Extract to table

Processor shall remain fully liable for the acts and omissions of its sub-processors as though such acts and omissions were those of Processor itself

As the primary audit mechanism, Processor shall make available to Controller, upon request, its most recent SOC 2 Type II report

Nothing in the DPA shall be construed to limit or restrict such regulatory access rights

Processor shall certify in writing to Controller upon completion of the return or deletion, as applicable, and shall retain no copies of such personal data except to the extent required by applicable law, in which case Processor shall continue to maintain the confidentiality and security of such retained data

Evidence of such coverage shall be provided to Controller upon execution and annually thereafter, and Processor shall provide Controller with not less than thirty (30) days' advance written notice of any material change to, cancellation of, or failure to renew such policy

Schedule A sets forth a detailed description of the processing activities to be carried out by Processor on behalf of Controller, including: (i) the categories of data subjects, encompassing approximately 412,000 Meridian accountholders, authorized signers on deposit and lending accounts, beneficial owners identified pursuant to Meridian's Customer Identification Program and beneficial-ownership requirements, and Meridian employees whose data is processed through the SBF Core platform; (ii) the categories of personal data processed, including full legal name, Social Security number, date of birth, residential and mailing address, email address, telephone number, deposit and loan account numbers, transaction data (including payment amounts, dates, payees, and merchant category codes), IP addresses, device identifiers, behavioral biometric data (including keystroke dynamics, mouse movement patterns, and touchscreen interactions collected for anti-fraud and authentication purposes), and such other categories as may be specified in the Subscription Agreement; (iii) the purposes of processing, including payment processing, anti-fraud analytics and monitoring, regulatory reporting via the SBF Core platform, customer authentication, and such other purposes as are necessary for the provision of services under the Subscription Agreement; and (iv) the duration of processing, which shall be co-terminus with the term of the Subscription Agreement unless otherwise instructed in writing by Controller