Contract analysis

1. Executive Summary This memorandum sets forth the findings of Calderwood & Harkness LLP's ("C&H") comprehensive gap analysis of the fourteen (14) European-facing websites and three (3) mobile applications (collectively, the "European Digital Properties") operated by Aurelius Global Media Group PLC ("AGMG" or the "Company") against the requirements of applicable data protection and e-privacy legislation across the E

1. Consent Mechanism Redesign — elimination of dark patterns, implementation of compliant cookie banners and mobile app consent flows;

2. Server-Side Pixel Remediation — consent-gating of all server-side tracking pixels;

3. DPA Renegotiation — negotiation and execution of GDPR-compliant Data Processing Agreements with nine non-compliant vendors;

4. Vendor Audit Rights — securing Article 28(3)(h) audit and inspection rights across all twenty-three vendor relationships;

5. DPIA Updates — updating and preparing Data Protection Impact Assessments for high-risk processing activities;

6. ROPA Update — comprehensive update of AGMG's Article 30 Records of Processing Activities;

7. Regulatory Responses — drafting and submitting compliance responses to both the CNIL and the ICO. Each finding in this memorandum is risk-rated on a four-tier scale: Critical (likely regulatory enforcement, high fine risk, systemic non-compliance), High (probable enforcement interest, significant remediation needed), Medium (gap identified requiring correction but lower enforcement risk), and Low (best-practice re

2. Scope and Methodology 2.1 Scope of Review The scope of this gap analysis encompasses the entirety of AGMG's European-facing digital operations, as follows: Websites. All fourteen (14) AGMG websites serving European audiences, including but not limited to: • aurelius-stream.fr (French-language streaming platform — subject of CNIL complaint PLT-2023-FR-04821); • aureliusnews.co.uk (UK English-language news portal —

3. Regulatory Background 3.1 CNIL Complaint and Formal Notice On 8 November 2023, a formal complaint was filed with the CNIL by Digitale Rechte Europa e.V. ("DRE"), a German-registered digital rights advocacy organisation (Executive Director: Friederike Nolte; legal counsel: Dr. Tobias Kreisel, Kreisel & Hausmann Rechtsanwälte PartG mbB, Friedrichstraße 95, 10117 Berlin, Germany). The complaint was registered under C

4. Gap Analysis Findings — Cookie Consent Mechanisms 4.1 Pre-Consent Cookie Firing Risk Rating: CRITICAL Finding. The Thistlewood technical audit identified a total of 312 unique cookies across AGMG's fourteen European websites. Of these, 74 cookies fire before any user consent interaction (i.e., they are set or activated upon initial page load, prior to any engagement with the CMP banner). Thistlewood classified 38

5. Gap Analysis Findings — Server-Side Tracking Pixels 5.1 Non-Compliant Server-Side Pixels Risk Rating: CRITICAL Finding. The Thistlewood audit identified nineteen (19) unique server-side tracking pixels deployed across AGMG's European Digital Properties. Unlike client-side cookies, which are set in the user's browser and can be managed through the CMP's tag management framework, server-side pixels operate at the se

6. Gap Analysis Findings — Transparency and Information Obligations 6.1 Privacy Notices — Article 13 and Article 14 GDPR Risk Rating: HIGH Finding. C&H's review of the privacy notices deployed across AGMG's fourteen websites and three mobile applications reveals several material deficiencies: (a) Incomplete disclosure of third-party recipients. Nine (9) of AGMG's twenty-three adtech vendors are not named or adequatel

7. Gap Analysis Findings — Legal Basis for Processing 7.1 Misuse of "Legitimate Interest" Under IAB TCF Risk Rating: CRITICAL Finding. Seven (7) of AGMG's twenty-three adtech vendors — including Pendleton AdTech Solutions Ltd and VoltGraph Analytics GmbH — have registered "legitimate interest" (GDPR Article 6(1)(f)) as their legal basis under the IAB TCF 2.2 framework for processing purposes that, under applicable EU

8. Gap Analysis Findings — Data Processing Agreements (Article 28 GDPR) 8.1 DPA Coverage Risk Rating: CRITICAL Finding. Nine (9) of AGMG's twenty-three (23) adtech vendors (39.1%) processing AGMG user data have either no Data Processing Agreement in place at all, or a materially deficient DPA that fails to include all mandatory provisions required by GDPR Article 28. C&H reviewed the contractual documentation for all

Article 28(3) Required Provisions. The following mandatory provisions of GDPR Article 28(3) are missing from the DPAs (or equivalent contractual documents) of the nine non-compliant vendors: (a) Processing only on documented instructions of the controller — Article 28(3)(a); (b) Obligation that persons authorised to process personal data have committed themselves to confidentiality or are under an appropriate statuto

9. Gap Analysis Findings — International Data Transfers (Articles 44–49 GDPR) 9.1 Transfers Without Adequate Safeguards Risk Rating: CRITICAL Finding. Six (6) of AGMG's twenty-three adtech vendors transfer AGMG user personal data to countries outside the European Economic Area that have not been the subject of an adequacy decision by the European Commission: • Four (4) vendors transfer data to the United States; • On