Extract to table

For purposes of GDPR compliance, particular attention must be given to the anti-fraud behavioral biometric data

Furthermore, the CLOUD Act implications of data stored at the Frankfurt location (operated by Osprey Cloud, a US corporation) must be considered, as discussed in Section VII below

If no supplementary measures can be identified that would provide such protection, the transfer must be suspended or terminated

However, several important limitations must be noted: First, the DPF adequacy does not extend to Osprey Cloud Infrastructure, Inc

" EO 14086 introduced binding requirements of proportionality and necessity for US signals intelligence activities directed at foreign persons' data, explicitly providing that signals intelligence shall be conducted only to the extent necessary and proportionate to a validated intelligence priority

Under this model, the Controller (Meridian) provides general written authorization for Skybridge to engage sub-processors, subject to the following conditions: Skybridge must provide the Controller with at least 30 days' prior written notice before engaging any new sub-processor or replacing an existing sub-processor; the notice must identify the sub-processor, the nature of the processing to be performed, and the location of processing; the Controller has the right to object to the engagement of a proposed sub-processor on reasonable data-protection grounds within the 30-day notice period; and Skybridge is required to flow down equivalent data protection obligations to all sub-processors through written contracts