Contract analysis

1. Purpose and Context We write to formally confirm the completion and close of Calderwood & Harkness LLP's ("C&H" or the "Firm") engagement with Northgate Telecommunications PLC ("NTP") under engagement reference SC/NTP/2023-0213/PDS (the "Engagement"). The Engagement was opened on 13 February 2023 pursuant to the engagement letter of the same date (the "Engagement Letter"), under which C&H was instructed to design

2. Scope of Engagement and Phasing Summary The Engagement was structured across five sequential phases, each with defined objectives, timelines, and deliverables. We provide below a summary of the work completed in each phase. Phase 1 — Assessment & Gap Analysis Phase 1 commenced with a formal kickoff meeting held at Northgate Tower on 20 February 2023, attended by the C&H engagement team, NTP's Data Protection Offic

3. Engagement Team We take this opportunity to formally acknowledge the members of the C&H engagement team and NTP's internal team who contributed to the successful delivery of the Program. Calderwood & Harkness LLP Engagement Team: NTP Internal Team: We also wish to acknowledge the invaluable contributions of Ashdown Consulting Group Ltd, and in particular Robert Fairclough (Managing Director) and Anita Chakravarti

4. Complete Schedule of Deliverables Handed Over Set out below is a complete schedule of all deliverables prepared and delivered by C&H under the Engagement. All deliverables have been transmitted to NTP under separate cover, and this schedule is provided for the purposes of formal record-keeping and accountability. NTP should confirm that all deliverables listed below have been received and are securely stored withi

1. Gap Analysis Report — Comprehensive report setting out the findings of C&H's assessment of NTP's current state of GDPR and UK GDPR compliance across the NTP Group, including prioritised recommendations for remediation. Delivered 31 March 2023.

2. Data Mapping Questionnaire Template — Standardised questionnaire template distributed to all NTP business units and EU subsidiaries for the purposes of data mapping and processing activity identification. Distributed 1 March 2023.

3. Regulatory Risk Assessment Memorandum — Detailed analysis of the regulatory risk profile arising from the ICO Enforcement Notice (ENF/2021/0934) and the DPC preliminary inquiry (IN-22-11-3), including an assessment of the likelihood of further enforcement action and recommendations for mitigation.

4. Memorandum on UK GDPR vs. EU GDPR Divergence — Post-Brexit regulatory analysis addressing the areas of divergence between the UK GDPR and the EU GDPR, with particular focus on the implications for NTP's dual-regime compliance obligations, including international data transfers, DPIA requirements, and the ICO's regulatory approach compared to that of EU supervisory authorities. 4.2 Phase 2 Deliverables — Records of

5. ROPA — Controller Activities (NTP PLC, UK Operations) — Records of Processing Activities for NTP PLC's UK operations, cataloguing 89 processing activities. ROPA v1.0, delivered 19 May 2023.

6. ROPA — Controller Activities (EU Subsidiaries) — Records of Processing Activities for NTP's five EU subsidiaries, cataloguing 58 processing activities across Northgate Ireland Ltd (18 activities), Northgate GmbH (16 activities), Northgate B.V. (11 activities), Northgate France SAS (8 activities), and Northgate Iberia S.L. (5 activities). ROPA v1.0, delivered 19 May 2023.

7. ROPA Methodology & Guidance Note — Guidance document setting out the methodology for the creation, maintenance, and periodic review of the ROPA, including procedures for trigger-based updates and the responsibilities of business unit data stewards.

8. Legitimate Interest Assessment (LIA) Template — Template for the conduct of legitimate interest balancing assessments, designed for application to the 64 processing activities within the ROPA that rely upon Article 6(1)(f) (legitimate interests) as the lawful basis for processing. Includes worked examples and guidance notes. 4.3 Phase 3 Deliverables — Data Protection Impact Assessments

9. DPIA-001: NorthCloud AI-Driven Customer Churn Prediction Model — Full DPIA for NTP's AI-driven customer churn prediction model deployed within the NorthCloud platform, including an assessment of automated decision-making implications under Article 22. Classified as high-risk; mitigation plan included.

10. DPIA-002: Network Traffic Analysis and Anomaly Detection — Full DPIA for NTP's network traffic analysis and anomaly detection processing, including an assessment of the proportionality of deep packet inspection techniques and the applicable lawful bases.

11. DPIA-003: Employee Wellbeing Monitoring Platform — NorthPulse — Full DPIA for NTP's employee wellbeing monitoring platform (NorthPulse), including an assessment of special category data processing (health data) and the adequacy of the Article 9(2)(b) employment law basis under UK and EU member state implementing legislation. Classified as high-risk; mitigation plan included.

12. DPIA-004: IoT Device Telemetry Processing (Smart City Pilot, Birmingham) — Full DPIA for NTP's smart city IoT pilot in Birmingham, including an assessment of anonymisation and pseudonymisation measures for device telemetry data that may be linked to identifiable individuals.

13. DPIA-005: Biometric Access Control System (Data Centres) — Full DPIA for NTP's biometric access control system deployed across its UK and EU data centre facilities, including an assessment of the processing of biometric data (fingerprint and iris scan) under Article 9.

14. DPIA-006: Customer Credit Scoring and Fraud Detection — Full DPIA for NTP's customer credit scoring and fraud detection processing, including an assessment of profiling and automated decision-making under Articles 21 and 22.

15. DPIA-007: Marketing Profiling and Targeted Advertising — NorthCloud Freemium Tier — Full DPIA for NTP's marketing profiling and targeted advertising activities directed at users of the NorthCloud freemium service tier, including an assessment of consent mechanisms, the ePrivacy Directive requirements (as transposed into UK and EU member state law), and the adequacy of opt-out mechanisms. Classified as high-risk;

16. DPIA-008: CCTV and Facial Recognition Pilot — London HQ — Full DPIA for NTP's CCTV and facial recognition pilot at the London headquarters. Classified as high-risk. C&H recommended discontinuation of the pilot on the basis that the identified risks to data subjects' fundamental rights and freedoms could not be sufficiently mitigated through technical or organisational measures. The NTP Board accepted this recomme

17. DPIA-009: Cross-Border HR Analytics and Workforce Planning — Full DPIA for NTP's cross-border HR analytics and workforce planning processing, involving the centralised analysis of employee data from UK and EU subsidiaries for strategic workforce management purposes.

18. DPIA-010: Lawful Intercept and Communications Data Retention (RIPA/IPA Compliance) — Full DPIA for NTP's lawful intercept capabilities and communications data retention obligations under the Regulation of Investigatory Powers Act 2000 ("RIPA") and the Investigatory Powers Act 2016 ("IPA"), including an assessment of the interaction between these statutory obligations and GDPR requirements.

19. DPIA-011: Caldwell Analytics Network Performance Data Transfer to US — Full DPIA for the transfer of network performance data from NTP to Caldwell Analytics Inc. in the United States for analytics and performance optimisation purposes, including an assessment of US surveillance law risks in light of Schrems II and the supplementary measures adopted. Classified as high-risk; mitigation plan included, informed by t

20. DPIA Summary Register & Board Report — Summary register of all 11 DPIAs, including risk classifications, key findings, and the status of mitigation measures, presented in a format suitable for Board and Audit & Risk Committee reporting. 4.4 Phase 4 Deliverables — International Data Transfer Mechanisms

21. EU Standard Contractual Clauses (Module 2: Controller to Processor) — NTP to Caldwell Analytics Inc. — Executed EU SCCs (Commission Implementing Decision (EU) 2021/914, Module 2) for the transfer of personal data from NTP (controller, EU) to Caldwell Analytics Inc. (processor, US). Executed 17 July 2023.

22. UK International Data Transfer Agreement (IDTA) — NTP to Caldwell Analytics Inc. — Executed UK IDTA for the transfer of personal data from NTP (exporter, UK) to Caldwell Analytics Inc. (importer, US), adopted pursuant to section 119A of the Data Protection Act 2018. Executed 17 July 2023.

23. UK Addendum to EU SCCs — Template — Template UK Addendum to EU SCCs, for use in connection with 4 transfers that are subject to dual UK and EU regulatory regimes. The template is designed for completion on a transfer-by-transfer basis and includes guidance notes on the completion of each table.

24. Amended Data Processing Agreement — NTP / Pinnacle Cloud Services Ltd — Amended and restated DPA between NTP and Pinnacle Cloud Services Ltd, addressing, among other matters, updated provisions on sub-processor management (including a 14-day prior notification period for new sub-processor appointments), data breach notification obligations (without undue delay, and in any event within 36 hours of becoming aware),

25. Transfer Impact Assessment — TIA-001: NTP → Caldwell Analytics Inc. (US) — Network Analytics Data — TIA assessing the laws and practices of the United States as they relate to the transfer of network analytics data to Caldwell, including analysis of FISA Section 702, Executive Order 12333, and the US Data Privacy Framework, together with an assessment of supplementary technical, contractual, and organisational me

26. Transfer Impact Assessment — TIA-002: Pinnacle Cloud Services → Pinnacle India Pvt Ltd (India) — Infrastructure Support Data — TIA assessing the laws and practices of India as they relate to the onward transfer of infrastructure support data from Pinnacle Cloud Services Ltd to its Indian affiliate, Pinnacle India Pvt Ltd, for the provision of technical support services.

27. Transfer Impact Assessment — TIA-003: Pinnacle Cloud Services → Pinnacle APAC Pte Ltd (Singapore) — Infrastructure Monitoring — TIA assessing the laws and practices of Singapore as they relate to the onward transfer of infrastructure monitoring data from Pinnacle to its Singapore affiliate, Pinnacle APAC Pte Ltd.

28. Transfer Impact Assessment — TIA-004: NTP → Sunderland-Hayes Payroll Services Inc. (US) — Expatriate Payroll — TIA assessing the laws and practices of the United States as they relate to the transfer of payroll data for approximately 45 expatriate employees to Sunderland-Hayes Payroll Services Inc. for payroll processing purposes.

29. Transfer Impact Assessment — TIA-005: NTP GmbH → Caldwell Analytics Inc. (US) — German Subscriber Analytics — TIA assessing the laws and practices of the United States as they relate to the transfer of German subscriber analytics data from Northgate GmbH to Caldwell, including analysis specific to the requirements of the Bundesdatenschutzgesetz ("BDSG") and relevant guidance from the Bundesbeauftragte für den Dat

30. Transfer Impact Assessment — TIA-006: NTP → Moritaka Systems K.K. (Japan) — IoT Platform Analytics — TIA assessing the transfer of IoT platform analytics data (relating to approximately 12,000 device endpoints) from NTP to Moritaka Systems K.K. in Japan, relying on the European Commission's adequacy decision for Japan (Commission Implementing Decision (EU) 2019/419), supplemented by additional contractual and org

31. International Transfers Policy & Mechanism Selection Guidance — Group-level policy governing international transfers of personal data, including a mechanism selection decision tree and guidance on the conduct and periodic reassessment of TIAs. 4.5 Phase 5 Deliverables — Policies, Training & Governance

32. Group Data Protection Policy — Northgate Telecommunications PLC — Comprehensive group-level data protection policy establishing the principles, roles, responsibilities, and procedures for GDPR and UK GDPR compliance across the NTP Group. Includes provisions on DPIA thresholds, data subject rights, breach notification, international transfers, data retention, and accountability.

33. Data Subject Rights Procedure — Detailed operational procedure for the receipt, verification, processing, and response to data subject access requests ("DSARs") and other data subject rights requests (rectification, erasure, restriction, portability, and objection), including multi-entity coordination mechanisms and escalation procedures.

34. Data Breach Notification Procedure — Operational procedure for the identification, assessment, containment, and notification of personal data breaches, incorporating the 72-hour notification timeline to supervisory authorities under Article 33 and the communication to data subjects under Article 34, with internal escalation chains and template notification forms.

35. Data Retention Schedule — Comprehensive retention schedule setting out the retention periods for all categories of personal data processed by the NTP Group, with reference to the applicable lawful basis, regulatory requirements, and business justification for each retention period, together with procedures for secure deletion and anonymisation upon expiry.

36. Privacy Notice — Consumer Subscribers (NorthCloud Platform) — Updated privacy notice for NorthCloud platform consumer subscribers, drafted in compliance with Articles 13 and 14 of the EU GDPR and UK GDPR, including transparent disclosures regarding processing purposes, lawful bases, international transfers, data subject rights, and automated decision-making.

37. Board GDPR Training Materials — Presentation materials and supporting documentation delivered to the NTP Board on 22 August 2023, covering Board-level responsibilities under the GDPR and UK GDPR, the key features of the Program, the regulatory landscape, and the ongoing compliance obligations of the NTP Group. 4.6 DPC Inquiry Response Deliverables

38. DPC Inquiry Response (IN-22-11-3) — Draft Submission — Comprehensive response to the DPC's preliminary inquiry, addressing the DPC's questions regarding NTP's cross-border data transfers from Northgate Ireland Ltd to US-based processors, the transfer mechanisms and supplementary measures in place, and the TIAs conducted. Submitted to the DPC on 4 September 2023.

39. DPC Inquiry Response Cover Letter — NTP to Data Protection Commission — Formal cover letter transmitting the inquiry response to the DPC, signed by Sanjay Mehta in his capacity as NTP's Data Protection Officer. Dated 4 September 2023.

5. Financial Summary We set out below a summary of the financial position of the Engagement as at close. The Engagement was delivered £32,550 under the aggregate fee cap of £850,000. The fee cap represents the sum of the five individual phase caps as set out above and in Schedule 2 to the Engagement Letter. Disbursements and travel expenses have been billed separately in accordance with paragraph 7.3 of the Engagemen

6. Outstanding Items and Open Matters While the Engagement has been completed and all deliverables have been handed over, we wish to draw your attention to the following outstanding items and open matters that will require NTP's ongoing attention following the close of this Engagement. 6.1 DPC Inquiry (IN-22-11-3) The DPC's preliminary inquiry (reference IN-22-11-3) remains open as at the date of this letter. The com

7. Ongoing Compliance Obligations and Recommendations The Program delivered under this Engagement establishes the foundations of NTP's GDPR and UK GDPR compliance framework. However, data protection compliance is an ongoing obligation, not a one-time exercise. Set out below are C&H's recommendations for NTP's ongoing compliance activities following the close of this Engagement. 7.1 ROPA Maintenance The ROPA delivered

8. Recommendation for Annual External Review C&H strongly recommends that NTP engage external counsel to conduct an annual compliance health check of the GDPR and UK GDPR compliance program established under this Engagement. We recommend that the first such annual review be commissioned no later than Q1 2024, to allow for a thorough assessment approximately six to nine months after the Program's completion. The annua

9. Confidentiality and Privilege All deliverables, advice, memoranda, and other work product provided by C&H under this Engagement are subject to legal professional privilege (including, where applicable, legal advice privilege and litigation privilege under English law and the equivalent protections under applicable EU member state laws) and the confidentiality obligations set out in Section 12 of the Engagement Let

10. Formal Close of Engagement This letter confirms the formal close of engagement SC/NTP/2023-0213/PDS as of 8 September 2023. The engagement status is recorded as closed — completed in C&H's matter management system. C&H's file in respect of this Engagement will be retained in accordance with the Firm's document retention policy, a copy of which was provided to NTP with the Engagement Letter. Under the Firm's curre

11. Acknowledgements We wish to express our sincere thanks to you, Fiona, and to the broader NTP team for the highly collaborative and constructive engagement throughout the duration of the Program. In particular, we acknowledge the exceptional commitment and cooperation of Sanjay Mehta (DPO), Thomas Okoye (CISO), Laura Dearden (VP, Product & Engineering, NorthCloud), Philippa Crane (Head of People & HR), and Marcus