Contract analysis

1. Introduction and Purpose of This Response Northgate Ireland Ltd ("Northgate Ireland" or the "Company") acknowledges receipt of the Data Protection Commission's (the "DPC" or the "Commission") preliminary inquiry opened in November 2022 under reference IN-22-11-3 (the "Inquiry"). The Inquiry concerns cross-border personal data transfers from Northgate Ireland Ltd to processors established in the United States of Am

2. Background — Northgate Group and Northgate Ireland Ltd 2.1 Corporate Structure and Operations Northgate Telecommunications PLC is a UK-headquartered public limited company incorporated under the laws of England and Wales (Company Number: 04837291), with its registered office and principal place of business at 140 Queensway Place, Reading, Berkshire RG1 4QT, United Kingdom. NTP is a provider of telecommunications i

3. Scope of the DPC Inquiry — Cross-Border Data Transfers from Northgate Ireland Ltd 3.1 Nature of the Inquiry The DPC's preliminary inquiry, opened in November 2022 under reference IN-22-11-3, focuses on cross-border personal data transfers from Northgate Ireland Ltd to US-based data processors. The Inquiry was initiated in the period following the CJEU's landmark judgment in Schrems II, which invalidated the EU-US

4. Comprehensive GDPR Compliance Program Undertaken 4.1 Overview of the Program As noted in Section 1 above, Calderwood & Harkness LLP was retained by Northgate Telecommunications PLC on 13 February 2023 under engagement reference SC/NTP/2023-0213/PDS. The engagement was scoped to deliver a comprehensive GDPR compliance programme covering the entirety of NTP's UK and EU operations, with a particular emphasis on the r

5. Transfer Mechanisms Now in Place 5.1 EU Standard Contractual Clauses — NTP to Caldwell Analytics Inc. EU Standard Contractual Clauses adopted pursuant to Commission Implementing Decision (EU) 2021/914 of 4 June 2021 (the "EU SCCs"), Module 2 (Controller to Processor), were executed between Northgate Telecommunications PLC (as data exporter and controller) and Caldwell Analytics Inc. (as data importer and processor

6. Transfer Impact Assessments 6.1 Overview of TIA Methodology NTP, with the assistance of C&H, completed six Transfer Impact Assessments ("TIAs") between 10 July 2023 and 4 August 2023. The TIAs were conducted in respect of all international data transfers identified in Section 3.2 and summarised in Section 5.6 above. The methodology applied for the TIAs is based on the European Data Protection Board's Recommendatio

7. Supplementary Measures Implemented 7.1 Technical Measures In accordance with the EDPB Recommendations 01/2020 and the conclusions of the six TIAs described in Section 6 above, NTP has implemented the following technical supplementary measures across all international data transfers within scope: Encryption at Rest: All personal data stored by US-based processors (Caldwell Analytics Inc. and Sunderland-Hayes Payrol

8. Data Protection Impact Assessments Relevant to Cross-Border Transfers 8.1 DPIA-011: Caldwell Analytics Network Performance Data Transfer DPIA-011 addresses the processing of NorthCloud subscriber analytics data by Caldwell Analytics Inc. in connection with AI-driven network analytics and predictive maintenance services. A copy of DPIA-011 is attached at Annexure J. DPIA-011 was classified as high-risk on the basis