STANDARD CONTRACTUAL CLAUSES
(PROCESSOR-TO-SUB-PROCESSOR) — MODULE 3
Pursuant to EU Commission Implementing Decision (EU) 2021/914 of 4 June 2021
DATA EXPORTER: Skybridge Fintech Ltd. (Processor)
DATA IMPORTER: Osprey Cloud Infrastructure, Inc. (Sub-processor)
Prepared by: Alan Burke Calderwood & Harkness LLP 1735 Market Street, Suite 2800 Philadelphia, PA 19103
Matter No.: 1009-00004
Date: December 12, 2025
DRAFT — FOR DISCUSSION PURPOSES ONLY
These Standard Contractual Clauses form part of, and are appended to, the Data Processing Agreement between Meridian Federal Savings Bank (Controller) and Skybridge Fintech Ltd. (Processor), and supplement the Skybridge–Osprey Cloud Data Processing Agreement dated March 1, 2024. This draft is confidential attorney work product and is subject to further revision and finalization. Execution version is anticipated February 5, 2026, for signing on February 15, 2026.
Right-click to update Table of Contents
PREAMBLE
These Standard Contractual Clauses ("Clauses" or "SCCs") are entered into by and between the following parties:
Data Exporter: Skybridge Fintech Ltd., a Delaware corporation (C-corp), with its principal place of business and headquarters located at 4100 Silverside Road, Suite 310, Wilmington, DE 19810, United States of America (hereinafter referred to as the "Processor" or "Data Exporter");
and
Data Importer: Osprey Cloud Infrastructure, Inc., a Delaware corporation, with its principal place of business and headquarters located at 2200 Campus Drive, San Jose, CA 95131, United States of America (hereinafter referred to as the "Sub-processor" or "Data Importer"),
each a "Party" and together the "Parties."
WHEREAS, the Data Exporter acts as a processor of personal data on behalf of its controller clients, including Meridian Federal Savings Bank, a federally chartered savings bank organized and existing under the laws of the United States (OCC Charter No. 14-2238), with its principal office located at 900 Broad Street, Suite 1200, Newark, NJ 07102 (the "Controller"). The Data Exporter provides the Controller with certain software-as-a-service payment processing, anti-fraud analytics, and regulatory reporting services through its proprietary SBF Core platform, in connection with which the Data Exporter processes personal data of the Controller's accountholders, including those residing in the European Union.
WHEREAS, these Clauses are adopted pursuant to Article 46(2)(c) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (the "General Data Protection Regulation" or "GDPR"), and in accordance with the EU Commission Implementing Decision (EU) 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679. The Parties have selected and incorporated Module 3 (Processor-to-Sub-processor) of the standard contractual clauses as set forth in the Annex to that Implementing Decision.
WHEREAS, these SCCs supplement the existing Data Processing Agreement between Skybridge Fintech Ltd. and Osprey Cloud Infrastructure, Inc. dated March 1, 2024 (the "Skybridge–Osprey Cloud DPA"), with respect to transfers of personal data originating from the European Union or the European Economic Area to Osprey Cloud Infrastructure, Inc. in the United States of America. These SCCs are intended to provide appropriate safeguards for such transfers in accordance with the requirements of the GDPR and applicable supervisory authority guidance.
WHEREAS, the Data Exporter has self-certified under the EU-US Data Privacy Framework established pursuant to the European Commission's adequacy decision of 10 July 2023, under Certification ID: DPF-2025-03912, effective as of July 1, 2025. The Data Exporter's participation in the EU-US Data Privacy Framework supplements, but does not replace, the safeguards provided by these Clauses. In the event of any conflict between the obligations arising under the Data Privacy Framework and these Clauses, the provision affording the greater protection to data subjects shall prevail.
WHEREAS, these Clauses are intended to ensure appropriate safeguards for the transfer of personal data of approximately 3,200 EU-resident accountholders of Meridian Federal Savings Bank whose personal data is processed through the SBF Core platform and hosted on Osprey Cloud's infrastructure. The Parties acknowledge that the protection of these data subjects' fundamental rights and freedoms, particularly their right to the protection of personal data, is a primary objective of these Clauses.
NOW, THEREFORE, the Parties agree as follows. Defined terms used herein and not otherwise defined shall have the meanings ascribed to them in the GDPR or, where applicable, in the Data Processing Agreement between the Controller and the Data Exporter, or in the Skybridge–Osprey Cloud DPA dated March 1, 2024. In the event of any conflict between the definitions set forth in these Clauses and those in the underlying agreements, the definitions in these Clauses shall take precedence for purposes of interpreting the Parties' obligations hereunder.
SECTION I — GENERAL PROVISIONS
Clause 1 — Purpose and Scope
(a) The purpose of these Standard Contractual Clauses is to ensure compliance with the requirements of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (the General Data Protection Regulation) for the transfer of personal data to a third country. Specifically, these Clauses are designed to provide appropriate safeguards as required by Article 46(2)(c) of the GDPR for the international transfer of personal data, and to ensure that the sub-processing of such data by the Data Importer is subject to obligations consistent with Article 28(3) and (4) of the GDPR, which govern the engagement of sub-processors.
(b) These Clauses apply to the transfer of personal data as specified in Annex I.B from Skybridge Fintech Ltd., the Data Exporter, which is established in the United States of America and processes personal data on behalf of EU-based data subjects through its affiliate, Skybridge Fintech Europe B.V. (Keizersgracht 482, 1017 EG Amsterdam, Netherlands, KvK No. 82104593), to Osprey Cloud Infrastructure, Inc., the Data Importer, which is also established in the United States of America and provides infrastructure-as-a-service and platform-as-a-service hosting for the Data Exporter's SBF Core platform.
(c) The Parties have selected Module 3 of the standard contractual clauses set out in the Annex to EU Commission Implementing Decision (EU) 2021/914. Module 3 applies to transfers from a processor (the Data Exporter, Skybridge Fintech Ltd.) to a sub-processor (the Data Importer, Osprey Cloud Infrastructure, Inc.). The transfer involves personal data of EU-resident accountholders of the Controller (Meridian Federal Savings Bank), which is processed through the SBF Core platform for the purposes of payment processing, fraud detection, and regulatory reporting.
(d) The Annexes to these Clauses form an integral part of the Clauses and contain additional information that supplements the provisions set forth herein, including a detailed description of the transfer, the technical and organizational measures implemented by the Data Importer, and the list of sub-processors engaged by the Data Importer.
Clause 2 — Effect and Invariability of the Clauses
(a) These Clauses set out appropriate safeguards, including enforceable data subject rights and effective legal remedies, pursuant to Article 46(1) and Article 46(2)(c) of Regulation (EU) 2016/679. The Parties acknowledge that these safeguards are intended to provide a level of protection for personal data that is essentially equivalent to that guaranteed by the GDPR, taking into account the specific circumstances of the transfer, the laws and practices of the third country of destination, and the supplementary measures implemented by the Parties.
(b) These Clauses shall not be modified in any way, except as expressly permitted by the EU Commission Implementing Decision (EU) 2021/914. Such permitted modifications are limited to the following: (i) the selection of the appropriate module (Module 3, as selected by the Parties); (ii) the completion of optional clauses, where applicable; and (iii) the addition of information in the Annexes to these Clauses, as necessary to describe the specific circumstances of the transfer. Any other modification to these Clauses would deprive them of the status of standard contractual clauses approved by the European Commission and would undermine the safeguards they are intended to provide.
(c) The foregoing does not prevent the Parties from incorporating these Standard Contractual Clauses into a broader contract or from adding other clauses or additional safeguards, provided that such clauses or safeguards do not contradict, directly or indirectly, these Clauses or prejudice the fundamental rights or freedoms of data subjects. In this regard, the Parties note that these Clauses are incorporated into and form part of the following broader contractual framework:
(i) the Data Processing Agreement between Meridian Federal Savings Bank (Controller) and Skybridge Fintech Ltd. (Processor), including all schedules and exhibits thereto; and
(ii) the Data Processing Agreement between Skybridge Fintech Ltd. and Osprey Cloud Infrastructure, Inc. dated March 1, 2024 (the "Skybridge–Osprey Cloud DPA"), including all schedules, exhibits, and amendments thereto.
(d) The Parties acknowledge and agree that, to the extent of any conflict between these Clauses and the provisions of the Skybridge–Osprey Cloud DPA or any other agreement between the Parties, the provisions of these Clauses shall prevail with respect to the protection of personal data transferred pursuant hereto.
Clause 3 — Third-Party Beneficiaries
(a) Data subjects whose personal data is transferred under these Clauses may invoke and enforce these Clauses, as third-party beneficiaries, against the Data Exporter and/or the Data Importer. The Parties acknowledge that the data subjects' status as third-party beneficiaries of these Clauses is a fundamental element of the safeguards provided herein, and the Parties shall not take any action that would impair or diminish the data subjects' ability to exercise their rights under these Clauses.
(b) The third-party beneficiaries of these Clauses include, without limitation, the approximately 3,200 EU-resident accountholders of Meridian Federal Savings Bank whose personal data is transferred from the Data Exporter to the Data Importer in the course of the Data Importer's provision of cloud infrastructure hosting services for the SBF Core platform. This includes retail and small-business accountholders, authorized signers, beneficial owners, and such other data subjects as may be described in Annex I.B.
(c) Under Module 3 (Processor-to-Sub-processor), data subjects may invoke and enforce the following Clauses as third-party beneficiaries:
(i) Clause 1 (Purpose and Scope);
(ii) Clause 2 (Effect and Invariability of the Clauses);
(iii) Clause 3 (Third-Party Beneficiaries);
(iv) Clause 8 (Data Protection Safeguards — Module 3);
(v) Clause 9 (Use of Sub-processors — Module 3);
(vi) Clause 10 (Data Subject Rights — Module 3);
(vii) Clause 11 (Redress);
(viii) Clause 12 (Liability);
(ix) Clause 13 (Local Laws and Practices Affecting Compliance with the Clauses);
(x) Clause 15 (Supervision);
(xi) Clause 16 (Non-compliance with the Clauses and Termination);
(xii) Clause 17 (Governing Law); and
(xiii) Clause 18 (Choice of Forum and Jurisdiction).
(d) The provisions of this Clause are without prejudice to any rights that data subjects may have under the GDPR, applicable national implementing legislation, or other applicable data protection laws.
Clause 4 — Interpretation
(a) These Clauses shall be read and interpreted in light of the provisions of Regulation (EU) 2016/679 (the GDPR), including the recitals thereto, and in a manner consistent with the objectives and purposes of that Regulation. The Parties acknowledge that the GDPR is the primary legal framework for the protection of personal data within the European Union, and that these Clauses are intended to give effect to the requirements of the GDPR with respect to international data transfers.
(b) Where these Clauses use terms that are defined in Regulation (EU) 2016/679, those terms shall have the same meaning as in that Regulation. This includes, without limitation, the terms "personal data," "processing," "controller," "processor," "data subject," "supervisory authority," "personal data breach," "special categories of personal data," and "third country." The Parties shall interpret these terms consistently with the guidance and decisions of the European Data Protection Board and the competent supervisory authorities.
(c) These Clauses shall be read and interpreted in accordance with the provisions of the GDPR, and the Parties' obligations hereunder shall be construed in a manner that is consistent with the full body of the GDPR, including its principles relating to lawfulness, fairness, transparency, purpose limitation, data minimization, accuracy, storage limitation, integrity and confidentiality, and accountability.
(d) These Clauses shall not be interpreted in a way that conflicts with the rights and obligations provided for in Regulation (EU) 2016/679. In the event of any ambiguity in the interpretation of these Clauses, the interpretation that most closely aligns with the purposes and protections of the GDPR shall prevail, and in all cases, the interpretation affording the greatest protection to data subjects shall be preferred.
SECTION II — OBLIGATIONS OF THE PARTIES
Clause 8 — Data Protection Safeguards (Module 3)
The Data Importer warrants that it has implemented appropriate technical and organizational measures to ensure the security and protection of personal data transferred under these Clauses, and that it will comply with the following obligations throughout the duration of its processing activities:
Clause 8.1 — Instructions
(a) The Data Importer (Osprey Cloud Infrastructure, Inc.) shall process the personal data only on documented instructions from the Data Exporter (Skybridge Fintech Ltd.), acting in its capacity as processor on behalf of the Controller (Meridian Federal Savings Bank). Such instructions shall be documented in writing and shall include, at a minimum, the subject matter, duration, nature, and purpose of the processing, as well as the categories of personal data and categories of data subjects. The initial instructions are set forth in Annex I.B to these Clauses and in the Skybridge–Osprey Cloud DPA dated March 1, 2024.
(b) The Data Exporter shall inform the Data Importer, in writing and without undue delay, of any changes to the processing instructions, including any new or modified instructions received from the Controller. The Data Importer shall not process personal data in any manner that is inconsistent with the documented instructions of the Data Exporter, unless required to do so by Union or Member State law to which the Data Importer is subject, in which case the Data Importer shall inform the Data Exporter of that legal requirement before processing, unless that law prohibits such notification on important grounds of public interest.
(c) If the Data Importer is unable to follow the instructions of the Data Exporter, including where it believes that an instruction infringes the GDPR or other Union or Member State data protection provisions, it shall promptly inform the Data Exporter. The Data Exporter shall, upon receipt of such notification, in turn inform the Controller (Meridian Federal Savings Bank) of the Data Importer's inability to comply with the instructions. If the Data Exporter itself is unable to resolve the matter after consulting with the Controller, the Data Exporter shall be entitled to suspend the transfer of personal data and/or terminate the relevant processing services in accordance with Clause 16.
(d) For purposes of these Clauses, the processing purposes authorized by the Data Exporter, on behalf of the Controller, are as follows: infrastructure hosting in the form of infrastructure-as-a-service (IaaS) and platform-as-a-service (PaaS) for the SBF Core platform, including compute, storage, and networking services. These infrastructure services support the Data Exporter's provision of payment processing, anti-fraud analytics, and regulatory reporting services to the Controller. The Data Importer shall not process personal data for any purpose beyond the provision of these infrastructure hosting services, unless expressly authorized in writing by the Data Exporter with the prior consent of the Controller.
Clause 8.2 — Purpose Limitation
(a) The Data Importer shall process the personal data only for the specific purpose(s) of the transfer, as set out in Annex I.B to these Clauses, unless on further documented instructions from the Data Exporter, provided that such further instructions have been authorized by the Controller. The Data Importer acknowledges and agrees that the personal data transferred under these Clauses has been entrusted to the Data Exporter by the Controller for specific and limited purposes, and that any processing beyond those purposes would constitute a breach of these Clauses and of the GDPR.
(b) The Data Importer shall not process the personal data for its own purposes, including but not limited to marketing, profiling, product development, analytics, or any other purpose unrelated to the provision of infrastructure hosting services to the Data Exporter. The Data Importer further agrees that it shall not combine the personal data transferred under these Clauses with personal data obtained from other sources or with personal data processed on behalf of other customers of the Data Importer, except to the extent strictly necessary for the provision of the hosting services described in Annex I.B and as expressly authorized in the documented instructions of the Data Exporter.
Clause 8.3 — Transparency
(a) On request, the Data Exporter shall make a copy of these Clauses, including the Annexes as completed by the Parties, available to the data subject free of charge. To the extent necessary to protect business secrets or other confidential information, including personal data of other individuals, the technical and organizational measures described in Annex II, or proprietary security architecture, the Data Exporter may redact part of the text of the Annexes prior to sharing a copy, but shall provide a meaningful summary where the data subject would otherwise not be able to understand the content or exercise his or her rights.
(b) The Data Exporter shall make available to the data subject, upon request, the identity and contact details of the Data Importer, a description of the nature of the processing, the categories of personal data processed, and any other information necessary to ensure fair and transparent processing. The Data Exporter shall respond to such requests in a timely manner, and in any event within thirty (30) calendar days of receipt of the request.
(c) The Data Exporter shall, upon request, provide the competent supervisory authority (the Autoriteit Persoonsgegevens) with access to these Clauses and the Annexes, as well as any supplementary information necessary for the supervisory authority to assess the adequacy of the safeguards provided by these Clauses.
Clause 8.4 — Accuracy
(a) If the Data Importer becomes aware that the personal data it has received is inaccurate, or has become outdated, it shall inform the Data Exporter without undue delay and in any event within five (5) business days of becoming aware of such inaccuracy. The notification shall identify the affected data, the nature of the inaccuracy, and, where possible, the steps the Data Importer has taken or proposes to take to address the issue.
(b) The Data Importer shall cooperate with the Data Exporter to erase or rectify the inaccurate data, as applicable, in accordance with the documented instructions of the Data Exporter and consistent with the Data Importer's technical capabilities. The Parties acknowledge that, given the nature of the Data Importer's processing (infrastructure hosting), the Data Importer may have limited ability to identify inaccuracies in the content of the personal data without notification from the Data Exporter.
Clause 8.5 — Duration of Processing and Erasure/Return of Data
(a) Processing by the Data Importer shall be for the duration of the SaaS subscription agreement between the Data Exporter (Skybridge Fintech Ltd.) and its Controller client (Meridian Federal Savings Bank), plus a period of ninety (90) calendar days following the termination or expiration of such subscription agreement, during which time the Data Exporter may request the return or deletion of all personal data held by the Data Importer.
(b) Upon termination or expiration of the Data Exporter's contractual relationship with the Controller, or upon termination of the Skybridge–Osprey Cloud DPA, the Data Importer shall, at the choice of the Data Exporter:
(i) delete all personal data processed on behalf of the Data Exporter and certify to the Data Exporter that it has done so; or
(ii) return all personal data to the Data Exporter in a commonly used, machine-readable format, and thereafter delete all remaining copies of the personal data and certify to the Data Exporter that it has done so.
(c) The Data Importer's obligation to delete or return personal data extends to all copies, whether in production systems, backup systems, disaster recovery systems, or any other storage medium under the Data Importer's control. Where it is not technically feasible to delete personal data from backup or archival systems immediately upon termination, the Data Importer shall isolate such data and refrain from any further processing until deletion is technically feasible, and shall complete such deletion no later than ninety (90) calendar days following the termination date.
(d) The Data Importer shall not be required to delete or return personal data to the extent that it is required by applicable law to retain such data, provided that the Data Importer (i) informs the Data Exporter of such retention obligation, identifying the specific legal basis for retention and the categories of data affected; (ii) ensures that the retained data is protected in accordance with these Clauses and the technical and organizational measures set forth in Annex II; and (iii) processes such retained data solely for the purpose required by the applicable law.
(e) The Data Importer shall provide a written certification of destruction to the Data Exporter within fifteen (15) business days following the completion of all deletion activities. Such certification shall be signed by an authorized officer of the Data Importer and shall confirm the complete and irreversible destruction of all personal data, identifying the methods of destruction used.
(f) The provisions of this Clause 8.5 are consistent with, and supplement, the data return and destruction provisions set forth in the Skybridge–Osprey Cloud DPA dated March 1, 2024.
Clause 8.6 — Security of Processing
(a) The Data Importer (Osprey Cloud Infrastructure, Inc.) shall implement and maintain appropriate technical and organizational measures to ensure a level of security appropriate to the risk presented by the processing, taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing, as well as the risks of varying likelihood and severity for the rights and freedoms of natural persons. The specific technical and organizational measures implemented by the Data Importer are described in detail in Annex II to these Clauses, and include, without limitation, the following:
(i) Encryption at Rest: AES-256 encryption for all personal data stored on the Data Importer's systems, including production databases, data warehouses, file storage systems, and backup media.
(ii) Encryption in Transit: TLS 1.2 or higher encryption for all personal data transmitted between endpoints, including data transmitted between the Data Exporter's application layer and the Data Importer's infrastructure, between data center regions, and between the Data Importer's internal systems.
(iii) Multi-Factor Authentication (MFA): Multi-factor authentication required for all administrative and privileged access to systems that process or have access to personal data, including production environments, management consoles, and monitoring systems.
(iv) Physical Security: Physical security measures at all data center facilities, including the US-East data center region located in Ashburn, Virginia and the EU data center region located in Frankfurt, Germany. Physical security measures include biometric access controls, closed-circuit television (CCTV) monitoring, 24/7 on-site security personnel, man-trap entry systems, and environmental controls (fire suppression, climate control, flood detection).
(v) Disaster Recovery: Disaster recovery capabilities at the Osprey Cloud US-East secondary availability zone (Ashburn, Virginia), with defined recovery time objectives (RTOs) and recovery point objectives (RPOs) as set forth in the Skybridge–Osprey Cloud DPA dated March 1, 2024.
(vi) Access Controls and Logging: Role-based access controls with the principle of least privilege, comprehensive audit logging of all access to personal data, and regular review and de-provisioning of access credentials upon personnel changes.
(b) The Data Importer shall grant access to the personal data being processed only to members of its personnel who need such access for the performance of the infrastructure hosting services described in Annex I.B, and who are bound by written confidentiality obligations. The Data Importer shall ensure that all persons authorized to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality, and that they have received appropriate training on their data protection responsibilities.
(c) In the event of a personal data breach (as defined in Article 4(12) of the GDPR) involving personal data processed by the Data Importer under these Clauses, the Data Importer shall notify the Data Exporter without undue delay after becoming aware of the breach, and in any event within such time as will enable the Data Exporter to meet its forty-eight (48) hour notification obligation to the Controller under the Data Processing Agreement between the Controller and the Data Exporter. The notification shall include, at a minimum:
(i) a description of the nature of the personal data breach, including, where possible, the categories and approximate number of data subjects concerned and the categories and approximate number of personal data records concerned;
(ii) the name and contact details of the Data Importer's data protection officer or other contact point where more information can be obtained;
(iii) a description of the likely consequences of the personal data breach;
(iv) a description of the measures taken or proposed to be taken to address the personal data breach, including, where appropriate, measures to mitigate its possible adverse effects.
(d) The Data Importer shall cooperate with the Data Exporter and take such reasonable commercial steps as are directed by the Data Exporter to assist in the investigation, mitigation, and remediation of any personal data breach. The specific requirements for breach notification content, escalation procedures, and cooperation obligations are further set forth in Schedule D to the Skybridge–Osprey Cloud DPA dated March 1, 2024.
Clause 8.7 — Sensitive Data
(a) Where the transfer of personal data under these Clauses involves special categories of personal data (as defined in Article 9 of the GDPR) or personal data relating to criminal convictions and offences (as referred to in Article 10 of the GDPR), specific restrictions and additional safeguards may apply. The Parties acknowledge that, while the data transferred under these Clauses may not include special categories of data as strictly defined by Article 9 of the GDPR, the data does include categories that are classified as sensitive under applicable laws.
(b) The Parties specifically acknowledge and agree that the personal data transferred under these Clauses includes Social Security numbers (SSNs) and behavioral biometric data, specifically keystroke dynamics and mouse movement patterns collected as part of the Data Exporter's anti-fraud analytics capabilities. Such data is classified as sensitive personal information under applicable United States state privacy laws, including the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA, Cal. Civ. Code § 1798.100 et seq.) and New Jersey Senate Bill S3377, which is expected to become effective on January 15, 2026.
(c) In recognition of the sensitive nature of the data categories identified in this Clause 8.7, the Data Importer shall apply the full complement of technical and organizational measures set out in Annex II to these Clauses. Without limiting the generality of Annex II, the Data Importer shall ensure that SSNs and behavioral biometric data are subject to AES-256 encryption at rest, TLS 1.2+ encryption in transit, strict role-based access controls with the principle of least privilege, and enhanced audit logging. The Data Importer shall also implement such additional safeguards as may be reasonably requested by the Data Exporter or the Controller in light of the sensitivity of the data and the evolving legal and regulatory landscape.
Clause 8.8 — Onward Transfers
(a) The Data Importer shall not sub-contract any of its processing operations performed on behalf of the Data Exporter under these Clauses to another processor (a "further sub-processor") without the prior specific or general written consent of the Data Exporter. The Data Exporter's consent is itself subject to the prior authorization of the Controller (Meridian Federal Savings Bank), as required by the Data Processing Agreement between the Controller and the Data Exporter and by Article 28(2) and (4) of the GDPR.
(b) Where the Data Importer engages a further sub-processor with the authorization of the Data Exporter, such engagement shall be governed by a written agreement between the Data Importer and the further sub-processor that imposes on the further sub-processor, in substance, the same data protection obligations as those binding the Data Importer under these Clauses. The Data Importer shall ensure that the further sub-processor agreement includes, at a minimum, provisions addressing:
(i) processing only on documented instructions;
(ii) confidentiality obligations for all personnel with access to personal data;
(iii) implementation of appropriate technical and organizational security measures;
(iv) cooperation with the Data Exporter and the Controller in responding to data subject requests;
(v) notification of personal data breaches;
(vi) obligations to delete or return personal data upon termination of the sub-processing relationship; and
(vii) submission to audits and inspections by the Data Exporter, the Controller, and/or the competent supervisory authority.
(c) The Data Importer shall provide the Data Exporter with a copy of any sub-processor agreement entered into pursuant to this Clause 8.8 upon the Data Exporter's written request. The Data Importer may redact commercially sensitive information from such agreements that is not relevant to the data protection obligations imposed on the further sub-processor, provided that the Data Exporter is able to verify the substantive adequacy of the data protection provisions.
(d) Where the further sub-processor fails to fulfill its data protection obligations under the sub-processor agreement, the Data Importer shall remain fully liable to the Data Exporter for the performance of the further sub-processor's obligations. This liability shall be without prejudice to the rights of data subjects under Clause 3 (Third-Party Beneficiaries) and Clause 12 (Liability) of these Clauses.
Clause 8.9 — Documentation and Compliance
(a) The Data Importer shall promptly deal with all inquiries from the Data Exporter that relate to the processing of personal data under these Clauses. The Data Importer shall respond to such inquiries in writing and within a reasonable timeframe, which shall not exceed fifteen (15) business days unless the complexity of the inquiry requires additional time, in which case the Data Importer shall notify the Data Exporter of the expected response timeline.
(b) The Data Importer shall submit to audits of its processing activities covered by these Clauses, carried out by the Data Exporter or an independent auditor mandated by the Data Exporter. The Data Importer shall make available to the Data Exporter all information necessary to demonstrate compliance with the obligations set out in these Clauses and in the GDPR, and shall contribute to audits and inspections in a cooperative and timely manner.
(c) Audit rights under these Clauses shall be exercised as follows:
(i) The Data Exporter, the Controller (Meridian Federal Savings Bank), or the Controller's regulator — including, without limitation, the Office of the Comptroller of the Currency (OCC), the Federal Deposit Insurance Corporation (FDIC), and the Consumer Financial Protection Bureau (CFPB) — may audit the Data Importer's processing operations with no less than thirty (30) calendar days' advance written notice.
(ii) Audits shall be conducted no more than once in any twelve (12) month period, unless an audit is triggered by: (A) a personal data breach involving data processed under these Clauses; (B) a regulatory inquiry, examination, or investigation by any regulator with jurisdiction over the Controller, the Data Exporter, or the Data Importer; or (C) reasonable grounds to believe that the Data Importer is in material breach of its obligations under these Clauses.
(iii) The costs and expenses of any audit conducted at the request of the Data Exporter, the Controller, or a regulatory authority shall be borne by the requesting party, except that the Data Importer shall bear its own internal costs of cooperating with such audits, including the costs of personnel time and access to facilities.
(iv) Audits shall be conducted during normal business hours and in a manner that minimizes disruption to the Data Importer's operations and to the services provided to the Data Exporter and other customers of the Data Importer.
(d) The Data Importer may, at its discretion, satisfy audit requests in whole or in part by providing the Data Exporter with copies of the following documentation:
(i) its current SOC 2 Type II report (or equivalent audit report), which shall be treated as confidential information of the Data Importer and shall be subject to the confidentiality provisions of the Skybridge–Osprey Cloud DPA; and
(ii) responses to a supplemental data protection questionnaire provided by the Data Exporter, covering such topics as the Data Importer's security practices, sub-processor management, breach response capabilities, and compliance with applicable data protection laws.
(e) The Data Exporter acknowledges that Skybridge Fintech Ltd. maintains its own SOC 2 Type II audit report, issued by Graystone & Ketchum LLP, 300 Delaware Avenue, Suite 700, Wilmington, DE 19801 (lead audit partner: Sandra Clearfield), covering the audit period from October 1, 2024 through September 15, 2025. This report is separately available to the Controller and the competent supervisory authority upon request and addresses the Data Exporter's own processing environment, including its interface with the Data Importer's infrastructure.
(f) The Data Importer shall maintain and make available to the Data Exporter, upon request, records of all processing activities carried out on behalf of the Data Exporter, in accordance with Article 30(2) of the GDPR.
Clause 9 — Use of Sub-processors (Module 3)
Clause 9(a) — General Written Authorization
(a) The Parties have selected Option 2: GENERAL WRITTEN AUTHORISATION. The Data Exporter hereby grants the Data Importer a general written authorization to engage sub-processors for the processing of personal data transferred under these Clauses, subject to the conditions set out in this Clause 9.
(b) The Data Importer shall specifically inform the Data Exporter in writing of any intended changes to the list of sub-processors engaged for the processing of personal data under these Clauses, including any addition of a new sub-processor or replacement of an existing sub-processor. Such notification shall be provided at least thirty (30) calendar days prior to the engagement of the new or replacement sub-processor, thereby giving the Data Exporter sufficient time to be able to object to such changes before the engagement of the sub-processor.
(c) The Data Importer shall provide the Data Exporter with the information necessary to enable the Data Exporter to exercise its right to object to the engagement of a new or replacement sub-processor. Such information shall include, at a minimum: (i) the name and address of the proposed sub-processor; (ii) a description of the processing activities to be performed by the sub-processor; (iii) the location(s) where the sub-processor will process the personal data; and (iv) such other information as is reasonably necessary for the Data Exporter to assess the sub-processor's compliance with the data protection obligations set out in these Clauses.
(d) If the Data Exporter objects to the engagement of a new or replacement sub-processor on reasonable data protection grounds, the Data Importer shall either: (i) refrain from engaging the sub-processor for the processing of personal data transferred under these Clauses and make reasonable adjustments to the services to avoid the need for the sub-processor; or (ii) take the corrective steps requested by the Data Exporter in its objection and proceed with the engagement of the sub-processor. If neither option is feasible, either Party may terminate these Clauses and the relevant processing services in accordance with Clause 16.
(e) The current list of sub-processors engaged by the Data Importer for the processing of personal data transferred under these Clauses is set out in Annex III.
Clause 9(b) — Contractual Safeguards
Where the Data Importer engages a sub-processor to carry out specific processing activities on behalf of the Data Exporter, it shall do so by way of a written contract that imposes on the sub-processor, in substance, the same data protection obligations as those binding the Data Importer under these Clauses, including with respect to the rights of third-party beneficiaries for data subjects. The Data Importer shall ensure that the sub-processor complies with the obligations to which the Data Importer is subject pursuant to these Clauses and pursuant to Regulation (EU) 2016/679. The Data Importer shall be responsible for monitoring the sub-processor's compliance with these obligations on an ongoing basis, including through periodic assessments and, where appropriate, audits of the sub-processor's processing activities.
Clause 9(c) — Liability
(a) The Data Importer shall remain fully liable to the Data Exporter for the performance of the sub-processor's obligations under the sub-processor agreement. The Data Importer's liability under this Clause 9(c) shall be joint and several with the sub-processor's liability to the extent of the sub-processor's processing of personal data under these Clauses.
(b) The Data Importer shall notify the Data Exporter of any failure by the sub-processor to fulfill its obligations under the sub-processor agreement, without undue delay after becoming aware of such failure. The notification shall include a description of the nature of the failure, the corrective steps taken or proposed to be taken by the Data Importer, and the potential impact on the personal data processed under these Clauses.
Clause 10 — Data Subject Rights (Module 3)
(a) The Data Importer shall promptly notify the Data Exporter of any request it receives directly from a data subject in relation to the personal data processed under these Clauses. Such notification shall be provided without undue delay and in any event within three (3) business days of receipt of the request. The Data Importer shall not respond to the data subject's request itself, unless it has been authorized to do so by the Data Exporter. The Data Importer shall forward the data subject's request to the Data Exporter together with all relevant information available to the Data Importer that may assist the Data Exporter in responding to the request.
(b) The Data Importer shall assist the Data Exporter in fulfilling its obligation to respond to data subjects' requests for the exercise of their rights under Chapter III of the GDPR (Articles 15 through 22), including the right of access, the right to rectification, the right to erasure ("right to be forgotten"), the right to restriction of processing, the right to data portability, and the right to object to processing. The Data Importer shall provide such technical and organizational assistance as is reasonably necessary and technically feasible, taking into account the nature of the processing and the information available to the Data Importer.
(c) In fulfilling its obligations under this Clause 10, the Parties shall have due regard to the nature of the processing, including the technical and organizational measures deployed, and the type of data involved. The Parties acknowledge that, given the Data Importer's role as an infrastructure hosting provider, its ability to identify specific data subjects within the data sets hosted on its infrastructure may be limited, and the Data Importer shall not be required to process or store additional personal data solely for the purpose of identifying data subjects for the exercise of their rights.
Clause 11 — Redress
(a) The Data Importer shall inform data subjects in a transparent and easily accessible format, through its website or through individual notice, of a contact point authorized to handle complaints. The designated contact point for the Data Importer as of the date of these Clauses is:
Osprey Cloud Infrastructure, Inc.
Attn: Privacy Office
2200 Campus Drive San Jose, CA 95131
Email: privacy@ospreycloud.com
(b) The Data Importer shall deal promptly with any complaints received from data subjects regarding the processing of their personal data under these Clauses. The Data Importer shall acknowledge receipt of any complaint within five (5) business days and shall provide a substantive response within thirty (30) calendar days of receipt. The Data Importer shall cooperate with the Data Exporter and the Controller to resolve complaints and shall keep the Data Exporter informed of the status and resolution of any complaints received.
(c) Data subjects may lodge a complaint with the competent supervisory authority. For purposes of these Clauses, the competent supervisory authority is the Autoriteit Persoonsgegevens (Dutch Data Protection Authority), given the establishment of Skybridge Fintech Europe B.V. (the EU affiliate of the Data Exporter's group) in the Netherlands. The contact details for the Autoriteit Persoonsgegevens are:
Autoriteit Persoonsgegevens Bezuidenhoutseweg 30 2594 AV The Hague Netherlands Telephone: +31 (0)70 888 8500 Website: https://autoriteitpersoonsgegevens.nl
(d) The Data Importer agrees to accept and submit to the decision of the competent supervisory authority or of a competent court of a Member State with jurisdiction over matters arising under these Clauses, including decisions regarding the Data Importer's compliance with its obligations under these Clauses and the GDPR. The Data Importer acknowledges that data subjects are entitled to invoke these Clauses as third-party beneficiaries and to seek effective legal remedies before the competent courts.
Clause 12 — Liability
(a) Each Party shall be liable to the other Party for any damages it causes the other Party by any breach of these Clauses. The Parties acknowledge and agree that their liability under these Clauses is subject to the general conditions of liability set forth in the GDPR, including Articles 82 and 83 thereof.
(b) The Data Importer shall be liable to the data subject, and the data subject shall be entitled to receive compensation, for any material or non-material damages the Data Importer causes the data subject by breaching the third-party beneficiary rights under these Clauses. The Data Importer's liability to data subjects under this provision shall not be limited by contract between the Parties.
(c) Where more than one Party is responsible for any damage caused to the data subject as a result of a breach of these Clauses, each responsible Party shall be jointly and severally liable for the entirety of the damage, in order to ensure effective compensation of the data subject. A Party that has paid full compensation to the data subject for the damage suffered shall be entitled to claim back from the other Party or Parties that part of the compensation corresponding to their part of responsibility for the damage.
(d) The liability of the Parties under these Standard Contractual Clauses is without prejudice to the liability cap and indemnification provisions set forth in the Skybridge–Osprey Cloud DPA dated March 1, 2024. For the avoidance of doubt, the liability cap applicable under the DPA is the greater of: (i) Five Million United States Dollars ($5,000,000.00); or (ii) two times (2×) the trailing twelve (12) month fees paid by the Controller (Meridian Federal Savings Bank) to the Data Exporter (Skybridge Fintech Ltd.) under the SaaS subscription agreement. However, nothing in the DPA liability cap shall be construed to limit the rights of data subjects to seek full compensation for damages under these Clauses or under the GDPR.
(e) For reference, the indemnification obligations of the Data Exporter (Skybridge Fintech Ltd.) to the Controller (Meridian Federal Savings Bank) under the Data Processing Agreement include coverage for third-party claims arising from breach of the DPA, including regulatory fines imposed on the Controller to the extent that such fines are attributable to the Data Exporter's or the Data Importer's breach of these Clauses or the GDPR, and to the extent that indemnification for such fines is permissible under applicable law.
SECTION III — LOCAL LAWS AND OBLIGATIONS IN CASE OF ACCESS BY PUBLIC AUTHORITIES
Clause 13 — Local Laws and Practices Affecting Compliance with the Clauses (Module 3)
Clause 13(a) — Representations and Warranties
(a) The Parties represent and warrant that they have no reason to believe that the laws and practices in the third country of destination (the United States of America) applicable to the processing of personal data by the Data Importer, including any requirements to disclose personal data or measures authorizing access by public authorities, prevent the Data Importer from fulfilling its obligations under these Clauses. This representation is based on the understanding that laws and practices that respect the essence of the fundamental rights and freedoms and do not exceed what is necessary and proportionate in a democratic society to safeguard one of the objectives listed in Article 23(1) of Regulation (EU) 2016/679 are not in contradiction with these Clauses.
(b) In making the representation set forth in Clause 13(a)(a) above, the Parties have taken into account, in particular, the following elements:
(i) The specific circumstances of the transfer, including: the content and length of the processing chain; the number of actors involved (the Controller, the Data Exporter, and the Data Importer); the categories of personal data transferred (full name, date of birth, Social Security number, taxpayer identification number, account numbers, routing numbers, transaction amounts and metadata, IP addresses, device identifiers, city-level geolocation, email addresses, phone numbers, and behavioral biometric data including keystroke dynamics and mouse movement patterns); the number of data subjects affected (approximately 3,200 EU-resident data subjects out of a total population of approximately 412,000 data subjects); the volume of data processed (approximately 18.6 million transactions per month); the purposes of the processing (infrastructure hosting for payment processing, anti-fraud analytics, and regulatory reporting); and the transmission channels used.
(ii) The laws and practices of the United States of America that are relevant to the transfer, including but not limited to: (A) Section 702 of the Foreign intelligence Surveillance Act (FISA), 50 U.S.C. § 1881a, which authorizes the collection of foreign intelligence information from non-U.S. persons located outside the United States through the compelled assistance of electronic communication service providers; (B) Executive Order 14086 of October 7, 2022, entitled "Enhancing Safeguards for United States signals intelligence Activities," which establishes principles of necessity and proportionality for signals intelligence activities and creates the Data Protection Review Court mechanism for EU data subjects to seek redress for violations of applicable U.S. law governing signals intelligence activities; (C) the requirements of the Stored Communications Act (18 U.S.C. §§ 2701-2712) and the Electronic Communications Privacy Act; and (D) such other laws and practices as are identified in the Transfer Impact Assessment.
(iii) The technical and organizational measures applied, including encryption (AES-256 at rest, TLS 1.2+ in transit), access controls, and the other measures described in Annex II, which provide additional layers of protection against unauthorized access to personal data.
(c) The Parties note that a Transfer Impact Assessment has been prepared by Calderwood & Harkness LLP (prepared by Alan Burke, dated December 8, 2025) and is available to the Parties and the competent supervisory authority upon request. The Transfer Impact Assessment analyzes the relevant legal framework of the United States of America, the specific circumstances of the transfer, and the supplementary measures implemented by the Parties, and concludes that the combination of these Clauses, the technical and organizational measures described in Annex II, and the Data Exporter's EU-US Data Privacy Framework self-certification provides an adequate level of protection for the personal data transferred.
(d) The Data Exporter's self-certification under the EU-US Data Privacy Framework (Certification ID: DPF-2025-03912, effective July 1, 2025) provides additional safeguards for the personal data transferred under these Clauses, including the following:
(i) compliance with the Data Privacy Framework Principles, including the principles of notice, choice, accountability for onward transfer, security, data integrity and purpose limitation, access, and recourse, enforcement, and liability;
(ii) the availability of the Data Protection Review Court mechanism under Executive Order 14086, which provides EU data subjects with an independent and impartial redress mechanism for complaints regarding U.S. Signals intelligence activities affecting their personal data; and
(iii) oversight and enforcement by the Federal Trade Commission (FTC) of the Data Exporter's compliance with the Data Privacy Framework Principles.
Clause 13(b) — Obligations of the Data Importer in Case of Access by Public Authorities
(a) The Data Importer agrees to promptly notify the Data Exporter and, where possible, the data subject (with the assistance of the Data Exporter where necessary), if it receives a legally binding request from a public authority, including judicial authorities, under the laws of the country of destination for the disclosure of personal data transferred pursuant to these Clauses. Such notification shall include information about the personal data requested, the requesting authority, the legal basis for the request, and the response provided. If the Data Importer is prohibited from notifying the Data Exporter — for example, by a criminal law prohibition intended to preserve the confidentiality of a law enforcement investigation — the Data Importer shall use its best efforts to obtain a waiver of the prohibition, with a view to communicating as much information to the Data Exporter as possible and as soon as possible. The Data Importer shall document the efforts undertaken to obtain such waiver and shall be prepared to demonstrate these efforts to the competent supervisory authority upon request.
(b) The Data Importer shall preserve information about the requests received from public authorities, including the date and content of the request, the requesting authority, the legal basis cited, the Data Importer's response, and any challenges raised. The Data Importer shall make this information available to the Data Exporter and to the competent supervisory authority on request.
(c) The Data Importer shall review, under the laws of the country of destination, the legality of any request for disclosure received from a public authority, in particular whether it remains within the powers granted to the requesting authority. If, after careful assessment, the Data Importer concludes that there are reasonable grounds to consider that the request is unlawful under the laws of the country of destination, the Data Importer shall challenge the request through available legal channels. When challenging a request, the Data Importer shall seek interim measures with a view to suspending the effects of the request until the competent judicial authority has decided on its merits. The Data Importer shall not disclose the personal data requested until required to do so under applicable procedural rules.
(d) The Data Importer shall, in any case, provide the minimum amount of information permissible when responding to a request for disclosure, based on a reasonable interpretation of the request. The Data Importer shall not voluntarily disclose more personal data than is specifically requested by the public authority, and shall apply any available exemptions or privileges that may limit the scope of the disclosure.
Clause 14 — Obligations of the Data Importer in Case of Access (Module 3)
Clause 14 of the EU Commission's standard contractual clauses (as set forth in the Annex to Implementing Decision (EU) 2021/914) is optional for Module 3 (Processor-to-Sub-processor) and is not separately completed by the Parties in this document. The obligations of the Data Importer with respect to government access requests are addressed through Clause 13 above and through the supplementary measures set forth in Annex II to these Clauses. For the avoidance of doubt, the Parties' obligations under Clause 13 are not diminished or limited by the non-completion of Clause 14, and the supplementary measures described in Annex II are intended to provide additional protection against unauthorized access by public authorities.
Clause 15 — Supervision
Clause 15.1 — Competent Supervisory Authority
(a) The competent supervisory authority with responsibility for ensuring compliance with Regulation (EU) 2016/679 with regard to the data transfer shall be the Autoriteit Persoonsgegevens (Dutch Data Protection Authority), being the supervisory authority of the Member State in which the representative of the Data Exporter within the meaning of Article 27(1) of the GDPR — specifically, Skybridge Fintech Europe B.V. — is established.
(b) The contact details for the competent supervisory authority are:
Autoriteit Persoonsgegevens Bezuidenhoutseweg 30 2594 AV The Hague Netherlands Telephone: +31 (0)70 888 8500 Website: https://autoriteitpersoonsgegevens.nl
Clause 15.2 — Cooperation with the Supervisory Authority
(a) The Data Importer agrees to cooperate, on request, with the competent supervisory authority in the performance of its tasks. The Data Importer shall respond promptly and appropriately to inquiries from the supervisory authority regarding the processing operations covered by these Clauses, and shall make available to the supervisory authority such information as may be necessary for the supervisory authority to carry out its functions.
(b) The Data Importer agrees to submit itself to any audit or inspection of its processing activities by the competent supervisory authority, and to comply with the advice of the competent supervisory authority with regard to the processing of personal data transferred under these Clauses. The Data Importer shall facilitate such audits and inspections and shall provide the supervisory authority with access to its premises, systems, and records as necessary for the supervisory authority to verify compliance with these Clauses.
(c) The Data Importer shall provide the supervisory authority, on request, with copies of these Clauses and the Annexes, and with information on the technical and organizational measures implemented by the Data Importer to protect the personal data processed under these Clauses, including any updates or changes to such measures.
(d) The Data Exporter shall inform the Data Importer of any contact, inquiry, or investigation by the competent supervisory authority relating to the personal data transferred under these Clauses, and the Parties shall cooperate in responding to any such contact, inquiry, or investigation.
SECTION IV — FINAL PROVISIONS
Clause 16 — Non-compliance with the Clauses and Termination
(a) The Data Importer shall promptly inform the Data Exporter if it is unable to comply with these Clauses, for whatever reason. The notification shall include a description of the nature and extent of the non-compliance, the reasons for the non-compliance, and the corrective measures taken or proposed to be taken by the Data Importer to restore compliance.
(b) If the Data Importer is in breach of these Clauses or is unable to comply with these Clauses, the Data Exporter shall suspend the transfer of personal data to the Data Importer until compliance is ensured or the contract is terminated. This is without prejudice to the provisions of Clause 13(b), which require the Data Importer to notify the Data Exporter in the event of a government access request. The Data Exporter may also suspend the transfer of personal data where:
(i) the competent supervisory authority has issued an order suspending or prohibiting the transfer;
(ii) the Data Exporter has reasonable grounds to believe that the Data Importer can no longer fulfill its obligations under these Clauses, including as a result of changes in the laws or practices of the third country of destination;
(iii) the Data Importer has materially breached the warranties and representations set forth in Clause 13(a); or
(iv) a personal data breach has occurred that, in the reasonable judgment of the Data Exporter, presents a significant risk to the rights and freedoms of data subjects.