Contract analysis

1. INTRODUCTION AND PURPOSE 1.1 Purpose This Data Subject Rights Procedure (this "Procedure") establishes the comprehensive framework by which Northgate Telecommunications PLC ("NTP" or the "Company") and its subsidiaries (collectively, the "NTP Group") shall receive, assess, process, and respond to data subject rights requests made pursuant to the United Kingdom General Data Protection Regulation (the "UK GDPR"), as

1. To ensure the consistent, timely, and lawful handling of all data subject rights requests across NTP's operations in the United Kingdom and the European Union/European Economic Area, regardless of the channel through which such requests are received or the NTP entity to which they are directed.

2. To establish clear roles, responsibilities, escalation pathways, and internal service-level targets that enable NTP to comply with the statutory response deadlines prescribed by Article 12 of the UK GDPR and EU GDPR.

3. To provide detailed, step-by-step procedural guidance for each category of data subject right recognised under Chapter III of the UK GDPR and EU GDPR, including the right of access, rectification, erasure, restriction of processing, data portability, objection, and rights relating to automated decision-making and profiling.

4. To support NTP's accountability obligations under Articles 5(2) and 24 of the UK GDPR and EU GDPR by demonstrating that the NTP Group has implemented appropriate technical and organisational measures to ensure and be able to demonstrate compliance with data protection legislation.

5. To document the processes for the application of exemptions and restrictions, ensuring that any reliance on exemptions is assessed on a case-by-case basis, documented with full reasoning, and applied narrowly and proportionately. This Procedure has been developed as part of the comprehensive GDPR compliance programme build undertaken by Calderwood & Harkness LLP for NTP under engagement reference SC/NTP/2023-0213/

2. DEFINITIONS For the purposes of this Procedure, the following terms shall have the meanings set out below. Terms defined in the UK GDPR or EU GDPR and not otherwise defined in this Section shall have the meanings given to them in the UK GDPR or EU GDPR (as applicable). "Controller" means Northgate Telecommunications PLC or the relevant NTP Group subsidiary acting as controller for the processing activity or activi

3. DATA SUBJECT RIGHTS — OVERVIEW This Section provides an overview of each data subject right recognised under Chapter III of the UK GDPR and EU GDPR, together with NTP-specific considerations. Detailed procedural steps for the exercise of each right are set out in Section 10. 3.1 Right of Access (Article 15) Data Subjects have the right to obtain from NTP confirmation as to whether or not personal data concerning t

4. ROLES AND RESPONSIBILITIES 4.1 Data Protection Officer — Sanjay Mehta The DPO has overall accountability for the oversight of the data subject rights process across the NTP Group. The DPO's specific responsibilities under this Procedure include: (a) acting as the final decision-maker on complex requests, the application of exemptions, and the refusal of Rights Requests (in whole or in part); (b) serving as the esc

5. REQUEST RECEIPT AND LOGGING 5.1 Channels for Receiving Requests NTP accepts Rights Requests through the following channels: Email. Data Subjects may submit Rights Requests by email to the DPO office at dpo@northgate-telecom.co.uk. This email address is monitored continuously by the DPO office during business hours and is checked at least twice daily outside of business hours, including weekends and public holidays

6. IDENTITY VERIFICATION 6.1 Purpose Before acting on any Rights Request, NTP must take reasonable steps to verify the identity of the individual making the request, to ensure that personal data is not disclosed to, or actions are not taken at the instruction of, any individual who is not the Data Subject or their duly authorised representative. The purpose of identity verification is to prevent the unauthorised disc

7. TRIAGE AND ASSESSMENT 7.1 Initial Triage Within two (2) business days of logging a Rights Request in Sundial Solutions, the assigned Request Handler shall perform an initial triage of the request. The triage process involves the following assessments: (a) Right identification: Confirm which specific right or rights under Chapter III of the UK GDPR / EU GDPR the Data Subject is seeking to exercise. Where the reques

8. RESPONSE TIMELINES (SLAs) 8.1 Standard Response Deadline NTP must respond to all Rights Requests within one calendar month from the receipt date (as defined in Section 5.4). The calendar month is calculated in accordance with Article 12(3) of the UK GDPR and EU GDPR — for example, a request received on 15 January requires a response by 15 February; a request received on 31 January requires a response by 28 Februar

9. EXEMPTIONS AND RESTRICTIONS 9.1 General Approach NTP recognises that the data subject rights set out in Chapter III of the UK GDPR and EU GDPR are not absolute and that certain exemptions and restrictions may apply. However, exemptions must be applied on a case-by-case basis and must be interpreted narrowly. The DPO is responsible for all exemption assessments, and the assessment and reasoning must be fully docume