Contract analysis

1. PURPOSE AND OBJECTIVES 1.1 Purpose. The purpose of this International Transfers Policy & Mechanism Selection Guidance (the "Policy") is to establish a binding internal policy framework governing the transfer of personal data from Northgate Telecommunications PLC ("NTP" or the "Company") and its subsidiaries (together, the "NTP Group") to recipients located outside the United Kingdom (the "UK") and the European Eco

1. Ensure that all international transfers of personal data by or on behalf of the NTP Group are carried out in full compliance with the UK General Data Protection Regulation (the "UK GDPR"), as retained EU law under the European Union (Withdrawal) Act 2018 and as supplemented by the Data Protection Act 2018 (the "DPA 2018"), and the EU General Data Protection Regulation (Regulation (EU) 2016/679) (the "EU GDPR"), as

2. Provide a structured, repeatable decision-making process for the selection of appropriate transfer mechanisms, ensuring consistency across all NTP Group entities and business units.

3. Mandate the conduct of Transfer Impact Assessments in accordance with the methodology set out by the European Data Protection Board ("EDPB") in its Recommendations 01/2020 on supplementary measures, as adopted on 18 June 2021, and in line with guidance published by the UK Information Commissioner's Office (the "ICO").

4. Establish clear roles and responsibilities for the identification, escalation, approval, documentation, and periodic review of international data transfers.

5. Maintain a comprehensive and up-to-date International Transfers Register, integrated with the NTP Group's Record of Processing Activities ("ROPA") and the Sundial Solutions privacy management platform.

6. Ensure that supplementary measures — whether technical, contractual, or organisational — are identified, implemented, and maintained where a Transfer Impact Assessment reveals that the legal framework of the destination country does not provide a level of protection for personal data that is essentially equivalent to that guaranteed within the UK or the EEA.

7. Support the NTP Group's compliance with its obligations to supervisory authorities, including the ICO and the Data Protection Commission of Ireland (the "DPC"), and to respond to regulatory inquiries, including the active DPC preliminary inquiry (reference IN-22-11-3) regarding cross-border transfers from Northgate Ireland Ltd to US-based processors. 1.3 Context. This Policy has been developed as part of the NTP G

2. SCOPE 2.1 Organisational Scope This Policy applies to the following entities within the NTP Group: 2.1.1 Northgate Telecommunications PLC (the ultimate parent company of the NTP Group), a public limited company incorporated in England and Wales under Company Number 04837291, with its registered office at 140 Queensway Place, Reading, Berkshire RG1 4QT, United Kingdom, and its principal office at Northgate Tower, 8

3. REGULATORY FRAMEWORK 3.1 UK GDPR The UK GDPR, as retained and adapted under the European Union (Withdrawal) Act 2018 and as supplemented by the DPA 2018, governs the processing of personal data by NTP PLC in respect of its UK operations. Chapter V of the UK GDPR (Articles 44 to 49, as retained) establishes the framework for restricted transfers of personal data to third countries and international organisations. T

4. DEFINITIONS For the purposes of this Policy, the following terms shall have the meanings set out below. Terms defined in the UK GDPR or the EU GDPR shall, unless otherwise stated, bear the same meaning as in the relevant regulation. "Adequate Country" means a country or territory in respect of which (a) the UK Secretary of State has made regulations under Section 17A of the DPA 2018 confirming that the country or

5. ROLES AND RESPONSIBILITIES 5.1 Data Protection Officer — Sanjay Mehta Sanjay Mehta, CIPP/E, is the designated Data Protection Officer ("DPO") of the NTP Group, having been appointed to the role in March 2019 in accordance with Articles 37–39 of the UK GDPR and Articles 37–39 of the EU GDPR. The DPO reports functionally to the General Counsel and has a dotted-line reporting relationship to the Audit & Risk Committe

6. TRANSFER MECHANISM SELECTION — DECISION TREE 6.1 Overview. A structured, sequential decision tree must be followed before any international transfer of personal data is initiated or continued by any NTP Group entity. This decision tree is designed to ensure that the appropriate transfer mechanism is identified and implemented for each international data transfer, in accordance with the requirements of the UK GDPR

7. TRANSFER IMPACT ASSESSMENTS (TIAs) 7.1 Purpose and Legal Basis The Transfer Impact Assessment is the centrepiece of the NTP Group's framework for ensuring that international data transfers comply with the requirements of the UK GDPR and the EU GDPR in the post-Schrems II environment. The legal basis for the TIA requirement derives from the CJEU's Schrems II judgment, in which the Court held that a data exporter re

8. SUPPLEMENTARY MEASURES 8.1 Overview. Where a Transfer Impact Assessment identifies gaps in the level of protection for personal data in the destination country — that is, where the legal framework of the destination country does not, on its own, ensure a level of protection that is essentially equivalent to that guaranteed within the UK and/or the EEA — the Data Exporter must implement Supplementary Measures to br