DATA PROCESSING ADDENDUM
Exhibit C to the Master Software-as-a-Service Agreement
CONFIDENTIAL — SUBJECT TO RESTRICTIONS ON DISCLOSURE SET FORTH IN THE MSA
This Data Processing Addendum ("DPA" or "Addendum") is entered into as of the Effective Date of the Master Software-as-a-Service Agreement (the "MSA") by and between:
Skybridge Fintech Ltd., a Delaware limited company, with its principal office at 1400 Concord Pike, Suite 320, Wilmington, DE 19803 (hereinafter referred to as "Provider" or "Licensor");
and
Meridian National Bank, National Association, a national banking association chartered under federal law, with its principal office at 600 Lexington Avenue, 40th Floor, New York, NY 10022 (hereinafter referred to as "Customer" or "Licensee").
Provider and Customer are each referred to herein individually as a "Party" and collectively as the "Parties."
This DPA is attached as Exhibit C to the Master Software-as-a-Service Agreement dated as of the MSA Effective Date between Provider and Customer for the provision of the SkyComply™ platform and related services (the "MSA"). Capitalized terms used but not otherwise defined in this DPA shall have the meanings ascribed to such terms in the MSA.
RECITALS
WHEREAS, Provider and Customer have entered into the MSA pursuant to which Provider will provide the SkyComply™ AI-driven anti-money-laundering and transaction-monitoring platform to Customer on a software-as-a-service basis, together with related implementation, support, and managed services as more fully described in the MSA and the applicable Order Form;
WHEREAS, in connection with the performance of its obligations under the MSA, Provider will Process certain Customer Data, including Non-Public Personal Information ("NPI") subject to the Gramm-Leach-Bliley Act, 15 U.S.C. § 6801 et seq. (the "GLBA"), and personally identifiable information ("PII"), across Customer's retail banking, commercial banking, and wealth management divisions;
WHEREAS, Customer is a national banking association subject to the supervision and examination authority of the Office of the Comptroller of the Currency (the "OCC"), the Board of Governors of the Federal Reserve System (the "Federal Reserve"), and the Federal Deposit Insurance Corporation (the "FDIC"), and is required to comply with regulatory requirements governing third-party service provider relationships, including without limitation OCC Bulletin 2013-29 (Third-Party Relationships: Risk Management Guidance), the Interagency Guidance on Third-Party Relationships: Risk Management (June 6, 2023), and the Federal Financial Institutions Examination Council ("FFIEC") Information Technology Examination Handbook;
WHEREAS, Provider is a Bank Service Company within the meaning of the Bank Service Company Act, 12 U.S.C. § 1867, and acknowledges that the services it provides to Customer are subject to examination by Customer's federal banking regulators;
WHEREAS, the Parties wish to set forth their respective rights and obligations regarding the Processing of Customer Data in compliance with Applicable Data Protection Laws and the MSA, and to ensure that Customer Data is handled with appropriate safeguards commensurate with the sensitivity of such data and the regulatory environment in which Customer operates;
NOW, THEREFORE, in consideration of the mutual covenants and agreements set forth herein and in the MSA, and for other good and valuable consideration, the receipt and sufficiency of which are hereby acknowledged, the Parties agree as follows:
Right-click to update Table of Contents
ARTICLE 1 — DEFINITIONS
Section 1.1 — Defined Terms
For purposes of this DPA, the following terms shall have the meanings set forth below:
(a) "Applicable Data Protection Laws" means all federal, state, and local laws, regulations, rules, orders, and regulatory guidance applicable to the Processing of Customer Data under or in connection with this DPA and the MSA, including without limitation: (i) the Gramm-Leach-Bliley Act, 15 U.S.C. § 6801 et seq., and its implementing regulations, including Regulation P (12 C.F.R. Part 1016) and the Interagency Guidelines Establishing Information Security Standards; (ii) the Bank Secrecy Act, 31 U.S.C. § 5311 et seq. (the "BSA"), and its implementing regulations, including the regulations promulgated by the Financial Crimes Enforcement Network ("FinCEN"); (iii) applicable state data breach notification laws (including, without limitation, the New York SHIELD Act, N.Y. Gen. Bus. Law § 899-aa, and the Delaware Computer Security Breaches Act, 6 Del. C. § 12B-101 et seq.); (iv) regulations, bulletins, and guidance promulgated by the OCC, the Federal Reserve, and the FDIC, including OCC Bulletin 2013-29, the Interagency Guidance on Third-Party Relationships: Risk Management (June 6, 2023), and the FFIEC Information Technology Examination Handbook; and (v) any other federal, state, or local law or regulation applicable to the protection, privacy, or security of Customer Data as may be in effect from time to time during the term of this DPA.
(b) "Approved Subprocessor" means a Subprocessor that has been approved by Customer or deemed approved pursuant to Section 6 of this DPA.
(c) "Certified Destruction" means the irreversible deletion and destruction of Customer Data from all systems, storage media, backup copies, and archival copies in Provider's (or its Subprocessor's) possession or control, confirmed by a written certification executed by an authorized officer of Provider (and, where applicable, the relevant Subprocessor) attesting to the completeness and permanence of such deletion and destruction.
(d) "Confidential Data" means Customer Data that has been classified as "Confidential" under Customer's data classification policy, as communicated to Provider from time to time. Confidential Data is subject to the standard confidentiality protections set forth in the MSA.
(e) "Customer Data" means all data, information, records, documents, and materials, in any form or medium, that are: (i) provided by or on behalf of Customer to Provider in connection with the MSA; (ii) generated, collected, derived, or processed by Provider on Customer's behalf through the SkyComply™ platform or in the course of providing services under the MSA; or (iii) otherwise made available by Customer to Provider in connection with the MSA. Customer Data includes, without limitation, all NPI, PII, transaction data, account data, customer identification data, financial records, AML/BSA compliance data, and any derivatives, aggregations, or analyses thereof that contain or reflect Customer Data.
(f) "Data Export" means the provision of all Customer Data to Customer in a machine-readable, industry-standard format, as more fully described in Section 8.2 of this DPA, upon termination or expiration of the MSA.
(g) "Highly Restricted Data" means Customer Data that has been classified as "Highly Restricted" under Customer's data classification policy, as communicated to Provider from time to time. Highly Restricted Data includes, without limitation, all NPI under GLBA and all PII, and is subject to the highest level of security protections, including enhanced access controls, encryption, and monitoring as set forth in this DPA and the Security Exhibit (Exhibit B to the MSA).
(h) "Non-Public Personal Information" or "NPI" has the meaning given to such term under the GLBA and its implementing regulations, including Regulation P (12 C.F.R. Part 1016), and includes any personally identifiable financial information provided by a consumer to a financial institution, resulting from any transaction with the consumer, or otherwise obtained by the financial institution.
(i) "Personally Identifiable Information" or "PII" means any information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, to an identifiable natural person or household, including without limitation name, address, date of birth, Social Security number, tax identification number, account numbers, identification document numbers, and any other information defined as "personally identifiable information," "personal information," or "personal data" under Applicable Data Protection Laws.
(j) "Processing" (and its cognates "Process" and "Processed") means any operation or set of operations performed on Customer Data, whether or not by automated means, including without limitation the collection, recording, organization, structuring, storage, adaptation, alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment, combination, restriction, erasure, or destruction of Customer Data.
(k) "Security Incident" means any confirmed unauthorized access to, acquisition of, use of, disclosure of, alteration of, or destruction of Customer Data, or any confirmed breach of Provider's security obligations under this DPA or the Security Exhibit (Exhibit B to the MSA), including any event that compromises the confidentiality, integrity, or availability of Customer Data. For the avoidance of doubt, a Security Incident does not include unsuccessful attempts or activities that do not compromise the security of Customer Data, such as pings, port scans, denial of service attacks that do not result in a breach, or unsuccessful log-in attempts.
(l) "Subprocessor" means any third party (other than Provider's employees acting within the scope of their employment) engaged by Provider or by any of Provider's affiliates to Process Customer Data on Provider's behalf in connection with the services under the MSA, including without limitation infrastructure providers, hosting providers, and managed service providers.
Section 1.2 — Interpretation
(a) Unless the context otherwise requires, references in this DPA to the MSA shall be deemed to include all exhibits, schedules, annexes, and order forms attached thereto or incorporated therein by reference, including the Service Level Agreement Exhibit (Exhibit A), the Security Exhibit (Exhibit B), this DPA (Exhibit C), and the Acceptable Use Policy (Exhibit D).
(b) The headings and captions in this DPA are for convenience of reference only and shall not be used in the interpretation or construction of this DPA.
(c) The words "include," "includes," and "including" shall be deemed to be followed by the phrase "without limitation."
(d) References to "days" shall mean calendar days unless otherwise specified as "business days."
(e) In the event of any conflict or inconsistency between the provisions of this DPA and the provisions of the MSA (excluding this DPA), the provisions of this DPA shall control and govern with respect to the Processing of Customer Data. In the event of any conflict or inconsistency between this DPA and the Security Exhibit (Exhibit B), the provision that provides the greater level of protection for Customer Data shall control.
ARTICLE 2 — SCOPE AND PURPOSE OF PROCESSING
Section 2.1 — Scope
(a) Provider shall Process Customer Data solely for the purpose of providing the SkyComply™ platform services and related implementation, support, and managed services as described in the MSA, the applicable Order Form, and this DPA. Provider acknowledges that it is Processing Customer Data as a service provider to Customer and not for any independent purpose.
(b) The nature and purpose of the Processing is as follows: Provider will use the SkyComply™ platform to perform AI-driven anti-money-laundering screening, transaction monitoring, suspicious activity detection, alert generation and management, case management workflows, regulatory reporting (including the preparation and filing support of Suspicious Activity Reports and Currency Transaction Reports), and compliance analytics on behalf of Customer. The Processing includes the ingestion, normalization, analysis, and storage of Customer Data necessary to deliver these services.
(c) The categories of data subjects whose Customer Data will be Processed under this DPA include: Customer's banking customers, account holders (individual and entity), beneficial owners, authorized signatories, and other individuals or entities whose data is submitted to or processed through the SkyComply™ platform in connection with Customer's AML/BSA compliance program. These data subjects span Customer's retail banking, commercial banking, and wealth management divisions.
(d) The types of Customer Data Processed include, without limitation: transaction data (including wire transfers, ACH transactions, check deposits, cash transactions, and securities transactions), account information (including account numbers, account types, and account balances), customer identification data (including name, address, date of birth, Social Security number, tax identification number, and government-issued identification documents), NPI, PII, financial records, and AML/BSA compliance data (including alerts, case files, investigation notes, and regulatory filings).
(e) As of the Effective Date, approximately thirty-two thousand (32,000) named users across Customer's United States and international operations will access and generate Customer Data on the SkyComply™ platform, including compliance analysts, investigators, supervisory reviewers, and administrative users.
Section 2.2 — Processing Instructions
(a) Provider shall Process Customer Data only in accordance with Customer's documented instructions, as set forth in the MSA, this DPA, the applicable Order Form, and any additional written instructions provided by Customer to Provider from time to time. Customer's initial processing instructions are set forth in Schedule A to this DPA and in the MSA.
(b) Provider shall not Process Customer Data for any purpose other than the provision of services under the MSA unless such Processing is required by applicable law. If applicable law requires Provider to Process Customer Data for any purpose other than the provision of services under the MSA, Provider shall notify Customer of such legal requirement before commencing the required Processing, unless applicable law prohibits Provider from providing such notice on important grounds of public interest. In such event, Provider shall Process only the minimum amount of Customer Data necessary to comply with the applicable legal requirement.
(c) Provider shall promptly notify Customer in writing if, in Provider's reasonable opinion, any Processing instruction received from Customer infringes or is likely to infringe Applicable Data Protection Laws. Provider's notification shall describe the nature of the concern and the specific legal provision(s) at issue. Notwithstanding the foregoing, Provider's obligation to notify Customer shall not be construed as imposing on Provider a duty to monitor or evaluate the legality of Customer's processing instructions, and Provider shall not be liable for Customer's processing instructions to the extent Provider has complied with its notification obligation under this Section 2.2(c).
Section 2.3 — Data Classification
Customer Data shall be classified and handled in accordance with Customer's data classification policy as communicated to Provider in writing. As of the Effective Date, Customer's data classification policy includes the following classifications relevant to this DPA:
(a) Confidential. Customer Data classified as "Confidential" is subject to the standard confidentiality protections set forth in the MSA, including restrictions on disclosure, use limitations, and the obligation to maintain reasonable security safeguards.
(b) Highly Restricted. Customer Data classified as "Highly Restricted" is subject to enhanced security protections, including the highest level of access controls, encryption (consistent with Section 3.2 of this DPA), monitoring, and logging. All NPI under GLBA and all PII shall, at a minimum, be treated as Highly Restricted Data. Provider shall handle Highly Restricted Data in accordance with the specific technical and organizational controls set forth in this DPA and the Security Exhibit (Exhibit B to the MSA).
Provider acknowledges that Customer may update its data classification policy from time to time during the term of the MSA. Customer shall provide Provider with reasonable advance notice of any material changes to its data classification policy, and Provider shall implement any reasonably required changes to its Processing practices within a commercially reasonable timeframe agreed upon by the Parties.
ARTICLE 3 — DATA SECURITY OBLIGATIONS
Section 3.1 — Security Standards
(a) Provider's detailed security obligations with respect to Customer Data are set forth in the Security Exhibit (Exhibit B to the MSA), which is incorporated herein by reference. Provider shall comply with all obligations set forth in the Security Exhibit as they apply to the Processing of Customer Data under this DPA.
(b) Without limiting the generality of the foregoing, Provider shall implement and maintain a comprehensive information security program consisting of administrative, technical, and physical safeguards that are designed to: (i) ensure the confidentiality, integrity, and availability of Customer Data; (ii) protect against any anticipated threats or hazards to the security or integrity of Customer Data; (iii) protect against unauthorized access to or use of Customer Data; and (iv) ensure the proper disposal of Customer Data. Such safeguards shall be consistent with and no less protective than: (A) industry standards for financial services software-as-a-service providers; (B) the requirements for Service Organization Control 2 Type II ("SOC 2 Type II") certification; (C) the requirements of the International Organization for Standardization/International Electrotechnical Commission 27001 standard ("ISO 27001"); and (D) the requirements of Applicable Data Protection Laws, including the GLBA safeguard requirements set forth in the Interagency Guidelines Establishing Information Security Standards.
(c) Provider represents and warrants that, as of the Effective Date, it holds: (i) a SOC 2 Type II certification, with the most recent report dated March 15, 2025, covering the period from April 1, 2024 through March 14, 2025, and performed by Crestfield Cyber Advisors, Inc., an independent third-party security auditor; and (ii) an ISO 27001 certification, with the most recent certificate dated January 22, 2025, issued by Crestfield Cyber Advisors, Inc. following a recertification audit. Provider has delivered copies of both the SOC 2 Type II report and the ISO 27001 certificate to Customer prior to the Effective Date.
Section 3.2 — Encryption
Provider shall implement and maintain the following encryption standards with respect to Customer Data:
(a) Data at Rest. All Customer Data stored on Provider's systems or the systems of its Approved Subprocessors shall be encrypted using Advanced Encryption Standard with a minimum key length of 256 bits (AES-256) or an equivalent or stronger encryption standard.
(b) Data in Transit. All Customer Data transmitted over public or untrusted networks, including data transmitted between Customer and Provider's systems, between Provider's systems, and between Provider and its Approved Subprocessors, shall be encrypted using Transport Layer Security (TLS) version 1.2 or higher, with strong cipher suites as identified in the Security Exhibit.
(c) Key Management. Encryption keys shall be managed through Provider-managed hardware security modules ("HSMs") that are FIPS 140-2 Level 3 (or higher) validated. Customer shall have the option to implement bring-your-own-key ("BYOK") functionality via integration with Customer's key management infrastructure, as described in the Security Exhibit. In the event Customer elects to implement BYOK, the Parties shall cooperate in good faith to complete the integration within a mutually agreed timeframe.
Section 3.3 — Access Controls
(a) Provider shall restrict access to Customer Data to those Provider personnel who have a legitimate business need to access such data in order to perform the services under the MSA. Provider shall enforce the principle of least privilege, ensuring that each authorized individual has access only to the minimum amount of Customer Data necessary to perform his or her assigned duties.
(b) Provider shall implement role-based access controls, multi-factor authentication for all access to systems containing Customer Data, and comprehensive logging and monitoring of all access events. Provider shall conduct periodic access reviews (no less frequently than quarterly) to verify that access permissions remain appropriate and that access by terminated or reassigned personnel has been promptly revoked.
(c) All Provider personnel with access to Customer Data must undergo background checks consistent with FFIEC guidelines, including criminal background checks and verification of employment history, prior to being granted access to Customer Data. The specific requirements for such background checks are set forth in the Security Exhibit (Exhibit B to the MSA).
Section 3.4 — Security Certifications
(a) Provider shall maintain its SOC 2 Type II certification throughout the term of the MSA. Provider shall undergo an annual SOC 2 Type II audit covering the trust service criteria relevant to the services provided under the MSA, conducted by an independent third-party auditor reasonably acceptable to Customer.
(b) Provider shall maintain its ISO 27001 certification throughout the term of the MSA, including triennial recertification audits and annual surveillance audits conducted by an accredited certification body.
(c) Provider shall promptly deliver to Customer updated SOC 2 Type II reports and ISO 27001 certificates upon receipt, and in any event within ten (10) business days following Provider's receipt of each updated report or certificate. Provider shall promptly notify Customer of any material findings, qualifications, or exceptions identified in any SOC 2 Type II report or ISO 27001 audit, and shall provide Customer with a detailed remediation plan for addressing any such findings within thirty (30) days.
ARTICLE 4 — DATA RESIDENCY AND TRANSFER RESTRICTIONS
Section 4.1 — Data Residency
(a) All Customer Data shall be stored and processed exclusively within the continental United States. Provider's hosting infrastructure for the SkyComply™ platform is provided by Orion Cloud Services, Inc. ("Orion Cloud"), Provider's Approved Subprocessor as set forth in Section 6.1 and Schedule B of this DPA, and is located in the US-East (Virginia) and US-West (Oregon) regions only.
(b) Provider shall not transfer, store, process, or otherwise make available Customer Data at or from any location outside of the continental United States without Customer's prior written consent. For purposes of this Section 4.1, "transfer" includes any transmission, replication, caching, or access of Customer Data from or to a location outside the continental United States, whether by Provider, its personnel, its Subprocessors, or any third party.
(c) Provider shall maintain configuration settings on all systems used to store or process Customer Data to ensure that Customer Data is not replicated to, backed up to, or cached in data centers or servers located outside of the continental United States. Provider shall provide Customer with documentation of such configuration settings upon request.
Section 4.2 — Prohibition on Cross-Border Transfers
(a) No Customer Data shall be accessed, viewed, processed, stored, or transmitted from any location outside of the continental United States by Provider personnel, Subprocessors, or any third party, without Customer's prior written consent. This prohibition applies to all forms of access, including remote access, VPN access, and any access through web-based portals or application interfaces.
(b) Provider shall implement technical and organizational controls to enforce this data residency requirement, including geo-fencing controls, IP address restrictions, and access logging that captures the geographic location of all access attempts. Provider shall monitor for and promptly investigate any access attempts originating from locations outside of the continental United States.
(c) In the event that Provider identifies any unauthorized access to Customer Data from a location outside of the continental United States, Provider shall immediately take steps to block such access, shall notify Customer within the timeframes applicable to Security Incidents under Article 5 of this DPA, and shall cooperate with Customer in investigating the incident.
ARTICLE 5 — SECURITY INCIDENT NOTIFICATION AND RESPONSE
Section 5.1 — Notification Obligation
(a) Provider shall notify Customer of any confirmed Security Incident affecting Customer Data as promptly as possible, and in any event within the timeframe specified in the Security Exhibit (Exhibit B to the MSA) following Provider's discovery of, or Provider's having reasonable grounds to believe that, such Security Incident has occurred. The Security Exhibit sets forth the negotiated incident notification window as finalized between the Parties' respective positions during contract negotiations. Provider acknowledges the critical importance of timely notification to Customer's ability to assess risk, comply with regulatory obligations, and protect affected data subjects.
(b) Provider shall designate its Chief Information Security Officer (as of the Effective Date, Amara Okafor, or her designated successor) as the primary point of contact for all Security Incident communications with Customer. Provider shall maintain a twenty-four-hours-a-day, seven-days-a-week Security Incident reporting capability for the duration of the MSA.
Section 5.2 — Content of Notification
Notification of a Security Incident shall include, to the extent known or reasonably ascertainable at the time of notification, the following information:
(a) A description of the nature and scope of the Security Incident, including the systems, services, and infrastructure affected;
(b) The categories and approximate volume of Customer Data records affected or potentially affected;
(c) The likely consequences of the Security Incident for the confidentiality, integrity, and availability of Customer Data, including an assessment of the risk of harm to affected data subjects;
(d) A description of the measures taken or proposed to be taken by Provider to contain, investigate, and remediate the Security Incident, including any steps taken to mitigate potential harm to Customer or affected data subjects;
(e) The identity and contact information of Provider's designated point of contact for the Security Incident (as of the Effective Date: Amara Okafor, CISO, Skybridge Fintech Ltd., 1400 Concord Pike, Suite 320, Wilmington, DE 19803; telephone and email as provided under separate cover); and
(f) Any other information reasonably requested by Customer to evaluate the Security Incident and its potential impact on Customer's operations, regulatory obligations, and customers.
Provider shall supplement its initial notification with updated information as soon as such information becomes available, and shall continue to provide regular status updates to Customer until the Security Incident has been fully resolved.
Section 5.3 — Cooperation and Remediation
(a) Provider shall cooperate fully with Customer in investigating and remediating any Security Incident, including by making available Provider's relevant personnel, records, systems, and facilities. Provider shall designate a dedicated incident response team for each Security Incident and shall participate in joint calls and meetings with Customer's incident response team as reasonably requested by Customer.
(b) Provider shall take all commercially reasonable steps to contain and mitigate the effects of the Security Incident, including by isolating affected systems, stopping any ongoing unauthorized access, and implementing temporary and permanent corrective measures to prevent recurrence.
(c) Provider shall preserve and provide to Customer all relevant forensic evidence related to the Security Incident, including system logs, access logs, audit trails, network traffic captures, and any other evidence reasonably necessary to investigate the Security Incident and assess its impact. Provider shall not destroy or alter any such evidence without Customer's prior written consent.
(d) Provider shall comply with any applicable breach notification obligations under state data breach notification laws and shall coordinate with Customer regarding notifications to affected individuals, regulatory authorities, law enforcement, or other parties. Customer shall retain the right to control the timing, content, and method of notifications to its customers and regulatory authorities.
(e) To the extent the Security Incident resulted from Provider's breach of its security obligations under this DPA, the Security Exhibit, or the MSA, Provider shall bear the reasonable and documented costs of: (i) notification to affected individuals; (ii) credit monitoring services for affected individuals, if warranted; (iii) forensic investigation; and (iv) remediation measures necessary to address the Security Incident, in each case subject to the indemnification and liability provisions of the MSA.
Section 5.4 — Regulatory Notification
Provider acknowledges that Customer is subject to regulatory notification obligations with respect to significant security incidents, including obligations to notify the OCC, the Federal Reserve, and the FDIC in accordance with applicable law and regulatory guidance, including the Computer-Security Incident Notification Requirements (12 C.F.R. Part 53). Provider shall cooperate fully with Customer in fulfilling such regulatory notification obligations, including by providing to Customer, on an expedited basis, all information necessary for Customer to make timely and complete regulatory notifications. Provider shall not independently notify Customer's banking regulators of any Security Incident without Customer's prior written consent, unless required to do so by applicable law.
ARTICLE 6 — SUBPROCESSORS
Section 6.1 — Approved Subprocessors
(a) Customer acknowledges and approves the following Subprocessor(s) as of the Effective Date of this DPA:
(b) Orion Cloud Services, Inc. is a Delaware corporation with its principal office at 4500 Great America Parkway, Santa Clara, CA 95054. Provider represents that Orion Cloud maintains SOC 2 Type II and ISO 27001 certifications, and that Orion Cloud's platform service level agreement provides for 99.95% monthly uptime availability.
(c) The complete list of Approved Subprocessors, including additional details regarding each Subprocessor's entity type, address, and scope of Processing, is set forth in Schedule B to this DPA.
Section 6.2 — Advance Notice of New Subprocessors
(a) Provider shall provide Customer with no less than thirty (30) days' advance written notice before engaging any new Subprocessor that will Process Customer Data in connection with the services under the MSA. Such notice shall be delivered to Customer's designated data protection contact identified in Section 10.2 of this DPA.
(b) The notice required under Section 6.2(a) shall include: (i) the identity and legal name of the proposed Subprocessor, including its jurisdiction of incorporation and principal office address; (ii) a detailed description of the Processing activities to be performed by the proposed Subprocessor; (iii) the categories of Customer Data to be Processed by the proposed Subprocessor; (iv) the geographic location(s) where the Processing will occur; and (v) a description of the security measures the proposed Subprocessor will implement with respect to Customer Data, including its relevant certifications and audit reports.
Section 6.3 — Customer's Right to Object
(a) Customer shall have a reasonable right to object to the engagement of any proposed new Subprocessor by providing written notice to Provider within fifteen (15) business days of Customer's receipt of Provider's notice under Section 6.2. Any such objection shall set forth in reasonable detail the grounds for Customer's objection.
(b) Customer's objection must be based on reasonable grounds related to data security, data protection, regulatory compliance, operational risk, or reputational risk, including without limitation concerns relating to the proposed Subprocessor's security posture, data handling practices, geographic location, financial stability, or regulatory standing.
(c) If Customer objects to a proposed Subprocessor, the Parties shall work in good faith for a period of thirty (30) days following Customer's objection to resolve Customer's concerns. Such resolution efforts may include Provider proposing an alternative Subprocessor acceptable to Customer, Provider implementing additional technical or organizational safeguards to address Customer's concerns, or Provider modifying the scope of Processing to be performed by the proposed Subprocessor.
(d) If the Parties are unable to resolve Customer's objection within the thirty (30)-day period specified in Section 6.3(c), Customer may terminate the affected portion of the services upon sixty (60) days' written notice to Provider. Upon any such termination, Provider shall refund to Customer any prepaid fees on a pro-rata basis attributable to the terminated services for the period following the effective date of termination, and shall comply with the data export and destruction obligations set forth in Article 8 of this DPA with respect to Customer Data associated with the terminated services.
Section 6.4 — Subprocessor Obligations
(a) Prior to any Subprocessor commencing the Processing of Customer Data, Provider shall enter into a written agreement with such Subprocessor that imposes data protection, data security, and confidentiality obligations that are no less protective of Customer Data than the obligations imposed on Provider under this DPA and the Security Exhibit.
(b) Provider shall ensure that each Subprocessor: (i) Processes Customer Data only within the continental United States, in accordance with Article 4 of this DPA; (ii) implements administrative, technical, and physical security measures consistent with the requirements of the Security Exhibit (Exhibit B to the MSA); (iii) complies with all Applicable Data Protection Laws; and (iv) is subject to audit by Provider and, upon Customer's reasonable request, by Customer or Customer's designee, as provided in Article 7 of this DPA.
(c) Provider shall remain fully liable to Customer for the acts, omissions, and breaches of its Subprocessors with respect to Customer Data as if such acts, omissions, or breaches were those of Provider. Provider's engagement of any Subprocessor shall not relieve Provider of any of its obligations under this DPA or the MSA.
Section 6.5 — Subprocessor Changes
(a) Provider shall maintain a current and accurate list of all Subprocessors Processing Customer Data, which shall be made available to Customer promptly upon request and in any event within five (5) business days of Customer's request.
(b) Any material change to the scope, nature, or location of Processing performed by an existing Approved Subprocessor shall be treated as a new Subprocessor engagement for purposes of the advance notice and objection procedures set forth in Sections 6.2 and 6.3 of this DPA. For purposes of this Section 6.5(b), a "material change" includes, without limitation: (i) a change in the geographic location of Processing; (ii) a significant expansion of the categories or volume of Customer Data Processed; (iii) a change in the type of services performed; or (iv) a change of control of the Subprocessor.
ARTICLE 7 — AUDIT RIGHTS
Section 7.1 — Audit Right
(a) Customer shall have the right to audit Provider's compliance with this DPA and the Security Exhibit no more than once per calendar year during the term of the MSA, upon no less than thirty (30) business days' prior written notice to Provider. This limitation on frequency shall not apply to audits conducted in response to a Security Incident or where required by Customer's banking regulators.
(b) Provider may satisfy Customer's annual audit request, in whole or in part, by delivering to Customer the following documentation: (i) Provider's most recent SOC 2 Type II report, including the independent auditor's opinion and any management responses to identified exceptions; (ii) Provider's current ISO 27001 certificate; and (iii) Provider's completed responses to Customer's security assessment questionnaire (the "Security Assessment Questionnaire"), which Provider shall complete and return within fifteen (15) business days of receipt. Customer shall review such documentation and may, at its discretion, determine that the documentation satisfies Customer's audit requirements for the applicable period.
(c) If, after reviewing the documentation provided under Section 7.1(b), Customer reasonably determines that additional audit procedures are necessary to assess Provider's compliance with this DPA, Customer may request additional information or documentation from Provider, and Provider shall cooperate in good faith to address Customer's concerns.
Section 7.2 — On-Site Audits
(a) On-site audits of Provider's facilities and systems shall be permitted only upon Customer's demonstration of a material security concern, including without limitation a Security Incident, a material finding in a SOC 2 Type II report, a regulatory requirement, or Customer's reasonable belief that Provider is not in compliance with its obligations under this DPA or the Security Exhibit.
(b) On-site audits shall be conducted at Customer's expense, during normal business hours (Monday through Friday, 9:00 a.m. to 5:00 p.m. Eastern Time, excluding federal holidays), and subject to Provider's reasonable confidentiality and access control requirements. Customer shall use commercially reasonable efforts to minimize disruption to Provider's operations during any on-site audit.
(c) Customer may designate a qualified third-party auditor, subject to Provider's reasonable approval (not to be unreasonably withheld, conditioned, or delayed), to conduct on-site audits on Customer's behalf, provided that such third-party auditor enters into a confidentiality agreement acceptable to Provider.
Section 7.3 — Regulatory Examination
(a) Provider acknowledges that Customer's federal banking regulators, including the OCC, the Federal Reserve, and the FDIC, have the right under applicable law, including the Bank Service Company Act (12 U.S.C. § 1867), OCC Bulletin 2013-29, and the Interagency Guidance on Third-Party Relationships: Risk Management (June 6, 2023), to examine the services Provider performs for Customer, including the right to access Provider's books, records, reports, and other documentation relevant to the services, and to inspect Provider's facilities.
(b) Provider shall cooperate fully with any examination, inspection, or inquiry by Customer's banking regulators and shall provide reasonable access to Provider's personnel, records, systems, and facilities as requested by such regulators, at no cost to Customer. Provider shall not impose fees, charges, or conditions on Customer or its regulators for any such examination or inspection.
(c) Provider shall promptly notify Customer, and in any event within two (2) business days, of any examination, inquiry, subpoena, or request for information from a federal or state banking regulator related to the services provided under the MSA or to Customer Data. Provider shall consult with Customer before responding to any such examination, inquiry, subpoena, or request to the extent permitted by applicable law.
Section 7.4 — Third-Party Security Assessments
(a) Customer may commission third-party security assessments, including vulnerability assessments and penetration testing, of Provider's systems and infrastructure used to Process Customer Data, as set forth in and subject to the terms, conditions, and limitations of the Security Exhibit (Exhibit B to the MSA). Such assessments shall be coordinated in advance with Provider's security team and shall be conducted in a manner designed to minimize risk of disruption to Provider's systems and other customers.
(b) Provider's independent third-party security auditor as of the Effective Date is Crestfield Cyber Advisors, Inc. Provider shall notify Customer of any change in its independent third-party security auditor and shall ensure that any replacement auditor is reasonably acceptable to Customer.
ARTICLE 8 — DATA RETENTION, EXPORT, AND DESTRUCTION
Section 8.1 — Data Retention During Term
(a) Provider shall retain Customer Data for the duration of the MSA term, including any renewal terms, and any applicable transition period, in accordance with Customer's Processing instructions and Applicable Data Protection Laws. Provider shall maintain Customer Data in a manner that ensures its availability, integrity, and confidentiality throughout the retention period.
(b) Provider shall not delete, destroy, overwrite, or render inaccessible any Customer Data during the term of the MSA, except as specifically instructed by Customer in writing. Provider shall implement appropriate backup and disaster recovery procedures to protect Customer Data against loss or corruption, as described in the Security Exhibit.
Section 8.2 — Data Export Upon Termination or Expiration
(a) Upon termination or expiration of the MSA for any reason, Provider shall make all Customer Data available for export by Customer in a machine-readable format within thirty (30) days following the effective date of termination or expiration (the "Export Period"). During the Export Period, Provider shall maintain Customer Data in accordance with this DPA and shall ensure that Customer has full access to the SkyComply™ platform for the purpose of retrieving and exporting Customer Data.
(b) Provider shall cooperate with Customer to facilitate the orderly migration of Customer Data to Customer or Customer's designated successor service provider, and shall provide reasonable technical assistance during the Export Period at no additional charge. Such assistance shall include, without limitation, making Provider's technical personnel reasonably available to answer questions and resolve issues related to the data export process.
(c) The format of Data Export shall be structured data in industry-standard formats as reasonably specified by Customer, including without limitation comma-separated values (CSV), JavaScript Object Notation (JSON), and Extensible Markup Language (XML). Provider shall provide complete data dictionaries, schema documentation, and any other documentation necessary for Customer to interpret and use the exported data.
Section 8.3 — Certified Destruction
(a) Following the expiration of the thirty (30)-day Export Period and Customer's written confirmation of successful receipt of exported Customer Data (or, in the absence of such confirmation, the expiration of an additional thirty (30)-day period following the end of the Export Period during which Customer has not retrieved the data), Provider shall irreversibly delete and destroy all Customer Data in Provider's possession or control. All such deletion and destruction shall be completed within sixty (60) days following the effective date of termination or expiration of the MSA. To summarize the timeline: (i) Data Export shall be completed within thirty (30) days of termination or expiration; and (ii) Certified Destruction shall be completed within sixty (60) days of termination or expiration.
(b) Provider shall certify in writing to Customer, within five (5) business days following completion of the destruction process, that all Customer Data has been permanently and irreversibly deleted and destroyed from all of Provider's systems, including all primary, backup, archival, and disaster recovery copies, except to the extent retention is required by applicable law. Such certification shall be executed by an authorized officer of Provider and shall identify the categories of data destroyed, the methods of destruction used, and the date of completion.
(c) If retention of any Customer Data is required by applicable law following termination or expiration of the MSA, Provider shall: (i) notify Customer in writing of the specific legal obligation requiring retention, including the citation to the applicable legal authority and the duration of the required retention period; (ii) continue to protect such retained Customer Data in accordance with all applicable provisions of this DPA, including the security, confidentiality, and data residency requirements; (iii) limit Processing of such retained data to the minimum necessary to comply with the applicable legal obligation; and (iv) destroy such data promptly upon the expiration of the applicable retention obligation and provide written certification of such destruction to Customer.
Section 8.4 — Subprocessor Data Destruction
(a) Provider shall ensure that each of its Subprocessors, including Orion Cloud Services, Inc., complies with the data export and destruction obligations set forth in this Article 8 with respect to any Customer Data in such Subprocessor's possession or control. Provider's agreements with its Subprocessors shall include contractual obligations consistent with this Article 8.
(b) Provider shall obtain and deliver to Customer written certifications of destruction from each Subprocessor that has Processed or stored Customer Data, confirming that such Subprocessor has permanently and irreversibly deleted and destroyed all Customer Data from its systems. Provider shall deliver such certifications to Customer within ten (10) business days following receipt from the applicable Subprocessor.
ARTICLE 9 — DATA SUBJECT RIGHTS AND COOPERATION
Section 9.1 — Assistance with Data Subject Requests
(a) Provider shall provide reasonable cooperation and assistance to Customer in responding to requests from data subjects (including Customer's banking customers, account holders, and other individuals whose PII is included in Customer Data) exercising rights under Applicable Data Protection Laws, including without limitation rights of access, correction, deletion, and restriction of processing, to the extent applicable.
(b) Provider shall promptly redirect to Customer any data subject requests received directly by Provider, and in any event within three (3) business days of receipt. Provider shall not independently respond to any data subject request relating to Customer Data without Customer's prior written authorization, unless required by applicable law.
(c) Upon Customer's reasonable request, Provider shall implement technical measures to assist Customer in fulfilling data subject requests, including by providing search, retrieval, and deletion capabilities with respect to Customer Data stored on the SkyComply™ platform.
Section 9.2 — Regulatory Cooperation
(a) Provider shall cooperate with Customer in responding to inquiries, examinations, investigations, enforcement actions, or requests for information from banking regulators, law enforcement agencies, or other governmental authorities regarding the Processing of Customer Data under this DPA and the MSA.
(b) Provider shall make available to Customer, upon reasonable request, all information in Provider's possession or control that is reasonably necessary to demonstrate Customer's and Provider's compliance with Applicable Data Protection Laws. Such information may include, without limitation, audit reports, certifications, policies, procedures, training records, and incident response documentation.
ARTICLE 10 — PROVIDER PERSONNEL
Section 10.1 — Personnel Obligations
Provider shall ensure that all of its personnel (including employees, contractors, and temporary workers) who are authorized to Process Customer Data:
(a) Have undergone background checks consistent with FFIEC guidelines, including criminal background checks, verification of employment history, and such other screening as may be required by Customer and set forth in the Security Exhibit, prior to being granted access to Customer Data;
(b) Are subject to binding confidentiality obligations, whether by contract or by operation of law, that prohibit the unauthorized disclosure or use of Customer Data and that survive the termination of such personnel's engagement with Provider;
(c) Have received appropriate training on data protection, information security, and the specific requirements of this DPA and the Security Exhibit, including training on the identification and reporting of Security Incidents, prior to being granted access to Customer Data and on an annual basis thereafter; and
(d) Access Customer Data only to the extent necessary to perform their assigned duties in connection with the services under the MSA, in accordance with the principle of least privilege and the role-based access controls described in Section 3.3 of this DPA.
Section 10.2 — Designated Contacts
The following individuals are designated as the primary contacts for data protection matters under this DPA:
Provider's Designated Data Protection Contact: Amara Okafor, Chief Information Security Officer Skybridge Fintech Ltd. 1400 Concord Pike, Suite 320 Wilmington, DE 19803
Customer's Designated Data Protection Contact: Sandra Petrov, Head of Financial Crimes & Compliance Meridian National Bank, National Association 600 Lexington Avenue, 40th Floor New York, NY 10022
Either Party may change its designated data protection contact by providing written notice to the other Party in accordance with the notice provisions of the MSA. Provider shall ensure that a qualified successor is designated in writing to Customer in the event that Amara Okafor ceases to serve as Provider's CISO.
ARTICLE 11 — LIABILITY AND INDEMNIFICATION
Section 11.1 — Cross-Reference to MSA
(a) The indemnification, liability cap, and limitation of liability provisions set forth in the MSA shall apply to this DPA and to all claims arising out of or relating to the Processing of Customer Data, except as expressly modified or supplemented by this DPA.
(b) For the avoidance of doubt, Provider's obligations with respect to the unauthorized access, disclosure, use, alteration, or destruction of Customer Data are subject to the indemnification provisions set forth in the MSA, including the applicable data breach indemnity cap and the data security super-cap, as defined in the MSA. Nothing in this Section 11.1 shall be construed to limit any indemnification obligation that is expressly identified in the MSA as not subject to the general limitation of liability.
Section 11.2 — Provider Liability for Subprocessors
Provider shall be directly liable to Customer for any breach of this DPA, the Security Exhibit, or the MSA caused by the acts or omissions of any of Provider's Subprocessors with respect to Customer Data, to the same extent and in the same manner as if such breach were committed by Provider directly. This liability shall apply regardless of whether the Subprocessor was an Approved Subprocessor and regardless of the terms of Provider's agreement with such Subprocessor.
ARTICLE 12 — TERM AND SURVIVAL
Section 12.1 — Term
This DPA shall become effective as of the Effective Date of the MSA and shall remain in full force and effect for the duration of the MSA, including any renewal terms, and for such additional period as Provider retains any Customer Data in its possession or control, whether pursuant to Article 8 of this DPA, applicable law, or otherwise.
Section 12.2 — Survival
The obligations of the Parties under the following provisions of this DPA shall survive the termination or expiration of this DPA and the MSA: Article 5 (Security Incident Notification and Response), Article 7 (Audit Rights), Article 8 (Data Retention, Export, and Destruction), Article 9 (Data Subject Rights and Cooperation), Article 11 (Liability and Indemnification), and this Article 12 (Term and Survival), together with any definitions and interpretive provisions necessary to give effect to such surviving obligations.
ARTICLE 13 — GENERAL PROVISIONS
Section 13.1 — Governing Law
This DPA shall be governed by and construed in accordance with the laws of the State of Delaware, without regard to its conflict of laws principles or rules that would require or permit the application of the laws of any other jurisdiction.
Section 13.2 — Dispute Resolution
Any dispute, controversy, or claim arising out of or relating to this DPA, including the breach, termination, or validity hereof, shall be resolved in accordance with the dispute resolution provisions of the MSA, including: (a) mandatory executive escalation to senior officers of each Party for a period of not less than fifteen (15) business days; (b) if not resolved through executive escalation, mandatory mediation administered by JAMS in Wilmington, Delaware, for a period of sixty (60) days; and (c) if not resolved through mediation, submission to the exclusive jurisdiction of the Delaware Court of Chancery or, if the Delaware Court of Chancery declines jurisdiction, the United States District Court for the District of Delaware. Each Party irrevocably consents to the personal jurisdiction of such courts and waives any objection to venue therein.
Section 13.3 — Amendments
This DPA may not be amended, modified, or supplemented except by a written instrument duly executed by authorized representatives of both Parties. No course of dealing, course of performance, or usage of trade shall operate to modify the terms of this DPA. For the avoidance of doubt, email or other informal correspondence between the Parties shall not constitute a written amendment to this DPA.
Section 13.4 — Entire Agreement
This DPA, together with the MSA and all exhibits, schedules, and order forms attached thereto or incorporated therein by reference (including the SLA Exhibit (Exhibit A), the Security Exhibit (Exhibit B), this DPA (Exhibit C), and the Acceptable Use Policy (Exhibit D)), constitutes the entire agreement between the Parties with respect to the Processing of Customer Data and supersedes all prior and contemporaneous agreements, representations, warranties, and understandings, whether written, oral, or implied, relating to the subject matter hereof.
Section 13.5 — Severability
If any provision of this DPA is held to be invalid, illegal, or unenforceable by a court of competent jurisdiction, such provision shall be modified to the minimum extent necessary to make it valid, legal, and enforceable while preserving the original intent of the Parties. If such modification is not possible, such provision shall be severed from this DPA, and the remaining provisions shall continue in full force and effect. The invalidity, illegality, or unenforceability of any provision in one jurisdiction shall not affect the validity, legality, or enforceability of such provision in any other jurisdiction.
Section 13.6 — Notices
(a) All notices, requests, demands, and other communications required or permitted under this DPA shall be in writing and shall be delivered in accordance with the notice provisions set forth in the MSA.
(b) Notices relating to data protection matters, including Security Incident notifications, Subprocessor notices, and audit requests, shall be directed to the designated data protection contacts identified in Section 10.2 of this DPA, in addition to any other notice requirements set forth in the MSA.
Section 13.7 — Counterparts
This DPA may be executed in two or more counterparts, each of which shall be deemed an original and all of which together shall constitute one and the same instrument. Execution and delivery of this DPA by electronic signature (including PDF, Brightwater Software, or similar electronic signature technology) shall be deemed to have the same legal effect as delivery of an original executed counterpart.