Contract analysis

1. UK Country's Law that Governs the IDTA The laws of England and Wales shall govern this IDTA, including its formation, validity, interpretation, and performance. For the avoidance of doubt, this governing law clause does not affect the application of mandatory data protection laws applicable to the Exporter or the Importer, including UK GDPR.

2. Primary Place for Legal Claims to be Made by the Parties The courts of England and Wales shall have non-exclusive jurisdiction to hear and determine any legal claims arising out of or in connection with this IDTA. Data subjects who are third-party beneficiaries of this IDTA may bring claims before the courts of England and Wales or, where applicable, in any other court of competent jurisdiction.

3. Status of the Exporter The Exporter is a Controller under UK GDPR with respect to the personal data transferred under this IDTA. The Exporter determines the purposes and means of processing of the personal data that is the subject of the restricted transfer.

4. Status of the Importer The Importer is a Processor under UK GDPR with respect to the personal data transferred under this IDTA. The Importer processes the personal data solely on behalf of, and in accordance with the documented instructions of, the Exporter.

5. Whether the EU SCCs are Also Being Used for the Transfer Yes. The EU Standard Contractual Clauses adopted under Commission Implementing Decision (EU) 2021/914 of 4 June 2021, Module 2 (Controller to Processor), have been executed between the parties on 17 July 2023 and apply in parallel to this IDTA for data flows that are also subject to EU GDPR. The parties acknowledge and agree that: (a) This IDTA governs restr

6. Link to Tool for Review of the Importer's Legal Framework The parties have completed a Transfer Impact Assessment referenced as TIA-001, which was finalised and dated 4 August 2023. TIA-001 analyses the following aspects of United States law and practice as they relate to the transfer of personal data under this IDTA: (a) FISA Section 702 — an assessment of the scope and application of Section 702 of the Foreign i

1. Description of the Transfer The Exporter transfers pseudonymised subscriber analytics data to the Importer for the purpose of AI-driven network analytics and predictive maintenance services under the Master Services Agreement dated 1 June 2021. The transfer enables the Importer to perform network performance analysis, predictive maintenance modelling, anomaly detection, and network optimisation reporting on behalf

2. Categories of Data Subjects The personal data transferred under this IDTA relates to the following categories of data subjects: (a) Consumer subscribers of the Exporter's telecommunications and NorthCloud SaaS services who are located in the United Kingdom, representing a subset of the Exporter's approximately 6.3 million total consumer subscribers; and (b) Enterprise client end-users in the United Kingdom, being

3. Categories of Personal Data Transferred The following categories of personal data are transferred to the Importer under this IDTA: (a) Network performance data (including latency, bandwidth utilisation, packet loss, jitter, and signal strength metrics); (b) Subscriber metadata (pseudonymised) — including subscriber identifiers that have been replaced with pseudonymous tokens by the Exporter; (c) Location data (pse

4. Sensitive Data (Special Categories) Transferred None. The transfer does not include special category data as defined in Article 9 of UK GDPR (including, without limitation, data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, health data, or data concerning a person's sex life or sexual orientation), nor does it includ

5. Frequency of the Transfer The transfer is continuous and ongoing. Personal data is transmitted via automated, secure API connections operating on a 24-hour, 7-day-a-week basis. Data feeds are initiated by the Exporter's systems and are pushed to the Importer's processing environment through encrypted channels. The volume of data transferred varies based on network activity but typically comprises approximately 2.5

6. Nature and Purpose of the Processing The Importer processes the transferred personal data for the following purposes, as documented in the MSA and the Exporter's data processing instructions: (a) AI-driven network analytics — applying machine learning algorithms to identify patterns, trends, and correlations in network performance data for the purpose of optimising the Exporter's telecommunications infrastructure;

7. Retention Period / Deletion Criteria The Importer shall retain transferred personal data for a maximum period of 24 months from the date of transfer, after which time the data shall be securely deleted or returned to the Exporter in accordance with the MSA and the Exporter's documented instructions. The Importer shall implement automated deletion processes to ensure that personal data exceeding the 24-month retent

8. Sub-Processors The Importer engages sub-processors for the processing of transferred personal data as listed in the approved sub-processor list set out in Annex 3 to this IDTA. The sub-processor list is maintained and updated by the Importer in accordance with Clause 9(a) of the EU SCCs (Module 2) and the corresponding provisions of this IDTA. The Exporter has approved the sub-processors listed in Annex 3 as of th

Section 1: Supplementary Measures — Technical 2.1 Encryption at Rest. All transferred personal data stored by the Importer — whether in primary storage, backup storage, archival storage, or any other form of persistent storage — shall be encrypted using the Advanced Encryption Standard with a key length of 256 bits (AES-256) or an equivalent or stronger encryption standard as may be adopted from time to time in accor

Section 2: Supplementary Measures — Contractual 2.6 Government Access Requests — Notification. The Importer shall promptly notify the Exporter of any legally binding request for disclosure of transferred personal data by a public authority, including but not limited to requests from law enforcement agencies, intelligence services, or regulatory authorities (a "Government Access Request"), unless the Importer is prohi

Section 3: Supplementary Measures — Organisational 2.11 Personnel Obligations. The Importer shall ensure that all personnel authorised to process transferred personal data — including employees, contractors, and temporary staff — are bound by legally enforceable contractual obligations of confidentiality that are at least as protective as the confidentiality obligations set out in this IDTA. The Importer shall furthe

Section 1: Relationship with the Underlying Agreement 3.1 This IDTA supplements and forms an integral part of the data protection obligations established under the Master Services Agreement dated 1 June 2021 between the Exporter and the Importer (the "MSA"), including any data processing addendum, schedule, or annex thereto. The provisions of this IDTA shall be read and construed in conjunction with the MSA, and term

Section 2: Liability 3.4 Liability as between the Exporter and the Importer for breach of this IDTA shall be governed by the liability provisions set out in the MSA, subject to the following modifications: (a) Liability for breaches of the data protection clauses of this IDTA — including the supplementary measures set out in Part 2 and the mandatory clauses set out in Part 4 — shall not be subject to any contractual

Section 3: Costs 3.6 The costs of compliance with this IDTA — including the implementation, maintenance, and ongoing operation of the supplementary measures set out in Part 2, the costs of conducting Transfer Impact Assessments, and the costs of any modifications to the Importer's systems or processes required to comply with this IDTA — shall be borne by the Importer, unless otherwise agreed in writing by the parties

Section 4: Confidentiality 3.8 Each party shall treat the personal data transferred under this IDTA, and all information relating to the other party's data protection measures, security measures, and compliance with this IDTA, as confidential information. Such confidential information shall not be disclosed to any third party except: (a) to the extent necessary for the performance of the party's obligations under thi

Section 5: Dispute Resolution 3.10 Governing Law. This IDTA and any dispute or claim arising out of or in connection with it or its subject matter, existence, negotiation, validity, termination, or enforceability (including non-contractual disputes or claims) shall be governed by and construed in accordance with the laws of England and Wales. 3.11 Jurisdiction. The courts of England and Wales shall have non-exclusive

Section 1: Compliance with UK GDPR 4.1 The Importer shall comply with all applicable provisions of UK GDPR as if it were a processor established in the United Kingdom, to the extent relevant to its processing of transferred personal data under this IDTA. This obligation includes, without limitation, compliance with the principles relating to processing of personal data set out in Article 5 of the UK GDPR (lawfulness,

Section 2: Data Subject Rights 4.4 The Importer shall promptly assist the Exporter in responding to requests from data subjects to exercise their rights under UK GDPR in relation to the transferred personal data. Data subject rights for which the Importer shall provide assistance include: (a) the right of access under Article 15 of the UK GDPR; (b) the right to rectification under Article 16 of the UK GDPR; (c) the r

Section 3: ICO Powers and Data Subject Remedies 4.7 The Importer agrees to submit to the jurisdiction of the Information Commissioner's Office and the courts of England and Wales for the purposes of any investigation, inquiry, enforcement action, or proceedings arising out of or in connection with this IDTA, the Importer's processing of transferred personal data, or the exercise of data subject rights under this IDTA

Section 4: Onward Transfers 4.10 The Importer shall not transfer, disclose, or otherwise make available the personal data received under this IDTA to any third party (including any sub-processor, affiliate, or other entity) located outside the United Kingdom (an "Onward Transfer") unless one or more of the following conditions is satisfied: (a) the third party recipient has entered into an appropriate safeguard mecha

Section 5: Suspension and Termination 4.13 Suspension by the Exporter. The Exporter may suspend the transfer of personal data under this IDTA, in whole or in part, immediately upon written notice to the Importer if any of the following circumstances arise: (a) the ICO (or any competent court or tribunal) issues a decision that the safeguards relied upon for the transfer under this IDTA are no longer adequate or do no

Section 6: Review and Update 4.18 The parties shall review this IDTA at least annually, or more frequently if there is a material change in the laws or practices of the Importer's country that may affect the adequacy of the safeguards provided by this IDTA, to ensure that the protections afforded to transferred personal data remain adequate and effective. 4.19 The first annual review shall take place no later than 17

1. Nature of the Transfer The transfer described in this IDTA constitutes a "restricted transfer" within the meaning of Section 18 of the Data Protection Act 2018, read in conjunction with Article 46 of the UK GDPR. The personal data is transferred from the Exporter, which is established in the United Kingdom, to the Importer, which is established in the United States of America. As of the Start Date, the United Stat

2. Categories of Data Subjects (a) Consumer subscribers of the Exporter's telecommunications and NorthCloud SaaS services located in the United Kingdom (a subset of the Exporter's approximately 6.3 million total consumer subscribers); and (b) Enterprise client end-users in the United Kingdom (individual users associated with a subset of the Exporter's approximately 42,000 enterprise client accounts).

3. Categories of Personal Data (a) Network performance data; (b) Subscriber metadata (pseudonymised); (c) Location data (pseudonymised — cell-level and IP-based); (d) Device identifiers (pseudonymised — IMEI and IMSI derivatives, device type); (e) Usage and traffic patterns; and (f) Service quality metrics. All direct identifiers are pseudonymised by the Exporter prior to transfer. The Importer does not receive pseud

4. Special Category Data No special category data (Article 9, UK GDPR) or criminal conviction/offence data (Article 10, UK GDPR) is transferred.

5. Purposes of the Transfer AI-driven network analytics, predictive maintenance modelling, anomaly detection, and network optimisation reporting, as described in DPIA-011 and the MSA.

6. Frequency Continuous / ongoing — automated data feeds via secure API connection operating 24/7.

7. Retention Period Maximum 24 months from the date of transfer, with secure deletion or return thereafter. Upon termination or expiry, deletion or return within 30 calendar days, with written certification. Annex 2: Technical and Organisational Measures This Annex describes the technical and organisational security measures implemented by the Importer to protect the transferred personal data. The Importer's Chief Te

1. Encryption (a) Encryption at rest: All transferred personal data stored by the Importer is encrypted using AES-256 encryption. This applies to all storage media, including primary databases, data warehouses, file systems, backup storage, and archival storage. Encryption keys are managed through a dedicated hardware security module (HSM) infrastructure with key rotation on a quarterly cycle. (b) Encryption in trans

2. Pseudonymisation Pseudonymisation of direct identifiers is applied by the Exporter prior to transfer. The pseudonymisation process uses HMAC-SHA256 tokenisation. Pseudonymisation keys are retained exclusively by the Exporter within its UK-based systems. The Importer does not hold, and has no mechanism to obtain, the pseudonymisation keys. The Importer's systems are designed to process pseudonymised data without th

3. Access Controls (a) Role-based access controls (RBAC): Access to systems containing transferred personal data is restricted to authorised personnel based on role assignments. Roles are defined in accordance with the least-privilege principle. (b) Multi-factor authentication (MFA): All access to systems containing transferred personal data requires MFA, using hardware tokens (FIDO2/WebAuthn-compliant) in combinatio

4. Network Security (a) Firewalls: Enterprise-grade firewalls are deployed at all network perimeters, with rule sets reviewed and updated at least quarterly. (b) Intrusion detection and prevention systems (IDS/IPS): Network-based and host-based IDS/IPS are deployed across the Importer's infrastructure, with real-time alerting and automated response capabilities. (c) Network segmentation: The Importer's network is seg

5. Data Centre Security The Importer's primary data processing facility is located at its principal office at 2700 Technology Drive, San Jose, California 95134, USA. Physical access controls include: (a) 24/7 on-site security personnel; (b) Biometric access controls (fingerprint and iris recognition) for entry to data centre areas; (c) Mantrap entry systems with anti-tailg