Contract analysis

1. Purpose and Executive Summary The purpose of this memorandum is to formally confirm the closing of the GDPR cookie-consent and adtech remediation engagement conducted by Calderwood & Harkness LLP ("C&H") on behalf of Aurelius Global Media Group PLC ("AGMG" or the "Client"), under C&H Matter No. 1017-00008 (the "Engagement"), effective 3 May 2024. The Engagement was opened on 12 January 2024, following the converge

2. Background 2.1 Trigger Events The Engagement was initiated in response to three distinct but interrelated regulatory events that arose in rapid succession during the fourth quarter of 2023. Each event is described in detail below. CNIL Complaint (PLT-2023-FR-04821). On 8 November 2023, Digitale Rechte Europa eingetragener Verein ("DRE"), a Berlin-based pan-European digital rights advocacy organisation (Executive D

3. Summary of Remediation Workstreams — Completion Status The Engagement was organised into seven discrete remediation workstreams, each designed to address a specific category of non-compliance identified during the initial audit phase or required by the CNIL formal notice and ICO inquiry. This Section provides a detailed summary of each workstream, the work performed, and its completion status. 3.1 Workstream 1: Co

4. Regulatory Outcomes 4.1 CNIL Outcome On 29 April 2024, CNIL issued a formal acknowledgment of compliance in response to AGMG's submission of 12 April 2024. CNIL confirmed that AGMG had satisfactorily addressed all deficiencies identified in formal notice MED-2023-097 and that the measures implemented were adequate to bring AGMG's practices into compliance with the applicable provisions of the Loi Informatique et L

5. Financial Summary 5.1 Calderwood & Harkness LLP Professional Fees The Engagement was conducted under a capped fee arrangement, as set out in the engagement letter dated 12 January 2024. The capped fee was £425,000, exclusive of VAT and disbursements. Under the terms of the engagement letter, C&H agreed to invoice fees at standard hourly rates up to the cap, with any excess absorbed by C&H. Actual hours worked and

6. Engagement Timeline — Key Milestones Recap The following table provides a complete chronological summary of all key milestones from the opening to the closing of the Engagement:

7. Recommended Ongoing Compliance Governance Framework While the Engagement has been completed and both regulatory matters resolved, the compliance posture achieved through the remediation programme must be maintained on an ongoing basis to ensure that AGMG remains in continuous compliance with the GDPR, the ePrivacy Directive, PECR, and the applicable national implementing laws of each jurisdiction in which AGMG ope

1. Engineering / Technical Team: Initial detection and triage. The engineering team should assess the nature and severity of the issue and implement any immediate technical mitigation (e.g., disabling a non-compliant tag or pixel).

2. DPO Office (Margaux Fontaine-Li): Notification within four (4) hours of detection. The DPO should assess the regulatory implications, determine whether personal data breach notification obligations are engaged, and coordinate the remediation response.

3. Group General Counsel (Sanjay Redworth): Notification as soon as practicable following DPO assessment, particularly where the non-compliance may give rise to regulatory reporting obligations or reputational risk.

4. External Counsel (C&H or other appointed firm): Engagement if the non-compliance may require regulatory notification, a regulatory response submission, or if there is a material risk of enforcement action. Remediation Timelines. C&H recommends the following target remediation timelines: • Critical issues (non-essential cookies or tracking pixels firing without valid consent, affecting user populations in real time

8. Deliverables Index The following is a complete list of all documents and formal deliverables produced by C&H during the course of the Engagement, together with their respective dates of delivery: Note on Privilege. All documents produced in this Engagement are subject to attorney-client privilege and, where applicable, litigation privilege, legal professional privilege, and/or the common-interest privilege establi

9. Open Items and Limitations The following matters are noted for the record as part of the formal closing of the Engagement: Engagement Closure. The Engagement under C&H Matter No. 1017-00008 is formally closed as of 3 May 2024. C&H's obligation to provide legal services under this matter number has concluded. No further work will be undertaken, and no further invoices will be rendered, under this matter number. Adv

10. Closing The Engagement under C&H Matter No. 1017-00008 is hereby formally closed, effective 3 May 2024. On behalf of the entire Calderwood & Harkness team, I wish to express our sincere appreciation for the outstanding collaboration and responsiveness demonstrated by Sanjay Redworth, Margaux Fontaine-Li, Leander Voss, and the broader AGMG DPO and technology teams throughout the course of this Engagement. The favo