Contract analysis

Section 1: Introduction and Purpose 1.1 Background This questionnaire forms part of the comprehensive data protection compliance program currently being undertaken by Northgate Telecommunications PLC ("NTP" or the "Company") and its subsidiaries across the United Kingdom and the European Union. The compliance program has been established by the NTP Board of Directors and the Chief Legal Officer to ensure full complia

1. ROPA Population. Responses will be used to populate the Records of Processing Activities for each NTP entity, covering both UK operations (subject to the UK GDPR and DPA 2018) and the operations of each EU subsidiary (subject to the EU GDPR and applicable national implementing legislation). Each completed questionnaire will correspond to a discrete ROPA entry within the Sundial Solutions platform.

2. DPIA Identification. The information provided will be analysed to identify processing activities that are likely to result in a high risk to the rights and freedoms of natural persons and that therefore require a Data Protection Impact Assessment ("DPIA") to be conducted under Article 35 of the GDPR. The DPIA screening questions contained within Section 13 of this questionnaire will assist the DPO in making this d

3. International Transfer Mapping. Responses will support the identification of all international data transfers — including restricted transfers from the United Kingdom and transfers outside the European Economic Area ("EEA") — that require appropriate transfer mechanisms (such as adequacy decisions, Standard Contractual Clauses, the UK International Data Transfer Agreement, or other safeguards) to be put in place.

4. Lawful Basis Documentation. The questionnaire will enable a structured assessment of the lawful basis relied upon for each processing activity, including the identification of processing activities that require a documented Legitimate Interest Assessment or that rely on consent as the lawful basis.

5. Processor and Sub-Processor Inventory. Responses will contribute to a comprehensive inventory of all third-party processors and sub-processors engaged across the NTP group, enabling a gap analysis of existing data processing agreements and contractual safeguards.

6. Data Subject Rights Readiness. The information captured will support NTP's ability to respond to data subject access requests, erasure requests, and other rights requests by providing a clear map of where personal data is held and how it is processed. 1.3 Scope This questionnaire is applicable to all business units of the following NTP group entities: • Northgate Telecommunications PLC (England and Wales) — all UK

Section 2: Respondent Information 2.1 Business Unit Details Please provide the following information about the business unit completing this questionnaire. 2.2 Respondent Contact Details Please provide the contact details of the person completing this questionnaire. 2.3 Data Steward Please identify the nominated Data Steward for this business unit and processing activity. Guidance Note: The Data Steward is the indivi

Section 3: Processing Activity Identification 3.1 Processing Activity Name Guidance Note: Please provide a short, descriptive title that clearly identifies the processing activity. The title should be sufficiently specific to distinguish this activity from other processing activities within the same business unit. Examples of appropriate titles include: "Customer account management — consumer broadband," "Employee pa

Section 4: Categories of Data Subjects 4.1 Data Subject Categories Identify all categories of individuals whose personal data is processed in this activity. Select all that apply by marking the relevant categories below: If "Other" selected, please specify: (Insert description of other categories of data subjects) 4.2 Approximate Number of Data Subjects Guidance Note: Consider the total number of data subjects across

Section 5: Categories of Personal Data 5.1 Categories of Personal Data Processed Identify all categories of personal data processed in this activity. Select all that apply by marking the relevant categories below: If "Other" selected, please specify: (Insert description of other categories of personal data) 5.2 Special Category Data (Article 9 GDPR) If Yes, select all categories of special category data that apply: G

Section 6: Purposes of Processing 6.1 Primary Purpose(s) Describe the primary purpose(s) for which personal data is processed in this activity: (Insert detailed description of the primary purpose(s)) Guidance Note: Please be specific and avoid generic or vague descriptions such as "business purposes," "operational needs," or "as required." The purpose should clearly describe why the processing is being carried out an

Section 7: Lawful Basis for Processing 7.1 Lawful Basis (Article 6(1) GDPR) Select the primary lawful basis relied upon for this processing activity: Guidance Note: Only one primary lawful basis should be selected per purpose. If different purposes identified in Section 6 rely on different lawful bases, please complete separate entries or clearly distinguish within the response below which lawful basis applies to whi

Section 8: Data Recipients and Sharing 8.1 Internal Recipients 8.2 External Recipients — Processors If Yes, complete the following table for each processor: Guidance Note: A "processor" is any external organisation that processes personal data on behalf of NTP (as controller). Common examples include cloud hosting providers, payroll service providers, outsourced customer service centres, email marketing platforms, IT

Section 9: International Data Transfers 9.1 Transfer Outside the United Kingdom If Yes, complete the following table for each transfer: Guidance Note: A "restricted transfer" under the UK GDPR is a transfer of personal data from the United Kingdom to a country or territory outside the UK that is not subject to UK adequacy regulations (currently, the EU/EEA Member States are covered by the UK's adequacy regulations in

Section 10: Data Retention 10.1 Retention Period Guidance Note: Under Article 5(1)(e) of the GDPR (the "storage limitation" principle), personal data must be kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed. The retention period should be justified by reference to a specific legal, regulatory, or operational require

Section 11: Technical and Organisational Security Measures 11.1 Access Controls 11.2 Encryption If Yes or Partially: 11.3 Pseudonymisation / Anonymisation 11.4 System and Infrastructure 11.5 Data Backup and Recovery If Yes: 11.6 Other Security Measures Describe any additional technical or organisational security measures relevant to this processing activity: (Insert, e.g., "Annual penetration testing conducted by ind

Section 12: Automated Decision-Making and Profiling 12.1 Automated Decision-Making If Yes: Guidance Note: Article 22(1) of the GDPR provides that data subjects have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them. Where such automated decision-making takes place, it must fall withi

Section 13: Data Protection Impact Assessment (DPIA) Screening 13.1 DPIA Trigger Assessment Based on the information provided in this questionnaire, does this processing activity meet any of the following DPIA trigger criteria? Select all that apply: Guidance Note: Article 35(1) of the GDPR requires that a DPIA be carried out where a type of processing is likely to result in a high risk to the rights and freedoms of

Section 14: Data Subject Rights 14.1 Rights Facilitation How does the business unit facilitate the exercise of data subject rights in relation to this processing activity? Please describe the procedures, systems, and points of contact for handling each of the following rights: Guidance Note: NTP is required under Articles 15–22 of the GDPR to facilitate the exercise of data subject rights without undue delay and in a

Section 15: Privacy Notices 15.1 Transparency Information If Yes: If No: Guidance Note: Articles 13 and 14 of the GDPR require that data subjects are provided with specified information about the processing of their personal data. Where data is collected directly from the data subject, the privacy notice must be provided at the time of collection (Article 13). Where data is obtained from a source other than the data

Section 16: Additional Information and Attachments 16.1 Supporting Documentation List any supporting documentation attached to or available in connection with this questionnaire response: (e.g., data flow diagrams, system architecture diagrams, existing Data Processing Agreements, privacy notices, consent forms, Legitimate Interest Assessments, existing DPIA reports, data retention schedules, information security pol

Section 17: Sign-Off and Approval 17.1 Respondent Declaration I confirm that the information provided in this questionnaire is accurate and complete to the best of my knowledge. I understand that this information will be used to build and maintain the Records of Processing Activities and to support the GDPR/UK GDPR compliance program being undertaken by Northgate Telecommunications PLC and its group entities. I ackno

1. Are any of the systems used for this processing activity hosted outside the UK or EEA?

2. Do any of the processors or sub-processors identified in Section 8 have personnel, data centres, or support operations outside the UK or EEA?

3. Is data shared with any NTP group entity located outside the UK or EEA?

4. Can any person located outside the UK or EEA access the data (including via remote access, VPN, or web portal)?

5. Is data disclosed to any third-party controller or regulatory authority located outside the UK or EEA? If the answer to any of these questions is "Yes" or "Possibly," the respondent should complete Section 9 and identify the relevant transfers. Transfer Mechanisms Where an international transfer is identified, an appropriate transfer mechanism (also referred to as a "safeguard" or "transfer tool") must be in place