INITIAL DRAFT — SUBJECT TO NEGOTIATION — PRIVILEGED AND CONFIDENTIAL ATTORNEY WORK PRODUCT — PREPARED AT THE DIRECTION OF COUNSEL
DATA PROCESSING ADDENDUM
Exhibit C to the Master Software-as-a-Service Agreement
between
SKYBRIDGE FINTECH LTD. and MERIDIAN NATIONAL BANK, NATIONAL ASSOCIATION
DATA PROCESSING ADDENDUM
This Data Processing Addendum ("DPA") is entered into as of the Effective Date (as defined below) by and between:
Skybridge Fintech Ltd., a Delaware limited company ("Provider" or "Processor"), with its principal place of business at 1400 Concord Pike, Suite 320, Wilmington, DE 19803;
and
Meridian National Bank, National Association, a national banking association chartered under the laws of the United States ("Customer" or "Controller"), with its principal office at 600 Lexington Avenue, 40th Floor, New York, NY 10022.
Provider and Customer are each referred to herein as a "Party" and collectively as the "Parties."
This DPA is attached to, and incorporated into, the Master Software-as-a-Service Agreement (the "MSA") between Provider and Customer for the SkyComply™ platform, and shall become effective as of the effective date of the MSA (the "Effective Date").
Prepared by Calderwood & Harkness LLP
Right-click to update Table of Contents
RECITALS
WHEREAS, Provider and Customer have entered into, or are concurrently entering into, the MSA, pursuant to which Provider will provide the SkyComply™ AI-driven anti-money-laundering and transaction-monitoring platform (the "Platform") to Customer on a software-as-a-service basis, together with the related implementation, support, and managed services described therein (collectively, the "Services");
WHEREAS, in the course of providing the Services, Provider will Process certain Customer Data, including Non-Public Personal Information ("NPI") as defined under Title V of the Gramm-Leach-Bliley Act ("GLBA") (15 U.S.C. § 6801 et seq.) and its implementing regulations, as well as personally identifiable information ("PII") and other sensitive financial data;
WHEREAS, Customer is a national banking association chartered under the National Bank Act and is subject to the supervisory authority and examination oversight of the Office of the Comptroller of the Currency ("OCC"), the Board of Governors of the Federal Reserve System (the "Federal Reserve"), and the Federal Deposit Insurance Corporation ("FDIC"), and is further subject to, among other requirements, the Interagency Guidance on Third-Party Relationships: Risk Management (issued June 6, 2023), OCC Bulletin 2013-29 (Third-Party Relationships: Risk Management Guidance), and the Bank Service Company Act (12 U.S.C. § 1867);
WHEREAS, the Parties recognize that the Processing of Customer Data in connection with the Services must be conducted in strict compliance with all Applicable Data Protection Laws (as defined herein), including applicable federal and state privacy, data protection, and information security statutes and regulations, and in accordance with the supervisory expectations of Customer's federal banking regulators;
WHEREAS, the Parties desire to set forth their respective rights and obligations regarding the Processing of Customer Data in a manner that ensures adequate protections for such data, satisfies applicable legal and regulatory requirements, and establishes clear procedures for data handling, security incident response, audit, and oversight; and
WHEREAS, this DPA is intended to supplement the confidentiality and data security provisions of the MSA and to provide additional specificity regarding the Processing of Customer Data;
NOW, THEREFORE, in consideration of the mutual covenants and obligations set forth herein, and for other good and valuable consideration, the receipt and sufficiency of which are hereby acknowledged, the Parties agree as follows:
ARTICLE 1 — DEFINITIONS
1.1 "Applicable Data Protection Laws" means all federal, state, and local laws, rules, regulations, orders, directives, and regulatory guidance relating to data privacy, data protection, cybersecurity, and information security that are applicable to the Processing of Customer Data under this DPA, including without limitation: (a) Title V of the Gramm-Leach-Bliley Act (15 U.S.C. § 6801 et seq.) and its implementing regulations, including Regulation P (12 C.F.R. Part 1016) and the Interagency Guidelines Establishing Information Security Standards (the "Safeguards Rule"); (b) the Bank Secrecy Act ("BSA") (31 U.S.C. § 5311 et seq.) and its implementing regulations (31 C.F.R. Chapter X); (c) applicable state data breach notification laws (including, without limitation, New York General Business Law § 899-aa, the New York SHIELD Act, the Delaware Computer Security Breaches Act (6 Del. C. § 12B-101 et seq.), and the California Consumer Privacy Act ("CCPA") as amended by the California Privacy Rights Act ("CPRA"), to the extent applicable); (d) applicable OCC bulletins, advisories, and examination guidance, including OCC Bulletin 2013-29 and the Interagency Guidance on Third-Party Relationships: Risk Management (June 2023); and (e) any applicable guidance or directives issued by the Federal Reserve, the FDIC, the Financial Crimes Enforcement Network ("FinCEN"), or other governmental or regulatory authorities having jurisdiction over Customer or the Processing of Customer Data.
1.2 "Customer Data" means all data, information, records, documents, and materials, in any form or format (whether electronic, paper-based, or otherwise), that are: (a) provided by or on behalf of Customer to Provider in connection with the Services; (b) collected, received, generated, created, derived, processed, or stored by Provider on behalf of Customer in connection with the Services; or (c) otherwise made available to Provider by Customer or at Customer's direction in connection with the Services. Customer Data includes, without limitation, NPI, PII, transaction data, account data, customer identification records, suspicious activity report ("SAR") data and related information, alert and case management data, risk scores, and any other data input into, processed by, or output from the SkyComply™ Platform.
1.3 "Data Classification" means the classification of Customer Data in accordance with Customer's data classification policy, as communicated to Provider from time to time. Customer Data shall be classified as either: (a) "Confidential" or (b) "Highly Restricted." All NPI and PII within Customer Data shall be deemed classified as "Highly Restricted" unless Customer provides an alternative written designation. Provider shall handle and protect all Customer Data in accordance with the applicable classification level and the corresponding security controls specified in this DPA and the Security Exhibit (Exhibit B to the MSA).
1.4 "NPI" or "Non-Public Personal Information" means non-public personal information as defined in the GLBA and its implementing regulations, including 12 C.F.R. Part 1016, and encompasses personally identifiable financial information as that term is used in Regulation P.
1.5 "PII" or "Personally Identifiable Information" means any information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, to an identified or identifiable natural person. PII includes, without limitation, names, addresses, dates of birth, Social Security numbers, government-issued identification numbers, account numbers, and biometric data, as well as any information that, when combined with other information, could be used to identify a natural person.
1.6 "Processing" or "Process" means any operation or set of operations performed on Customer Data, whether or not by automated means, including without limitation the collection, recording, organization, structuring, storage, adaptation, alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment, combination, restriction, erasure, or destruction of Customer Data. "Processes" and "Processed" shall have corresponding meanings.
1.7 "Security Incident" means any confirmed unauthorized access to, acquisition of, use of, disclosure of, modification of, or loss of Customer Data, or any breach, compromise, or failure of Provider's security controls or systems that compromises or is reasonably likely to compromise the confidentiality, integrity, or availability of Customer Data. For the avoidance of doubt, "Security Incident" includes any "data breach," "security breach," or "breach of the security of the system" as those terms are defined under applicable state data breach notification laws.
1.8 "Subprocessor" means any third party (other than Provider's employees acting within the scope of their employment) engaged, appointed, or authorized by Provider to Process Customer Data on behalf of Customer in connection with the Services, including without limitation infrastructure providers, hosting providers, and any subcontractors that access, receive, or Process Customer Data.
1.9 "Services" means the SkyComply™ Platform subscription, implementation services, ongoing support and maintenance, managed services, and any other services provided by Provider to Customer under the MSA and the applicable Order Form(s), as further described therein.
1.10 Capitalized terms used but not otherwise defined in this DPA shall have the meanings ascribed to them in the MSA. In the event of any inconsistency between the definitions in this DPA and those in the MSA, the definitions in this DPA shall control with respect to the subject matter of this DPA.
ARTICLE 2 — SCOPE AND PURPOSE OF PROCESSING
2.1 Scope. This DPA applies to all Processing of Customer Data by Provider (and its Subprocessors) in connection with the provision of the Services under the MSA. The scope of Customer Data subject to this DPA includes, without limitation, transaction data, customer identification program ("CIP") records, account information, SARs and related supporting documentation and data, currency transaction report ("CTR") data, beneficial ownership information, watch list screening data, risk scores and model outputs, alert and case management data, and other financial records and data processed through or generated by the SkyComply™ Platform.
2.2 Purpose. Provider shall Process Customer Data solely and exclusively for the purpose of providing the Services as described in the MSA, this DPA, and the applicable Order Form(s), and as further instructed by Customer in writing in accordance with Article 3. Provider expressly acknowledges and agrees that it shall not Process Customer Data for any other purpose, including without limitation: (a) Provider's own commercial purposes; (b) marketing, advertising, or promotional purposes; (c) analytics, benchmarking, or research unrelated to the provision of the Services to Customer; (d) product development or improvement for Provider's general benefit (other than as expressly permitted in the MSA with respect to aggregated and anonymized platform performance metrics that do not contain or derive from identifiable Customer Data); or (e) any purpose that would render Provider a "business" (rather than a "service provider") under the CCPA/CPRA, to the extent applicable.
2.3 Duration. Processing of Customer Data under this DPA shall commence on the earlier of: (a) the start of the Implementation Period as defined in the MSA and Order Form (targeted commencement date: September 15, 2025), or (b) the date on which Customer first provides Customer Data to Provider. Processing shall continue for the duration of the MSA, including any renewal terms, plus the post-termination data export and destruction period specified in Article 8 of this DPA. Upon expiration or termination of the MSA, Provider's Processing of Customer Data shall be limited solely to the activities necessary to complete the data export and destruction obligations set forth in Article 8, and Provider shall have no right to continue Processing Customer Data for any other purpose.
2.4 Categories of Data Subjects. Customer Data processed under this DPA may relate to the following categories of data subjects:
(a) Customer's retail banking customers and their household members;
(b) Customer's commercial and business banking customers, including their officers, directors, authorized signatories, and key principals;
(c) Customer's wealth management and private banking clients and associated persons;
(d) Beneficial owners of accounts maintained by Customer, as identified through Customer's customer due diligence and enhanced due diligence procedures;
(e) Counterparties to transactions processed through Customer's systems and monitored by the SkyComply™ Platform;
(f) Customer's employees and authorized users of the SkyComply™ Platform (up to 32,000 named users, as specified in the Order Form); and
(g) Any other natural persons whose personal data is input into, processed by, or generated by the SkyComply™ Platform in connection with the Services.
2.5 Types of Customer Data. The types of Customer Data processed under this DPA include, without limitation:
(a) Identifying information: full names, aliases, former names, mailing addresses, residential addresses, business addresses, email addresses, telephone numbers, dates of birth, places of birth, nationalities, and citizenship information;
(b) Government-issued identification numbers: Social Security numbers, Individual Taxpayer Identification Numbers, Employer Identification Numbers, passport numbers, driver's license numbers, and state identification card numbers;
(c) Account information: account numbers, account types, account opening dates, account status, and account relationships;
(d) Transaction records: transaction amounts, dates, descriptions, originator and beneficiary details, wire transfer data, ACH transaction data, check data, and card transaction data;
(e) Financial data: account balances, income information, employment information, credit data, and other financial profile information;
(f) AML/BSA screening data: watch list and sanctions screening results, politically exposed person ("PEP") screening data, adverse media screening results, and customer risk ratings;
(g) Risk scores and model outputs: transaction risk scores, customer risk scores, behavioral analytics outputs, and anomaly detection results generated by the SkyComply™ Platform;
(h) Alert and case management data: alerts generated by the Platform, investigation notes, case disposition data, SAR filing data, and related correspondence; and
(i) Any other data input into or generated by the SkyComply™ Platform in connection with the Services.
A detailed description of Processing activities is set forth in Schedule 1 to this DPA.
ARTICLE 3 — PROCESSING INSTRUCTIONS
3.1 Documented Instructions. Provider shall Process Customer Data only in accordance with Customer's documented written instructions. The MSA, this DPA (including its Schedules), and the applicable Order Form(s) constitute Customer's initial documented instructions to Provider regarding the Processing of Customer Data. Customer may issue additional or supplementary written instructions from time to time, provided that such instructions are reasonable, lawful, and consistent with the terms of the MSA. Provider shall comply with all such documented instructions, unless compliance would require Provider to violate Applicable Data Protection Laws.
3.2 Compliance with Instructions. If Provider reasonably believes that an instruction from Customer would violate Applicable Data Protection Laws or any applicable regulatory requirement, Provider shall: (a) promptly notify Customer in writing of its belief, providing a reasonable explanation of the basis for its conclusion; and (b) not proceed with the instruction until the matter is resolved to the reasonable satisfaction of both Parties. The Parties shall cooperate in good faith to resolve any disagreement regarding the lawfulness of a Customer instruction. Provider's obligation under this Section 3.2 shall not be construed as requiring Provider to provide legal advice to Customer.
3.3 Prohibited Processing. Without limiting the generality of Section 3.1, Provider expressly agrees that it shall not:
(a) Sell Customer Data to any third party, or otherwise transfer Customer Data to a third party for monetary or other valuable consideration;
(b) Retain, use, or disclose Customer Data for any purpose other than as necessary to perform the Services in accordance with this DPA and Customer's documented instructions;
(c) Combine Customer Data with personal data or other data obtained from or on behalf of other customers of Provider, or with Provider's own data, except to the extent strictly necessary for the provision of shared infrastructure services (e.g., multi-tenant hosting) in a logically segregated environment in accordance with Section 4.4;
(d) De-identify, anonymize, or aggregate Customer Data for Provider's own purposes, including for product development, benchmarking, analytics, or any commercial purpose unrelated to the delivery of the Services to Customer; or
(e) Process Customer Data in any manner that would cause Customer to be in violation of Applicable Data Protection Laws or the supervisory expectations of Customer's federal banking regulators.
ARTICLE 4 — DATA CLASSIFICATION AND HANDLING
4.1 Classification. All Customer Data shall be classified and handled in accordance with Customer's data classification policy, as communicated to Provider in writing. Provider acknowledges that it has received a copy of Customer's current data classification policy and that Customer Data encompasses data classified at both the "Confidential" and "Highly Restricted" levels. Provider shall implement and maintain controls and procedures sufficient to satisfy the handling requirements applicable to each classification level.
4.2 Highly Restricted Data. Provider acknowledges and agrees that all NPI and PII within Customer Data is classified as "Highly Restricted" and shall be subject to the most stringent security controls maintained by Provider. Such controls shall be no less protective than those set forth in the Security Exhibit (Exhibit B to the MSA) and the minimum security measures described in Schedule 2 to this DPA. Without limiting the foregoing, Highly Restricted data shall be subject to encryption standards, access controls, logging, and monitoring requirements at least as protective as those specified in Section 4.3 below.
4.3 Handling Requirements. Provider shall implement and maintain administrative, technical, and physical safeguards appropriate to the classification level of Customer Data, consistent with the Security Exhibit, industry best practices, and the requirements of Applicable Data Protection Laws. Such safeguards shall include, at a minimum, the following:
(a) Access Controls. Provider shall implement and maintain role-based access controls ("RBAC") enforcing the principle of least privilege for all systems and applications that store, process, or transmit Customer Data. Access to Customer Data classified as "Highly Restricted" shall require multi-factor authentication ("MFA") for all Provider personnel, including employees, contractors, and agents. Provider shall conduct periodic access reviews (no less than quarterly) to confirm that access privileges remain appropriate and shall promptly revoke access for any personnel who no longer require it.
(b) Encryption. Provider shall encrypt all Customer Data at rest using AES-256 encryption (or a successor algorithm of equivalent or greater strength). All Customer Data in transit shall be encrypted using TLS 1.2 or higher (with preference for TLS 1.3 where supported). Provider shall not transmit Customer Data over unencrypted channels under any circumstances.
(c) Key Management. Provider shall manage encryption keys using hardware security modules ("HSMs") that are FIPS 140-2 Level 3 validated (or successor standard). Provider shall implement and maintain key management procedures, including key generation, distribution, storage, rotation, and destruction, consistent with NIST SP 800-57 or equivalent standards. Customer shall have the option to utilize a bring-your-own-key ("BYOK") integration, the technical specifications and implementation details of which shall be agreed upon by the Parties during the Implementation Period.
(d) Logging and Monitoring. Provider shall implement and maintain comprehensive audit logging of all access to Customer Data, including without limitation user access events, administrative actions, data modifications, data exports, and system-level events. Audit logs shall be retained for a minimum of twelve (12) months in online or readily accessible storage, and for an additional twelve (12) months in archival storage, for a total minimum retention period of twenty-four (24) months. Audit logs shall be tamper-evident and protected against unauthorized modification or deletion. Provider shall monitor audit logs on a continuous basis (24/7) using a security information and event management ("SIEM") system and shall promptly investigate any anomalous or suspicious activity.
4.4 Logical Segregation. Customer Data shall be logically segregated from the data of Provider's other customers at both the application layer and the database layer. Provider shall implement and maintain technical controls (including, without limitation, tenant isolation mechanisms, database-level segregation, and application-level access controls) to ensure that Customer Data is not accessible to or commingled with the data of any other customer of Provider. Provider shall provide Customer with a written description of its tenant isolation architecture upon Customer's reasonable request.
ARTICLE 5 — DATA RESIDENCY AND CROSS-BORDER TRANSFER RESTRICTIONS
5.1 Data Residency. All Customer Data shall be stored, processed, and maintained exclusively within the continental United States. Provider shall not store, process, or maintain Customer Data at any location outside the continental United States. Provider shall utilize only the following Orion Cloud Services, Inc. ("Orion Cloud") data center regions for the storage and processing of Customer Data:
(a) US-East — Northern Virginia region; and
(b) US-West — Oregon region.
Provider shall not migrate Customer Data to any other data center region without Customer's prior written consent.
5.2 Prohibition on Cross-Border Transfers. Provider shall not transfer, transmit, store, process, or otherwise make Customer Data accessible from any location outside the continental United States without Customer's express prior written consent. This prohibition applies to all forms of access, including without limitation remote access by Provider personnel, contractors, or Subprocessors located outside the continental United States. Provider represents and warrants that, as of the Effective Date, no Provider personnel located outside the continental United States have access to Customer Data, and Provider shall maintain this restriction throughout the term of this DPA.
5.3 Subprocessor Data Residency. Provider shall ensure that all Subprocessors engaged to Process Customer Data comply with the data residency requirements set forth in this Article 5. Provider shall include data residency requirements in all Subprocessor agreements and shall monitor Subprocessor compliance on an ongoing basis. Provider's obligations under this Article 5 shall flow down to all Subprocessors engaged in the Processing of Customer Data.
5.4 Regulator Access. Nothing in this Article 5 shall be construed to restrict or impede access to Customer Data by the OCC, the Federal Reserve, the FDIC, FinCEN, or any other applicable federal or state banking regulator in the exercise of their lawful supervisory, examination, or enforcement authority. Provider shall cooperate fully with any such regulatory access in accordance with Section 9.5 of this DPA.
ARTICLE 6 — SUBPROCESSOR OBLIGATIONS
6.1 Authorized Subprocessors. Customer hereby authorizes Provider's use of the Subprocessor(s) identified in the table below as of the Effective Date (the "Authorized Subprocessor(s)"):
Provider represents and warrants that, as of the Effective Date, the Authorized Subprocessor identified above is the only Subprocessor engaged by Provider to Process Customer Data in connection with the Services.
6.2 Restrictions on Subprocessing. Provider shall not engage any new Subprocessor, or replace any existing Authorized Subprocessor, to Process Customer Data without providing Customer at least thirty (30) days' advance written notice prior to such engagement or replacement. Such notice shall include, at a minimum:
(a) The Subprocessor's legal name and principal business address;
(b) A description of the nature and scope of Processing to be performed by the Subprocessor;
(c) The geographic location(s) at which the Subprocessor will Process Customer Data;
(d) The security certifications and compliance attestations held by the Subprocessor (e.g., SOC 2 Type II, ISO 27001); and
(e) A summary of the due diligence performed by Provider with respect to the Subprocessor's data protection and information security practices.
6.3 Customer Objection Right. Customer shall have the right to object to Provider's use of a new or replacement Subprocessor by providing written notice to Provider within fifteen (15) days of Customer's receipt of the notice described in Section 6.2 (the "Objection Period"). Customer's objection must state reasonable grounds related to data security, data protection, regulatory compliance, or reputational risk. If Customer timely objects on such grounds, the following procedures shall apply:
(a) Provider shall not engage the proposed Subprocessor with respect to Customer Data unless and until the objection is resolved;
(b) The Parties shall work together in good faith to identify an alternative Subprocessor or arrangement that addresses Customer's concerns; and
(c) If no mutually acceptable alternative can be agreed upon within thirty (30) days following Customer's objection, Customer may terminate the affected Services (or, at Customer's election, the MSA in its entirety) without penalty, termination fee, or other early termination charge, upon written notice to Provider. In such event, Provider shall cooperate fully with Customer in transitioning the Services in accordance with the transition assistance provisions of the MSA.
6.4 Subprocessor Agreements. Prior to permitting any Subprocessor to Process Customer Data, Provider shall enter into a written agreement with such Subprocessor that imposes data protection, data security, confidentiality, and compliance obligations on the Subprocessor that are no less protective than those imposed on Provider under this DPA. Such Subprocessor agreements shall include, at a minimum, obligations related to:
(a) Confidentiality and non-disclosure;
(b) Data security, including encryption, access control, and monitoring requirements;
(c) Data residency restrictions consistent with Article 5;
(d) Security Incident notification requirements consistent with Article 7;
(e) Audit and inspection rights consistent with Article 9;
(f) Data retention, export, and destruction requirements consistent with Article 8; and
(g) Compliance with Applicable Data Protection Laws.
Provider shall make copies of its Subprocessor agreements (or relevant extracts thereof, with commercially sensitive terms redacted) available to Customer upon reasonable request.
6.5 Liability for Subprocessors. Provider shall remain fully responsible and liable for the acts, omissions, errors, and negligence of its Subprocessors in connection with the Processing of Customer Data to the same extent as if Provider were performing the Processing directly. Provider's engagement of a Subprocessor shall not relieve Provider of any of its obligations under this DPA, the MSA, or Applicable Data Protection Laws.
ARTICLE 7 — SECURITY INCIDENT PROCEDURES
7.1 Security Incident Notification. Provider shall notify Customer of any confirmed Security Incident affecting Customer Data without unreasonable delay, and in any event within twenty-four (24) hours of Provider's discovery of such Security Incident. Notification shall be made to the Customer contacts identified in Section 14.5 of this DPA by telephone and confirmed in writing (via email to the addresses on file). Provider shall designate a single point of contact for all communications related to the Security Incident and shall make such contact available to Customer on a 24/7 basis for the duration of the incident response.
[Note to Customer's Counsel: Customer's initial position requests a twelve (12)-hour notification window. This draft reflects Provider's initial position of twenty-four (24) hours. This provision is subject to further negotiation between the Parties.]
7.2 Content of Notification. The initial notification provided under Section 7.1 shall include the following information, to the extent known or reasonably determinable at the time of notification:
(a) A description of the nature and circumstances of the Security Incident, including the date and time of discovery and the suspected date and time of the incident;
(b) The categories and approximate number of data subjects whose Customer Data has been or may have been affected;
(c) The categories, nature, and approximate volume of Customer Data that has been or may have been affected;
(d) The likely consequences and potential impact of the Security Incident on Customer and affected data subjects;
(e) A description of the measures taken or proposed to be taken by Provider to address the Security Incident, including measures to contain the incident and mitigate its adverse effects; and
(f) The name and contact information of Provider's designated point of contact for the incident.
If Provider is unable to provide all of the information described above at the time of the initial notification, Provider shall provide such information as is available and shall supplement the notification without unreasonable delay as additional information becomes available.
7.3 Ongoing Updates. Following the initial notification, Provider shall provide Customer with regular updates regarding the investigation, containment, remediation, and resolution of the Security Incident. During the initial response period (defined as the first fourteen (14) calendar days following discovery of the Security Incident, or such longer period as may be reasonably necessary), Provider shall provide updates to Customer no less frequently than once per calendar day. Thereafter, Provider shall provide updates at such frequency as is reasonably appropriate under the circumstances, but no less frequently than weekly, until the Security Incident has been fully resolved and remediated.
7.4 Cooperation. Provider shall cooperate fully with Customer in connection with any Security Incident affecting Customer Data, including by:
(a) Assisting Customer in investigating the nature, scope, and cause of the Security Incident;
(b) Providing Customer with all information and documentation reasonably necessary for Customer to comply with applicable state and federal data breach notification laws (including, without limitation, New York General Business Law § 899-aa, the New York SHIELD Act, and the Delaware Computer Security Breaches Act);
(c) Cooperating with Customer in responding to inquiries, examinations, or investigations by the OCC, the Federal Reserve, the FDIC, state banking regulators, state attorneys general, or other governmental or regulatory authorities;
(d) Supporting Customer in mitigating the effects of the Security Incident, including by providing affected data subjects with credit monitoring or identity theft protection services at Provider's expense, if reasonably requested by Customer and appropriate under the circumstances; and
(e) Participating in joint incident response calls and meetings as reasonably requested by Customer.
7.5 Remediation. Provider shall take all commercially reasonable steps, at Provider's own expense, to remediate the root cause of any Security Incident and to implement measures to prevent the recurrence of similar incidents. Within thirty (30) calendar days of the discovery of the Security Incident (or such other timeframe as the Parties may agree in writing), Provider shall deliver to Customer a written root-cause analysis report and a detailed remediation plan. The remediation plan shall identify: (a) the root cause(s) of the incident; (b) the specific remediation actions taken or to be taken; (c) the timeline for implementation of each remediation action; and (d) any changes to Provider's security controls, policies, or procedures implemented or proposed as a result of the incident. Customer shall have the right to review and comment on the remediation plan, and Provider shall consider Customer's comments in good faith.
7.6 Preservation of Evidence. Provider shall preserve all logs, records, data, forensic images, and other evidence related to a Security Incident for a minimum of three (3) years following the date of discovery of the Security Incident, or such longer period as may be required by Applicable Data Protection Laws, Customer's document retention policies (to the extent communicated to Provider), or a litigation hold or regulatory directive. Provider shall maintain the chain of custody for all forensic evidence and shall not destroy or alter any evidence without Customer's prior written consent.
7.7 No Public Disclosure. Provider shall not issue any press release, public statement, regulatory filing, or notification to affected data subjects or third parties regarding a Security Incident affecting Customer Data without Customer's prior written approval. Customer shall have sole discretion over the content, timing, and recipients of any public disclosure or notification. This restriction shall not apply to disclosures required by Applicable Data Protection Laws, provided that: (a) Provider provides Customer with advance notice of any such required disclosure to the extent legally permissible; and (b) Provider cooperates with Customer to limit the scope and content of the disclosure to the minimum required by law.
ARTICLE 8 — DATA RETENTION, EXPORT, AND DESTRUCTION
8.1 Retention During Term. During the term of the MSA, Provider shall retain Customer Data in accordance with Customer's documented instructions and any applicable retention schedules communicated by Customer to Provider in writing. Provider shall not delete or destroy any Customer Data during the term of the MSA without Customer's prior written authorization, except as required by Applicable Data Protection Laws or at Customer's documented instruction.
8.2 Data Export Upon Termination. Upon termination or expiration of the MSA for any reason (whether by expiration of the term, termination for cause, termination for convenience, or otherwise), Provider shall, within thirty (30) calendar days of the effective date of such termination or expiration, provide Customer with a complete and accurate export of all Customer Data in Provider's possession or control (including data held by Subprocessors on Provider's behalf). The data export shall be provided in a machine-readable, industry-standard format, such as CSV, JSON, XML, or such other format as may be reasonably requested by Customer. Provider shall provide the data export at no additional charge to Customer. Provider shall cooperate with Customer and Customer's designees in facilitating the orderly migration of Customer Data to Customer's systems or to a successor service provider, as applicable.
8.3 Certified Destruction. Within sixty (60) calendar days following the effective date of termination or expiration of the MSA, and subject to Customer's confirmation of receipt of the data export described in Section 8.2 (or Customer's written waiver of its right to receive such export), Provider shall permanently and securely destroy all copies of Customer Data in Provider's possession or control. Destruction shall encompass all copies of Customer Data, including copies residing on primary production systems, backup systems, disaster recovery systems, archival systems, and any other media or storage environments. Destruction shall be performed using methods consistent with the National Institute of Standards and Technology Special Publication 800-88, Revision 1 ("NIST SP 800-88") — Guidelines for Media Sanitization — or a successor publication of equivalent or greater rigor, and shall be appropriate to the media type (e.g., cryptographic erasure for encrypted storage, secure overwrite or physical destruction for unencrypted media). Within five (5) business days of the completion of destruction, Provider shall deliver to Customer a written certification of destruction, signed by an authorized officer of Provider, confirming the date, scope, and method of destruction and certifying that no copies of Customer Data remain in Provider's possession or control.
8.4 Subprocessor Data Destruction. Provider shall ensure that each Subprocessor destroys all Customer Data in its possession or control in accordance with the same timelines, standards, and methods set forth in this Article 8. Provider shall obtain from each Subprocessor a written certification of destruction and shall deliver copies of all such Subprocessor certifications to Customer within five (5) business days of receipt.
8.5 Exceptions. Notwithstanding the foregoing, Provider may retain Customer Data (or specific portions thereof) beyond the destruction deadline set forth in Section 8.3 solely to the extent that such retention is required by Applicable Data Protection Laws, a valid court order, or a regulatory directive or examination request. In the event that Provider is required to retain Customer Data pursuant to this Section 8.5, Provider shall:
(a) Promptly notify Customer in writing of the legal or regulatory requirement necessitating continued retention, identifying the specific data subject to the requirement and the authority under which the requirement arises;
(b) Limit the scope and duration of the retention to the minimum necessary to comply with the applicable requirement;
(c) Continue to protect all retained Customer Data in accordance with the security, confidentiality, and data handling obligations of this DPA for the entire duration of such retention; and
(d) Promptly destroy the retained Customer Data (in accordance with Section 8.3) upon the expiration of the applicable retention requirement, and provide Customer with a written certification of destruction in accordance with Section 8.3.
ARTICLE 9 — AUDIT AND INSPECTION RIGHTS
9.1 Audit Right. Customer shall have the right, at its own expense (except as otherwise provided herein), to audit, review, and assess Provider's compliance with this DPA, the security obligations set forth in the MSA and Security Exhibit (Exhibit B), and Applicable Data Protection Laws, no more than once per twelve (12)-month period, upon thirty (30) business days' prior written notice to Provider. Notwithstanding the foregoing frequency limitation, Customer shall have the right to conduct additional audits in the event of a Security Incident affecting Customer Data, a material change in Provider's security posture, or a regulatory examination or inquiry requiring Customer to verify Provider's compliance.
9.2 Satisfaction of Audit Obligations. Provider may satisfy Customer's audit requests under Section 9.1 by providing Customer with the following documentation and information:
(a) Provider's most recent SOC 2 Type II audit report (the current report is dated March 15, 2025, and was prepared by Crestfield Cyber Advisors, Inc.), together with any bridge letters or management letters issued in connection therewith;
(b) Provider's current ISO 27001 certificate (the current certificate is dated January 22, 2025, and was issued following an audit conducted by Crestfield Cyber Advisors, Inc.), together with the statement of applicability;
(c) Provider's written responses to Customer's Security Assessment Questionnaire, completed in full and updated annually or upon material changes to Provider's security environment; and
(d) Such additional documentation as Customer may reasonably request to verify Provider's compliance with this DPA, including penetration testing reports, vulnerability assessment results, and summaries of Security Incident response activities (with appropriate redaction of information relating to other customers).
Customer shall treat all audit reports, certifications, and related documentation provided by Provider under this Section 9.2 as Provider's Confidential Information, subject to the confidentiality obligations of the MSA, except that Customer may disclose such materials to its federal banking regulators in connection with regulatory examinations or as otherwise required by law.
9.3 On-Site Audit. In addition to the documentary audit rights described in Section 9.2, Customer shall have the right to conduct an on-site audit of Provider's facilities, systems, and operations upon demonstration of a material security concern or compliance issue that is not adequately addressed by the documentation provided under Section 9.2. Any on-site audit shall be subject to the following conditions:
(a) Customer shall provide Provider with no less than thirty (30) business days' prior written notice of the proposed on-site audit;
(b) The on-site audit shall be conducted during Provider's normal business hours and shall be scheduled at a mutually convenient time;
(c) The scope of the on-site audit shall be limited to those systems, facilities, processes, and records that are relevant to Provider's Processing of Customer Data and its compliance with this DPA;
(d) Customer's audit team shall comply with Provider's reasonable site access and security policies, including requirements for confidentiality agreements and visitor escorts;
(e) Customer may engage a qualified independent third-party auditor (reasonably acceptable to Provider and not a direct competitor of Provider) to conduct the on-site audit on Customer's behalf; and
(f) On-site audits shall be conducted at Customer's expense, except that if the audit reveals a material breach of this DPA or a material deficiency in Provider's security controls, the reasonable costs of the audit shall be borne by Provider.
9.4 Subprocessor Audit. Provider shall ensure that Customer's audit rights under this Article 9 extend to each Subprocessor engaged in the Processing of Customer Data, to the extent necessary to verify the Subprocessor's compliance with the data protection obligations set forth in this DPA. Provider shall satisfy this requirement by either: (a) facilitating Customer's direct audit of the Subprocessor (subject to reasonable scheduling and confidentiality requirements); or (b) conducting Provider's own audit of the Subprocessor and providing Customer with a summary of the audit findings and any remediation actions taken or planned. Provider shall use commercially reasonable efforts to include audit rights in its agreements with Subprocessors that are sufficient to enable compliance with this Section 9.4.
9.5 Regulatory Examination. Nothing in this DPA shall limit, restrict, or impede the rights of the OCC, the Federal Reserve, the FDIC, or any other applicable federal or state banking regulator to access, examine, audit, inspect, or obtain copies of any records, systems, facilities, or other information of Provider that relates to the Services or the Processing of Customer Data, in accordance with the Bank Service Company Act (12 U.S.C. § 1867(c)), OCC Bulletin 2013-29, the Interagency Guidance on Third-Party Relationships: Risk Management (June 2023), and any other applicable legal or regulatory authority. Provider expressly acknowledges and agrees that:
(a) Provider may be subject to direct examination by the OCC, the Federal Reserve, and/or the FDIC with respect to its provision of the Services to Customer;
(b) Provider shall cooperate fully, promptly, and without obstruction with any regulatory examination, inspection, or inquiry, including by providing timely access to Provider's personnel, facilities, systems, records, and documentation;
(c) Provider shall not restrict or condition regulatory access on the basis of confidentiality, proprietary rights, or any other grounds; and
(d) Provider shall promptly notify Customer of any regulatory examination, inspection, or inquiry relating to the Services or the Processing of Customer Data (to the extent permitted by law and consistent with any regulatory instructions).
ARTICLE 10 — DATA SUBJECT RIGHTS COORDINATION
10.1 Cooperation. Provider shall, taking into account the nature of the Processing and the information available to Provider, assist Customer by appropriate technical and organizational measures, insofar as is reasonably practicable, in fulfilling Customer's obligations to respond to requests from individuals (including Customer's banking customers, employees, and other data subjects) exercising their rights under Applicable Data Protection Laws. Such rights may include, without limitation, rights of access, correction, amendment, deletion, restriction of processing, data portability, and objection to processing, as applicable under the relevant Applicable Data Protection Laws. Provider shall implement and maintain technical capabilities within the SkyComply™ Platform to facilitate the search, retrieval, correction, deletion, and export of individual-level Customer Data upon Customer's request.
10.2 Notification of Data Subject Requests. If Provider receives a request directly from a data subject (or a data subject's authorized representative) regarding Customer Data, Provider shall promptly, and in no event later than three (3) business days following receipt of such request, redirect the data subject to Customer and notify Customer in writing of the request, including the identity of the data subject (to the extent known), the nature of the request, and the date received. Provider shall not independently fulfill, respond to, or act upon any data subject request regarding Customer Data unless expressly instructed to do so by Customer in writing or required to do so by Applicable Data Protection Laws.
10.3 No Independent Response. Except as required by Applicable Data Protection Laws, Provider shall not independently respond to, fulfill, deny, or otherwise take action on any data subject request regarding Customer Data. All responses to data subject requests shall be made by Customer or at Customer's documented instruction. Provider shall cooperate with Customer in preparing and delivering any required responses.
10.4 Regulatory Requests. Provider shall promptly (and in no event later than three (3) business days) notify Customer of any request, order, subpoena, civil investigative demand, or other inquiry or directive received by Provider from any governmental or regulatory authority (including, without limitation, the OCC, the Federal Reserve, the FDIC, FinCEN, state banking regulators, state attorneys general, or law enforcement agencies) that relates to or requests access to Customer Data, to the extent that Provider is legally permitted to provide such notification. Provider shall not disclose Customer Data to any governmental or regulatory authority in response to such a request without Customer's prior written consent, except to the extent required by law. Provider shall cooperate with Customer in responding to any such request, including by providing all information and documentation reasonably requested by Customer.
ARTICLE 11 — PROVIDER PERSONNEL
11.1 Background Checks. All Provider personnel (including employees, independent contractors, temporary staff, and agents) who will have access to Customer Data must undergo comprehensive background checks prior to being granted such access. Background checks shall be consistent with the guidance set forth by the Federal Financial Institutions Examination Council ("FFIEC") and shall include, at a minimum, criminal history checks, identity verification, and, where applicable, credit history checks. Provider shall not grant access to Customer Data to any individual who has not successfully completed the required background checks. Provider shall maintain records of completed background checks and shall make such records available to Customer upon reasonable request (subject to applicable privacy laws).
11.2 Confidentiality. Provider shall ensure that all personnel authorized to Process Customer Data are bound by enforceable written confidentiality obligations that are no less restrictive than the confidentiality provisions set forth in the MSA. Such obligations shall survive the termination of the individual's employment or engagement with Provider. Provider shall take appropriate disciplinary action against any personnel who breach their confidentiality obligations with respect to Customer Data.
11.3 Training. Provider shall ensure that all personnel with access to Customer Data receive initial training prior to being granted access, and thereafter receive recurring training at least annually, on the following subjects:
(a) Data protection and privacy principles, including obligations under Applicable Data Protection Laws;
(b) Information security best practices, including phishing awareness, password hygiene, and social engineering prevention;
(c) Provider's data handling policies and procedures applicable to Customer Data;
(d) Regulatory compliance obligations applicable to the Processing of Customer Data, including obligations arising from the GLBA, BSA, and applicable banking regulatory guidance; and
(e) Security Incident reporting procedures and escalation protocols.
Provider shall maintain records of training completion and shall provide evidence of training compliance to Customer upon reasonable request.
11.4 Access Limitation. Provider shall limit access to Customer Data strictly to those personnel who have a documented need-to-know basis for such access in connection with the performance of the Services. Provider shall maintain current and accurate records of all personnel (by name and role) who are authorized to access Customer Data, and shall update such records promptly upon any changes. Provider shall make such records available to Customer upon reasonable written request. Provider shall promptly revoke access to Customer Data for any personnel whose access is no longer required (including upon termination of employment or engagement, transfer to a role that does not require access, or at Customer's request).
ARTICLE 12 — COMPLIANCE WITH APPLICABLE DATA PROTECTION LAWS
12.1 Mutual Compliance. Each Party shall comply with its respective obligations under Applicable Data Protection Laws in connection with the Processing of Customer Data contemplated by this DPA. Customer, as Controller, shall be responsible for ensuring that its Processing instructions to Provider comply with Applicable Data Protection Laws. Provider, as Processor, shall be responsible for Processing Customer Data in compliance with Customer's instructions and with the obligations imposed on Processors under Applicable Data Protection Laws.
12.2 GLBA Compliance. Provider acknowledges that Customer Data includes NPI that is subject to the privacy and safeguarding requirements of the GLBA and its implementing regulations, including Regulation P (12 C.F.R. Part 1016) and the Interagency Guidelines Establishing Information Security Standards (the Safeguards Rule). Provider shall comply with all requirements applicable to service providers under the GLBA Safeguards Rule, including the implementation and maintenance of a comprehensive information security program that contains administrative, technical, and physical safeguards designed to: (a) ensure the security and confidentiality of Customer Data; (b) protect against anticipated threats or hazards to the security or integrity of Customer Data; and (c) protect against unauthorized access to or use of Customer Data that could result in substantial harm or inconvenience to any customer of Customer.
12.3 State Breach Notification Laws. Provider shall cooperate fully with Customer in complying with applicable state data breach notification laws in the event of a Security Incident that triggers notification obligations. Provider's cooperation shall include, without limitation: (a) providing Customer with all information reasonably necessary for Customer to determine whether notification is required under applicable law; (b) assisting Customer in preparing and distributing any required notifications to affected individuals, regulators, or other parties; and (c) providing information required for any regulatory filings or reports in connection with the incident.
12.4 Regulatory Changes. The Parties acknowledge that Applicable Data Protection Laws may be enacted, amended, or reinterpreted during the term of this DPA. If any change in Applicable Data Protection Laws, or any new guidance or directive issued by a governmental or regulatory authority, materially affects the obligations of either Party under this DPA, the Parties shall negotiate in good faith to amend this DPA as necessary to ensure continued compliance with such laws, guidance, or directives. Neither Party shall unreasonably withhold, condition, or delay its consent to any such amendment. Pending the execution of any such amendment, both Parties shall use commercially reasonable efforts to comply with the changed requirements.
ARTICLE 13 — RELATIONSHIP TO THE MSA
13.1 Incorporation. This DPA is incorporated into and forms an integral part of the MSA as Exhibit C. The terms and conditions of this DPA are supplemental to, and shall be read in conjunction with, the MSA and its other Exhibits and Order Form(s). In the event of any conflict or inconsistency between the terms of this DPA and the terms of the MSA (or any other Exhibit to the MSA) with respect to the Processing, protection, or security of Customer Data, the terms of this DPA shall prevail and control.
13.2 Indemnification. The indemnification obligations set forth in the MSA shall apply to any breach of this DPA, including without limitation any breach of Provider's data security, data handling, confidentiality, or compliance obligations hereunder. For the avoidance of doubt, Provider's indemnification obligations with respect to breaches of data security and confidentiality obligations under this DPA are subject to the data breach indemnification cap set forth in the MSA.
[Note to Customer's Counsel: Provider's initial position is that Provider's indemnification obligations for data security and confidentiality breaches should be capped at two times (2×) the annual fees payable under the MSA, which is approximately $18,650,000 based on the current Order Form. Customer's initial position is that indemnification for data security breaches should be uncapped. This provision is subject to further negotiation between the Parties.]
13.3 Liability. The limitations of liability and exclusions of damages set forth in the MSA shall apply to this DPA, subject to the specific carve-outs and exceptions specified in the MSA. Without limiting the foregoing, the Parties acknowledge that the MSA includes a data security "super-cap" that applies to liability arising from breaches of data security and confidentiality obligations.
[Note to Customer's Counsel: Provider's initial position is that the data security super-cap should be set at three times (3×) the annual fees payable under the MSA, which is approximately $27,975,000 based on the current Order Form. Customer's initial position is that liability for data security breaches should be uncapped, or, in the alternative, subject to a significantly higher cap. This provision is subject to further negotiation between the Parties.]
13.4 Term. This DPA shall become effective as of the Effective Date and shall remain in full force and effect for the duration of the MSA (including any renewal terms), plus the post-termination data export and destruction period set forth in Article 8 of this DPA. The obligations of the Parties under this DPA that by their nature should survive termination or expiration (including, without limitation, obligations related to confidentiality, data destruction, evidence preservation, cooperation with regulatory examinations, and indemnification) shall survive the termination or expiration of this DPA.
ARTICLE 14 — GENERAL PROVISIONS
14.1 Governing Law. This DPA shall be governed by, and construed and enforced in accordance with, the laws of the State of Delaware, without regard to its conflict of laws principles or rules that would cause the application of the laws of any other jurisdiction.
14.2 Dispute Resolution. Any dispute, controversy, or claim arising out of or relating to this DPA, or the breach, termination, or validity thereof, shall be resolved in accordance with the dispute resolution provisions set forth in the MSA. Without limiting the foregoing, such provisions include: (a) mandatory escalation to senior executives of each Party for a period of not less than thirty (30) days; (b) if the dispute remains unresolved following executive escalation, mandatory mediation administered by JAMS for a period of sixty (60) days; and (c) if the dispute remains unresolved following mediation, submission to the exclusive jurisdiction of the Delaware Court of Chancery (or, if the Court of Chancery declines jurisdiction, the Superior Court of the State of Delaware in and for New Castle County, or the United States District Court for the District of Delaware), and each Party consents to the personal jurisdiction of such courts.
14.3 Waiver of Jury Trial. EACH PARTY HEREBY IRREVOCABLY AND UNCONDITIONALLY WAIVES, TO THE FULLEST EXTENT PERMITTED BY APPLICABLE LAW, ANY AND ALL RIGHT TO TRIAL BY JURY IN ANY LEGAL ACTION, PROCEEDING, OR COUNTERCLAIM (WHETHER BASED ON CONTRACT, TORT, OR OTHERWISE) ARISING OUT OF OR RELATING TO THIS DPA OR THE ACTIONS OF THE PARTIES IN THE NEGOTIATION, ADMINISTRATION, PERFORMANCE, OR ENFORCEMENT OF THIS DPA.
14.4 Amendments. This DPA may not be amended, modified, or supplemented except by a written instrument duly executed by authorized representatives of both Parties. No waiver of any provision of this DPA shall be effective unless made in writing and signed by the waiving Party. A waiver of any provision on one occasion shall not constitute a waiver of such provision on any other occasion.
14.5 Notices. All notices, requests, demands, and other communications under this DPA shall be given in accordance with the notice provisions set forth in the MSA, except that for purposes of Security Incident notifications under Article 7 of this DPA, notices shall be directed to the following:
To Customer:
Catherine Woo Associate General Counsel (Technology) Meridian National Bank, National Association 600 Lexington Avenue, 40th Floor New York, NY 10022
Email: cwoo@meridiannational.com
Telephone: (212) 555-0147
With a copy to:
Sandra Petrov Head of Financial Crimes & Compliance Meridian National Bank, National Association 600 Lexington Avenue, 40th Floor New York, NY 10022
Email: spetrov@meridiannational.com
Telephone: (212) 555-0233
To Provider: