Contract analysis

Clause 1 — Purpose and Scope (a) These Standard Contractual Clauses (the “Clauses”) are entered into by and between Northgate Telecommunications PLC, as data exporter, and Caldwell Analytics Inc., as data importer, for the purpose of ensuring compliance with Regulation (EU) 2016/679 of the European Parliament and of the Council (“Regulation (EU) 2016/679” or the “GDPR”) in connection with the transfer of personal dat

Clause 2 — Effect and Invariability of the Clauses (a) These Clauses constitute appropriate safeguards within the meaning of Article 46(1) and Article 46(2)(c) of Regulation (EU) 2016/679 for the transfer of personal data from the data exporter to the data importer. (b) The parties shall not modify the text of these Clauses, except as expressly permitted under Commission Implementing Decision (EU) 2021/914, including

Clause 3 — Third-Party Beneficiaries (a) Data subjects may invoke and enforce these Clauses, as third-party beneficiaries, against the data exporter, in particular the following provisions to the extent applicable: Clause 8.1 (Module 2), Clause 8.2(a) through (f), Clause 8.3, Clause 8.9, Clause 9, Clause 10, Clause 11, Clause 12, Clause 13, Clause 15(1)(a) through (e), Clause 16(e), and Clause 18. (b) Data subjects m

Clause 4 — Interpretation (a) Where these Clauses use terms that are defined in Regulation (EU) 2016/679, those terms shall have the same meaning as in that Regulation. (b) These Clauses shall be read and interpreted in light of the provisions of Regulation (EU) 2016/679. (c) These Clauses shall not be interpreted in a manner that conflicts with rights and obligations provided for in Regulation (EU) 2016/679.

Clause 5 — Hierarchy In the event of any contradiction between these Clauses and the provisions of related agreements between the parties, whether entered into at the same time as, before, or after these Clauses, these Clauses shall prevail to the extent of the inconsistency. This includes, without limitation, the Master Services Agreement entered into between Northgate Telecommunications PLC and Caldwell Analytics I

Clause 6 — Description of the Transfer(s) The details of the transfer or transfers of personal data, including the categories of personal data transferred, the categories of data subjects concerned, the frequency of the transfer, the nature of the processing, the purposes of the transfer and further processing, and the applicable retention periods, are set out in Annex I.B to these Clauses. Annex I.B forms an integra

Clause 7 — Docking Clause (a) The parties agree that the docking clause shall apply to these Clauses. (b) An entity that is not a party to these Clauses may, with the agreement of all existing parties, accede to these Clauses at any time, either as a data exporter or as a data importer, by completing the appropriate Annexes and signing Annex I.A. (c) Upon completion of Annex I.A and execution by the acceding entity,

Clause 8 — Data Protection Safeguards

Clause 8.1 — Instructions (a) The data importer shall process the personal data only on documented instructions from the data exporter. This includes processing for the purposes described in Annex I.B and such other documented instructions as the data exporter may issue from time to time in connection with the services covered by the Master Services Agreement dated 1 June 2021. (b) The data exporter hereby instructs

Clause 8.2 — Purpose Limitation The data importer shall process the personal data only for the specific purposes of the transfer set out in Annex I.B. The data importer shall not process the personal data for any other purpose unless: (a) it has obtained further documented instructions from the data exporter; (b) the processing is necessary for the establishment, exercise, or defence of legal claims; or (c) the proce

Clause 8.3 — Transparency (a) The data importer shall make available to the data subject, upon request, a copy of these Clauses, including the completed Annexes. (b) To the extent necessary to protect business secrets or other confidential information, including personal data, the data importer may redact portions of the text of the Annexes before disclosing a copy. Where such redactions would otherwise prevent the d

Clause 8.4 — Accuracy If the data importer becomes aware that the personal data it has received is inaccurate or has become outdated, it shall inform the data exporter without undue delay. The data importer shall cooperate with the data exporter, including by implementing correction, deletion, suppression, or replacement measures, in order to erase or rectify the data as appropriate.

Clause 8.5 — Duration of Processing and Erasure or Return of Data (a) Processing by the data importer shall take place only for the duration specified in Annex I.B and only for so long as necessary to perform the documented processing activities. (b) Upon termination of the data processing services, or upon the data exporter’s written instruction following expiration or termination of the relevant contractual relatio

Clause 8.6 — Security of Processing (a) The data importer, and the data exporter during transmission, shall implement appropriate technical and organisational measures to ensure the security of the personal data, including protection against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or unauthorised access. (b) The measures implemented by the data importer are those set out in Anne

Clause 8.7 — Sensitive Data (a) The parties confirm that the transfers covered by these Clauses do not involve personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health, or data concerning a natural person’s sex life or sexual orientation

Clause 8.8 — Onward Transfers The data importer shall disclose personal data to a third party only on documented instructions from the data exporter. Any onward transfer to a sub-processor shall be governed exclusively by Clause 9 and the related Annexes. No onward transfer shall be made in a manner that undermines the level of protection guaranteed by these Clauses.

Clause 8.9 — Documentation and Compliance (a) The data importer shall promptly and adequately deal with inquiries from the data exporter relating to the processing of personal data under these Clauses. (b) The data importer shall make available to the data exporter all information necessary to demonstrate compliance with these Clauses, including relevant policies, records, certifications, and audit materials, and sha

Clause 9 — Use of Sub-processors

Clause 9(a) — General Written Authorisation (a) The parties select Option 2: General Written Authorisation. (b) The data exporter hereby grants the data importer general written authorisation to engage sub-processors listed in Annex III for the performance of processing activities covered by these Clauses. (c) The data importer shall specifically inform the data exporter in writing of any intended changes to that lis

Clause 9(b) — Sub-processor Contract Requirements (a) Where the data importer engages a sub-processor, it shall do so only by way of a written contract that imposes on the sub-processor the same data protection obligations as those set out in these Clauses, to the extent applicable to the nature of the delegated processing. (b) The data importer shall ensure that each sub-processor provides sufficient guarantees to i

Clause 9(c) — Liability The data importer shall remain fully liable to the data exporter for the performance of each sub-processor’s obligations under its sub-processing agreement. Delegation of processing to a sub-processor shall not relieve the data importer of any duty, responsibility, or liability under these Clauses.

Clause 9(d) — Back-up Mechanism Where a sub-processor fails to fulfil its data protection obligations, the data importer shall remain fully liable to the data exporter for the performance of those obligations and for any resulting non-compliance, damage, or remediation required under these Clauses.

Clause 10 — Data Subject Rights (a) Taking into account the nature of the processing, the data importer shall assist the data exporter by appropriate technical and organisational measures, insofar as this is possible, for the fulfilment of the data exporter’s obligations to respond to requests for exercising data subject rights under the GDPR. (b) The data importer shall deal promptly, and in any event within one mon

Clause 11 — Redress (a) The data importer shall inform data subjects, in a transparent and easily accessible format, of a contact point authorised to handle complaints arising under these Clauses. (b) For purposes of this Clause, the designated contact point at the data importer is: Jennifer Huang VP, Legal & Privacy Caldwell Analytics Inc. 2700 Technology Drive, Suite 400 San Jose, CA 95134 USA (c) The data importer

Clause 12 — Liability (a) Each party shall be liable to the other party or parties for any damages it causes by any breach of these Clauses. (b) Each party shall be liable to the data subject, and the data subject shall be entitled to receive compensation for any material or non-material damage that the party causes the data subject by breaching these Clauses. (c) Where the data importer is liable for damage caused t

Clause 13(a) — Competent Supervisory Authority (a) The supervisory authority with responsibility for ensuring compliance by the data exporter with Regulation (EU) 2016/679 shall act as competent supervisory authority for purposes of these Clauses. (b) The parties identify the competent supervisory authority in Annex I.C as the Data Protection Commission (Ireland), acting in light of Northgate Telecommunications PLC’s

Clause 13(b) — Data Importer’s Obligations Re Supervisory Authority The data importer agrees: (a) to submit itself to the jurisdiction of the competent supervisory authority; (b) to cooperate with the competent supervisory authority in any procedures aimed at ensuring compliance with these Clauses; (c) to abide by any decision of the competent supervisory authority that is binding under applicable EU or Member State

Clause 14 — Local Laws and Practices Affecting Compliance with the Clauses

Clause 14(a) — Warranty of No Reason to Believe (a) The parties warrant that they have no reason to believe that the laws and practices in the third country of destination, namely the United States of America, applicable to the processing of the personal data by the data importer, including any requirements to disclose personal data or measures authorising access by public authorities, prevent the data importer from

Clause 14(b) — Relevant Assessment Elements In carrying out the assessment required under this Clause 14, the parties have taken into account, and agree that the following elements are materially relevant: (a) the specific circumstances of the transfer, including the nature of the personal data transferred, namely network performance data, pseudonymised subscriber metadata, approximate location data, and device ident

Clause 14(c) — Documentation Obligation (a) The data importer warrants that it has made best efforts to provide the data exporter with all relevant information reasonably available to it concerning the laws and practices of the United States insofar as they may affect compliance with these Clauses. (b) The data importer shall continue to cooperate with the data exporter on an ongoing basis to ensure continued complia

Clause 14(d) — Ongoing Review (a) The data importer agrees to notify the data exporter promptly if it has reason to believe that it is or has become subject to laws or practices not in line with the requirements under Clause 14(a), including any legal developments, changes in governmental practice, or other circumstances that may materially impair its ability to comply with these Clauses. (b) Following such notificat

Clause 14(e) — Data Importer Notification If Unable to Comply If, after having agreed to these Clauses, the data importer has reason to believe that it can no longer fulfil its obligations under these Clauses, including as a result of changes in United States law, regulatory practice, government access mechanisms, or judicial interpretation, it shall notify the data exporter without undue delay. The parties agree tha

Clause 15 — Obligations of the Data Importer in Case of Access by Public Authorities

Clause 15.1 — Notification (a) The data importer shall notify the data exporter promptly, and where possible before any disclosure, if it: 1. receives a legally binding request from a public authority, including a judicial authority, under United States law for the disclosure of personal data transferred pursuant to these Clauses; or 2. becomes aware of any direct access by public authorities to such personal data in

Clause 15.2 — Review of Legality and Data Minimisation (a) The data importer shall review the legality of any request for disclosure, including whether the request remains within the powers granted to the requesting public authority under the applicable law of the requesting country. (b) If, after careful assessment, the data importer concludes that there are reasonable grounds to consider the request unlawful under

Clause 15.3 — Transparency (a) The data importer agrees to provide the data exporter, at regular intervals and at least annually, with as much relevant information as possible concerning the requests received from public authorities for access to personal data processed under these Clauses. (b) Such information shall include, to the extent legally permissible, the number of requests received, the categories or type o

Clause 16 — Non-compliance with the Clauses and Termination (a) Where the data importer is in breach of these Clauses, the data exporter shall suspend the transfer of personal data to the data importer until compliance is again ensured or the relevant contract is terminated. (b) Where the data importer is in substantial or persistent breach of these Clauses, the data exporter shall be entitled to terminate the contra

Clause 17 — Governing Law These Clauses shall be governed by the laws of Ireland, being the law of a Member State that allows for third-party beneficiary rights. The parties select Irish law in light of the data exporter’s EU establishment through Northgate Ireland Ltd and the designation of the Data Protection Commission (Ireland) as competent supervisory authority.

Clause 18 — Choice of Forum and Jurisdiction (a) Any dispute arising from these Clauses shall be resolved by the courts of a Member State of the European Union. (b) The parties agree that the courts of Ireland shall have jurisdiction to resolve disputes arising from these Clauses. (c) Nothing in this Clause shall prejudice the right of a data subject to bring proceedings against the data exporter and/or the data impo

1. Data Exporter Name: Northgate Telecommunications PLC Addresses: Registered Office: 140 Queensway Place, Reading, Berkshire RG1 4QT, United Kingdom Principal Office: Northgate Tower, 88 Canary Wharf Boulevard, London E14 5HN, United Kingdom Contact person: Sanjay Mehta Data Protection Officer Northgate Tower, 88 Canary Wharf Boulevard, London E14 5HN, United Kingdom Activities relevant to the data transferred: Nort

2. Data Importer Name: Caldwell Analytics Inc. Addresses: Principal Office: 2700 Technology Drive, Suite 400, San Jose, CA 95134, USA Registered Agent: 1209 Orange Street, Wilmington, New Castle County, Delaware 19801, USA Contact person: Jennifer Huang VP, Legal & Privacy 2700 Technology Drive, Suite 400, San Jose, CA 95134, USA Activities relevant to the data transferred: Caldwell Analytics Inc. provides AI-driven

1. Categories of data subjects whose personal data is transferred The categories of data subjects whose personal data may be transferred under these Clauses are as follows: • consumer subscribers of Northgate Telecommunications PLC telecommunications services and NorthCloud services, representing approximately 6.3 million individuals across the United Kingdom and the European Union; and • end-users of enterprise clie

2. Categories of personal data transferred The categories of personal data transferred to the data importer are limited to those necessary for the defined analytics purposes and include: • network performance data, including call data records, session logs, and bandwidth utilisation metrics; • subscriber metadata in pseudonymised form, including pseudonymised subscriber identifiers, with direct identifiers such as na

3. Sensitive data transferred No sensitive data is transferred. The transfer does not include special categories of personal data within the meaning of Article 9 GDPR, nor data relating to criminal convictions and offences within the meaning of Article 10 GDPR.

4. Frequency of the transfer The transfer takes place on a continuous or near real-time basis through operational data feeds used for analytics processing. In addition, batch transfers occur daily at 02:00 UTC for reconciliation, model refresh, and reporting support purposes.

5. Nature of the processing The nature of the processing includes collection, receipt, storage, organisation, structuring, analysis, machine-learning-assisted and AI-driven analytics, aggregation, reporting, dashboard generation, and erasure or anonymisation upon completion of the relevant processing cycle or retention period.

6. Purpose(s) of the transfer and further processing The personal data is transferred and further processed solely for the following purposes on behalf of the data exporter and subject to its documented instructions: • AI-driven network analytics to optimise network performance and capacity planning; • predictive maintenance modelling to identify risks of network infrastructure failure; • network anomaly detection an

7. Retention period The data importer shall retain personal data for no longer than necessary for the purposes for which it is processed, as specified in the Master Services Agreement dated 1 June 2021 and related instructions. The default retention period is 12 months from the date of ingestion, after which the personal data is either irreversibly anonymised or deleted. Aggregated or anonymised outputs that no longe

8. Transfers to sub-processors Where personal data is transferred onward to approved sub-processors, the subject matter, nature, and duration of the processing are as specified in Annex III. Sub-processors are engaged only for infrastructure hosting, data storage, managed support, and computational processing in support of Caldwell Analytics Inc.’s provision of services to Northgate Telecommunications PLC. Such sub-p

1. Pseudonymisation and Data Minimisation (a) All direct identifiers, including subscriber names, contact details, addresses, and account numbers, are pseudonymised by the data exporter prior to transfer through tokenisation or equivalent transformation methods. (b) The pseudonymisation key, token vault, and any mapping capability permitting reversal of the pseudonymisation are retained exclusively by the data export

2. Encryption (a) Encryption at rest: All personal data stored on systems operated by or for the data importer is encrypted using AES-256 or an equivalent industry-recognised standard affording comparable protection. (b) Encryption in transit: All personal data transmitted between the data exporter and data importer, and between internal systems within the data importer’s environment, is encrypted using TLS 1.3. (c)

3. Access Controls (a) Role-based access control (RBAC) is enforced across systems that store, process, or otherwise handle transferred personal data. (b) Multi-factor authentication (MFA) is mandatory for all personnel with access to systems containing transferred personal data. (c) Access is restricted to personnel with a demonstrated business need and is subject to approval under internal access governance procedu

4. Network Security (a) Intrusion detection and prevention systems (IDS/IPS) are deployed at relevant network perimeters and within internal network segments associated with transferred personal data. (b) Network segmentation is maintained between environments processing transferred data and other corporate or development environments to reduce lateral movement risk. (c) Independent third-party penetration testing is

5. Physical Security (a) Data centres hosting transferred personal data are SOC 2 Type II certified or hosted in facilities providing equivalent audited assurance standards. (b) Physical access controls include biometric or similarly robust authentication controls, 24/7 CCTV monitoring, visitor management procedures, and on-site or contracted security staffing. (c) As of the execution date, the primary data centre lo

6. Personnel Security (a) All Caldwell personnel with access to transferred personal data are subject to pre-engagement background checks to the extent permitted by applicable law. (b) Such personnel are required to sign confidentiality agreements or are otherwise bound by enforceable confidentiality obligations. (c) Annual data protection, privacy, and security awareness training is mandatory for personnel handling

7. Incident Detection and Response (a) The data importer maintains a Security Operations Centre operating 24 hours a day, 7 days a week, 365 days a year for real-time monitoring and detection of security events. (b) A documented incident response plan defines severity levels, escalation procedures, containment protocols, evidence preservation requirements, stakeholder notification processes, and post-incident review

8. Data Deletion and Anonymisation (a) Secure deletion procedures are implemented using methods aligned with NIST SP 800-88 or equivalent recognised standards. (b) Personal data is subject to automatic anonymisation or deletion after the twelve-month default retention period, unless a shorter period or specific deletion instruction applies. (c) Anonymisation is designed to be irreversible and to prevent re-identifica

9. Business Continuity and Disaster Recovery (a) The data importer maintains documented business continuity and disaster recovery plans covering systems relevant to the transferred personal data. (b) Backups are performed regularly and are encrypted using AES-256 or an equivalent standard. (c) The target recovery point objective (RPO) for the relevant environment is four (4) hours. (d) The target recovery time object