by Public Authorities
Clause 15.1 — Notification
(a) The Data Importer agrees to notify the Data Exporter and, where possible, the data subject (with the assistance of the Data Exporter if necessary) promptly if it:
(i) receives a legally binding request from a public authority, including judicial authorities, under the laws of the country of destination for the disclosure of personal data transferred pursuant to these Clauses; such notification shall include information about the personal data requested, the requesting authority, the legal basis for the request, and the response provided; or
(ii) becomes aware of any direct access by public authorities to personal data transferred pursuant to these Clauses in accordance with the laws of the country of destination; in such case, the Data Importer shall use its best efforts to provide the Data Exporter with as much information as possible regarding such access.
(b) If the Data Importer is prohibited under the laws of the country of destination from notifying the Data Exporter and/or the data subject, the Data Importer agrees to use its best efforts to obtain a waiver of the prohibition, with a view to communicating as much information as possible, as soon as possible. The Data Importer agrees to document its best efforts in order to be able to demonstrate them on request of the Data Exporter.
(c) Where permissible under the laws of the country of destination, the Data Importer agrees to provide the Data Exporter, at regular intervals for the duration of the contract, with as much relevant information as possible on the requests received (in particular, number of requests, type of data requested, requesting authority/ies, whether requests have been challenged and the outcome of such challenges, etc.).
(d) The Data Importer agrees to preserve the information pursuant to paragraphs (a) through (c) for the duration of the contract and make it available to the competent supervisory authority on request.
Clause 15.2 — Review of Legality and Data Minimization
(a) The Data Importer agrees to review the legality of any request for disclosure received from a public authority under the laws of the country of destination, in particular whether the request remains within the powers granted to the requesting public authority, and to challenge the request if, after careful assessment, it concludes that there are reasonable grounds to consider that the request is unlawful under the laws of the country of destination, applicable obligations under international law, and principles of international comity. The Data Importer shall, under the same conditions, pursue possibilities of appeal. When challenging a request, the Data Importer shall seek interim measures with a view to suspending the effects of the request until the competent judicial authority has decided on its merits. It shall not disclose the personal data requested until required to do so under the applicable procedural rules.
(b) The Data Importer agrees to document its legal assessment of the legality of the request and any challenge to the request, and, to the extent permissible under the laws of the country of destination, to make such documentation available to the Data Exporter upon request. The Data Importer shall also make such documentation available to the competent supervisory authority on request.
(c) The Data Importer agrees that, when responding to a request for disclosure, it shall provide the minimum amount of information permissible, based on a reasonable interpretation of the request.
SECTION IV — FINAL PROVISIONS
Clause 16 — Non-Compliance with the Clauses and Termination
(a) The Data Importer shall promptly inform the Data Exporter if it is unable to comply with these Clauses, for whatever reason.
(b) In the event that the Data Importer is in breach of these Clauses or is unable to comply with these Clauses, the Data Exporter shall suspend the transfer of personal data to the Data Importer until compliance is again ensured or the contract is terminated. This is without prejudice to Clause 14(d).
(c) The Data Exporter shall be entitled to terminate the contract, insofar as it concerns the processing of personal data under these Clauses, where:
(i) the Data Exporter has suspended the transfer of personal data to the Data Importer pursuant to paragraph (b), and compliance with these Clauses is not restored within a reasonable time, and in any event within one (1) month of suspension;
(ii) the Data Importer is in substantial or persistent breach of these Clauses;
(iii) the Data Importer fails to comply with a binding decision of a competent court or supervisory authority regarding its obligations under these Clauses; or
(iv) where the Data Importer ceases to be subject to the laws and practices described in Clause 14(b) and no adequate supplementary measures are available.
(d) In these cases, the Data Exporter shall notify the competent supervisory authority identified in Clause 13 of such non-compliance. Where the contract involves more than two parties, the Data Exporter may exercise this right to termination only with respect to the relevant party, unless the parties have agreed otherwise.
(e) Personal data that has been transferred prior to the termination of the contract pursuant to paragraph (c) shall, at the choice of the Data Exporter, immediately be returned to the Data Exporter or deleted in its entirety. The same shall apply to any copies of the data. The Data Importer shall certify the deletion of the data to the Data Exporter in writing. Until the data is deleted or returned, the Data Importer shall continue to ensure compliance with these Clauses. In cases of local laws applicable to the Data Importer that prohibit the return or deletion of the transferred personal data, the Data Importer warrants that it will continue to ensure compliance with these Clauses and will only process the data to the extent and for as long as required under that local law.
Clause 17 — Governing Law
(a) These Clauses shall be governed by the law of the Netherlands, which is the law of the Member State in which the Data Importer's EU establishment, Skybridge Fintech Europe B.V., is located.
(b) The governing law selected under this Clause 17 applies solely to these Standard Contractual Clauses. The Data Processing Agreement to which these SCCs are appended, and the Master SaaS Subscription Agreement between the parties, are governed by the law of the State of Delaware, United States of America, and nothing in this Clause 17 shall