Contract analysis

1. Purpose and Executive Summary The purpose of this memorandum is to formally document the closure of engagement SC/NTP/2023-0213/PDS and to provide a comprehensive record of the work performed, deliverables produced, fees incurred, and outstanding items arising from the GDPR compliance program build undertaken by Calderwood & Harkness LLP ("C&H" or the "Firm") for Northgate Telecommunications PLC ("NTP" or the "Cli

2. Client and Engagement Overview 2.1 Client Details The Client's full details are set out below for the record of the engagement file. NTP operates a mixed business model combining traditional telecommunications infrastructure services with a growing enterprise SaaS division operating under the "NorthCloud" brand. The NorthCloud platform provides cloud-based communications, collaboration, and data analytics services

3. Fee Arrangement and Financial Reconciliation 3.1 Engagement Fee Structure The engagement was conducted on a blended hourly rate arrangement with phase-based fee caps, as agreed in the engagement letter dated 13 February 2023. The applicable hourly rates were as follows: The engagement letter established individual fee caps for each of the five phases, as well as an overall total engagement fee cap. The phase-based

4. Phase-by-Phase Deliverables Summary 4.1 Phase 1 — Assessment & Gap Analysis (13 February – 31 March 2023) Fee cap: £185,000 Key Milestones. Phase 1 commenced upon opening of the engagement on 13 February 2023 and concluded with the delivery of the Gap Analysis Report on 31 March 2023. The principal milestones during Phase 1 were as follows: • 20 February 2023: Phase 1 kickoff meeting held at Northgate Tower, 88 Ca

1. GDPR Gap Analysis Report. This report provided a comprehensive assessment of NTP's then-current compliance state measured against the requirements of the EU General Data Protection Regulation (Regulation (EU) 2016/679) ("EU GDPR") and the United Kingdom General Data Protection Regulation (as retained and amended under the European Union (Withdrawal) Act 2018 and the Data Protection Act 2018) ("UK GDPR"). The asses

2. Data Mapping Questionnaire Template. A standardised questionnaire template was designed for use across all NTP business units to capture the information necessary for a comprehensive Article 30 ROPA. The questionnaire addressed the following data fields: (i) description of the processing activity; (ii) purpose of processing; (iii) categories of data subjects; (iv) categories of personal data; (v) special categorie

3. Regulatory Risk Assessment Memorandum. This memorandum provided a detailed analysis of NTP's regulatory risk profile in light of the prior ICO enforcement action (Enforcement Notice ENF/2021/0934, imposing a monetary penalty of £320,000 for inadequate consent mechanisms for direct marketing cookies on the NorthCloud customer portal) and the ongoing DPC preliminary inquiry (IN-22-11-3) regarding cross-border data t

4. Memorandum on UK GDPR vs. EU GDPR Divergence. This advisory memorandum addressed the post-Brexit regulatory divergence between the UK GDPR and the EU GDPR insofar as it affected NTP's compliance obligations. The memorandum covered the following topics: (a) the UK International Data Transfer Agreement ("UK IDTA") introduced under Section 119A of the Data Protection Act 2018, as compared with the EU Standard Contrac

2. ROPA — Controller Activities (EU Subsidiaries). This Article 30 register documented 58 processing activities conducted by the five EU subsidiaries in their capacity as data controllers. The register was prepared in accordance with Article 30(1) of the EU GDPR and was structured on a per-entity basis, with the following distribution of processing activities: The variation in the number of processing activities per

3. ROPA Methodology & Guidance Note. This internal guidance document was prepared for NTP's use in maintaining and updating the ROPA on an ongoing basis following engagement closure. The guidance note covered: (a) the responsibilities of the DPO (Sanjay Mehta) in maintaining and overseeing the ROPA, including the requirement to ensure accuracy, completeness, and timely updates; (b) the role of business unit data stew

4. Legitimate Interest Assessment (LIA) Template. This template was developed for use by NTP in conducting and documenting legitimate interest assessments for the 64 processing activities across the group that rely on legitimate interest under Article 6(1)(f) of the GDPR as their lawful basis for processing. The template implements the three-part balancing test established in regulatory guidance from both the ICO and

2. DPIA Summary Register & Board Report. An executive summary document was prepared for presentation to the NTP Audit & Risk Committee. The report provided a consolidated overview of all 11 DPIAs, including: a brief description of each processing activity assessed; the risk rating assigned (standard or high risk); key findings and concerns; the mitigation measures recommended and their implementation status; and resi

1. EU Standard Contractual Clauses (Module 2: Controller to Processor) — NTP to Caldwell Analytics Inc. Executed 17 July 2023. This agreement implemented Module 2 of the European Commission's Standard Contractual Clauses (adopted under Implementing Decision (EU) 2021/914) for the transfer of personal data from NTP (as controller) to Caldwell (as processor) in the United States.

2. UK International Data Transfer Agreement — NTP to Caldwell Analytics Inc. Executed 17 July 2023. This agreement implemented the UK IDTA (as approved under Section 119A of the Data Protection Act 2018) for the transfer of UK personal data from NTP to Caldwell in the United States, operating in parallel with the EU SCCs for EEA-originating personal data.

3. TIA-001 (NTP → Caldwell Analytics Inc., US). The detailed Transfer Impact Assessment analysing FISA Section 702, Executive Order 12333, the CLOUD Act, and the EU-US Data Privacy Framework, as described above.

4. TIA-002 (Pinnacle Cloud Services → Pinnacle India Pvt Ltd, India). The detailed Transfer Impact Assessment analysing the Indian IT Act 2000 and Indian surveillance and lawful access laws, as described above.

5. TIA-003 (Pinnacle Cloud Services → Pinnacle APAC Pte Ltd, Singapore). The Transfer Impact Assessment for the Singapore transfer, as described above.

6. TIA-004 (NTP → Sunderland-Hayes Payroll Services Inc., US). The Transfer Impact Assessment for the expatriate payroll data transfer, as described above.

7. TIA-005 (NTP GmbH → Caldwell Analytics Inc., US). The Transfer Impact Assessment for the German subscriber analytics transfer, as described above.

8. TIA-006 (NTP → Moritaka Systems K.K., Japan). The Transfer Impact Assessment for the IoT platform analytics transfer, as described above.

9. Amended Data Processing Agreement — NTP / Pinnacle Cloud Services Ltd. Executed 28 June 2023. This amended DPA replaced the existing data processing agreement between NTP and Pinnacle Cloud Services Ltd and was comprehensively updated to incorporate: full Article 28 GDPR requirements (including processing instructions, confidentiality obligations, security measures, sub-processing restrictions, and cooperation wit

10. Redline of Pinnacle DPA Showing Negotiation Changes. A tracked-changes version of the Pinnacle DPA showing all amendments negotiated with Graham Alderton, Head of Legal at Pinnacle Cloud Services Ltd. This document was retained in the C&H matter file for reference purposes and to document the negotiation process and rationale for specific provisions.

11. UK Addendum to EU SCCs — Template. A template UK Addendum to the EU Standard Contractual Clauses was prepared for use across the four identified transfers where both UK and EU regulatory regimes applied. The template allows NTP to incorporate the UK Addendum into any future EU SCC arrangement where UK personal data is also in scope.

12. International Transfers Policy & Mechanism Selection Guidance. An internal NTP policy document providing a comprehensive framework for assessing, selecting, and implementing appropriate transfer mechanisms for international data transfers. The policy includes: a decision tree for selecting the appropriate transfer mechanism based on the recipient country, the nature of the transfer (controller-to-controller, cont

2. Data Subject Rights Procedure. This procedure establishes the process for handling requests from data subjects exercising their rights under the GDPR, including the right of access (Article 15), the right to rectification (Article 16), the right to erasure (Article 17), the right to restriction of processing (Article 18), the right to data portability (Article 20), and the right to object (Article 21). The procedu

3. Data Breach Notification Procedure. This procedure establishes the internal escalation chain and process for identifying, assessing, containing, and reporting personal data breaches in accordance with Articles 33 and 34 of the GDPR. The procedure defines the escalation chain as follows: initial identification by any NTP employee or contractor → immediate escalation to Thomas Okoye (CISO) for containment and initia

4. Data Retention Schedule. This comprehensive schedule sets out the retention periods applicable to each category of personal data processed by NTP, together with the lawful basis for retention, the applicable regulatory or legal basis for the specified retention period, and the deletion or anonymisation method to be applied at the expiry of the retention period. The retention periods have been determined by referen

5. Privacy Notice — Consumer Subscribers (NorthCloud Platform). A revised customer-facing privacy notice was prepared for use on the NorthCloud platform. The notice was drafted to comply with the transparency requirements of Articles 13 and 14 of the GDPR and provides clear, accessible information to consumer subscribers regarding: the identity and contact details of the controller; the contact details of the DPO; th