Contract analysis

From: Natalie Prescott <n.prescott@hlw-law.com> To: Sara Hendricks <s.hendricks@calderwoodharkness.com> Cc: Jennifer Huang <j.huang@caldwellanalytics.com> Date: Mon, 10 Jul 2023 17:42:31 +0100 Subject: Re: NTP / Caldwell Analytics — Draft EU SCCs (Module 2) and UK IDTA — Caldwell Comments

Attachments: - EU-SCCs-Module2-NTP-Caldwell-MARKED-UP-HLW-10Jul2023.docx - UK-IDTA-NTP-Caldwell-MARKED-UP-HLW-10Jul2023.docx - Annex-I-II-III-MARKED-UP-HLW-10Jul2023.docx

Thank you for circulating the initial drafts of the EU Standard Contractual Clauses (Module 2 — Controller to Processor) and the UK International Data Transfer Agreement in your email of 27 June. Caldwell Analytics Inc. and its internal privacy team — Jennifer Huang (VP, Legal & Privacy) and Derek Rawlings (CTO) — have now had the opportunity to review both instruments, together with the accompanying Annexes, in deta

Caldwell's comments are set out in the three marked-up documents attached to this email (the EU SCCs, the UK IDTA, and the combined Annexes I, II, and III). Before the teams work through the mark-ups line by line, I wanted to flag the four principal areas where Caldwell has proposed revisions, which I summarise below for ease of discussion.

While Caldwell is broadly aligned with the structure and approach taken in the drafts, the following points require further discussion:

**(a) Scope of Audit Rights (Clause 8.9 of the EU SCCs / Corresponding UK IDTA Provisions)**

The draft as circulated grants Northgate, as data exporter and controller, unlimited on-site audit rights subject only to five business days' prior notice. Caldwell respectfully requests that audit rights be exercised no more than once per calendar year under ordinary circumstances, with an express exception permitting additional audits where triggered by a specific, documented personal data breach or a formal inquir

By way of rationale, Caldwell's data infrastructure at its principal office in San Jose (2700 Technology Drive, Suite 400, San Jose, CA 95134) serves multiple telecommunications clients. Unlimited on-site audit access creates meaningful operational disruption and raises legitimate confidentiality concerns with respect to other clients' segregated environments and data.

As an alternative to on-site audit in any given year, Caldwell proposes that Northgate may rely on an independent third-party audit report — specifically, a SOC 2 Type II report or equivalent — which Caldwell will procure and provide annually at its own expense. On-site audit would remain available where the third-party report is reasonably determined by Northgate to be insufficient to assess compliance, or where a s

**(b) Sub-Processor Replacement Notification Period (Clause 9 of the EU SCCs / Annex III)**

The draft requires Caldwell to provide Northgate with 30 calendar days' prior written notice before appointing or replacing any sub-processor listed in Annex III. Caldwell requests that this period be reduced to 14 calendar days, which we view as both reasonable and operationally workable.

In Caldwell's experience, the 30-day notification period can create genuine difficulties in circumstances where urgent infrastructure changes or vendor replacements are necessary — whether for service continuity, security remediation, or both. A 14-day notice period provides Northgate with sufficient time to review the proposed change and exercise its right to object, while affording Caldwell the operational flexibil

The draft SCCs and UK IDTA as circulated contain uncapped liability for data protection breaches attributable to the data importer (Caldwell). Caldwell proposes that liability under both the SCCs and the UK IDTA be subject to the overall liability cap set out in the existing Master Services Agreement between NTP and Caldwell dated 1 June 2021, with the exception that liability arising from wilful misconduct or gross

Caldwell's view is that the liability framework under the transfer mechanisms should be read consistently with the commercial agreement governing the underlying services relationship. Uncapped liability is, in Caldwell's submission, disproportionate in the present context, given that the personal data processed by Caldwell is pseudonymised and that Caldwell already has robust supplementary technical measures in place

We acknowledge, of course, that the mandatory text of the EU SCCs (as adopted by the European Commission) cannot be modified, and Caldwell's comment on this point relates specifically to the supplementary commercial terms that sit alongside the SCCs and to the UK IDTA, which permits certain adaptations to be agreed between the parties.

**(d) Mutual Confidentiality Obligations**

The draft currently contains one-directional confidentiality obligations, under which Caldwell is bound to maintain the confidentiality of Northgate's personal data and processing instructions. Caldwell requests the inclusion of mutual confidentiality provisions that also cover Caldwell's proprietary technical and organisational measures, security architecture details, and any audit findings or reports.

The rationale here is straightforward: the description of Caldwell's technical and organisational measures set out in Annex II — including details of our encryption standards, pseudonymisation protocols, access control procedures, and incident response framework — constitutes commercially sensitive and security-critical information. Caldwell requests that Northgate be bound to keep such information confidential and t

You will find a number of further, more minor mark-ups in the attached documents, which I briefly note here:

- **Annex I (List of Parties):** We have made minor corrections to Caldwell's entity details. For the record, the full legal name is Caldwell Analytics Inc., a Delaware C-corporation, with its principal office at 2700 Technology Drive, Suite 400, San Jose, CA 95134, USA. We request that the registered agent address (1209 Orange Street, Wilmington, New Castle County, Delaware 19801) not be used as the contact address

- **Annex I (Description of Transfer):** We have suggested refining the description of the data transferred to align precisely with the scope defined under the Master Services Agreement. Specifically, the transfer comprises pseudonymised network performance data, including subscriber metadata, location data, and device identifiers, processed by Caldwell for purposes of AI-driven network analytics and predictive maint

- **Annex I (Competent Supervisory Authority):** The draft identifies the Data Protection Commission (Ireland) as the competent supervisory authority for EU transfers — on the basis, we understand, of NTP's EU establishment in Dublin through Northgate Ireland Ltd — and the Information Commissioner's Office (ICO) for UK transfers. Caldwell has no objection to either designation but would appreciate confirmation that t

- **Annex II (Technical and Organisational Measures):** Derek Rawlings (CTO) has reviewed the Annex II description in detail and has proposed minor updates to the specifications relating to encryption standards and access control procedures to ensure they accurately reflect Caldwell's current technical environment. These are marked in the attached.

- **Annex III (List of Sub-Processors):** Caldwell confirms that the sub-processor list as set out in the draft is accurate as of today's date. No additions are proposed at this time.

We would suggest scheduling a call between the teams during the week of 17 July to work through the mark-ups and any remaining open points, with a view to reaching agreement and executing the SCCs and UK IDTA as promptly as possible thereafter. We are aware that Northgate is keen to have the transfer mechanisms finalised as part of its broader GDPR compliance programme, and Caldwell shares that objective entirely.

I am happy to coordinate availability with you and Kevin. Jennifer Huang (copied) is available from Caldwell's side to join the call and address any commercial or operational questions directly.

Thank you, Sara. We look forward to progressing this to completion.

**Natalie Prescott** Partner, Data Privacy & Cybersecurity Hargrove Lister & Webb LLP

555 Mission Street, Suite 3100 San Francisco, CA 94105, USA

London Office: 30 Fenchurch Street London EC3M 3BD, UK

T: +1 (415) 702-8340 E: n.prescott@hlw-law.com

CONFIDENTIALITY NOTICE: This email and any attachments are privileged, confidential, and intended solely for the use of the named recipient(s). If you have received this communication in error, please notify the sender immediately and delete all copies. Any unauthorised review, use, disclosure, or distribution is strictly prohibited. Attorney-client privilege and work product protections are not waived by any inadver