1009-00004 · Skybridge Fintech Ltd · Transaction Documents/Schedules

schedule-a-description-of-processing.docx DOCUMENT Finance & Banking

32 / 35 ← → ✕

SCHEDULE A

Description of Processing

This Schedule A is made and entered into as part of the Data Processing Agreement dated February 5, 2026 (the "Agreement"), between Meridian Federal Savings Bank ("Controller") and Skybridge Fintech Ltd. ("Processor"). Capitalized terms used but not defined herein shall have the meanings ascribed to them in the Agreement.

This Schedule A forms an integral part of the Agreement and describes the subject matter, nature, purpose, duration, categories of data subjects, and categories of personal data processed by Processor on behalf of Controller in connection with the SBF Core platform. The descriptions set forth herein are intended to satisfy the documentation requirements of the Agreement, the General Data Protection Regulation (Regulation (EU) 2016/679) ("GDPR"), and applicable United States federal and state data protection laws. In the event of any conflict between this Schedule A and the body of the Agreement, the terms of the Agreement shall control unless this Schedule A expressly states otherwise.

1. Parties to the Processing

1.1 Controller. The Controller under this Schedule A is:

Full Legal Name: Meridian Federal Savings Bank

Entity Type: Federally chartered savings bank, insured by the Federal Deposit Insurance Corporation ("FDIC")

Charter Number: 14-2238

Principal Office Address: 900 Broad Street, Suite 1200, Newark, New Jersey 07102, United States of America

Primary Contacts for Data Processing Matters:

• Andrea Sokolov, Chief Compliance Officer

• Marcus Tibaldi, Vice President, Third-Party Risk Management

All notices, inquiries, and communications relating to the processing of personal data under this Schedule A shall be directed to the contacts identified above, or to such other persons as Controller may designate in writing from time to time in accordance with the notice provisions of the Agreement.

1.2 Processor. The Processor under this Schedule A is:

Full Legal Name: Skybridge Fintech Ltd.

Entity Type: Delaware corporation (C-corp)

Principal Office Address: 4100 Silverside Road, Suite 310, Wilmington, Delaware 19810, United States of America

Primary Contacts for Data Processing Matters:

• Thomas Elridge, General Counsel and Chief Privacy Officer

• Rebecca Muñoz, Chief Information Security Officer ("CISO")

All notices, inquiries, and communications relating to the processing of personal data under this Schedule A shall be directed to the contacts identified above, or to such other persons as Processor may designate in writing from time to time in accordance with the notice provisions of the Agreement.

2. Subject Matter and Nature of Processing

Subject Matter. The processing of personal data by Processor under this Schedule A arises in connection with the provision of the SBF Core software-as-a-service ("SaaS") platform to Controller, pursuant to the SaaS Subscription Agreement entered into between the parties concurrently with the Agreement (the "Subscription Agreement"). Processor processes personal data solely on behalf of Controller and only to the extent necessary to perform Processor's obligations under the Subscription Agreement and in accordance with Controller's documented instructions as described in this Schedule A and in the Agreement.

Nature of Processing. Processor's processing of personal data is automated electronic processing. The processing operations include, without limitation, the following activities with respect to personal data: collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission to Controller and Controller's authorized recipients, alignment, combination, restriction, erasure, and destruction. Processor does not engage in manual paper-based processing of Controller's personal data under this Schedule A.

Platform Description. The SBF Core platform is a software-as-a-service platform that provides real-time payment processing, anti-fraud analytics (including behavioral biometric analysis), and regulatory reporting services to FDIC-insured banks and credit unions. The platform is designed to support financial institutions' compliance with applicable federal and state banking regulations and to enhance the security and efficiency of payment processing operations.

Processing Environment. Processor processes personal data in a multi-tenant SaaS environment hosted by Osprey Cloud Infrastructure, Inc. ("Osprey Cloud"), a third-party infrastructure-as-a-service and platform-as-a-service provider. Controller's personal data resides in the following data center environments:

(a) United States — Primary: The Osprey Cloud US-East data center region located in Ashburn, Virginia, which serves as the primary processing environment for all categories of personal data processed under this Schedule A.

(b) United States — Disaster Recovery: The Osprey Cloud US-East secondary availability zone located in Ashburn, Virginia, which serves as the disaster recovery and business continuity site for all categories of personal data.

(c) European Union — Primary: For personal data relating to EU-resident data subjects (as further described in Section 4 below), Processor processes such data in the Osprey Cloud EU data center region located in Frankfurt, Germany.

(d) European Union — Support: Personal data of EU-resident data subjects may also be processed by Skybridge Fintech Europe B.V., a wholly-owned subsidiary of Processor, located at Keizersgracht 482, 1017 EG Amsterdam, Netherlands.

Controller's personal data is logically segregated from the data of Processor's other customers through the use of tenant-level encryption keys, access controls, and database partitioning, as further described in Schedule B to the Agreement.

3. Purpose of Processing

Processor processes personal data on behalf of Controller solely for the following purposes, each of which is necessary for the performance of Processor's obligations under the Subscription Agreement:

3.1 Payment Processing

Processor processes personal data for the purpose of real-time processing of payment transactions initiated by or on behalf of Controller's accountholders, including transactions involving checking accounts, savings accounts, and loan accounts maintained by Controller. The payment processing activities include, without limitation:

(a) Receipt, validation, and routing of payment instructions containing account numbers, routing numbers, transaction amounts, timestamps, and related transaction metadata;

(b) Processing of electronic fund transfers, automated clearing house (ACH) transactions, wire transfers, and real-time payment network transactions on behalf of Controller;

(c) Generation of transaction records and confirmations for Controller's internal systems and for accountholder-facing communications; and

(d) Maintenance of transaction logs and audit trails as required by applicable law and regulation and as necessary for the proper functioning of the SBF Core platform.

Controller estimates the volume of payment transactions to be processed by Processor under this Schedule A at approximately 18.6 million transactions per month, subject to seasonal and business-cycle variation. This estimate is provided for informational purposes and does not constitute a cap on processing volume; actual transaction volumes may exceed or fall below this estimate without requiring amendment of this Schedule A, provided that material changes in volume that affect the risk profile of processing shall be communicated by Controller to Processor in a timely manner.

3.2 Anti-Fraud Analytics

Processor processes personal data for the purpose of real-time and batch fraud detection and prevention analysis of Controller's accountholder transactions and account activity. The anti-fraud analytics activities include, without limitation:

(a) Real-time monitoring and analysis of payment transactions and account activity for indicators of fraudulent or suspicious behavior, including transaction velocity analysis, anomalous transaction patterns, and geographic inconsistencies;

(b) Analysis of behavioral biometric data, including keystroke dynamics (typing speed, rhythm, and pressure patterns) and mouse movement patterns (trajectory, velocity, and click patterns), for the purpose of fraud-scoring and anomaly detection in connection with Controller's digital banking channels;

(c) Analysis of IP addresses, device identifiers (including device fingerprints, browser identifiers, and operating system information), and geolocation data (resolved to city-level granularity) for risk assessment and device reputation scoring;

(d) Generation and delivery of fraud alerts and risk scores to Controller's fraud operations team for human review and disposition; and

(e) Maintenance of fraud models, rule sets, and analytics outputs as necessary for the ongoing calibration and improvement of fraud detection capabilities, subject at all times to Controller's documented instructions and the limitations set forth in the Agreement.

For the avoidance of doubt, Processor does not make automated decisions with legal or similarly significant effects on data subjects without Controller's explicit authorization. Fraud alerts and risk scores generated by the SBF Core platform are delivered to Controller for human review and final determination.

3.3 Regulatory Reporting

Processor processes personal data for the purpose of preparing, formatting, and transmitting regulatory reports derived from Controller's transaction and accountholder data as required by applicable law and regulation. The regulatory reporting activities include, without limitation:

(a) Preparation and formatting of regulatory filings and data submissions required by Controller's primary and secondary regulatory supervisors, including the Office of the Comptroller of the Currency ("OCC"), the Federal Deposit Insurance Corporation ("FDIC"), and the Consumer Financial Protection Bureau ("CFPB");

(b) Generation of data feeds, reports, and extracts in the formats and file specifications required by Controller's regulatory supervisors, including call report data, suspicious activity report (SAR) supporting data, currency transaction report (CTR) supporting data, and other regulatory data submissions;

(c) Support for Controller's compliance with applicable anti-money laundering (AML), Bank Secrecy Act (BSA), and other financial crime reporting obligations to the extent that such compliance requires the processing of personal data through the SBF Core platform; and

(d) Maintenance of data retention and audit trail records necessary to support Controller's regulatory examination and supervisory review processes.

Processor's role in regulatory reporting is limited to the preparation, formatting, and transmission of data and reports at Controller's direction. Controller retains sole responsibility for the accuracy, completeness, and timeliness of all regulatory filings submitted to regulatory supervisors. Processor does not independently file regulatory reports with any governmental authority on Controller's behalf unless expressly instructed to do so by Controller in writing.

4. Categories of Data Subjects

The personal data processed by Processor under this Schedule A relates to the following categories of data subjects:

(a) Retail Accountholders. Individual persons who maintain one or more retail deposit or loan accounts with Controller, including checking account holders, savings account holders, and consumer loan borrowers. As of the effective date of this Schedule A, Controller estimates that there are approximately 412,000 retail accountholders whose personal data may be processed under this Schedule A. This estimate is provided for informational purposes and may vary over the term of the Subscription Agreement.

(b) Small-Business Accountholders. Individuals who are the owners, principals, or authorized representatives of small-business entities that maintain one or more business deposit or loan accounts with Controller, to the extent that personal data relating to such individuals is processed through the SBF Core platform.

(c) Authorized Signers. Individuals who are authorized to transact on behalf of an accountholder on one or more accounts maintained by Controller, including joint account holders, power-of-attorney designees, and authorized corporate signers.

(d) Beneficial Owners. Individuals identified as beneficial owners of accounts maintained by Controller, as determined pursuant to Controller's customer identification program (CIP) and beneficial ownership verification processes in accordance with 31 CFR § 1010.230 and applicable FinCEN guidance.

(e) Controller Employees. Employees of Controller whose personal data passes through the SBF Core platform in the ordinary course of processing, including (i) employees who are authorized users of the SBF Core platform and whose user credentials, access logs, and authentication data are processed by the platform, and (ii) employees whose payroll, direct deposit, or personal account data is processed through the SBF Core platform.

(f) EU-Resident Data Subjects. Approximately 3,200 of Controller's accountholders maintain EU residency, including expatriate accounts and dual-resident accounts. The processing of personal data relating to these EU-resident data subjects triggers obligations under the GDPR. The Standard Contractual Clauses appended to the Agreement as Schedule D govern the transfer of personal data of EU-resident data subjects to the extent such transfers are subject to GDPR requirements. Processor shall ensure that the personal data of EU-resident data subjects is processed and stored in accordance with the processing location requirements set forth in Section 7 of this Schedule A, unless otherwise directed by Controller in writing.

5. Categories of Personal Data

The following categories of personal data are processed by Processor on behalf of Controller under this Schedule A:

5.1 Identity and Contact Data

(a) Full legal name of the data subject, including first name, middle name or initial, last name, and suffix (e.g., Jr., Sr., III);

(b) Date of birth;

(d) Phone numbers, including mobile, home, and business telephone numbers associated with the account.

5.2 Government-Issued Identifiers

(a) Social Security number ("SSN");

(b) Taxpayer identification number ("TIN"), including individual taxpayer identification numbers (ITINs) and employer identification numbers (EINs) where associated with an individual data subject.

SSNs and TINs are classified as sensitive personal data under applicable United States state privacy laws, including, without limitation, the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA/CPRA") (Cal. Civ. Code §§ 1798.100 et seq.) and the New Jersey Data Privacy Act (NJ S3377). Processor shall apply heightened security measures to SSNs and TINs as described in Schedule B to the Agreement, including, without limitation, encryption at rest using AES-256 encryption, encryption in transit using TLS 1.2 or higher, and role-based access controls limiting access to authorized personnel with a legitimate business need.

5.3 Financial Account Data

(a) Account numbers for checking, savings, and loan accounts maintained by Controller;

(b) Routing numbers associated with Controller's accounts;

(d) Transaction metadata, including timestamps, counterparty identifiers, transaction type codes (e.g., debit, credit, transfer, payment), and merchant category codes ("MCCs").

Financial account data constitutes nonpublic personal information subject to the Gramm-Leach-Bliley Act ("GLBA") and Regulation P (12 CFR Part 1016). Processor shall safeguard financial account data in accordance with the information security requirements of the GLBA Safeguards Rule and the security measures described in Schedule B to the Agreement.

5.4 Technical and Device Data

(a) IP addresses, including both IPv4 and IPv6 addresses, associated with data subjects' sessions on Controller's digital banking platforms;

(b) Device identifiers, including device fingerprints, browser identifiers (user agent strings), and operating system information;

(c) Geolocation data resolved to city-level granularity, derived from IP address mapping and, where available, from device-level location services data provided by the data subject's device.

Processor does not process precise geolocation data (i.e., geolocation data that identifies the specific location of a data subject with a precision of 1,750 feet or less) under this Schedule A. City-level geolocation data is used solely for fraud risk assessment and device reputation scoring purposes.

5.5 Behavioral Biometric Data

(a) Keystroke dynamics, including typing speed, keystroke rhythm, inter-key interval timing, and key pressure patterns, collected during data subjects' interactions with Controller's digital banking platforms;

(b) Mouse movement patterns, including cursor trajectory, cursor velocity, click timing, click position patterns, and scroll behavior, collected during data subjects' interactions with Controller's digital banking platforms.

Behavioral biometric data is classified as sensitive personal data under certain applicable United States state privacy laws, including the CCPA/CPRA (Cal. Civ. Code § 1798.140(ae)) and the New Jersey Data Privacy Act (NJ S3377). Behavioral biometric data is collected and processed solely for the purpose of fraud-scoring and anomaly detection as described in Section 3.2 of this Schedule A. Processor shall apply heightened security measures to behavioral biometric data as described in Schedule B to the Agreement.

6. Sensitive Data

The parties acknowledge and agree that the following categories of personal data processed under this Schedule A constitute sensitive personal data or special category data under one or more applicable data protection laws:

(a) Social Security numbers — classified as sensitive personal data under applicable United States state privacy laws, including the CCPA/CPRA and the New Jersey Data Privacy Act (NJ S3377);

(b) Behavioral biometric data (keystroke dynamics and mouse movement patterns) — classified as sensitive personal data under applicable United States state privacy laws, including the CCPA/CPRA and the New Jersey Data Privacy Act (NJ S3377).

The parties expressly confirm that no personal data falling within the special categories described in Article 9(1) of the GDPR is intended to be processed under this Schedule A or the Agreement. Specifically, the processing described herein does not encompass personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, data concerning health, or data concerning a natural person's sex life or sexual orientation. In the event that Processor becomes aware that it has received or is processing any such special category data, Processor shall promptly notify Controller and shall not further process such data except as instructed by Controller in writing.

Processor shall apply heightened security measures to all sensitive data identified in this Section 6, as described in detail in Schedule B (Technical and Organizational Security Measures) to the Agreement. Such heightened security measures shall include, without limitation, enhanced encryption standards, access controls, audit logging, and data minimization practices specifically tailored to the protection of sensitive data categories.

7. Processing Locations

Processor shall process Controller's personal data only at the following approved processing locations. Any change in processing location requires Controller's prior written approval in accordance with the terms of the Agreement.

Processor shall not transfer, access, or process personal data at any location other than those identified in the table above without Controller's prior written authorization. For the avoidance of doubt, remote access by Processor's authorized personnel (e.g., employees or contractors working from locations other than the facilities listed above) shall be subject to the access control and security requirements set forth in Schedule B to the Agreement, and shall not constitute a change of processing location provided that such remote access does not result in the storage or persistence of personal data outside of the approved processing locations.

8. Duration of Processing

8.1 Term of Processing

Processing of personal data by Processor under this Schedule A shall commence on the effective date of the SaaS Subscription Agreement between Controller and Processor (target effective date: February 15, 2026). Processing shall continue for the full term of the Subscription Agreement, including any renewals, extensions, or modifications thereof. The initial term of the Subscription Agreement is five (5) years, with an annual contract value of $2.74 million per year (total contract value: $13.7 million over the initial term). In the event that the Subscription Agreement is renewed or extended, the processing described in this Schedule A shall continue for the duration of such renewal or extension period without requiring amendment to this Schedule A, unless the scope of processing changes materially.

8.2 Post-Termination Retention Period

Upon expiration or termination of the Subscription Agreement for any reason, Processor shall retain Controller's personal data for a period of ninety (90) calendar days following the effective date of expiration or termination (the "Post-Termination Retention Period"). During the Post-Termination Retention Period, Processor shall retain Controller's personal data solely for the purpose of facilitating Controller's retrieval, return, or migration of such data to Controller or to a successor service provider designated by Controller. Processor shall make Controller's personal data available for export in a structured, commonly used, and machine-readable format during the Post-Termination Retention Period.

At the expiration of the ninety (90)-day Post-Termination Retention Period, Processor shall securely delete or destroy all personal data of Controller in Processor's possession, custody, or control, including all copies, backups, and archived instances of such data, using methods consistent with NIST Special Publication 800-88, Revision 1 (Guidelines for Media Sanitization), or equivalent industry standards. Processor shall not retain any copies of Controller's personal data following the completion of deletion or destruction, unless retention is required by applicable law, including federal banking regulations, tax laws, or other legal obligations applicable to Processor.

Upon Controller's written request, Processor shall provide Controller with a written certification of deletion or destruction, signed by Processor's CISO or General Counsel, confirming that all personal data has been deleted or destroyed in accordance with this Section 8.2 and specifying the methods of deletion or destruction employed.

8.3 Legal Hold Exception

Notwithstanding the foregoing provisions of Section 8.2, Processor may retain personal data beyond the ninety (90)-day Post-Termination Retention Period to the extent that such retention is required by applicable law, regulation, or legal process (including, without limitation, litigation hold obligations, subpoenas, regulatory examination requests, or court orders), provided that Processor shall:

(i) notify Controller in writing of the existence and general nature of such legal requirement within five (5) business days of Processor's becoming aware of such requirement, to the extent that such notification is permitted by applicable law;

(ii) limit the retention of personal data to the minimum scope and duration strictly required to comply with the applicable legal requirement;

(iii) continue to protect all retained personal data in accordance with the technical and organizational security measures set forth in Schedule B to the Agreement for the entire duration of such extended retention; and

(iv) promptly delete or destroy the retained personal data upon the expiration or satisfaction of the applicable legal requirement, and provide Controller with written certification of such deletion or destruction.

9. Sub-Processors

Processor engages the following sub-processors in connection with the processing of Controller's personal data under this Schedule A:

(a) Osprey Cloud Infrastructure, Inc. — Provides infrastructure-as-a-service (IaaS) and platform-as-a-service (PaaS) hosting for the SBF Core platform in the Osprey Cloud US-East data center region (Ashburn, Virginia, USA) and the Osprey Cloud EU data center region (Frankfurt, Germany).

(b) Skybridge Fintech Europe B.V. — A wholly-owned subsidiary of Processor providing EU personal data processing support services from Amsterdam, Netherlands.

A complete and current list of all approved sub-processors is set forth in Schedule C (Approved Sub-Processor List) to the Agreement. Controller has reviewed and approved the sub-processors listed in Schedule C as of the effective date of the Agreement.

The mechanics governing Processor's engagement of new sub-processors and changes to existing sub-processors are set forth in Section 7 of the Agreement, including, without limitation: (i) Processor's obligation to provide Controller with at least thirty (30) days' prior written notice before engaging any new sub-processor or making any material change to an existing sub-processor; (ii) Controller's right to object to the engagement of a new sub-processor on reasonable grounds related to data protection; and (iii) the resolution procedures applicable in the event of a Controller objection. Processor shall ensure that all sub-processors are bound by written agreements imposing data protection obligations no less protective than those set forth in the Agreement.

10. Controller Instructions

Processor shall process personal data solely in accordance with Controller's documented instructions as set forth in the Agreement, this Schedule A, and any subsequent written instructions provided by Controller from time to time in accordance with the terms of the Agreement. The processing activities described in Sections 2 through 5 of this Schedule A constitute Controller's initial complete instructions to Processor with respect to the processing of personal data under the Agreement.

Any processing of personal data by Processor outside the scope of this Schedule A — including, without limitation, processing for any new or additional purpose, processing of any new category of personal data not described in Section 5, or processing involving any new category of data subjects not described in Section 4 — requires Controller's prior written authorization. Processor shall promptly inform Controller if, in Processor's opinion, an instruction from Controller infringes applicable data protection law, and shall not be required to comply with such instruction until Controller has confirmed the instruction in writing after being so informed.

With respect to the personal data of EU-resident data subjects, the description of the data importer and data exporter, the categories of data subjects, the categories of personal data, and the purpose and nature of the processing set forth in this Schedule A shall serve as the description of the transfer required by Annex I of the Standard Contractual Clauses (Module Two: Controller to Processor) appended to the Agreement as Schedule D. To the extent of any inconsistency between this Schedule A and Annex I of the Standard Contractual Clauses with respect to EU personal data transfers, the Standard Contractual Clauses shall prevail.

11. Applicable Data Protection Laws

The processing of personal data described in this Schedule A is subject to, and shall be carried out in compliance with, the following data protection and privacy laws, regulations, and regulatory guidance, as amended from time to time:

(a) Gramm-Leach-Bliley Act ("GLBA") (15 U.S.C. §§ 6801–6809) and Regulation P (12 CFR Part 1016) — governing the privacy and security of nonpublic personal information of consumers of financial institutions;

(b) OCC Bulletin 2023-17 (Third-Party Risk Management) — establishing supervisory expectations for banks' management of risks associated with third-party relationships, including relationships involving access to customer information;

(c) FDIC/OCC Computer-Security Incident Notification Rule (12 CFR Part 53) — requiring banking organizations and their service providers to notify regulators of computer-security incidents that could result in notification obligations;

(d) General Data Protection Regulation ("GDPR") (Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016) — applicable to the processing of personal data of approximately 3,200 EU-resident data subjects identified in Section 4(f) of this Schedule A, including the requirements for lawful transfer of personal data to third countries;

(e) California Consumer Privacy Act / California Privacy Rights Act ("CCPA/CPRA") (Cal. Civ. Code §§ 1798.100 et seq.) — applicable to the processing of personal information of California-resident accountholders of Controller;

(f) New Jersey Data Privacy Act (NJ S3377), effective January 15, 2026 — applicable to the processing of personal data of New Jersey-resident accountholders of Controller and imposing obligations with respect to, among other things, sensitive data processing, data protection assessments, and consumer rights;

(g) Such other applicable United States federal and state privacy, data security, and financial services laws and regulations as may apply to the processing of personal data described herein, including, without limitation, state data breach notification laws, state biometric privacy laws, and federal banking examination requirements.

Processor shall monitor changes in applicable data protection laws and regulations and shall promptly inform Controller of any developments that may materially affect the processing described in this Schedule A or Processor's ability to comply with its obligations under the Agreement.

Incorporation and Execution

This Schedule A is incorporated into and forms an integral part of the Agreement. The terms and conditions set forth in this Schedule A are binding upon the parties as of the effective date of the Agreement.

Separate signature lines are not required on this Schedule A. This Schedule A is deemed executed and effective upon execution of the Agreement by both parties. Reference is hereby made to the signature pages of the Agreement for evidence of the parties' execution. The target date of execution of the Agreement, and therefore the effective date of this Schedule A, is February 15, 2026.

[Remainder of this page intentionally left blank.]

CONFIDENTIAL — This Schedule A contains confidential business information of the parties and is subject to the confidentiality provisions of the Agreement.

Location	Entity / Facility	Data Types Processed	Purpose
Ashburn, Virginia, USA (Primary)	Osprey Cloud Infrastructure, Inc. — US-East data center region	All categories of personal data described in Section 5	Primary hosting of SBF Core platform; payment processing, fraud detection and prevention, regulatory reporting
Ashburn, Virginia, USA (Disaster Recovery)	Osprey Cloud Infrastructure, Inc. — US-East secondary availability zone	All categories of personal data described in Section 5	Disaster recovery and business continuity
Frankfurt, Germany (EU — Primary)	Osprey Cloud Infrastructure, Inc. — EU data center region	Personal data of EU-resident data subjects (approximately 3,200 accountholders)	Hosting and processing of EU personal data in compliance with GDPR data residency requirements
Amsterdam, Netherlands (EU — Support)	Skybridge Fintech Europe B.V., Keizersgracht 482, 1017 EG Amsterdam, Netherlands	Personal data of EU-resident data subjects	EU personal data processing support, including customer support, incident response, and platform maintenance for EU-resident data subject accounts
Wilmington, Delaware, USA (Administrative)	Skybridge Fintech Ltd. — headquarters, 4100 Silverside Road, Suite 310, Wilmington, DE 19810	Administrative access to all categories of personal data	Platform administration, software engineering, technical support, and operational management

SCHEDULE A
Description of Processing
This Schedule A is made and entered into as part of the Data Processing Agreement dated February 5, 2026 (the "Agreement"), between Meridian Federal Savings Bank ("Controller") and Skybridge Fintech Ltd. ("Processor"). Capitalized terms used but not defined herein shall have the meanings ascribed to them in the Agreement.
This Schedule A forms an integral part of the Agreement and describes the subject matter, nature, purpose, duration, categories of data subjects, and categories of personal data processed by Processor on behalf of Controller in connection with the SBF Core platform. The descriptions set forth herein are intended to satisfy the documentation requirements of the Agreement, the General Data Protection Regulation (Regulation (EU) 2016/679) ("GDPR"), and applicable United States federal and state data protection laws. In the event of any conflict between this Schedule A and the body of the Agreement, the terms of the Agreement shall control unless this Schedule A expressly states otherwise.
1. Parties to the Processing
1.1 Controller.  The Controller under this Schedule A is:
Full Legal Name: Meridian Federal Savings Bank
Entity Type: Federally chartered savings bank, insured by the Federal Deposit Insurance Corporation ("FDIC")
Charter Number: 14-2238
Principal Office Address: 900 Broad Street, Suite 1200, Newark, New Jersey 07102, United States of America
Primary Contacts for Data Processing Matters:
•  Andrea Sokolov, Chief Compliance Officer
•  Marcus Tibaldi, Vice President, Third-Party Risk Management
All notices, inquiries, and communications relating to the processing of personal data under this Schedule A shall be directed to the contacts identified above, or to such other persons as Controller may designate in writing from time to time in accordance with the notice provisions of the Agreement.
1.2 Processor.  The Processor under this Schedule A is:
Full Legal Name: Skybridge Fintech Ltd.
Entity Type: Delaware corporation (C-corp)
Principal Office Address: 4100 Silverside Road, Suite 310, Wilmington, Delaware 19810, United States of America
Primary Contacts for Data Processing Matters:
•  Thomas Elridge, General Counsel and Chief Privacy Officer
•  Rebecca Muñoz, Chief Information Security Officer ("CISO")
All notices, inquiries, and communications relating to the processing of personal data under this Schedule A shall be directed to the contacts identified above, or to such other persons as Processor may designate in writing from time to time in accordance with the notice provisions of the Agreement.
2. Subject Matter and Nature of Processing
Subject Matter. The processing of personal data by Processor under this Schedule A arises in connection with the provision of the SBF Core software-as-a-service ("SaaS") platform to Controller, pursuant to the SaaS Subscription Agreement entered into between the parties concurrently with the Agreement (the "Subscription Agreement"). Processor processes personal data solely on behalf of Controller and only to the extent necessary to perform Processor's obligations under the Subscription Agreement and in accordance with Controller's documented instructions as described in this Schedule A and in the Agreement.
Nature of Processing. Processor's processing of personal data is automated electronic processing. The processing operations include, without limitation, the following activities with respect to personal data: collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission to Controller and Controller's authorized recipients, alignment, combination, restriction, erasure, and destruction. Processor does not engage in manual paper-based processing of Controller's personal data under this Schedule A.
Platform Description. The SBF Core platform is a software-as-a-service platform that provides real-time payment processing, anti-fraud analytics (including behavioral biometric analysis), and regulatory reporting services to FDIC-insured banks and credit unions. The platform is designed to support financial institutions' compliance with applicable federal and state banking regulations and to enhance the security and efficiency of payment processing operations.
Processing Environment. Processor processes personal data in a multi-tenant SaaS environment hosted by Osprey Cloud Infrastructure, Inc. ("Osprey Cloud"), a third-party infrastructure-as-a-service and platform-as-a-service provider. Controller's personal data resides in the following data center environments:
(a) United States — Primary: The Osprey Cloud US-East data center region located in Ashburn, Virginia, which serves as the primary processing environment for all categories of personal data processed under this Schedule A.
(b) United States — Disaster Recovery: The Osprey Cloud US-East secondary availability zone located in Ashburn, Virginia, which serves as the disaster recovery and business continuity site for all categories of personal data.
(c) European Union — Primary: For personal data relating to EU-resident data subjects (as further described in Section 4 below), Processor processes such data in the Osprey Cloud EU data center region located in Frankfurt, Germany.
(d) European Union — Support: Personal data of EU-resident data subjects may also be processed by Skybridge Fintech Europe B.V., a wholly-owned subsidiary of Processor, located at Keizersgracht 482, 1017 EG Amsterdam, Netherlands.
Controller's personal data is logically segregated from the data of Processor's other customers through the use of tenant-level encryption keys, access controls, and database partitioning, as further described in Schedule B to the Agreement.
3. Purpose of Processing
Processor processes personal data on behalf of Controller solely for the following purposes, each of which is necessary for the performance of Processor's obligations under the Subscription Agreement:
3.1 Payment Processing
Processor processes personal data for the purpose of real-time processing of payment transactions initiated by or on behalf of Controller's accountholders, including transactions involving checking accounts, savings accounts, and loan accounts maintained by Controller. The payment processing activities include, without limitation:
(a) Receipt, validation, and routing of payment instructions containing account numbers, routing numbers, transaction amounts, timestamps, and related transaction metadata;
(b) Processing of electronic fund transfers, automated clearing house (ACH) transactions, wire transfers, and real-time payment network transactions on behalf of Controller;
(c) Generation of transaction records and confirmations for Controller's internal systems and for accountholder-facing communications; and
(d) Maintenance of transaction logs and audit trails as required by applicable law and regulation and as necessary for the proper functioning of the SBF Core platform.
Controller estimates the volume of payment transactions to be processed by Processor under this Schedule A at approximately 18.6 million transactions per month, subject to seasonal and business-cycle variation. This estimate is provided for informational purposes and does not constitute a cap on processing volume; actual transaction volumes may exceed or fall below this estimate without requiring amendment of this Schedule A, provided that material changes in volume that affect the risk profile of processing shall be communicated by Controller to Processor in a timely manner.
3.2 Anti-Fraud Analytics
Processor processes personal data for the purpose of real-time and batch fraud detection and prevention analysis of Controller's accountholder transactions and account activity. The anti-fraud analytics activities include, without limitation:
(a) Real-time monitoring and analysis of payment transactions and account activity for indicators of fraudulent or suspicious behavior, including transaction velocity analysis, anomalous transaction patterns, and geographic inconsistencies;
(b) Analysis of behavioral biometric data, including keystroke dynamics (typing speed, rhythm, and pressure patterns) and mouse movement patterns (trajectory, velocity, and click patterns), for the purpose of fraud-scoring and anomaly detection in connection with Controller's digital banking channels;
(c) Analysis of IP addresses, device identifiers (including device fingerprints, browser identifiers, and operating system information), and geolocation data (resolved to city-level granularity) for risk assessment and device reputation scoring;
(d) Generation and delivery of fraud alerts and risk scores to Controller's fraud operations team for human review and disposition; and
(e) Maintenance of fraud models, rule sets, and analytics outputs as necessary for the ongoing calibration and improvement of fraud detection capabilities, subject at all times to Controller's documented instructions and the limitations set forth in the Agreement.
For the avoidance of doubt, Processor does not make automated decisions with legal or similarly significant effects on data subjects without Controller's explicit authorization. Fraud alerts and risk scores generated by the SBF Core platform are delivered to Controller for human review and final determination.
3.3 Regulatory Reporting
Processor processes personal data for the purpose of preparing, formatting, and transmitting regulatory reports derived from Controller's transaction and accountholder data as required by applicable law and regulation. The regulatory reporting activities include, without limitation:
(a) Preparation and formatting of regulatory filings and data submissions required by Controller's primary and secondary regulatory supervisors, including the Office of the Comptroller of the Currency ("OCC"), the Federal Deposit Insurance Corporation ("FDIC"), and the Consumer Financial Protection Bureau ("CFPB");
(b) Generation of data feeds, reports, and extracts in the formats and file specifications required by Controller's regulatory supervisors, including call report data, suspicious activity report (SAR) supporting data, currency transaction report (CTR) supporting data, and other regulatory data submissions;
(c) Support for Controller's compliance with applicable anti-money laundering (AML), Bank Secrecy Act (BSA), and other financial crime reporting obligations to the extent that such compliance requires the processing of personal data through the SBF Core platform; and
(d) Maintenance of data retention and audit trail records necessary to support Controller's regulatory examination and supervisory review processes.
Processor's role in regulatory reporting is limited to the preparation, formatting, and transmission of data and reports at Controller's direction. Controller retains sole responsibility for the accuracy, completeness, and timeliness of all regulatory filings submitted to regulatory supervisors. Processor does not independently file regulatory reports with any governmental authority on Controller's behalf unless expressly instructed to do so by Controller in writing.
4. Categories of Data Subjects
The personal data processed by Processor under this Schedule A relates to the following categories of data subjects:
(a) Retail Accountholders. Individual persons who maintain one or more retail deposit or loan accounts with Controller, including checking account holders, savings account holders, and consumer loan borrowers. As of the effective date of this Schedule A, Controller estimates that there are approximately 412,000 retail accountholders whose personal data may be processed under this Schedule A. This estimate is provided for informational purposes and may vary over the term of the Subscription Agreement.
(b) Small-Business Accountholders. Individuals who are the owners, principals, or authorized representatives of small-business entities that maintain one or more business deposit or loan accounts with Controller, to the extent that personal data relating to such individuals is processed through the SBF Core platform.
(c) Authorized Signers. Individuals who are authorized to transact on behalf of an accountholder on one or more accounts maintained by Controller, including joint account holders, power-of-attorney designees, and authorized corporate signers.
(d) Beneficial Owners. Individuals identified as beneficial owners of accounts maintained by Controller, as determined pursuant to Controller's customer identification program (CIP) and beneficial ownership verification processes in accordance with 31 CFR § 1010.230 and applicable FinCEN guidance.
(e) Controller Employees. Employees of Controller whose personal data passes through the SBF Core platform in the ordinary course of processing, including (i) employees who are authorized users of the SBF Core platform and whose user credentials, access logs, and authentication data are processed by the platform, and (ii) employees whose payroll, direct deposit, or personal account data is processed through the SBF Core platform.
(f) EU-Resident Data Subjects. Approximately 3,200 of Controller's accountholders maintain EU residency, including expatriate accounts and dual-resident accounts. The processing of personal data relating to these EU-resident data subjects triggers obligations under the GDPR. The Standard Contractual Clauses appended to the Agreement as Schedule D govern the transfer of personal data of EU-resident data subjects to the extent such transfers are subject to GDPR requirements. Processor shall ensure that the personal data of EU-resident data subjects is processed and stored in accordance with the processing location requirements set forth in Section 7 of this Schedule A, unless otherwise directed by Controller in writing.
5. Categories of Personal Data
The following categories of personal data are processed by Processor on behalf of Controller under this Schedule A:
5.1 Identity and Contact Data
(a) Full legal name of the data subject, including first name, middle name or initial, last name, and suffix (e.g., Jr., Sr., III);
(b) Date of birth;
(c) Email addresses (personal and, where applicable, business email addresses associated with the account);
(d) Phone numbers, including mobile, home, and business telephone numbers associated with the account.
5.2 Government-Issued Identifiers
(a) Social Security number ("SSN");
(b) Taxpayer identification number ("TIN"), including individual taxpayer identification numbers (ITINs) and employer identification numbers (EINs) where associated with an individual data subject.
SSNs and TINs are classified as sensitive personal data under applicable United States state privacy laws, including, without limitation, the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA/CPRA") (Cal. Civ. Code §§ 1798.100 et seq.) and the New Jersey Data Privacy Act (NJ S3377). Processor shall apply heightened security measures to SSNs and TINs as described in Schedule B to the Agreement, including, without limitation, encryption at rest using AES-256 encryption, encryption in transit using TLS 1.2 or higher, and role-based access controls limiting access to authorized personnel with a legitimate business need.
5.3 Financial Account Data
(a) Account numbers for checking, savings, and loan accounts maintained by Controller;
(b) Routing numbers associated with Controller's accounts;
(c) Transaction amounts;
(d) Transaction metadata, including timestamps, counterparty identifiers, transaction type codes (e.g., debit, credit, transfer, payment), and merchant category codes ("MCCs").
Financial account data constitutes nonpublic personal information subject to the Gramm-Leach-Bliley Act ("GLBA") and Regulation P (12 CFR Part 1016). Processor shall safeguard financial account data in accordance with the information security requirements of the GLBA Safeguards Rule and the security measures described in Schedule B to the Agreement.
5.4 Technical and Device Data
(a) IP addresses, including both IPv4 and IPv6 addresses, associated with data subjects' sessions on Controller's digital banking platforms;
(b) Device identifiers, including device fingerprints, browser identifiers (user agent strings), and operating system information;
(c) Geolocation data resolved to city-level granularity, derived from IP address mapping and, where available, from device-level location services data provided by the data subject's device.
Processor does not process precise geolocation data (i.e., geolocation data that identifies the specific location of a data subject with a precision of 1,750 feet or less) under this Schedule A. City-level geolocation data is used solely for fraud risk assessment and device reputation scoring purposes.
5.5 Behavioral Biometric Data
(a) Keystroke dynamics, including typing speed, keystroke rhythm, inter-key interval timing, and key pressure patterns, collected during data subjects' interactions with Controller's digital banking platforms;
(b) Mouse movement patterns, including cursor trajectory, cursor velocity, click timing, click position patterns, and scroll behavior, collected during data subjects' interactions with Controller's digital banking platforms.
Behavioral biometric data is classified as sensitive personal data under certain applicable United States state privacy laws, including the CCPA/CPRA (Cal. Civ. Code § 1798.140(ae)) and the New Jersey Data Privacy Act (NJ S3377). Behavioral biometric data is collected and processed solely for the purpose of fraud-scoring and anomaly detection as described in Section 3.2 of this Schedule A. Processor shall apply heightened security measures to behavioral biometric data as described in Schedule B to the Agreement.
6. Sensitive Data
The parties acknowledge and agree that the following categories of personal data processed under this Schedule A constitute sensitive personal data or special category data under one or more applicable data protection laws:
(a) Social Security numbers — classified as sensitive personal data under applicable United States state privacy laws, including the CCPA/CPRA and the New Jersey Data Privacy Act (NJ S3377);
(b) Behavioral biometric data (keystroke dynamics and mouse movement patterns) — classified as sensitive personal data under applicable United States state privacy laws, including the CCPA/CPRA and the New Jersey Data Privacy Act (NJ S3377).
The parties expressly confirm that no personal data falling within the special categories described in Article 9(1) of the GDPR is intended to be processed under this Schedule A or the Agreement. Specifically, the processing described herein does not encompass personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, data concerning health, or data concerning a natural person's sex life or sexual orientation. In the event that Processor becomes aware that it has received or is processing any such special category data, Processor shall promptly notify Controller and shall not further process such data except as instructed by Controller in writing.
Processor shall apply heightened security measures to all sensitive data identified in this Section 6, as described in detail in Schedule B (Technical and Organizational Security Measures) to the Agreement. Such heightened security measures shall include, without limitation, enhanced encryption standards, access controls, audit logging, and data minimization practices specifically tailored to the protection of sensitive data categories.
7. Processing Locations
Processor shall process Controller's personal data only at the following approved processing locations. Any change in processing location requires Controller's prior written approval in accordance with the terms of the Agreement.
Processor shall not transfer, access, or process personal data at any location other than those identified in the table above without Controller's prior written authorization. For the avoidance of doubt, remote access by Processor's authorized personnel (e.g., employees or contractors working from locations other than the facilities listed above) shall be subject to the access control and security requirements set forth in Schedule B to the Agreement, and shall not constitute a change of processing location provided that such remote access does not result in the storage or persistence of personal data outside of the approved processing locations.
8. Duration of Processing
8.1 Term of Processing
Processing of personal data by Processor under this Schedule A shall commence on the effective date of the SaaS Subscription Agreement between Controller and Processor (target effective date: February 15, 2026). Processing shall continue for the full term of the Subscription Agreement, including any renewals, extensions, or modifications thereof. The initial term of the Subscription Agreement is five (5) years, with an annual contract value of $2.74 million per year (total contract value: $13.7 million over the initial term). In the event that the Subscription Agreement is renewed or extended, the processing described in this Schedule A shall continue for the duration of such renewal or extension period without requiring amendment to this Schedule A, unless the scope of processing changes materially.
8.2 Post-Termination Retention Period
Upon expiration or termination of the Subscription Agreement for any reason, Processor shall retain Controller's personal data for a period of ninety (90) calendar days following the effective date of expiration or termination (the "Post-Termination Retention Period"). During the Post-Termination Retention Period, Processor shall retain Controller's personal data solely for the purpose of facilitating Controller's retrieval, return, or migration of such data to Controller or to a successor service provider designated by Controller. Processor shall make Controller's personal data available for export in a structured, commonly used, and machine-readable format during the Post-Termination Retention Period.
At the expiration of the ninety (90)-day Post-Termination Retention Period, Processor shall securely delete or destroy all personal data of Controller in Processor's possession, custody, or control, including all copies, backups, and archived instances of such data, using methods consistent with NIST Special Publication 800-88, Revision 1 (Guidelines for Media Sanitization), or equivalent industry standards. Processor shall not retain any copies of Controller's personal data following the completion of deletion or destruction, unless retention is required by applicable law, including federal banking regulations, tax laws, or other legal obligations applicable to Processor.
Upon Controller's written request, Processor shall provide Controller with a written certification of deletion or destruction, signed by Processor's CISO or General Counsel, confirming that all personal data has been deleted or destroyed in accordance with this Section 8.2 and specifying the methods of deletion or destruction employed.
8.3 Legal Hold Exception
Notwithstanding the foregoing provisions of Section 8.2, Processor may retain personal data beyond the ninety (90)-day Post-Termination Retention Period to the extent that such retention is required by applicable law, regulation, or legal process (including, without limitation, litigation hold obligations, subpoenas, regulatory examination requests, or court orders), provided that Processor shall:
(i) notify Controller in writing of the existence and general nature of such legal requirement within five (5) business days of Processor's becoming aware of such requirement, to the extent that such notification is permitted by applicable law;
(ii) limit the retention of personal data to the minimum scope and duration strictly required to comply with the applicable legal requirement;
(iii) continue to protect all retained personal data in accordance with the technical and organizational security measures set forth in Schedule B to the Agreement for the entire duration of such extended retention; and
(iv) promptly delete or destroy the retained personal data upon the expiration or satisfaction of the applicable legal requirement, and provide Controller with written certification of such deletion or destruction.
9. Sub-Processors
Processor engages the following sub-processors in connection with the processing of Controller's personal data under this Schedule A:
(a) Osprey Cloud Infrastructure, Inc. — Provides infrastructure-as-a-service (IaaS) and platform-as-a-service (PaaS) hosting for the SBF Core platform in the Osprey Cloud US-East data center region (Ashburn, Virginia, USA) and the Osprey Cloud EU data center region (Frankfurt, Germany).
(b) Skybridge Fintech Europe B.V. — A wholly-owned subsidiary of Processor providing EU personal data processing support services from Amsterdam, Netherlands.
A complete and current list of all approved sub-processors is set forth in Schedule C (Approved Sub-Processor List) to the Agreement. Controller has reviewed and approved the sub-processors listed in Schedule C as of the effective date of the Agreement.
The mechanics governing Processor's engagement of new sub-processors and changes to existing sub-processors are set forth in Section 7 of the Agreement, including, without limitation: (i) Processor's obligation to provide Controller with at least thirty (30) days' prior written notice before engaging any new sub-processor or making any material change to an existing sub-processor; (ii) Controller's right to object to the engagement of a new sub-processor on reasonable grounds related to data protection; and (iii) the resolution procedures applicable in the event of a Controller objection. Processor shall ensure that all sub-processors are bound by written agreements imposing data protection obligations no less protective than those set forth in the Agreement.
10. Controller Instructions
Processor shall process personal data solely in accordance with Controller's documented instructions as set forth in the Agreement, this Schedule A, and any subsequent written instructions provided by Controller from time to time in accordance with the terms of the Agreement. The processing activities described in Sections 2 through 5 of this Schedule A constitute Controller's initial complete instructions to Processor with respect to the processing of personal data under the Agreement.
Any processing of personal data by Processor outside the scope of this Schedule A — including, without limitation, processing for any new or additional purpose, processing of any new category of personal data not described in Section 5, or processing involving any new category of data subjects not described in Section 4 — requires Controller's prior written authorization. Processor shall promptly inform Controller if, in Processor's opinion, an instruction from Controller infringes applicable data protection law, and shall not be required to comply with such instruction until Controller has confirmed the instruction in writing after being so informed.
With respect to the personal data of EU-resident data subjects, the description of the data importer and data exporter, the categories of data subjects, the categories of personal data, and the purpose and nature of the processing set forth in this Schedule A shall serve as the description of the transfer required by Annex I of the Standard Contractual Clauses (Module Two: Controller to Processor) appended to the Agreement as Schedule D. To the extent of any inconsistency between this Schedule A and Annex I of the Standard Contractual Clauses with respect to EU personal data transfers, the Standard Contractual Clauses shall prevail.
11. Applicable Data Protection Laws
The processing of personal data described in this Schedule A is subject to, and shall be carried out in compliance with, the following data protection and privacy laws, regulations, and regulatory guidance, as amended from time to time:
(a) Gramm-Leach-Bliley Act ("GLBA") (15 U.S.C. §§ 6801–6809) and Regulation P (12 CFR Part 1016) — governing the privacy and security of nonpublic personal information of consumers of financial institutions;
(b) OCC Bulletin 2023-17 (Third-Party Risk Management) — establishing supervisory expectations for banks' management of risks associated with third-party relationships, including relationships involving access to customer information;
(c) FDIC/OCC Computer-Security Incident Notification Rule (12 CFR Part 53) — requiring banking organizations and their service providers to notify regulators of computer-security incidents that could result in notification obligations;
(d) General Data Protection Regulation ("GDPR") (Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016) — applicable to the processing of personal data of approximately 3,200 EU-resident data subjects identified in Section 4(f) of this Schedule A, including the requirements for lawful transfer of personal data to third countries;
(e) California Consumer Privacy Act / California Privacy Rights Act ("CCPA/CPRA") (Cal. Civ. Code §§ 1798.100 et seq.) — applicable to the processing of personal information of California-resident accountholders of Controller;
(f) New Jersey Data Privacy Act (NJ S3377), effective January 15, 2026 — applicable to the processing of personal data of New Jersey-resident accountholders of Controller and imposing obligations with respect to, among other things, sensitive data processing, data protection assessments, and consumer rights;
(g) Such other applicable United States federal and state privacy, data security, and financial services laws and regulations as may apply to the processing of personal data described herein, including, without limitation, state data breach notification laws, state biometric privacy laws, and federal banking examination requirements.
Processor shall monitor changes in applicable data protection laws and regulations and shall promptly inform Controller of any developments that may materially affect the processing described in this Schedule A or Processor's ability to comply with its obligations under the Agreement.
Incorporation and Execution
This Schedule A is incorporated into and forms an integral part of the Agreement. The terms and conditions set forth in this Schedule A are binding upon the parties as of the effective date of the Agreement.
Separate signature lines are not required on this Schedule A. This Schedule A is deemed executed and effective upon execution of the Agreement by both parties. Reference is hereby made to the signature pages of the Agreement for evidence of the parties' execution. The target date of execution of the Agreement, and therefore the effective date of this Schedule A, is February 15, 2026.
[Remainder of this page intentionally left blank.]
CONFIDENTIAL — This Schedule A contains confidential business information of the parties and is subject to the confidentiality provisions of the Agreement.
Location | Entity / Facility | Data Types Processed | Purpose
Ashburn, Virginia, USA (Primary) | Osprey Cloud Infrastructure, Inc. — US-East data center region | All categories of personal data described in Section 5 | Primary hosting of SBF Core platform; payment processing, fraud detection and prevention, regulatory reporting
Ashburn, Virginia, USA (Disaster Recovery) | Osprey Cloud Infrastructure, Inc. — US-East secondary availability zone | All categories of personal data described in Section 5 | Disaster recovery and business continuity
Frankfurt, Germany (EU — Primary) | Osprey Cloud Infrastructure, Inc. — EU data center region | Personal data of EU-resident data subjects (approximately 3,200 accountholders) | Hosting and processing of EU personal data in compliance with GDPR data residency requirements
Amsterdam, Netherlands (EU — Support) | Skybridge Fintech Europe B.V., Keizersgracht 482, 1017 EG Amsterdam, Netherlands | Personal data of EU-resident data subjects | EU personal data processing support, including customer support, incident response, and platform maintenance for EU-resident data subject accounts
Wilmington, Delaware, USA (Administrative) | Skybridge Fintech Ltd. — headquarters, 4100 Silverside Road, Suite 310, Wilmington, DE 19810 | Administrative access to all categories of personal data | Platform administration, software engineering, technical support, and operational management

SCHEDULE A

Record

Parties

Dates

Amounts