Contract analysis

1. ATTENDEES 1.1 Calderwood & Harkness LLP 1.2 Northgate Telecommunications PLC 1.3 Ashdown Consulting Group Ltd 1.4 Apologies The following individuals were unable to attend the meeting but have been notified of the agenda and will receive a copy of these minutes: • Rachel Bernstein — Billing Partner, Privacy & Data Security, Calderwood & Harkness LLP. Ms Bernstein was unable to attend due to a pre-existing travel c

2. AGENDA The following agenda was circulated in advance by Sara Hendricks on 16 February 2023 and was confirmed at the opening of the meeting. All items were addressed during the meeting as set out in the minutes of discussion in Section 3 below. 2.1 Welcome and Introductions Kevin Ostrowski to open the meeting; introductions around the table. Confirmation of the roles of each attendee in the engagement. 2.2 Engagem

3. MINUTES OF DISCUSSION The following minutes record the substantive discussions that took place during the meeting. They are prepared under the protection of legal professional privilege and are intended to be a comprehensive record of the matters discussed and decisions taken. These minutes should be read in conjunction with the action items set out in Section 5 and the document request list at Section 4. 3.1 Welc

1. While the formal Transfer Mechanisms work is scheduled for Phase 4 of the engagement, the Calderwood & Harkness team will begin preliminary analysis of the Caldwell transfer arrangement during Phase 1. This preliminary analysis will serve two purposes: (a) it will inform the gap analysis report by identifying the specific compliance gaps in the Caldwell transfer mechanism; and (b) it will enable early engagement w

2. Rachel Bernstein, who has specific expertise in cross-border data transfers and telecommunications regulation, will lead the DPC inquiry response workstream and the Caldwell SCC negotiation. She will be briefed on the outcomes of this meeting by 22 February 2023 and will begin substantive work immediately.

3. The target is for the updated EU SCCs and UK IDTA with Caldwell to be negotiated, executed, and implemented before the substantive response to the DPC inquiry is submitted, so that NTP can present the DPC with a fully remediated position.

4. The substantive DPC response is to be prepared and submitted before the close of the engagement (i.e., by Q3 2023 at the latest), and ideally significantly earlier. Fiona Gallagher confirmed that she is content with this approach. She asked that Calderwood & Harkness keep her informed of any developments in the DPC inquiry, including any further communications from the DPC, on an immediate basis. Sanjay Mehta conf

4. DOCUMENT REQUEST LIST The following documents and materials are requested by Calderwood & Harkness LLP from Northgate Telecommunications PLC. Target delivery dates are indicated for each item. Documents should be provided electronically via the secure file-sharing portal to be established by Sara Hendricks. Where documents exist in multiple versions, the most current version should be provided together with any ma

5. ACTION ITEMS The following action items were agreed during the meeting. All action items are to be completed by the deadlines indicated unless otherwise agreed in writing.

6. NEXT STEPS SUMMARY The following summary captures the key next steps agreed at the meeting:

1. Phase 1 work commences immediately. Calderwood & Harkness will begin the assessment and gap analysis workstream without delay, commencing with a review of the priority documents to be provided by NTP by 24 February 2023 and the remaining documents to be provided by 27 February – 6 March 2023.

2. Data mapping questionnaires to be distributed by 1 March 2023. Priscilla Wynn will finalise the standardised data mapping questionnaire and coordinate with Sanjay Mehta for distribution to all NTP business units across UK and EU operations by 1 March 2023. Business unit responses are expected within two weeks of distribution.

3. Ashdown to begin Bramwell Systems and technical scanning in parallel. Robert Fairclough and Anita Chakravarti will commence Sundial Solutions platform configuration immediately and begin technical data flow scanning across NTP systems. Initial data flow inventory outputs are targeted for mid-March 2023.

4. Priority document production from NTP. DPC inquiry correspondence and the Board Audit & Risk Committee resolution are requested by 24 February 2023. Remaining documents are requested in accordance with the deadlines specified in the Document Request List at Section 4.

5. On-site visits to EU offices to be scheduled for March 2023. Sara Hendricks, Sanjay Mehta, and Robert Fairclough will coordinate the scheduling of on-site data mapping sessions at NTP's offices in Dublin, Berlin, and Amsterdam, with all visits to be scheduled by 10 March 2023.

6. Rachel Bernstein briefing. Kevin Ostrowski and Sara Hendricks will brief Rachel Bernstein by 22 February 2023 on the DPC inquiry status, the preliminary transfer mechanism analysis, and the need for early engagement with Hargrove Lister & Webb LLP regarding the Caldwell SCC negotiation.

7. Gap analysis report target delivery: 31 March 2023. The comprehensive Phase 1 gap analysis report will be delivered to NTP by 31 March 2023, incorporating findings from the data mapping questionnaires, Ashdown's technical data flow inventories, the document review, and Calderwood & Harkness's legal analysis.

8. Phase 2 (ROPA & Data Mapping) to commence 3 April 2023, contingent on satisfactory completion of Phase 1 and agreement of Phase 2 work plan. Marcus Engström will be engaged for Phase 2 when EU subsidiary ROPA work commences.

9. Next meeting: first fortnightly status call, Tuesday, 7 March 2023, 14:00 GMT (virtual). Sara Hendricks will circulate dial-in details and a standing agenda in advance.

7. CLOSING Kevin Ostrowski thanked all attendees for a productive and comprehensive discussion. He noted that the meeting had achieved its objectives of confirming the engagement scope, establishing the governance framework, identifying the key workstreams and priorities, and agreeing a clear set of action items and deadlines. Fiona Gallagher reiterated the Board's commitment to the GDPR compliance programme and the