STANDARD CONTRACTUAL CLAUSES
(PROCESSOR-TO-SUB-PROCESSOR) — MODULE 3
Pursuant to EU Commission Implementing Decision (EU) 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council
Data Transfers from Skybridge Fintech Ltd. (Data Exporter / Processor) to Skybridge Fintech Europe B.V. (Data Importer / Sub-processor)
DRAFT December 12, 2025
Prepared by: Alan Burke, Working Associate, Privacy & Data Security, Calderwood & Harkness LLP, 1735 Market Street, Suite 2800, Philadelphia, PA 19103. Matter No.: 1009-00004. This document contains information subject to the attorney-client privilege and work product doctrine. Do not distribute without prior authorization.
This Module 3 SCC is appended to and forms an integral part of the Data Processing Agreement (the "DPA") between Meridian Federal Savings Bank (the "Controller") and Skybridge Fintech Ltd. (the "Processor"), as executed on or about the date hereof. In the event of any inconsistency between these Standard Contractual Clauses and the DPA, the provisions of these Standard Contractual Clauses shall prevail insofar as the rights and protections of data subjects are concerned.
Right-click to update Table of Contents
PREAMBLE
WHEREAS, Skybridge Fintech Ltd. ("SBF" or the "Data Exporter"), a Delaware corporation with its principal place of business at 4100 Silverside Road, Suite 310, Wilmington, DE 19810, United States, acts as a Processor of personal data on behalf of Meridian Federal Savings Bank ("Meridian" or the "Controller"), a federally chartered savings bank organized under the laws of the United States, pursuant to a Data Processing Agreement between Meridian and SBF (the "DPA");
WHEREAS, Skybridge Fintech Europe B.V. ("SBF Europe" or the "Data Importer"), a besloten vennootschap met beperkte aansprakelijkheid organized under the laws of the Netherlands and registered with the Kamer van Koophandel under number 82104593, with its registered office at Keizersgracht 482, 1017 EG Amsterdam, Netherlands, acts as a Sub-processor engaged by SBF to process personal data relating to EU-resident data subjects on behalf of the Controller;
WHEREAS, in the course of providing payment processing, anti-fraud analytics, and regulatory reporting services via the SBF Core platform under a SaaS subscription agreement between Meridian and SBF, personal data originating from the Controller and passing through the Processor in the United States is transferred to the Sub-processor in the Netherlands for further processing;
WHEREAS, the Parties wish to ensure that adequate safeguards are in place for the protection of personal data transferred from the Data Exporter (a Processor established in a third country, the United States) to the Data Importer (a Sub-processor established in an EU Member State, the Netherlands), in full compliance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (the "GDPR"), and in particular in light of the judgment of the Court of Justice of the European Union in Case C-311/18, Data Protection Commissioner v. Kestrel Services Inc. Ireland Limited and Maximillian Schrems ("Schrems II"), delivered on 16 July 2020;
WHEREAS, the European Commission adopted Implementing Decision (EU) 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council ("Implementing Decision"), which sets forth standardized contractual clauses ("Standard Contractual Clauses" or "SCCs") intended to provide appropriate safeguards within the meaning of Articles 46(1) and 46(2)(c) of the GDPR;
WHEREAS, the Parties have selected Module 3 (Processor-to-Sub-processor) of the Standard Contractual Clauses, which governs the transfer of personal data from a processor to a sub-processor and sets out the respective obligations of the Parties in connection with such transfer;
WHEREAS, these Standard Contractual Clauses supplement, and are appended to, the DPA between Meridian Federal Savings Bank and Skybridge Fintech Ltd., and are intended to operate in conjunction with the obligations set forth therein;
WHEREAS, it is noted for the avoidance of doubt that Skybridge Fintech Ltd. is also self-certified under the EU-U.S. Data Privacy Framework established pursuant to the European Commission's adequacy decision of 10 July 2023 (Certification ID: DPF-2025-03912, effective July 1, 2025), which provides a supplementary and independent legal basis for certain transfers of personal data from the European Union to the United States; provided, however, that such self-certification supplements but does not replace these Standard Contractual Clauses, and the protections afforded by these SCCs shall apply independently and in addition to any protections arising under the Data Privacy Framework;
NOW, THEREFORE, the Parties hereby agree to the following Standard Contractual Clauses (the "Clauses") in order to adduce adequate safeguards with respect to the protection of privacy and fundamental rights and freedoms of individuals for the transfer of personal data as specified in Annex I:
SECTION I — GENERAL PROVISIONS
Clause 1 — Purpose and Scope
(a) The purpose of these Standard Contractual Clauses is to ensure compliance with the requirements of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (the "GDPR"), and in particular Article 28(3) and (4) thereof, for the transfer of personal data from the Data Exporter, Skybridge Fintech Ltd., acting as a Processor on behalf of the Controller, Meridian Federal Savings Bank, to the Data Importer, Skybridge Fintech Europe B.V., acting as a Sub-processor.
(b) These Clauses set out appropriate safeguards, including enforceable data subject rights and effective legal remedies, pursuant to Article 46(1) and Article 46(2)(c) of the GDPR and, with respect to data transfers from controllers to processors and/or processors to sub-processors, the requirements of Article 28(3) and (4) of the GDPR.
(c) The Parties have selected Module 3 (Processor-to-Sub-processor) of the Standard Contractual Clauses adopted pursuant to EU Commission Implementing Decision (EU) 2021/914, which applies to the transfer of personal data from a processor to a sub-processor.
(d) For the avoidance of doubt, although SBF Europe is established in the Netherlands (an EU Member State), these Module 3 Standard Contractual Clauses govern the obligations as between the Processor and the Sub-processor for data flows that originate with the Controller (Meridian Federal Savings Bank, United States), pass through the Processor (Skybridge Fintech Ltd., United States), and are transferred to the Sub-processor (Skybridge Fintech Europe B.V., Netherlands). The application of these Clauses is intended to ensure that the full chain of processing obligations prescribed by the GDPR is contractually secured, regardless of the establishment of the Data Importer within the European Union.
(e) These Clauses shall not be interpreted in a way that conflicts with the rights and obligations provided for in the GDPR.
Clause 2 — Effect and Invariability of the Clauses
(a) These Clauses set forth appropriate safeguards, including enforceable data subject rights and effective legal remedies, within the meaning of Article 46(1) and Article 46(2)(c) of Regulation (EU) 2016/679 and, with respect to data transfers from processors to sub-processors, in compliance with Article 28(3) and (4) of Regulation (EU) 2016/679.
(b) These Clauses shall not be modified by the Parties, except to:
(i) select the appropriate Module (Module 3 has been selected);
(ii) add or update the information contained in the Annexes attached hereto; or
(iii) select or include the optional clauses expressly permitted under the Standard Contractual Clauses adopted pursuant to EU Commission Implementing Decision (EU) 2021/914.
(c) This does not prevent the Parties from including the Standard Contractual Clauses laid down in these Clauses in a wider contract, or from adding other clauses or additional safeguards; provided, however, that such additional clauses or safeguards do not contradict, directly or indirectly, these Clauses or prejudice the fundamental rights or freedoms of data subjects.
(d) These Clauses are without prejudice to the rights and obligations of the Parties under the GDPR.
Clause 3 — Third-Party Beneficiaries
(a) Data subjects may invoke and enforce these Clauses, as third-party beneficiaries, against the Data Exporter and/or the Data Importer, with the following exceptions:
(i) Clause 1, Clause 2, Clause 3, Clause 6, Clause 7 — data subjects may invoke and enforce these provisions;
(ii) Clause 8 — data subjects may invoke and enforce Clause 8.1, Clause 8.8, and Clause 8.9;
(iii) Clause 9 — data subjects may invoke and enforce Clause 9(a), (b), (c), and (e);
(iv) Clause 12 — data subjects may invoke and enforce this Clause in its entirety;
(v) Clause 13 — data subjects may invoke and enforce this Clause in its entirety;
(vi) Clause 15.1(c), (d), and (e) — data subjects may invoke and enforce these provisions;
(vii) Clause 16(e) — data subjects may invoke and enforce this provision;
(viii) Clause 18 — data subjects may invoke and enforce this Clause in its entirety.
(b) Paragraph (a) is without prejudice to the rights of data subjects under Regulation (EU) 2016/679.
(c) The Parties agree not to restrict or limit the third-party beneficiary rights conferred upon data subjects by these Clauses beyond what is expressly permitted by the Standard Contractual Clauses adopted pursuant to EU Commission Implementing Decision (EU) 2021/914.
Clause 4 — Interpretation
(a) Where these Clauses use terms that are defined in Regulation (EU) 2016/679, those terms shall have the same meaning as in that Regulation.
(b) These Clauses shall be read and interpreted in the light of the provisions of Regulation (EU) 2016/679.
(c) These Clauses shall not be interpreted in a way that conflicts with rights and obligations provided for in Regulation (EU) 2016/679.
Clause 5 — Hierarchy
(a) In the event of a contradiction between these Clauses and the provisions of the Data Processing Agreement between Meridian Federal Savings Bank and Skybridge Fintech Ltd. (the "DPA"), or of the SaaS subscription agreement between Meridian Federal Savings Bank and Skybridge Fintech Ltd., these Clauses shall prevail.
(b) In the event of a contradiction between these Clauses and any related agreements between the Parties, including any intragroup agreements between Skybridge Fintech Ltd. and Skybridge Fintech Europe B.V., these Clauses shall prevail insofar as the rights and protections of data subjects are concerned.
(c) For the avoidance of doubt, nothing in the DPA or the SaaS subscription agreement shall operate to limit or restrict the rights of data subjects arising under these Clauses.
Clause 6 — Description of the Transfer(s)
The details of the transfer(s), and in particular the categories of personal data that are transferred and the purpose(s) for which they are transferred, are specified in Annex I.B.
The Parties agree that the following key elements characterize the transfer(s) covered by these Clauses:
(a) Data Exporter: Skybridge Fintech Ltd., 4100 Silverside Road, Suite 310, Wilmington, DE 19810, United States (a Delaware corporation), acting in its capacity as Processor on behalf of the Controller, Meridian Federal Savings Bank.
(b) Data Importer: Skybridge Fintech Europe B.V., Keizersgracht 482, 1017 EG Amsterdam, Netherlands (Kamer van Koophandel number: 82104593), acting in its capacity as Sub-processor.
(c) Data Subjects: Approximately 3,200 EU-resident accountholders of Meridian Federal Savings Bank, together with authorized signers, beneficial owners, and any Meridian employees whose personal data passes through the SBF Core platform.
(d) Categories of Personal Data: Full name, date of birth, Social Security number (SSN), taxpayer identification number (TIN), account numbers (checking, savings, and loan), routing numbers, transaction amounts and metadata, IP addresses, device identifiers, geolocation data (city-level), email addresses, phone numbers, and behavioral biometric data (including keystroke dynamics and mouse movement patterns).
(e) Sensitive Data: Behavioral biometric data and Social Security numbers, in each case where relating to EU-resident data subjects.
(f) Processing Purpose: Payment processing, anti-fraud analytics, and regulatory reporting via the SBF Core platform on behalf of Meridian Federal Savings Bank (Controller).
(g) Frequency: Continuous and real-time processing. Approximately 18.6 million transactions per month are processed through SBF Core on a platform-wide basis, with the EU subset proportional to the approximately 3,200 EU-resident accountholders of Meridian.
(h) Retention: Personal data will be retained for the duration of the SaaS subscription agreement between Meridian and Skybridge, plus 90 calendar days post-termination to permit the return or deletion of data, except as required by applicable law.
Further details are set forth in Annex I hereto, which forms an integral part of these Clauses.
Clause 7 — Docking Clause
(a) An entity that is not a Party to these Clauses may, with the agreement of the Parties, accede to these Clauses at any time, either as a data exporter or as a data importer, by completing the Appendix and signing Annex I.A.
(b) Once it has completed the Appendix and signed Annex I.A, the acceding entity shall become a Party to these Clauses and have the rights and obligations of a data exporter or data importer, as specified in the accession agreement.
(c) The acceding entity shall have no rights or obligations arising under these Clauses from the period prior to becoming a Party.
(d) The Parties have elected to include the Docking Clause, permitting future accessions by additional entities as may be required in connection with changes to the processing arrangements under the DPA or the SaaS subscription agreement.
SECTION II — OBLIGATIONS OF THE PARTIES
Clause 8 — Data Protection Safeguards
The Data Importer warrants that it has implemented and shall maintain appropriate technical and organizational measures to protect personal data in accordance with the GDPR and these Clauses, and that it has no reason to believe that the laws and practices applicable to it prevent it from fulfilling its obligations under these Clauses.
8.1 — Instructions. (a) The Data Importer shall process personal data only on documented instructions from the Data Exporter. The Data Exporter acts on the instructions of the Controller, Meridian Federal Savings Bank, and shall convey such instructions to the Data Importer in writing (which may include electronic means).
(b) The Data Importer shall immediately inform the Data Exporter if it is unable to follow the instructions received, including if such instructions infringe the GDPR or other Union or Member State data protection provisions. In such event, the Data Exporter shall in turn promptly notify the Controller.
(c) If the Data Importer is required by European Union or Netherlands law to process personal data beyond the scope of the instructions received from the Data Exporter (including, without limitation, pursuant to a court order, regulatory directive, or binding legal obligation), the Data Importer shall inform the Data Exporter of that legal requirement before processing, unless the law in question prohibits such notification on important grounds of public interest. Such notification shall include identification of the specific legal requirement and an explanation of the processing activities required thereby.
(d) The Data Exporter shall ensure that the instructions given to the Data Importer are consistent with the processing agreement between the Data Exporter and the Controller, and that the Data Exporter has obtained any necessary authorizations from the Controller to issue such instructions to the Data Importer.
8.2 — Purpose Limitation. (a) The Data Importer shall process personal data only for the specific purposes of the transfer as set out in Annex I.B, namely: payment processing, anti-fraud analytics, and regulatory reporting on behalf of Meridian Federal Savings Bank (Controller) via the SBF Core platform.
(b) The Data Importer may process personal data for another purpose only upon receiving prior specific written instructions from the Data Exporter, acting on behalf of and as authorized by the Controller. Such instructions shall reference the specific additional purpose and confirm that the Controller has authorized the processing for that purpose.
(c) The Data Importer shall not process personal data for its own purposes, for the purposes of direct marketing, or for any purpose other than those expressly authorized under paragraph (a) or (b) of this Clause 8.2.
8.3 — Transparency. (a) The Data Exporter shall make available to data subjects, upon request, a copy of these Clauses, including the completed Annexes hereto, together with a summary description of the security measures implemented by the Data Importer as described in Annex II.
(b) The Data Exporter may redact business-confidential information from the copies made available to data subjects; provided, however, that a meaningful summary is provided that enables data subjects to understand the content of the Clauses, the identity and role of the Parties, the categories of personal data being transferred, the purposes of the transfer, and the safeguards in place to protect the data.
(c) The Data Exporter shall, where reasonably requested by a data subject, refer the data subject to the Data Importer for any further information regarding the processing of that data subject's personal data by the Data Importer.
8.4 — Accuracy. (a) If the Data Importer becomes aware that personal data it has received is inaccurate, outdated, or has been unlawfully processed, it shall inform the Data Exporter without undue delay. In such event, the Data Importer shall cooperate with the Data Exporter to erase or rectify the data.
(b) The Data Importer shall take reasonable steps, having regard to the nature and purposes of the processing, to ensure that personal data that is inaccurate, having regard to the purposes for which it is processed, is erased or rectified without undue delay.
8.5 — Duration of Processing and Erasure/Return of Data. (a) Processing by the Data Importer shall take place for the duration of the SaaS subscription agreement between Meridian Federal Savings Bank and Skybridge Fintech Ltd. (the "Processing Period"). Following termination or expiration of the SaaS subscription agreement, the Data Importer shall be permitted to retain personal data for a period not to exceed 90 calendar days (the "Post-Termination Period") solely for the purpose of facilitating the return or deletion of the data in accordance with the instructions of the Data Exporter or the Controller.
(b) Upon expiration of the Post-Termination Period, or earlier upon the written instruction of the Data Exporter, the Data Importer shall, at the choice of the Data Exporter:
(i) delete all personal data processed on behalf of the Controller, and certify in writing to the Data Exporter that it has done so, including confirmation that all copies of the personal data have been permanently and irrecoverably deleted from all systems, back-up media, and archives; or
(ii) return all personal data to the Data Exporter in a structured, commonly used, and machine-readable format, and thereafter delete all existing copies of the personal data, unless European Union or Netherlands law requires further storage of the personal data.
(c) The Data Importer shall allow the Data Exporter, or the Controller acting through the Data Exporter, to verify compliance with this Clause 8.5 through audits or inspections, conducted in accordance with the audit rights framework set forth in Clause 8.9 and the DPA.
(d) Where the Data Importer is required by European Union or Netherlands law to retain personal data beyond the Post-Termination Period, the Data Importer shall inform the Data Exporter of the applicable legal requirement and shall continue to ensure the protection of the retained personal data in accordance with these Clauses for so long as the data is retained.
8.6 — Security of Processing. (a) The Data Importer shall implement and maintain appropriate technical and organizational measures to ensure the security of personal data, including protection against accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to personal data transmitted, stored, or otherwise processed (a "Personal Data Breach"). In assessing the appropriate level of security, the Parties shall take due account of the state of the art, the costs of implementation, the nature, scope, context, and purposes of processing, and the risks involved in the processing for the data subjects.
(b) The Data Importer represents and warrants that it has implemented and shall maintain the following specific technical and organizational measures, as further described in Annex II:
(i) Encryption at rest: All personal data stored in databases and file systems is encrypted using AES-256 encryption or a substantially equivalent standard.
(ii) Encryption in transit: All data transmissions between systems, between the Data Exporter and the Data Importer, and between the Data Importer and any further sub-processor, are encrypted using TLS 1.2 or higher.
(iii) Multi-factor authentication (MFA): Multi-factor authentication is required for all administrative and privileged access to systems processing personal data.
(iv) Penetration testing: Annual independent penetration testing is conducted by Ironvault Security Group LLC, 11710 Plaza America Drive, Suite 400, Reston, VA 20190, with the most recent test completed during the twelve (12) months preceding the date of these Clauses.
(v) SOC 2 Type II audit: The Data Importer holds a current SOC 2 Type II report issued by Graystone & Ketchum LLP, 300 Delaware Avenue, Suite 700, Wilmington, DE 19801 (lead partner: Sandra Clearfield), covering the audit period from October 1, 2024 through September 15, 2025, with the report issued on September 15, 2025.
(vi) Access controls: Role-based access control (RBAC) with the principle of least privilege applied to all systems processing personal data. Individual user accounts are assigned to each authorized employee, and shared accounts are prohibited.
(vii) Employee security training: All personnel of the Data Importer with access to personal data receive regular security awareness training, and are subject to background checks and confidentiality agreements.
(viii) Incident response plan: The Data Importer maintains a documented incident response plan with defined escalation procedures. Rebecca Muñoz, Chief Information Security Officer of Skybridge Fintech Ltd., serves as the primary incident coordinator, and the plan includes coordination procedures with the Data Importer's local management in Amsterdam.
(c) The Data Importer shall grant the Data Exporter access to relevant audit reports and security documentation upon request, subject to applicable confidentiality obligations. The Data Importer shall also promptly inform the Data Exporter of any material changes to the technical and organizational measures described in Annex II.
(d) The Data Importer shall ensure that persons authorized to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
(e) In the event of a Personal Data Breach involving personal data processed by the Data Importer under these Clauses, the Data Importer shall:
(i) notify the Data Exporter without undue delay after becoming aware of the breach, and in any event within a timeframe that enables the Data Exporter (and the Controller) to comply with applicable notification obligations under Articles 33 and 34 of the GDPR and the DPA;
(ii) cooperate with and assist the Data Exporter and the Controller in investigating, remediating, and mitigating the effects of the breach;
(iii) take immediate steps to contain and remedy the breach, and to minimize the risk to data subjects; and
(iv) provide the Data Exporter with sufficient information to enable the Controller to notify the competent supervisory authority and, where applicable, the affected data subjects, including the nature of the breach, the categories and approximate number of data subjects and personal data records concerned, the likely consequences of the breach, and the measures taken or proposed to address the breach.
(f) A full description of the technical and organizational measures implemented by the Data Importer is set forth in Annex II hereto, which forms an integral part of these Clauses.
8.7 — Sensitive Data. (a) Where the transfer involves personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data, or biometric data for the purpose of uniquely identifying a natural person, data concerning health, or data concerning a natural person's sex life or sexual orientation, or data relating to criminal convictions and offenses (collectively, "Sensitive Data"), the Data Importer shall apply specific restrictions and/or additional safeguards as set forth in Annex I.B.
(b) The Parties acknowledge that the transfer governed by these Clauses includes the following categories of Sensitive Data: (i) behavioral biometric data (keystroke dynamics and mouse movement patterns), which may constitute biometric data within the meaning of Article 9(1) of the GDPR where processed for the purpose of uniquely identifying a natural person; and (ii) Social Security numbers of EU-resident data subjects, which, while not "special categories" of data under Article 9 GDPR, are subject to heightened protection under certain Member State laws.
(c) With respect to Sensitive Data, the Data Importer shall:
(i) apply heightened access controls, limiting access to Sensitive Data to only those personnel who require access for the specific processing purposes;
(ii) ensure that Sensitive Data is encrypted both at rest and in transit using the encryption standards specified in Clause 8.6(b)(i) and (ii);
(iii) maintain separate audit logs for access to Sensitive Data; and
(iv) implement any additional safeguards specified in Annex I.B or as may be agreed between the Parties and the Controller from time to time.
8.8 — Onward Transfers. (a) The Data Importer shall not disclose personal data to a third party located outside the European Union/European Economic Area ("EEA") unless the following conditions are met:
(i) the third party is or agrees to be bound by these Clauses, under the appropriate Module, as a further data importer; or
(ii) the onward transfer is otherwise permitted under Chapter V of the GDPR (for example, pursuant to an adequacy decision under Article 45 GDPR or an appropriate safeguard under Article 46 GDPR).
(b) Any onward transfer to a third party is subject to compliance by the third party with the same data protection obligations as are set out in these Clauses, and in particular with the obligation to implement appropriate technical and organizational measures.
(c) The Data Importer shall inform the Data Exporter of any onward transfer arrangements and shall make available to the Data Exporter the relevant contractual arrangements governing such onward transfer upon request.
(d) For the avoidance of doubt, SBF Europe (the Data Importer) is located in Amsterdam, Netherlands, within the EEA. Any onward transfers of personal data from SBF Europe back to Skybridge Fintech Ltd. in the United States or to Osprey Cloud Infrastructure, Inc. in the United States are addressed under separate Module 2 and Module 3 SCC sets, respectively, and are not governed by this Clause 8.8.
8.9 — Documentation and Compliance. (a) The Data Importer shall promptly deal with inquiries from the Data Exporter or the Controller regarding the processing of personal data under these Clauses, and shall provide all information reasonably necessary to demonstrate compliance with the obligations set forth herein.
(b) The Parties shall be able to demonstrate compliance with these Clauses. In particular, the Data Importer shall keep appropriate documentation of the processing activities carried out on behalf of the Controller.
(c) The Data Importer shall make all documentation relevant to the processing available to the competent supervisory authority upon request.
(d) The Data Exporter may conduct audits of the Data Importer's processing activities, either directly or through an independent auditor appointed by the Data Exporter, subject to the following audit rights framework (as set forth in the DPA):
(i) Frequency: The Data Exporter may conduct one audit per twelve (12)-month period, with at least thirty (30) calendar days' advance written notice to the Data Importer, unless the audit is triggered by a Personal Data Breach, a complaint from a data subject, or a regulatory inquiry or investigation, in which case the Data Exporter may conduct an audit on shorter notice as reasonably required.
(ii) Scope: Audits may encompass the Data Importer's processing activities, facilities, systems, documentation, and personnel relevant to the processing of personal data under these Clauses, including compliance with the technical and organizational measures described in Annex II.
(iii) SOC 2 report in lieu of on-site audit: The Data Exporter may, at its discretion, satisfy its audit rights by reviewing the Data Importer's most recent SOC 2 Type II report and any supplemental questionnaire responses provided by the Data Importer. The Data Importer shall provide such report and responses within fifteen (15) business days of a written request by the Data Exporter.
(iv) Costs: The costs of any audit shall be borne by the Data Exporter, except that the Data Importer shall bear its own internal costs of providing access and cooperation during the audit.
(v) Confidentiality: All audit activities shall be conducted in a manner that minimizes disruption to the Data Importer's operations and shall be subject to appropriate confidentiality obligations.
(e) The Data Exporter shall, upon request, make the results of any audit available to the Controller.
Clause 9 — Use of Sub-processors
9(a) — General Written Authorization. The Parties have selected OPTION 2: General written authorization.
(i) The Data Importer (SBF Europe) has the Data Exporter's (Skybridge's) general written authorization to engage sub-processors to carry out specific processing activities on its behalf in connection with the processing of personal data under these Clauses. A list of sub-processors currently authorized by the Data Exporter is set forth in Annex III.
(ii) The Data Importer shall specifically inform the Data Exporter in writing of any intended changes to the list of sub-processors through the addition or replacement of sub-processors at least thirty (30) calendar days in advance of the engagement of any new sub-processor. Such notification shall include sufficient information to enable the Data Exporter, and the Controller through the Data Exporter, to evaluate the proposed sub-processor's data protection capabilities and to exercise the right to object.
(iii) The notification required under paragraph (ii) shall include, at a minimum: the name and contact details of the proposed sub-processor; the nature and scope of the processing activities to be performed by the proposed sub-processor; the location(s) of processing; and any relevant certifications, audit reports, or other evidence of the proposed sub-processor's data protection compliance.
(iv) If the Data Exporter, or the Controller acting through the Data Exporter, objects to a new sub-processor on reasonable grounds relating to data protection, the Data Importer shall not engage the proposed sub-processor for the processing of the relevant personal data. In such event, the Data Importer may propose reasonable steps to address the objection, including modifications to the proposed processing arrangements or the implementation of additional safeguards. If no resolution can be reached within a reasonable period, either Party may terminate the processing of the relevant personal data in accordance with Clause 16.
(v) As of the date of this draft, the Data Importer's authorized sub-processors are as follows:
Osprey Cloud Infrastructure, Inc. 2200 Campus Drive, San Jose, CA 95131, United States Processing activities: IaaS/PaaS cloud hosting of SBF Core infrastructure, including data storage, compute, and networking services Locations of processing: EU data center region (Frankfurt, Germany); US-East data center region (Ashburn, Virginia) Governing agreement: Skybridge–Osprey Cloud DPA dated March 1, 2024, together with separate Module 3 SCCs (Skybridge → Osprey Cloud) governing transfers to Osprey Cloud's US data centers.
9(b) — Flow-Down Obligations. (i) The Data Importer shall impose on its sub-processors, by way of a contract or other legally binding instrument under Union or Member State law, the same data protection obligations as are set out in these Clauses, in particular providing sufficient guarantees to implement appropriate technical and organizational measures in such a manner that the processing will meet the requirements of these Clauses and the GDPR.
(ii) The Data Importer shall ensure that its sub-processor agreements include third-party beneficiary rights for data subjects consistent with Clause 3 of these Clauses.
(iii) The Data Importer shall remain fully liable to the Data Exporter for the performance of the sub-processor's obligations under such contract. The Data Importer shall notify the Data Exporter of any failure by the sub-processor to fulfill its data protection obligations under such contract.
(iv) Upon request of the Data Exporter or the Controller, the Data Importer shall provide a copy of the sub-processor agreement and any subsequent amendments to the Data Exporter, provided that the Data Importer may redact business-confidential information not relevant to the data protection obligations.
9(c) — Due Diligence. (i) The Data Importer shall carry out appropriate due diligence on each sub-processor prior to engaging it to process personal data, including an assessment of the sub-processor's ability to provide sufficient guarantees to implement appropriate technical and organizational measures in accordance with these Clauses and the GDPR.
(ii) The Data Importer shall oversee the sub-processor's compliance with its data protection obligations during the entire duration of the processing relationship, including by conducting periodic reviews of the sub-processor's technical and organizational measures, audit reports, and data protection practices.
(iii) The Data Importer shall document the results of its due diligence and ongoing oversight activities, and shall make such documentation available to the Data Exporter upon request.
Clause 10 — Data Subject Rights
(a) The Parties shall cooperate in responding to requests from data subjects exercising their rights under the GDPR, including the rights of access (Article 15), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18), data portability (Article 20), and objection (Article 21).
(b) Where the Data Importer receives a request directly from a data subject, it shall promptly notify the Data Exporter and shall not respond to the request itself unless authorized to do so by the Data Exporter or the Controller.
(c) The Data Importer shall deal with requests from data subjects promptly and, in any event, within one (1) month of receipt or within such other time period as may be applicable under the GDPR, including any extension permitted under Article 12(3) of the GDPR.
(d) The Data Importer shall assist the Data Exporter in fulfilling its obligations to respond to data subject requests, taking into account the nature of the processing. Such assistance may include providing the Data Exporter with relevant information held by the Data Importer, implementing technical measures to facilitate responses to data subject requests, and cooperating with the Data Exporter and the Controller in any communications with data subjects.
(e) The Data Importer shall maintain appropriate processes and procedures to ensure that data subject requests are identified, tracked, and responded to in a timely and effective manner.
Clause 11 — Redress
11(a) — Complaint Mechanism. (i) The Data Importer shall inform data subjects in a transparent and easily accessible manner, through its website or by other appropriate means, of a contact point authorized to handle complaints. As of the date of these Clauses, the designated contact point is:
Lena Vogt Managing Director Skybridge Fintech Europe B.V. Keizersgracht 482 1017 EG Amsterdam, Netherlands
Email: [privacy@skybridgefintech.eu]
Phone: [+31 (0)20 XXX XXXX]
(ii) The Data Importer shall deal promptly and appropriately with any complaints received from data subjects regarding the processing of their personal data. The Data Importer shall keep a record of all complaints received and the responses provided.
11(b) — Data Subjects and the Data Exporter. (i) If a data subject invokes third-party beneficiary rights and/or lodges a claim for compensation against the Data Exporter under these Clauses, the Data Exporter shall promptly inform the Data Importer.
(ii) The Data Importer shall assist the Data Exporter in addressing the claim, including by providing information relevant to the complaint and cooperating in any investigation or proceedings.
(iii) The Data Importer agrees that the data subject may also lodge a complaint against the Data Importer directly in accordance with Clause 11(c) below.
11(c) — Data Subjects and the Data Importer. (i) The Data Importer agrees that a data subject may lodge a complaint directly with the Data Importer regarding the Data Importer's processing of the data subject's personal data under these Clauses.
(ii) The Data Importer agrees to accept the jurisdiction of, and to submit to the decisions of, the competent courts of the EU Member State in which the data subject has habitual residence, or the courts of the Netherlands, for any disputes arising under these Clauses.
(iii) The Data Importer agrees to accept the jurisdiction of, and to cooperate with, the competent supervisory authority (the Autoriteit Persoonsgegevens) for any matters arising under these Clauses.
(iv) The Data Importer shall abide by decisions of competent courts or supervisory authorities that are final and against which no further appeal is possible under the applicable law.
(v) The Data Importer agrees that nothing in this Clause 11(c) shall affect the data subject's right to seek redress from the Data Exporter.
Clause 12 — Liability
(a) Each Party shall be liable to data subjects, and each data subject shall be entitled to receive compensation, for any material or non-material damages caused by a breach of these Clauses by either Party.
(b) Where both the Data Exporter and the Data Importer are responsible for any damage caused to a data subject as a result of a breach of these Clauses, the data subject shall be entitled to bring a claim for the full amount of the damage against either the Data Exporter or the Data Importer, without prejudice to the data subject's right to seek redress from both Parties.
(c) Where one Party has paid full compensation to the data subject for the damage suffered, that Party shall be entitled to claim back from the other Party that part of the compensation corresponding to the other Party's share of responsibility for the damage.
(d) The Data Importer may not invoke the conduct of a sub-processor to avoid its own liability under these Clauses.
(e) For the avoidance of doubt, the liability provisions of these Standard Contractual Clauses are without prejudice to, and operate independently from, the liability cap provisions set forth in the DPA between Meridian Federal Savings Bank and Skybridge Fintech Ltd. (which provides for a liability cap equal to the greater of Five Million United States Dollars ($5,000,000) or two times (2×) the trailing twelve (12)-month fees paid by the Controller under the SaaS subscription agreement). To the extent that any provision of the DPA or any related agreement purports to limit or cap the liability of either Party to data subjects under these Clauses, such limitation or cap shall not apply insofar as it would restrict or limit the rights of data subjects to receive full compensation for damages under these Clauses, in accordance with Article 82 of the GDPR.
Clause 13 — Supervision
13(a) — Competent Supervisory Authority. (i) The competent supervisory authority with responsibility for ensuring compliance with Regulation (EU) 2016/679 regarding the data transfer is the:
Autoriteit Persoonsgegevens (Dutch Data Protection Authority) Bezuidenhoutseweg 30 2594 AV The Hague, Netherlands
(ii) The Autoriteit Persoonsgegevens is the competent supervisory authority because the Data Importer, Skybridge Fintech Europe B.V., is established in the Netherlands, and the Netherlands is the EU Member State in which the Data Importer carries out the processing activities covered by these Clauses.
(iii) Where the Data Exporter is not established in an EU Member State but falls within the territorial scope of the GDPR pursuant to Article 3(2) thereof, the competent supervisory authority shall be determined in accordance with Articles 55 and 56 of the GDPR.
13(b). The Data Importer agrees to submit to the jurisdiction of, and to cooperate with, the competent supervisory authority identified in Clause 13(a) in any procedures aimed at ensuring compliance with these Clauses. Such cooperation shall include responding to inquiries, providing documentation, and facilitating inspections or audits conducted by or on behalf of the supervisory authority.
SECTION III — LOCAL LAWS AND OBLIGATIONS IN CASE OF ACCESS BY PUBLIC AUTHORITIES
Clause 14 — Local Laws and Practices Affecting Compliance with the Clauses
14(a) — Warranties. (i) Each Party warrants that it has no reason to believe that the laws and practices in the country of the Data Importer (the Netherlands), including any requirements to disclose personal data or measures authorizing access by public authorities, prevent the Data Importer from fulfilling its obligations under these Clauses. This warranty is based on the understanding that laws and practices that respect the essence of the fundamental rights and freedoms and do not exceed what is necessary and proportionate in a democratic society to safeguard one of the objectives listed in Article 23(1) of the GDPR are not in contradiction with these Clauses.
(ii) The Parties specifically acknowledge and confirm that:
(A) The Netherlands is an EU Member State and is subject to the full body of European Union law, including the GDPR, the EU Charter of Fundamental Rights, and the European Convention on Human Rights, which collectively provide an adequate level of data protection for personal data processed within its territory.
(B) The Data Importer (SBF Europe) is a Dutch legal entity, established and operating exclusively in the Netherlands for the purposes of these Clauses, and is not subject to the laws of the United States concerning national security surveillance, foreign intelligence gathering, or other governmental access to personal data (including, without limitation, Section 702 of the Foreign intelligence Surveillance Act, Executive Order 12333, and the Clarifying Lawful Overseas Use of Data Act ("CLOUD Act")).
(C) Accordingly, the Schrems II concerns arising from US government access to personal data are not applicable to the Data Importer's processing of personal data under these Clauses, to the extent that such data is processed and retained within the territory of the Netherlands and the European Union.
14(b) — Assessment. The Parties represent and warrant that they have conducted an assessment of the laws and practices of the Netherlands that may be relevant to the Data Importer's ability to comply with these Clauses, taking into account the following elements:
(i) the specific circumstances of the transfer, including the nature of the personal data, the categories of data subjects, the purpose of the processing, the type and characteristics of the Data Importer, the length of the processing chain, and any applicable sector-specific laws or norms (including those applicable to the financial services industry and the processing of behavioral biometric data);
(ii) the laws and practices of the Netherlands, including those requiring the disclosure of data to public authorities or authorizing access by such authorities, as well as applicable restrictions and safeguards, including those provided by the Dutch constitution, the GDPR, the Dutch GDPR Implementation Act (Uitvoeringswet Algemene verordening gegevensbescherming), and oversight by the Autoriteit Persoonsgegevens;
(iii) any relevant contractual, technical, or organizational safeguards put in place to supplement the safeguards under these Clauses, including the measures described in Annex II and any additional measures agreed between the Parties;
(iv) the conclusion, based on the foregoing assessment, that the Netherlands, as an EU Member State, provides an adequate level of data protection, and that no supplementary measures beyond those set forth in these Clauses and Annex II are necessary to ensure compliance with these Clauses.
14(c) — Ongoing Compliance. (i) The Data Importer shall promptly notify the Data Exporter if it has reason to believe that it is or has become subject to laws or practices not in line with the requirements under Clause 14(a), including following a change in the laws of the Netherlands or any other relevant jurisdiction, or following any measure (such as a court order or regulatory directive) indicating an application of such laws in practice that is not in line with the requirements set forth in Clause 14(a).
(ii) Upon receiving a notification under paragraph (i), the Data Exporter shall promptly identify appropriate measures to be adopted to address the situation, including, where appropriate, additional technical or organizational measures to ensure the security and confidentiality of the personal data. If no appropriate measures can be identified or implemented that are sufficient to ensure compliance with these Clauses, the Data Exporter shall suspend the transfer of personal data to the Data Importer until such time as compliance can be restored.
(iii) The Data Exporter shall be entitled to terminate these Clauses insofar as they concern the processing of the affected personal data if it considers that no appropriate safeguards for such data can be ensured.
Clause 15 — Obligations of the Data Importer in Case of Access by Public Authorities
15.1 — Notification. (a) The Data Importer shall promptly notify the Data Exporter and, where possible, the data subject (if necessary with the help of the Data Exporter), if the Data Importer:
(i) receives a legally binding request from a public authority, including judicial authorities, under the laws of the Netherlands or any other applicable jurisdiction, for the disclosure of personal data transferred pursuant to these Clauses; such notification shall include information about the personal data requested, the requesting authority, the legal basis for the request, and the response provided;
(ii) becomes aware of any direct access by public authorities to personal data transferred pursuant to these Clauses, in accordance with the laws of the Netherlands or any other applicable jurisdiction; such notification shall include, to the extent available, all information available to the Data Importer;
(iii) receives any information, whether from a public authority or from any other source, indicating that indirect access by public authorities to personal data transferred pursuant to these Clauses has occurred or may be occurring.
(b) If the Data Importer is prohibited under the laws of the Netherlands from notifying the Data Exporter and/or the data subject of a disclosure request or access event, the Data Importer shall use its best efforts to obtain a waiver of the prohibition, with a view to communicating as much information as possible, as soon as possible. The Data Importer shall document its efforts to obtain such a waiver and shall make such documentation available to the Data Exporter upon request.