Extract to table

" RECITALS WHEREAS, Controller has entered into, or will concurrently enter into, that certain Software-as-a-Service Subscription Agreement (the "Subscription Agreement") with Processor for access to and use of the SBF Core platform, Processor's proprietary cloud-based software platform providing real-time payment processing, anti-fraud analytics, and regulatory reporting services; WHEREAS, in connection with the performance of the Subscription Agreement, Processor will process certain Personal Data on behalf of Controller, and this DPA sets forth the obligations of the Parties with respect to the processing and protection of such Personal Data by Processor on behalf of Controller; WHEREAS, Controller is a federally chartered savings bank subject to the supervisory authority and oversight of the Office of the Comptroller of the Currency ("OCC"), the Federal Deposit Insurance Corporation ("FDIC"), and the Consumer Financial Protection Bureau ("CFPB"), and the Parties intend for this DPA to comply in all respects with OCC Bulletin 2023-17 (Third-Party Relationships: Risk Management Guidance), the Gramm-Leach-Bliley Act ("GLBA"), Regulation P (12 CFR Part 1016), the General Data Protection Regulation (Regulation (EU) 2016/679) ("GDPR"), the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA/CPRA"), the New Jersey Data Privacy Act (NJ S3377), and all other applicable federal, state, and international data protection laws and regulations; WHEREAS, the Parties acknowledge that Controller maintains approximately 3,200 accountholders who are residents of the European Economic Area, thereby necessitating compliance with the GDPR and the implementation of appropriate transfer mechanisms for the lawful transfer of EU Data to the United States; WHEREAS, this DPA is incorporated into and forms an integral part of the Subscription Agreement; and in the event of any conflict or inconsistency between the terms of this DPA and the terms of the Subscription Agreement with respect to the processing and protection of Personal Data, the terms of this DPA shall control and prevail; NOW, THEREFORE, in consideration of the mutual covenants and agreements herein contained, and for other good and valuable consideration, the receipt and sufficiency of which are hereby acknowledged, the Parties agree as follows: ARTICLE 1 — DEFINITIONS For purposes of this DPA, the following terms shall have the meanings set forth below

Capitalized terms used but not defined in this DPA shall have the meanings ascribed to them in the Subscription Agreement

In the event of any inconsistency between the body of this DPA and Schedule A, the more protective provision (from the standpoint of Data Subject rights and Controller's obligations) shall prevail

Processor shall implement additional safeguards for Sensitive Data as described in Schedule B (Security Measures)

Processor shall not process Personal Data for any purpose other than those specified in this Section 2

Changes in transaction volume shall not, in and of themselves, constitute a modification of the processing activities described herein, but Processor shall promptly notify Controller of any material changes in processing infrastructure or architecture necessitated by significant increases in transaction volume