1017-00008 · Aurelius Global Media Group · Engagement

engagement-letter-agmg-gdpr-remediation.docx DOCUMENT Finance & Banking

7 / 12 ← → ✕

PRIVATE & CONFIDENTIAL — SUBJECT TO LEGAL PROFESSIONAL PRIVILEGE

CALDERWOOD & HARKNESS LLP Solicitors & Advisors One Finsbury Square London EC2A 1AE United Kingdom

T: +44 (0)20 7946 0100 F: +44 (0)20 7946 0101 www.calderwoodharkness.com

C&H Matter No.: 1017-00008

12 January 2024

Mr. Sanjay Redworth Group General Counsel & Company Secretary Aurelius Global Media Group PLC 140 Threadneedle Row London EC2R 8AH United Kingdom

Dear Sanjay,

Thank you for retaining Calderwood & Harkness LLP ("Calderwood & Harkness", "the firm", "we" or "us") to advise and act for Aurelius Global Media Group PLC in this important matter. We very much value our relationship with Aurelius Global Media Group PLC and are committed to delivering the highest quality of legal advice and representation throughout the course of this engagement.

This letter sets out the terms on which Calderwood & Harkness will act for Aurelius Global Media Group PLC (Companies House No. 08741562) in connection with the GDPR cookie-consent and advertising-technology remediation matter described more fully below (the "Engagement" or the "Matter"). This engagement letter, together with our Standard Terms of Business enclosed at Annex A, forms the contractual basis of our retainer. In the event of any conflict between this engagement letter and the Standard Terms of Business, the terms of this letter shall prevail.

We ask that you review this letter carefully and, if its terms are acceptable, countersign and return a copy to us at your earliest convenience so that we may proceed without delay.

1. The Client

The client for the purposes of this engagement is Aurelius Global Media Group PLC ("AGMG" or "the Company"), a public limited company incorporated in England and Wales under the Companies Act 2006, with Companies House registration number 08741562 and registered address at 140 Threadneedle Row, London EC2R 8AH, United Kingdom. AGMG's ordinary shares are admitted to trading on the Main Market of the London Stock Exchange under the ticker symbol LSE: AGMG.

For the avoidance of doubt, this engagement is with the Company and not with any individual officer, director, employee, or shareholder of the Company in a personal capacity. Calderwood & Harkness does not, by virtue of this engagement, undertake any duty of care to, or assume any responsibility towards, any person other than AGMG itself. If any individual officer or director requires personal legal advice in connection with the matters described in this letter, separate arrangements would need to be made.

The primary contact for the purposes of this engagement shall be Sanjay Redworth, Group General Counsel & Company Secretary, who is authorised to give instructions to the firm on behalf of AGMG. In addition, the following individuals are designated as key contacts with whom Calderwood & Harkness is authorised to communicate directly in connection with the Engagement:

• Margaux Fontaine-Li, Group Data Protection Officer; and

• Leander Voss, Chief Technology Officer.

We will take instructions from any of the above individuals unless and until AGMG notifies us otherwise in writing. We ask that all instructions of material significance be confirmed in writing (including by e-mail) where practicable to do so.

2. Background to the Matter

This section sets out the factual background giving rise to the Engagement, as we understand it from our initial discussions and the materials provided to us to date. If any aspect of this summary is inaccurate or incomplete, please notify us promptly so that we may update our understanding accordingly.

2.1 The CNIL Complaint and Formal Notice

On 8 November 2023, Digitale Rechte Europa eingetragener Verein ("DRE"), a Berlin-based digital rights advocacy organisation, filed a complaint with the Commission nationale de l'informatique et des libertés ("CNIL"), France's national data protection authority, under CNIL Complaint Reference PLT-2023-FR-04821. The complaint concerned AGMG's French-language streaming platform operated at the domain aurelius-stream.fr.

The substance of the complaint, as communicated to AGMG, alleged that:

(a) the aurelius-stream.fr platform deployed a total of 47 third-party tracking cookies on users' terminal equipment prior to any user consent interaction — that is, cookies were placed immediately upon page load, before the cookie-consent banner was presented to the user and before the user had any opportunity to accept, reject, or configure their consent preferences;

(b) the cookie-consent banner deployed on aurelius-stream.fr employed so-called "dark patterns" designed to steer users toward accepting all cookies, including asymmetric button design (a prominent, brightly coloured "Accept All" button paired with a less visible, greyed-out "Manage Preferences" link), pre-ticked consent boxes within the granular preference interface, and a consent withdrawal mechanism that was materially more difficult to navigate than the initial acceptance flow; and

(c) these practices constituted violations of, inter alia, Article 5(3) of the ePrivacy Directive (Directive 2002/58/EC as amended), the French Loi Informatique et Libertés (Loi n° 78-17 du 6 janvier 1978), CNIL's Guidelines on Cookies and Other Trackers of 1 October 2020 (as revised), and Articles 6 and 7 of the General Data Protection Regulation (Regulation (EU) 2016/679) ("GDPR").

Following its preliminary examination of the complaint, the CNIL issued a formal notice (mise en demeure) to AGMG on 14 December 2023, under Reference MED-2023-097. The formal notice identified the alleged violations described in the DRE complaint and imposed a compliance deadline of 14 March 2024 — that is, three months from the date of the formal notice — within which AGMG is required to bring its cookie-consent practices on aurelius-stream.fr into compliance with applicable French and EU law and to demonstrate such compliance to the satisfaction of the CNIL.

The formal notice makes clear that failure to comply within the stipulated deadline may result in the matter being referred to the CNIL's restricted formation (formation restreinte) for formal enforcement proceedings, which may include the imposition of administrative fines and the publication of any resulting decision.

2.2 The ICO Informal Inquiry

Separately, on 22 December 2023, the UK Information Commissioner's Office ("ICO") sent an informal inquiry letter to AGMG under Reference ICO/ENF/2023/LTR-11084. The ICO's letter raised concerns regarding:

(a) the deployment of server-side tracking pixels on AGMG's UK-facing websites aureliusnews.co.uk and shopaurelia.co.uk, the nature and extent of which were not immediately transparent to users; and

(b) the adequacy of AGMG's mechanisms for obtaining PECR-compliant consent (under the Privacy and Electronic Communications (EC Directive) Regulations 2003, as amended) for the use of analytics cookies and similar technologies on those properties.

While the ICO's letter was characterised as an "informal inquiry" rather than a formal enforcement action, it requested a substantive written response from AGMG and indicated that the ICO may take further steps, including the commencement of a formal investigation or the issuance of an assessment notice under section 146 of the Data Protection Act 2018, depending on the nature and adequacy of AGMG's response.

2.3 AGMG's Digital Footprint

By way of context, AGMG operates a significant portfolio of European-facing digital properties. The Company currently maintains 14 European-facing websites and 3 mobile applications serving audiences across the United Kingdom, France, Germany, the Netherlands, Spain, and Italy. These digital properties collectively serve approximately 87 million monthly active users within the EU and EEA.

AGMG's EU/EEA digital advertising revenue and e-commerce revenue amounted to approximately £612 million in the financial year ended 31 December 2023, representing a substantial proportion of the Company's total annual revenue of approximately £1.42 billion for the same period. The commercial significance of these digital operations underscores the importance of ensuring that AGMG's data processing practices — particularly those relating to online advertising, audience analytics, and user tracking — are fully compliant with applicable data protection and electronic communications legislation across all relevant jurisdictions.

3. Scope of Engagement

Calderwood & Harkness is retained to advise and act for AGMG in relation to the following workstreams, each of which is described in further detail below. The workstreams are interrelated and will be managed as a coordinated programme of work under the supervision of the engagement team described in Section 5.

3.1 Cookie and Consent Mechanism Audit

Calderwood & Harkness will direct and oversee a comprehensive technical audit of the cookie-consent mechanisms deployed across all 14 of AGMG's European-facing websites and all 3 of its mobile applications. The audit will assess the nature, number, and categorisation of all cookies and similar tracking technologies (including web beacons, server-side tracking pixels, local storage objects, and device fingerprinting scripts) deployed on each property, and will examine the consent mechanisms presented to users on each property for compliance with applicable law.

The technical component of the audit will be conducted by Thistlewood Consulting Ltd (further described in Section 7 below) under Calderwood & Harkness's direction and subject to the common-interest privilege arrangements set out in Section 8. Thistlewood's audit will include automated website scanning, manual verification of cookie behaviours, and cataloguing of all cookies and tracking technologies by purpose, provider, duration, and legal basis relied upon.

Calderwood & Harkness will then conduct a legal analysis of the audit findings against all applicable legal frameworks, including but not limited to:

(a) the General Data Protection Regulation (Regulation (EU) 2016/679) ("GDPR"), in particular Articles 4(11), 5, 6, 7, 12–14, and 25;

(b) the ePrivacy Directive (Directive 2002/58/EC as amended by Directive 2009/136/EC), in particular Article 5(3);

(c) the Privacy and Electronic Communications (EC Directive) Regulations 2003, as amended ("PECR"), in particular Regulation 6;

(d) the French Loi Informatique et Libertés (Loi n° 78-17 du 6 janvier 1978, as amended) and CNIL Guidelines on Cookies and Other Trackers of 1 October 2020;

(e) relevant guidance issued by the European Data Protection Board ("EDPB"), including Guidelines 05/2020 on consent under the GDPR; and

(f) relevant guidance issued by the ICO, including its guidance on the use of cookies and similar technologies.

A comprehensive written audit report, setting out findings, risk ratings, and remediation recommendations, will be delivered to AGMG upon completion of the audit phase.

3.2 Adtech Vendor Data Flow Mapping

Calderwood & Harkness will map the data flows between AGMG's digital properties and all advertising-technology ("adtech") vendors with which AGMG shares or receives personal data in connection with its online advertising and audience analytics activities. The mapping exercise will identify, for each data flow, the categories of personal data transferred, the purposes of the transfer, the legal basis relied upon, the destination jurisdiction, and the contractual framework governing the relationship.

The principal adtech vendors currently engaged by AGMG, and which will be the initial focus of the data flow mapping exercise, include but are not limited to the following:

(a) Pendleton AdTech Solutions Ltd (registered in Dublin, Ireland; Companies Registration Office No. 614823), which serves as AGMG's primary programmatic advertising partner pursuant to a Master Services Agreement dated 15 June 2021. Pendleton provides demand-side platform ("DSP") and supply-side platform ("SSP") services enabling AGMG to monetise its digital inventory through real-time bidding and programmatic advertising;

(b) VoltGraph Analytics GmbH (registered in Hamburg, Germany; Handelsregister HRB 159742), which provides cross-device tracking and audience segmentation analytics services to AGMG, enabling the Company to build unified audience profiles across its digital properties and to optimise advertising delivery based on user behaviour and demographic attributes; and

(c) Brightleaf Consent Technologies EU B.V. (registered in Amsterdam, the Netherlands; Kamer van Koophandel No. 81294503), which provides AGMG's consent management platform ("CMP") under the product name "ConsentShield". Brightleaf's ConsentShield product is certified under the IAB Europe Transparency & Consent Framework version 2.2 ("IAB TCF 2.2") and is the platform through which AGMG's cookie-consent banners are configured and deployed.

Calderwood & Harkness will identify any data flows involving the transmission of personal data to adtech vendors without valid consent or without an adequate alternative legal basis under Article 6(1) GDPR and, where applicable, without compliance with the requirements of Article 5(3) of the ePrivacy Directive or Regulation 6 of PECR. The firm will also assess the compliance of all server-side tracking pixels deployed across AGMG's digital properties, with particular attention to the properties identified in the ICO's informal inquiry (aureliusnews.co.uk and shopaurelia.co.uk).

3.3 Vendor Data Processing Agreement Renegotiation

On the basis of the data flow mapping exercise and the audit findings, Calderwood & Harkness will review, negotiate, and execute revised Data Processing Agreements ("DPAs") with AGMG's adtech vendors to ensure full compliance with the requirements of GDPR Article 28. This workstream will include:

(a) reviewing all existing DPAs and related contractual instruments between AGMG and its adtech vendors to identify gaps, deficiencies, or non-compliant provisions;

(b) preparing revised DPA templates and negotiating amended terms with each vendor, ensuring that all DPAs contain the mandatory provisions specified in Article 28(3) GDPR, including subject matter and duration of processing, nature and purpose of processing, type of personal data and categories of data subjects, and the obligations and rights of the controller;

(c) implementing Standard Contractual Clauses ("SCCs"), as adopted by the European Commission pursuant to Implementing Decision (EU) 2021/914 of 4 June 2021, where vendor data flows involve cross-border transfers of personal data to recipients established outside the European Economic Area;

(d) conducting Transfer Impact Assessments ("TIAs") for each cross-border data transfer involving an adtech vendor, assessing whether the law of the recipient country provides an adequate level of protection for personal data and identifying any supplementary measures that may be required; and

(e) ensuring that all DPAs incorporate adequate audit and inspection rights for AGMG as controller, in accordance with Article 28(3)(h) GDPR, including the right to conduct or commission audits of the processor's compliance with the DPA and applicable data protection law.

3.4 Remediation of Consent Mechanisms

Following the completion of the audit and data flow mapping, Calderwood & Harkness will advise AGMG on the remediation of its cookie-consent mechanisms across all affected digital properties. This workstream will include:

(a) preparing detailed legal and UX specifications for compliant cookie banners and mobile application consent flows, specifying the information to be presented to users, the design of consent interfaces, the granularity of consent options, and the mechanisms for recording, storing, and demonstrating consent;

(b) advising on the elimination of dark patterns from all consent interfaces, including the removal of pre-ticked consent boxes, the adoption of symmetrical button design (ensuring that the option to reject non-essential cookies is presented with equal prominence to the option to accept), the simplification of consent withdrawal mechanisms to ensure that withdrawal of consent is as easy as the giving of consent (in accordance with Article 7(3) GDPR and CNIL guidelines), and the elimination of any design elements that may be perceived as manipulating or unduly influencing user consent decisions;

(c) advising on the sequencing of cookie deployment to ensure that no non-essential cookies or tracking technologies are placed on user devices prior to the user's affirmative consent (addressing the core allegation in the DRE complaint); and

(d) overseeing the implementation of the remediated consent mechanisms by AGMG's internal technical teams and, where applicable, by Brightleaf Consent Technologies EU B.V. as AGMG's CMP provider, including conducting post-implementation compliance verification.

3.5 Data Protection Impact Assessments

Calderwood & Harkness will update AGMG's Data Protection Impact Assessments ("DPIAs") for the Company's programmatic advertising and audience analytics processing activities, pursuant to Article 35 GDPR. The updated DPIAs will take into account the remediated processing activities, the revised vendor arrangements, and the updated consent mechanisms, and will assess whether any residual processing activities give rise to a high risk to the rights and freedoms of natural persons requiring prior consultation with the relevant supervisory authority under Article 36 GDPR.

3.6 Record of Processing Activities Update

Calderwood & Harkness will update AGMG's Records of Processing Activities ("ROPA") pursuant to Article 30 GDPR to reflect the remediated processing activities, including updated descriptions of processing purposes, categories of data subjects and personal data, recipients and categories of recipients, international transfers and applicable safeguards, and retention periods.

3.7 Regulatory Responses

Calderwood & Harkness will advise and act for AGMG in relation to all regulatory communications arising out of the matters described in Section 2, including:

(a) drafting and submitting AGMG's compliance response to the CNIL in respect of formal notice MED-2023-097, demonstrating the steps taken by AGMG to achieve compliance and providing such evidence, documentation, and technical reports as may be required by the CNIL;

(b) preparing and submitting AGMG's written response to the ICO informal inquiry under Reference ICO/ENF/2023/LTR-11084, addressing the specific concerns raised by the ICO regarding server-side tracking pixels and PECR-compliant consent;

(c) advising on any requests for extension of regulatory deadlines, including, if appropriate, submitting a reasoned request to the CNIL for an extension of the 14 March 2024 compliance deadline; and

(d) liaising with the CNIL and the ICO as necessary on AGMG's behalf throughout the course of the Engagement, including responding to follow-up queries and facilitating any interactions between the regulators and AGMG's technical teams.

4. Matters Outside Scope

For the avoidance of doubt, the following matters fall outside the scope of this engagement and are not included in the fee arrangements described in Section 6:

(a) Representation in formal enforcement or judicial proceedings. This engagement does not extend to the representation of AGMG in any formal enforcement proceedings before the CNIL (including proceedings before the formation restreinte), the ICO, any other supervisory authority, or any court or tribunal. Should such proceedings be commenced or become reasonably anticipated, Calderwood & Harkness would be pleased to discuss the terms of a separate engagement to provide such representation, which would be the subject of a separate engagement letter.

(b) Non-European data protection laws. This engagement does not include advice on data protection or privacy laws outside Europe, including but not limited to United States federal or state privacy legislation (such as the California Consumer Privacy Act / California Privacy Rights Act, the Virginia Consumer Data Protection Act, the Colorado Privacy Act, or similar state laws), the Brazilian Lei Geral de Proteção de Dados Pessoais ("LGPD"), or the data protection laws of any other non-European jurisdiction. Should AGMG require advice on any such laws, Calderwood & Harkness can arrange referrals to qualified counsel in the relevant jurisdiction.

(c) General corporate, securities, or M&A advice. This engagement does not extend to general corporate advisory work, securities law compliance, or merger and acquisition transactional advice, even where such matters may have a tangential connection to the data protection issues addressed in this engagement.

(d) Tax advice. Calderwood & Harkness does not provide tax advice, and no aspect of this engagement letter or the advice provided hereunder should be construed as tax advice.

(e) Advice to other entities or individuals. This engagement is solely with AGMG. Calderwood & Harkness does not, by virtue of this engagement, act for any subsidiary, affiliate, officer, director, or employee of AGMG in any individual or personal capacity. Any such engagement would require a separate retainer.

5. Engagement Team

The following lawyers will comprise the core engagement team for this matter. Each team member brings relevant expertise in data protection, privacy, and regulatory compliance.

Responsible Partner — Rachel Bernstein Partner, Privacy & Data Security Practice

Rachel will have overall responsibility for the Engagement and will serve as the primary relationship partner. She will be the signatory on all regulatory submissions to the CNIL and the ICO and will be the principal point of contact for strategic advice and senior-level engagement with AGMG's leadership. Rachel will attend all material meetings with the client and with regulators.

Billing Partner — Kevin Ostrowski Partner, Privacy & Data Security Practice

Kevin will have oversight of all billing, fee estimates, and client financial matters in connection with the Engagement. Kevin will also contribute substantive expertise on cross-border data transfer issues, having led numerous engagements involving the implementation of Standard Contractual Clauses and Transfer Impact Assessments for multinational media and technology clients.

Lead Associate — Priscilla Wynn Senior Associate, Privacy & Data Security Practice

Priscilla will be responsible for the day-to-day management of all workstreams within the Engagement. She will serve as the principal drafter of legal memoranda, compliance specifications, vendor DPA terms, regulatory correspondence, and all other work product. Priscilla will coordinate directly with Margaux Fontaine-Li and Leander Voss on the client side and with Marcus Drayford at Thistlewood Consulting Ltd.

Working Associate — Alan Burke Associate, Privacy & Data Security Practice

Alan will support all workstreams with research, drafting, and analysis. His particular focus will be on vendor DPA review and negotiation, data flow mapping analysis, and the preparation of Records of Processing Activities and Data Protection Impact Assessment updates.

The firm may involve additional lawyers, trainees, or support staff from time to time as reasonably required to deliver the Engagement efficiently and to the required standard. Any additional team members whose hourly rates exceed those of the most junior member currently on the team will be discussed with AGMG and their rates agreed in advance of any material time being incurred.

6. Fees and Billing Arrangements

6.1 Capped Fee

Calderwood & Harkness's professional fees for the Engagement are subject to a fee cap of £425,000 (four hundred and twenty-five thousand pounds sterling), exclusive of Value Added Tax and disbursements.

The fee cap represents the maximum amount that the firm will charge for professional fees in connection with the workstreams described in Section 3 above, regardless of the actual time incurred by the engagement team. In the event that the actual time incurred exceeds the fee cap, Calderwood & Harkness will absorb the excess. In the event that the actual time incurred is less than the fee cap, AGMG will be invoiced only for the time actually recorded at the agreed hourly rates set out in Section 6.2 below.

The fee cap is predicated on the scope of the Engagement as described in Section 3. If the scope of the Engagement is materially expanded beyond that described in Section 3 — for example, if formal enforcement proceedings are commenced by the CNIL or the ICO, if additional regulatory complaints are received, or if AGMG requests significant additional advisory work not contemplated by this letter — the parties will agree a revised fee cap or supplemental fee arrangement in writing before any additional work commences. No additional work falling outside the scope described in Section 3 will be commenced without AGMG's prior written authorisation.

6.2 Hourly Rates

Time will be recorded by all members of the engagement team and reported to AGMG in monthly billing narratives. The following hourly rates will apply to the Engagement:

The total estimated pre-cap professional fees are therefore £420,825, comprising £76,075 (Bernstein) + £35,000 (Ostrowski) + £162,500 (Wynn) + £147,250 (Burke). These estimates are provided for transparency and budgeting purposes. The fee cap of £425,000 governs the maximum liability for professional fees, and AGMG will not be charged professional fees in excess of that amount absent a written agreement to expand the scope of the Engagement.

The hourly rates set out above are fixed for the duration of this Engagement and will not be subject to any annual increase during the term of this retainer.

6.3 Disbursements. Disbursements are in addition to the fee cap and will be charged at cost, without mark-up. Anticipated categories of disbursements include but are not limited to:

(a) travel expenses (including rail and air travel, accommodation, and subsistence) incurred in connection with meetings with AGMG, regulators, or vendors;

(b) courier and delivery charges;

(d) external translation costs (e.g., for French-language regulatory correspondence);

(e) electronic research and database charges directly attributable to this Engagement; and

(f) third-party consultant fees, in particular the fee of Thistlewood Consulting Ltd (see Section 7 below).

The principal anticipated disbursement is the fee of Thistlewood Consulting Ltd, which is estimated at £145,000 as described in Section 7. Calderwood & Harkness will obtain AGMG's prior approval before incurring any individual disbursement in excess of £5,000 (other than the Thistlewood fee, which has been pre-approved).

6.4 Total Estimated Client Cost

The total estimated cost to AGMG for this Engagement is £570,000, comprised as follows:

All amounts set out in this Section 6 are exclusive of Value Added Tax, which will be charged at the applicable rate (currently 20%) on both professional fees and disbursements where VAT is chargeable.

6.5 Billing Frequency

Invoices will be rendered monthly in arrears, on or about the 10th business day of each calendar month, covering professional fees and disbursements incurred during the preceding calendar month. Each invoice will be accompanied by a detailed narrative of time recorded by each team member, including date, description of work performed, and time spent.

Payment terms are 30 calendar days from the date of invoice. Payment should be made by bank transfer to the firm's client account, details of which will be provided on each invoice.

Calderwood & Harkness reserves the right to charge interest on overdue amounts at the rate of 2% per annum above the Bank of England base rate, calculated on a daily basis from the due date until the date of actual payment. This right is without prejudice to any other rights or remedies available to the firm in respect of unpaid fees.

7. Thistlewood Consulting Ltd — Technical Consultant

AGMG has separately retained Thistlewood Consulting Ltd ("Thistlewood"), a specialist cybersecurity and data governance consulting firm, to conduct the technical component of the cookie audit described in Section 3.1 above. Thistlewood is registered in England and Wales with its registered address at 9 Worship Street, London EC2A 2BF, United Kingdom.

The engagement lead at Thistlewood is Marcus Drayford, Principal Consultant, who will serve as the primary point of contact between Thistlewood and both Calderwood & Harkness and AGMG for the purposes of this Engagement.

Thistlewood's scope of work encompasses the technical audit of cookie-consent mechanisms across AGMG's digital properties, including automated and manual website scanning, cookie tagging and categorisation, data-flow mapping at the network and application layer, and the production of a technical audit report. A summary of Thistlewood's scope of work is enclosed at Annex C.

Thistlewood's fixed fee for its engagement is £145,000 (exclusive of VAT). This fee may be paid by AGMG directly to Thistlewood under the terms of AGMG's separate engagement with Thistlewood, or, at AGMG's election, may be passed through Calderwood & Harkness's account as a disbursement, in which case it will appear on Calderwood & Harkness's invoices and be subject to the payment terms set out in Section 6.5 above.

Critically, Thistlewood's technical audit will be conducted under Calderwood & Harkness's direction and oversight, and all Thistlewood work product produced in connection with this Engagement will be treated as subject to legal professional privilege and the common-interest arrangements described in Section 8 below. Thistlewood's audit report and all underlying work papers will be addressed to Calderwood & Harkness in the first instance and shared with AGMG under the common-interest protocol. Calderwood & Harkness will coordinate all instructions to Thistlewood and will review all Thistlewood deliverables before they are finalised.

8. Privilege and Common-Interest Arrangements

8.1 Legal Professional Privilege

All advice provided by Calderwood & Harkness in connection with this Engagement is protected by legal professional privilege. In particular:

(a) Legal advice privilege attaches to all confidential communications between Calderwood & Harkness and AGMG made for the purpose of giving or receiving legal advice in connection with this Engagement; and

(b) Litigation privilege is also engaged in respect of communications and work product created for the dominant purpose of anticipated or pending regulatory proceedings, given the existence of the CNIL formal notice (MED-2023-097) and the ICO informal inquiry (ICO/ENF/2023/LTR-11084), both of which create a reasonable prospect of adversarial regulatory proceedings.

We will take all reasonable steps to preserve privilege over all communications, advice, and work product generated in connection with this Engagement. All privileged documents will be marked "PRIVILEGED AND CONFIDENTIAL — SUBJECT TO LEGAL PROFESSIONAL PRIVILEGE" or with words to similar effect.

8.2 Common-Interest Privilege Protocol

Given the involvement of Thistlewood Consulting Ltd as a technical consultant working under Calderwood & Harkness's direction, it is necessary to establish a framework for the sharing of privileged information among Calderwood & Harkness, AGMG, and Thistlewood without waiving privilege.

Accordingly, Calderwood & Harkness will prepare a separate Common Interest and Privilege Protocol Memorandum (the "Protocol") to govern the sharing of privileged information among the three parties. The Protocol will establish:

(a) document-handling procedures, including the classification, marking, storage, and transmission of privileged documents;

(b) privilege markings to be applied to all audit findings, legal analyses, remediation plans, and related work product;

(c) communication channels to be used for the exchange of privileged information, including designated e-mail addresses and secure file-sharing platforms; and

(d) restrictions on further dissemination of privileged information outside the common-interest group without the prior written consent of all parties.

The key contacts under the Protocol will be:

• Calderwood & Harkness: Rachel Bernstein (Partner) and Priscilla Wynn (Senior Associate)

• AGMG: Margaux Fontaine-Li (Group Data Protection Officer)

• Thistlewood Consulting Ltd: Marcus Drayford (Principal Consultant)

For the avoidance of doubt, the common-interest arrangement does not create a solicitor-client relationship between Calderwood & Harkness and Thistlewood. Thistlewood is not a client of Calderwood & Harkness, and Calderwood & Harkness owes no duty of care to Thistlewood in connection with this Engagement.

8.3 Waiver. AGMG should exercise great care to avoid any inadvertent waiver of privilege over communications and work product generated in connection with this Engagement. In particular:

(a) AGMG should not disclose privileged communications or work product to any third party without prior consultation with Calderwood & Harkness, as such disclosure may constitute a waiver of privilege — potentially on a broad, subject-matter basis;

(b) any proposed disclosure of privileged materials to AGMG's external auditors, Hollander Warwick LLP, or to members of AGMG's Board of Directors or Audit Committee who are not within the existing common-interest group, should be discussed with Rachel Bernstein in advance so that appropriate measures can be put in place to preserve applicable protections; and

(c) particular care should be taken with internal e-mail communications, as the forwarding of privileged advice to individuals outside the privileged circle (including to AGMG employees who are not directly involved in the Engagement) may jeopardise the privileged status of those communications.

9. Conflicts of Interest

Calderwood & Harkness has conducted a comprehensive conflicts check in accordance with the firm's internal procedures and the requirements of the Solicitors Regulation Authority ("SRA"). Based on this check, the firm confirms that it does not currently act for any party adverse to AGMG's interests in connection with this Matter.

In particular, the firm confirms that it does not act for any of the following entities or their legal representatives:

(a) Digitale Rechte Europa e.V. (DRE), the complainant, whose legal counsel in connection with the CNIL complaint is understood to be Kreisel & Hausmann Rechtsanwälte PartG mbB, Berlin;

(b) Pendleton AdTech Solutions Ltd, whose outside legal counsel is understood to be Dalrymple Kearney & Co., Dublin;

(d) Brightleaf Consent Technologies Inc. or its EU subsidiary Brightleaf Consent Technologies EU B.V.

Calderwood & Harkness maintains an ongoing obligation to monitor for conflicts throughout the duration of the Engagement. If any actual or potential conflict of interest arises during the course of the Engagement, the firm will notify AGMG promptly and discuss appropriate measures, which may include the implementation of information barriers or, in exceptional circumstances, the withdrawal of the firm from the Engagement or the affected workstream.

10. Confidentiality

Calderwood & Harkness will treat all information received from or on behalf of AGMG in connection with this Engagement as strictly confidential. This obligation is subject to any overriding obligations imposed by law, regulation, court order, or the firm's professional rules (including the SRA Standards and Regulations).

The firm will not disclose confidential information to any third party without AGMG's prior written consent, except:

(a) as required by applicable law or regulation;

(b) as required by the firm's professional regulatory obligations;

(c) to the extent necessary to perform the Engagement, including communications with the CNIL and the ICO on AGMG's behalf (which will be made with AGMG's prior knowledge and approval) and communications with Thistlewood Consulting Ltd under the common-interest protocol described in Section 8; and

(d) to the firm's professional indemnity insurers, auditors, or legal advisers, to the extent reasonably necessary.

This confidentiality obligation shall continue in force following the completion or termination of the Engagement, without limitation of time.

11. Regulatory Context and Risk Exposure

For context, and to frame the urgency of the Engagement, Calderwood & Harkness draws AGMG's attention to the following regarding the Company's potential regulatory exposure:

CNIL Exposure. Under Article 83(5) GDPR, the CNIL has the power to impose administrative fines of up to the higher of €20 million or 4% of the total worldwide annual turnover of the undertaking in the preceding financial year, for infringements of the provisions identified in the CNIL's formal notice. Based on AGMG's reported FY 2023 annual revenue of approximately £1.42 billion, the 4% threshold equates to approximately £56.8 million (approximately €64.7 million at prevailing exchange rates). In addition to monetary fines, the CNIL may impose corrective measures including orders to bring processing into compliance, temporary or definitive bans on processing, and orders to communicate a data breach to data subjects. The CNIL may also publish any resulting decision, which carries significant reputational risk for a listed media company.

ICO Exposure. Under the UK GDPR and the Data Protection Act 2018, the ICO has the power to impose monetary penalty notices of up to the higher of £17.5 million or 4% of total annual worldwide turnover for the most serious infringements. The ICO also has powers to issue enforcement notices, assessment notices, and information notices.

The compliance deadline imposed by CNIL formal notice MED-2023-097 is 14 March 2024, being three months from the date of issuance on 14 December 2023. Calderwood & Harkness will assess at an early stage of the Engagement whether it is advisable to seek an extension of this deadline from the CNIL, taking into account the complexity of the remediation programme, the scale of AGMG's digital operations, and the regulatory practice of the CNIL in granting extensions of mise en demeure deadlines. Any recommendation in this regard will be communicated to AGMG promptly.

12. Limitation of Liability

Calderwood & Harkness's aggregate liability to AGMG arising out of or in connection with this Engagement, whether in contract, tort (including negligence), breach of statutory duty, or otherwise, shall not exceed the greater of:

(a) £5,000,000 (five million pounds sterling); or

(b) three times the total fees actually paid to Calderwood & Harkness under this engagement letter.

This limitation applies to the aggregate of all claims arising out of or in connection with the Engagement and not separately to each claim or cause of action.

This limitation of liability does not apply to any loss arising from:

(a) fraud or dishonesty on the part of Calderwood & Harkness or any of its partners, employees, or agents;

(b) wilful misconduct; or

(c) any breach of the firm's regulatory obligations where the applicable regulatory framework prohibits contractual limitation of liability in respect of such breach.

Nothing in this section shall be construed as excluding or limiting any liability that cannot lawfully be excluded or limited under English law or the regulatory requirements applicable to Calderwood & Harkness.

13. Data Protection — Firm as Controller

In providing legal services under this Engagement, Calderwood & Harkness will process personal data relating to individuals associated with AGMG and its business partners (including employees, officers, directors, and vendor representatives) as an independent controller for the purposes of the UK GDPR and the Data Protection Act 2018.

The firm processes such personal data for the purposes of providing legal services, managing the client relationship, complying with legal and regulatory obligations (including anti-money laundering and sanctions screening requirements), and administering the firm's business. The firm's privacy notice, which sets out further details of how the firm processes personal data in the course of its legal practice, is available at www.calderwoodharkness.com/privacy-notice. A copy will be provided on request.

14. Termination

Either party may terminate this Engagement upon 14 calendar days' written notice to the other party, such notice to be sent to the addresses specified in this letter (or such other address as may be notified in writing from time to time).

In the event of termination:

(a) AGMG will be liable for all professional fees and disbursements properly incurred up to the effective date of termination, subject to the fee cap for professional fees incurred prior to termination;

(b) AGMG will be liable for any irrevocable commitments made on AGMG's behalf prior to the effective date of termination (including, for example, commitments to Thistlewood Consulting Ltd or disbursements already incurred); and

(c) upon termination, Calderwood & Harkness will, subject to any applicable law or regulation or the firm's professional obligations (including document retention requirements), return or make available to AGMG all client documents and materials in the firm's possession.

Calderwood & Harkness's obligations regarding privilege, confidentiality, and data protection shall survive the termination of this Engagement and continue in full force and effect.

15. Governing Law and Jurisdiction

This engagement letter, and any non-contractual obligations arising out of or in connection with it, shall be governed by and construed in accordance with the laws of England and Wales.

The courts of England and Wales shall have exclusive jurisdiction in relation to any dispute, claim, or matter arising out of or in connection with this engagement letter, including any dispute as to its existence, validity, or termination.

16. Acceptance and Execution

We should be grateful if you would indicate AGMG's acceptance of the terms of this engagement letter by signing and returning the acknowledgment below. A countersigned copy may be returned by post, courier, or scanned e-mail to Rachel Bernstein at r.bernstein@calderwoodharkness.com. This engagement letter will become binding upon receipt of the countersigned copy.

If you have any questions about the terms of this letter or any aspect of the proposed Engagement, please do not hesitate to contact Rachel Bernstein or Priscilla Wynn. We look forward to working with you and the AGMG team on this important matter.

Yours sincerely,

CALDERWOOD & HARKNESS LLP

By: ________

Name: Rachel Bernstein

Title: Partner, Privacy & Data Security Practice

PRIVATE & CONFIDENTIAL — SUBJECT TO LEGAL PROFESSIONAL PRIVILEGE
CALDERWOOD & HARKNESS LLP Solicitors & Advisors One Finsbury Square London EC2A 1AE United Kingdom
T: +44 (0)20 7946 0100 F: +44 (0)20 7946 0101 www.calderwoodharkness.com
C&H Matter No.: 1017-00008
12 January 2024
Mr. Sanjay Redworth Group General Counsel & Company Secretary Aurelius Global Media Group PLC 140 Threadneedle Row London EC2R 8AH United Kingdom
Dear Sanjay,
Thank you for retaining Calderwood & Harkness LLP ("Calderwood & Harkness", "the firm", "we" or "us") to advise and act for Aurelius Global Media Group PLC in this important matter. We very much value our relationship with Aurelius Global Media Group PLC and are committed to delivering the highest quality of legal advice and representation throughout the course of this engagement.
This letter sets out the terms on which Calderwood & Harkness will act for Aurelius Global Media Group PLC (Companies House No. 08741562) in connection with the GDPR cookie-consent and advertising-technology remediation matter described more fully below (the "Engagement" or the "Matter"). This engagement letter, together with our Standard Terms of Business enclosed at Annex A, forms the contractual basis of our retainer. In the event of any conflict between this engagement letter and the Standard Terms of Business, the terms of this letter shall prevail.
We ask that you review this letter carefully and, if its terms are acceptable, countersign and return a copy to us at your earliest convenience so that we may proceed without delay.
1. The Client
The client for the purposes of this engagement is Aurelius Global Media Group PLC ("AGMG" or "the Company"), a public limited company incorporated in England and Wales under the Companies Act 2006, with Companies House registration number 08741562 and registered address at 140 Threadneedle Row, London EC2R 8AH, United Kingdom. AGMG's ordinary shares are admitted to trading on the Main Market of the London Stock Exchange under the ticker symbol LSE: AGMG.
For the avoidance of doubt, this engagement is with the Company and not with any individual officer, director, employee, or shareholder of the Company in a personal capacity. Calderwood & Harkness does not, by virtue of this engagement, undertake any duty of care to, or assume any responsibility towards, any person other than AGMG itself. If any individual officer or director requires personal legal advice in connection with the matters described in this letter, separate arrangements would need to be made.
The primary contact for the purposes of this engagement shall be Sanjay Redworth, Group General Counsel & Company Secretary, who is authorised to give instructions to the firm on behalf of AGMG. In addition, the following individuals are designated as key contacts with whom Calderwood & Harkness is authorised to communicate directly in connection with the Engagement:
•  Margaux Fontaine-Li, Group Data Protection Officer; and
•  Leander Voss, Chief Technology Officer.
We will take instructions from any of the above individuals unless and until AGMG notifies us otherwise in writing. We ask that all instructions of material significance be confirmed in writing (including by e-mail) where practicable to do so.
2. Background to the Matter
This section sets out the factual background giving rise to the Engagement, as we understand it from our initial discussions and the materials provided to us to date. If any aspect of this summary is inaccurate or incomplete, please notify us promptly so that we may update our understanding accordingly.
2.1 The CNIL Complaint and Formal Notice
On 8 November 2023, Digitale Rechte Europa eingetragener Verein ("DRE"), a Berlin-based digital rights advocacy organisation, filed a complaint with the Commission nationale de l'informatique et des libertés ("CNIL"), France's national data protection authority, under CNIL Complaint Reference PLT-2023-FR-04821. The complaint concerned AGMG's French-language streaming platform operated at the domain aurelius-stream.fr.
The substance of the complaint, as communicated to AGMG, alleged that:
(a) the aurelius-stream.fr platform deployed a total of 47 third-party tracking cookies on users' terminal equipment prior to any user consent interaction — that is, cookies were placed immediately upon page load, before the cookie-consent banner was presented to the user and before the user had any opportunity to accept, reject, or configure their consent preferences;
(b) the cookie-consent banner deployed on aurelius-stream.fr employed so-called "dark patterns" designed to steer users toward accepting all cookies, including asymmetric button design (a prominent, brightly coloured "Accept All" button paired with a less visible, greyed-out "Manage Preferences" link), pre-ticked consent boxes within the granular preference interface, and a consent withdrawal mechanism that was materially more difficult to navigate than the initial acceptance flow; and
(c) these practices constituted violations of, inter alia, Article 5(3) of the ePrivacy Directive (Directive 2002/58/EC as amended), the French Loi Informatique et Libertés (Loi n° 78-17 du 6 janvier 1978), CNIL's Guidelines on Cookies and Other Trackers of 1 October 2020 (as revised), and Articles 6 and 7 of the General Data Protection Regulation (Regulation (EU) 2016/679) ("GDPR").
Following its preliminary examination of the complaint, the CNIL issued a formal notice (mise en demeure) to AGMG on 14 December 2023, under Reference MED-2023-097. The formal notice identified the alleged violations described in the DRE complaint and imposed a compliance deadline of 14 March 2024 — that is, three months from the date of the formal notice — within which AGMG is required to bring its cookie-consent practices on aurelius-stream.fr into compliance with applicable French and EU law and to demonstrate such compliance to the satisfaction of the CNIL.
The formal notice makes clear that failure to comply within the stipulated deadline may result in the matter being referred to the CNIL's restricted formation (formation restreinte) for formal enforcement proceedings, which may include the imposition of administrative fines and the publication of any resulting decision.
2.2 The ICO Informal Inquiry
Separately, on 22 December 2023, the UK Information Commissioner's Office ("ICO") sent an informal inquiry letter to AGMG under Reference ICO/ENF/2023/LTR-11084. The ICO's letter raised concerns regarding:
(a) the deployment of server-side tracking pixels on AGMG's UK-facing websites aureliusnews.co.uk and shopaurelia.co.uk, the nature and extent of which were not immediately transparent to users; and
(b) the adequacy of AGMG's mechanisms for obtaining PECR-compliant consent (under the Privacy and Electronic Communications (EC Directive) Regulations 2003, as amended) for the use of analytics cookies and similar technologies on those properties.
While the ICO's letter was characterised as an "informal inquiry" rather than a formal enforcement action, it requested a substantive written response from AGMG and indicated that the ICO may take further steps, including the commencement of a formal investigation or the issuance of an assessment notice under section 146 of the Data Protection Act 2018, depending on the nature and adequacy of AGMG's response.
2.3 AGMG's Digital Footprint
By way of context, AGMG operates a significant portfolio of European-facing digital properties. The Company currently maintains 14 European-facing websites and 3 mobile applications serving audiences across the United Kingdom, France, Germany, the Netherlands, Spain, and Italy. These digital properties collectively serve approximately 87 million monthly active users within the EU and EEA.
AGMG's EU/EEA digital advertising revenue and e-commerce revenue amounted to approximately £612 million in the financial year ended 31 December 2023, representing a substantial proportion of the Company's total annual revenue of approximately £1.42 billion for the same period. The commercial significance of these digital operations underscores the importance of ensuring that AGMG's data processing practices — particularly those relating to online advertising, audience analytics, and user tracking — are fully compliant with applicable data protection and electronic communications legislation across all relevant jurisdictions.
3. Scope of Engagement
Calderwood & Harkness is retained to advise and act for AGMG in relation to the following workstreams, each of which is described in further detail below. The workstreams are interrelated and will be managed as a coordinated programme of work under the supervision of the engagement team described in Section 5.
3.1 Cookie and Consent Mechanism Audit
Calderwood & Harkness will direct and oversee a comprehensive technical audit of the cookie-consent mechanisms deployed across all 14 of AGMG's European-facing websites and all 3 of its mobile applications. The audit will assess the nature, number, and categorisation of all cookies and similar tracking technologies (including web beacons, server-side tracking pixels, local storage objects, and device fingerprinting scripts) deployed on each property, and will examine the consent mechanisms presented to users on each property for compliance with applicable law.
The technical component of the audit will be conducted by Thistlewood Consulting Ltd (further described in Section 7 below) under Calderwood & Harkness's direction and subject to the common-interest privilege arrangements set out in Section 8. Thistlewood's audit will include automated website scanning, manual verification of cookie behaviours, and cataloguing of all cookies and tracking technologies by purpose, provider, duration, and legal basis relied upon.
Calderwood & Harkness will then conduct a legal analysis of the audit findings against all applicable legal frameworks, including but not limited to:
(a) the General Data Protection Regulation (Regulation (EU) 2016/679) ("GDPR"), in particular Articles 4(11), 5, 6, 7, 12–14, and 25;
(b) the ePrivacy Directive (Directive 2002/58/EC as amended by Directive 2009/136/EC), in particular Article 5(3);
(c) the Privacy and Electronic Communications (EC Directive) Regulations 2003, as amended ("PECR"), in particular Regulation 6;
(d) the French Loi Informatique et Libertés (Loi n° 78-17 du 6 janvier 1978, as amended) and CNIL Guidelines on Cookies and Other Trackers of 1 October 2020;
(e) relevant guidance issued by the European Data Protection Board ("EDPB"), including Guidelines 05/2020 on consent under the GDPR; and
(f) relevant guidance issued by the ICO, including its guidance on the use of cookies and similar technologies.
A comprehensive written audit report, setting out findings, risk ratings, and remediation recommendations, will be delivered to AGMG upon completion of the audit phase.
3.2 Adtech Vendor Data Flow Mapping
Calderwood & Harkness will map the data flows between AGMG's digital properties and all advertising-technology ("adtech") vendors with which AGMG shares or receives personal data in connection with its online advertising and audience analytics activities. The mapping exercise will identify, for each data flow, the categories of personal data transferred, the purposes of the transfer, the legal basis relied upon, the destination jurisdiction, and the contractual framework governing the relationship.
The principal adtech vendors currently engaged by AGMG, and which will be the initial focus of the data flow mapping exercise, include but are not limited to the following:
(a) Pendleton AdTech Solutions Ltd (registered in Dublin, Ireland; Companies Registration Office No. 614823), which serves as AGMG's primary programmatic advertising partner pursuant to a Master Services Agreement dated 15 June 2021. Pendleton provides demand-side platform ("DSP") and supply-side platform ("SSP") services enabling AGMG to monetise its digital inventory through real-time bidding and programmatic advertising;
(b) VoltGraph Analytics GmbH (registered in Hamburg, Germany; Handelsregister HRB 159742), which provides cross-device tracking and audience segmentation analytics services to AGMG, enabling the Company to build unified audience profiles across its digital properties and to optimise advertising delivery based on user behaviour and demographic attributes; and
(c) Brightleaf Consent Technologies EU B.V. (registered in Amsterdam, the Netherlands; Kamer van Koophandel No. 81294503), which provides AGMG's consent management platform ("CMP") under the product name "ConsentShield". Brightleaf's ConsentShield product is certified under the IAB Europe Transparency & Consent Framework version 2.2 ("IAB TCF 2.2") and is the platform through which AGMG's cookie-consent banners are configured and deployed.
Calderwood & Harkness will identify any data flows involving the transmission of personal data to adtech vendors without valid consent or without an adequate alternative legal basis under Article 6(1) GDPR and, where applicable, without compliance with the requirements of Article 5(3) of the ePrivacy Directive or Regulation 6 of PECR. The firm will also assess the compliance of all server-side tracking pixels deployed across AGMG's digital properties, with particular attention to the properties identified in the ICO's informal inquiry (aureliusnews.co.uk and shopaurelia.co.uk).
3.3 Vendor Data Processing Agreement Renegotiation
On the basis of the data flow mapping exercise and the audit findings, Calderwood & Harkness will review, negotiate, and execute revised Data Processing Agreements ("DPAs") with AGMG's adtech vendors to ensure full compliance with the requirements of GDPR Article 28. This workstream will include:
(a) reviewing all existing DPAs and related contractual instruments between AGMG and its adtech vendors to identify gaps, deficiencies, or non-compliant provisions;
(b) preparing revised DPA templates and negotiating amended terms with each vendor, ensuring that all DPAs contain the mandatory provisions specified in Article 28(3) GDPR, including subject matter and duration of processing, nature and purpose of processing, type of personal data and categories of data subjects, and the obligations and rights of the controller;
(c) implementing Standard Contractual Clauses ("SCCs"), as adopted by the European Commission pursuant to Implementing Decision (EU) 2021/914 of 4 June 2021, where vendor data flows involve cross-border transfers of personal data to recipients established outside the European Economic Area;
(d) conducting Transfer Impact Assessments ("TIAs") for each cross-border data transfer involving an adtech vendor, assessing whether the law of the recipient country provides an adequate level of protection for personal data and identifying any supplementary measures that may be required; and
(e) ensuring that all DPAs incorporate adequate audit and inspection rights for AGMG as controller, in accordance with Article 28(3)(h) GDPR, including the right to conduct or commission audits of the processor's compliance with the DPA and applicable data protection law.
3.4 Remediation of Consent Mechanisms
Following the completion of the audit and data flow mapping, Calderwood & Harkness will advise AGMG on the remediation of its cookie-consent mechanisms across all affected digital properties. This workstream will include:
(a) preparing detailed legal and UX specifications for compliant cookie banners and mobile application consent flows, specifying the information to be presented to users, the design of consent interfaces, the granularity of consent options, and the mechanisms for recording, storing, and demonstrating consent;
(b) advising on the elimination of dark patterns from all consent interfaces, including the removal of pre-ticked consent boxes, the adoption of symmetrical button design (ensuring that the option to reject non-essential cookies is presented with equal prominence to the option to accept), the simplification of consent withdrawal mechanisms to ensure that withdrawal of consent is as easy as the giving of consent (in accordance with Article 7(3) GDPR and CNIL guidelines), and the elimination of any design elements that may be perceived as manipulating or unduly influencing user consent decisions;
(c) advising on the sequencing of cookie deployment to ensure that no non-essential cookies or tracking technologies are placed on user devices prior to the user's affirmative consent (addressing the core allegation in the DRE complaint); and
(d) overseeing the implementation of the remediated consent mechanisms by AGMG's internal technical teams and, where applicable, by Brightleaf Consent Technologies EU B.V. as AGMG's CMP provider, including conducting post-implementation compliance verification.
3.5 Data Protection Impact Assessments
Calderwood & Harkness will update AGMG's Data Protection Impact Assessments ("DPIAs") for the Company's programmatic advertising and audience analytics processing activities, pursuant to Article 35 GDPR. The updated DPIAs will take into account the remediated processing activities, the revised vendor arrangements, and the updated consent mechanisms, and will assess whether any residual processing activities give rise to a high risk to the rights and freedoms of natural persons requiring prior consultation with the relevant supervisory authority under Article 36 GDPR.
3.6 Record of Processing Activities Update
Calderwood & Harkness will update AGMG's Records of Processing Activities ("ROPA") pursuant to Article 30 GDPR to reflect the remediated processing activities, including updated descriptions of processing purposes, categories of data subjects and personal data, recipients and categories of recipients, international transfers and applicable safeguards, and retention periods.
3.7 Regulatory Responses
Calderwood & Harkness will advise and act for AGMG in relation to all regulatory communications arising out of the matters described in Section 2, including:
(a) drafting and submitting AGMG's compliance response to the CNIL in respect of formal notice MED-2023-097, demonstrating the steps taken by AGMG to achieve compliance and providing such evidence, documentation, and technical reports as may be required by the CNIL;
(b) preparing and submitting AGMG's written response to the ICO informal inquiry under Reference ICO/ENF/2023/LTR-11084, addressing the specific concerns raised by the ICO regarding server-side tracking pixels and PECR-compliant consent;
(c) advising on any requests for extension of regulatory deadlines, including, if appropriate, submitting a reasoned request to the CNIL for an extension of the 14 March 2024 compliance deadline; and
(d) liaising with the CNIL and the ICO as necessary on AGMG's behalf throughout the course of the Engagement, including responding to follow-up queries and facilitating any interactions between the regulators and AGMG's technical teams.
4. Matters Outside Scope
For the avoidance of doubt, the following matters fall outside the scope of this engagement and are not included in the fee arrangements described in Section 6:
(a) Representation in formal enforcement or judicial proceedings. This engagement does not extend to the representation of AGMG in any formal enforcement proceedings before the CNIL (including proceedings before the formation restreinte), the ICO, any other supervisory authority, or any court or tribunal. Should such proceedings be commenced or become reasonably anticipated, Calderwood & Harkness would be pleased to discuss the terms of a separate engagement to provide such representation, which would be the subject of a separate engagement letter.
(b) Non-European data protection laws. This engagement does not include advice on data protection or privacy laws outside Europe, including but not limited to United States federal or state privacy legislation (such as the California Consumer Privacy Act / California Privacy Rights Act, the Virginia Consumer Data Protection Act, the Colorado Privacy Act, or similar state laws), the Brazilian Lei Geral de Proteção de Dados Pessoais ("LGPD"), or the data protection laws of any other non-European jurisdiction. Should AGMG require advice on any such laws, Calderwood & Harkness can arrange referrals to qualified counsel in the relevant jurisdiction.
(c) General corporate, securities, or M&A advice. This engagement does not extend to general corporate advisory work, securities law compliance, or merger and acquisition transactional advice, even where such matters may have a tangential connection to the data protection issues addressed in this engagement.
(d) Tax advice. Calderwood & Harkness does not provide tax advice, and no aspect of this engagement letter or the advice provided hereunder should be construed as tax advice.
(e) Advice to other entities or individuals. This engagement is solely with AGMG. Calderwood & Harkness does not, by virtue of this engagement, act for any subsidiary, affiliate, officer, director, or employee of AGMG in any individual or personal capacity. Any such engagement would require a separate retainer.
5. Engagement Team
The following lawyers will comprise the core engagement team for this matter. Each team member brings relevant expertise in data protection, privacy, and regulatory compliance.
Responsible Partner — Rachel Bernstein Partner, Privacy & Data Security Practice
Rachel will have overall responsibility for the Engagement and will serve as the primary relationship partner. She will be the signatory on all regulatory submissions to the CNIL and the ICO and will be the principal point of contact for strategic advice and senior-level engagement with AGMG's leadership. Rachel will attend all material meetings with the client and with regulators.
Billing Partner — Kevin Ostrowski Partner, Privacy & Data Security Practice
Kevin will have oversight of all billing, fee estimates, and client financial matters in connection with the Engagement. Kevin will also contribute substantive expertise on cross-border data transfer issues, having led numerous engagements involving the implementation of Standard Contractual Clauses and Transfer Impact Assessments for multinational media and technology clients.
Lead Associate — Priscilla Wynn Senior Associate, Privacy & Data Security Practice
Priscilla will be responsible for the day-to-day management of all workstreams within the Engagement. She will serve as the principal drafter of legal memoranda, compliance specifications, vendor DPA terms, regulatory correspondence, and all other work product. Priscilla will coordinate directly with Margaux Fontaine-Li and Leander Voss on the client side and with Marcus Drayford at Thistlewood Consulting Ltd.
Working Associate — Alan Burke Associate, Privacy & Data Security Practice
Alan will support all workstreams with research, drafting, and analysis. His particular focus will be on vendor DPA review and negotiation, data flow mapping analysis, and the preparation of Records of Processing Activities and Data Protection Impact Assessment updates.
The firm may involve additional lawyers, trainees, or support staff from time to time as reasonably required to deliver the Engagement efficiently and to the required standard. Any additional team members whose hourly rates exceed those of the most junior member currently on the team will be discussed with AGMG and their rates agreed in advance of any material time being incurred.
6. Fees and Billing Arrangements
6.1 Capped Fee
Calderwood & Harkness's professional fees for the Engagement are subject to a fee cap of £425,000 (four hundred and twenty-five thousand pounds sterling), exclusive of Value Added Tax and disbursements.
The fee cap represents the maximum amount that the firm will charge for professional fees in connection with the workstreams described in Section 3 above, regardless of the actual time incurred by the engagement team. In the event that the actual time incurred exceeds the fee cap, Calderwood & Harkness will absorb the excess. In the event that the actual time incurred is less than the fee cap, AGMG will be invoiced only for the time actually recorded at the agreed hourly rates set out in Section 6.2 below.
The fee cap is predicated on the scope of the Engagement as described in Section 3. If the scope of the Engagement is materially expanded beyond that described in Section 3 — for example, if formal enforcement proceedings are commenced by the CNIL or the ICO, if additional regulatory complaints are received, or if AGMG requests significant additional advisory work not contemplated by this letter — the parties will agree a revised fee cap or supplemental fee arrangement in writing before any additional work commences. No additional work falling outside the scope described in Section 3 will be commenced without AGMG's prior written authorisation.
6.2 Hourly Rates
Time will be recorded by all members of the engagement team and reported to AGMG in monthly billing narratives. The following hourly rates will apply to the Engagement:
The total estimated pre-cap professional fees are therefore £420,825, comprising £76,075 (Bernstein) + £35,000 (Ostrowski) + £162,500 (Wynn) + £147,250 (Burke). These estimates are provided for transparency and budgeting purposes. The fee cap of £425,000 governs the maximum liability for professional fees, and AGMG will not be charged professional fees in excess of that amount absent a written agreement to expand the scope of the Engagement.
The hourly rates set out above are fixed for the duration of this Engagement and will not be subject to any annual increase during the term of this retainer.
6.3 Disbursements.  Disbursements are in addition to the fee cap and will be charged at cost, without mark-up. Anticipated categories of disbursements include but are not limited to:
(a) travel expenses (including rail and air travel, accommodation, and subsistence) incurred in connection with meetings with AGMG, regulators, or vendors;
(b) courier and delivery charges;
(c) regulatory filing fees, if any;
(d) external translation costs (e.g., for French-language regulatory correspondence);
(e) electronic research and database charges directly attributable to this Engagement; and
(f) third-party consultant fees, in particular the fee of Thistlewood Consulting Ltd (see Section 7 below).
The principal anticipated disbursement is the fee of Thistlewood Consulting Ltd, which is estimated at £145,000 as described in Section 7. Calderwood & Harkness will obtain AGMG's prior approval before incurring any individual disbursement in excess of £5,000 (other than the Thistlewood fee, which has been pre-approved).
6.4 Total Estimated Client Cost
The total estimated cost to AGMG for this Engagement is £570,000, comprised as follows:
All amounts set out in this Section 6 are exclusive of Value Added Tax, which will be charged at the applicable rate (currently 20%) on both professional fees and disbursements where VAT is chargeable.
6.5 Billing Frequency
Invoices will be rendered monthly in arrears, on or about the 10th business day of each calendar month, covering professional fees and disbursements incurred during the preceding calendar month. Each invoice will be accompanied by a detailed narrative of time recorded by each team member, including date, description of work performed, and time spent.
Payment terms are 30 calendar days from the date of invoice. Payment should be made by bank transfer to the firm's client account, details of which will be provided on each invoice.
Calderwood & Harkness reserves the right to charge interest on overdue amounts at the rate of 2% per annum above the Bank of England base rate, calculated on a daily basis from the due date until the date of actual payment. This right is without prejudice to any other rights or remedies available to the firm in respect of unpaid fees.
7. Thistlewood Consulting Ltd — Technical Consultant
AGMG has separately retained Thistlewood Consulting Ltd ("Thistlewood"), a specialist cybersecurity and data governance consulting firm, to conduct the technical component of the cookie audit described in Section 3.1 above. Thistlewood is registered in England and Wales with its registered address at 9 Worship Street, London EC2A 2BF, United Kingdom.
The engagement lead at Thistlewood is Marcus Drayford, Principal Consultant, who will serve as the primary point of contact between Thistlewood and both Calderwood & Harkness and AGMG for the purposes of this Engagement.
Thistlewood's scope of work encompasses the technical audit of cookie-consent mechanisms across AGMG's digital properties, including automated and manual website scanning, cookie tagging and categorisation, data-flow mapping at the network and application layer, and the production of a technical audit report. A summary of Thistlewood's scope of work is enclosed at Annex C.
Thistlewood's fixed fee for its engagement is £145,000 (exclusive of VAT). This fee may be paid by AGMG directly to Thistlewood under the terms of AGMG's separate engagement with Thistlewood, or, at AGMG's election, may be passed through Calderwood & Harkness's account as a disbursement, in which case it will appear on Calderwood & Harkness's invoices and be subject to the payment terms set out in Section 6.5 above.
Critically, Thistlewood's technical audit will be conducted under Calderwood & Harkness's direction and oversight, and all Thistlewood work product produced in connection with this Engagement will be treated as subject to legal professional privilege and the common-interest arrangements described in Section 8 below. Thistlewood's audit report and all underlying work papers will be addressed to Calderwood & Harkness in the first instance and shared with AGMG under the common-interest protocol. Calderwood & Harkness will coordinate all instructions to Thistlewood and will review all Thistlewood deliverables before they are finalised.
8. Privilege and Common-Interest Arrangements
8.1 Legal Professional Privilege
All advice provided by Calderwood & Harkness in connection with this Engagement is protected by legal professional privilege. In particular:
(a) Legal advice privilege attaches to all confidential communications between Calderwood & Harkness and AGMG made for the purpose of giving or receiving legal advice in connection with this Engagement; and
(b) Litigation privilege is also engaged in respect of communications and work product created for the dominant purpose of anticipated or pending regulatory proceedings, given the existence of the CNIL formal notice (MED-2023-097) and the ICO informal inquiry (ICO/ENF/2023/LTR-11084), both of which create a reasonable prospect of adversarial regulatory proceedings.
We will take all reasonable steps to preserve privilege over all communications, advice, and work product generated in connection with this Engagement. All privileged documents will be marked "PRIVILEGED AND CONFIDENTIAL — SUBJECT TO LEGAL PROFESSIONAL PRIVILEGE" or with words to similar effect.
8.2 Common-Interest Privilege Protocol
Given the involvement of Thistlewood Consulting Ltd as a technical consultant working under Calderwood & Harkness's direction, it is necessary to establish a framework for the sharing of privileged information among Calderwood & Harkness, AGMG, and Thistlewood without waiving privilege.
Accordingly, Calderwood & Harkness will prepare a separate Common Interest and Privilege Protocol Memorandum (the "Protocol") to govern the sharing of privileged information among the three parties. The Protocol will establish:
(a) document-handling procedures, including the classification, marking, storage, and transmission of privileged documents;
(b) privilege markings to be applied to all audit findings, legal analyses, remediation plans, and related work product;
(c) communication channels to be used for the exchange of privileged information, including designated e-mail addresses and secure file-sharing platforms; and
(d) restrictions on further dissemination of privileged information outside the common-interest group without the prior written consent of all parties.
The key contacts under the Protocol will be:
•  Calderwood & Harkness: Rachel Bernstein (Partner) and Priscilla Wynn (Senior Associate)
•  AGMG: Margaux Fontaine-Li (Group Data Protection Officer)
•  Thistlewood Consulting Ltd: Marcus Drayford (Principal Consultant)
For the avoidance of doubt, the common-interest arrangement does not create a solicitor-client relationship between Calderwood & Harkness and Thistlewood. Thistlewood is not a client of Calderwood & Harkness, and Calderwood & Harkness owes no duty of care to Thistlewood in connection with this Engagement.
8.3 Waiver.  AGMG should exercise great care to avoid any inadvertent waiver of privilege over communications and work product generated in connection with this Engagement. In particular:
(a) AGMG should not disclose privileged communications or work product to any third party without prior consultation with Calderwood & Harkness, as such disclosure may constitute a waiver of privilege — potentially on a broad, subject-matter basis;
(b) any proposed disclosure of privileged materials to AGMG's external auditors, Hollander Warwick LLP, or to members of AGMG's Board of Directors or Audit Committee who are not within the existing common-interest group, should be discussed with Rachel Bernstein in advance so that appropriate measures can be put in place to preserve applicable protections; and
(c) particular care should be taken with internal e-mail communications, as the forwarding of privileged advice to individuals outside the privileged circle (including to AGMG employees who are not directly involved in the Engagement) may jeopardise the privileged status of those communications.
9. Conflicts of Interest
Calderwood & Harkness has conducted a comprehensive conflicts check in accordance with the firm's internal procedures and the requirements of the Solicitors Regulation Authority ("SRA"). Based on this check, the firm confirms that it does not currently act for any party adverse to AGMG's interests in connection with this Matter.
In particular, the firm confirms that it does not act for any of the following entities or their legal representatives:
(a) Digitale Rechte Europa e.V. (DRE), the complainant, whose legal counsel in connection with the CNIL complaint is understood to be Kreisel & Hausmann Rechtsanwälte PartG mbB, Berlin;
(b) Pendleton AdTech Solutions Ltd, whose outside legal counsel is understood to be Dalrymple Kearney & Co., Dublin;
(c) VoltGraph Analytics GmbH, whose outside legal counsel is understood to be Feldstein Weber LLP, Frankfurt; or
(d) Brightleaf Consent Technologies Inc. or its EU subsidiary Brightleaf Consent Technologies EU B.V.
Calderwood & Harkness maintains an ongoing obligation to monitor for conflicts throughout the duration of the Engagement. If any actual or potential conflict of interest arises during the course of the Engagement, the firm will notify AGMG promptly and discuss appropriate measures, which may include the implementation of information barriers or, in exceptional circumstances, the withdrawal of the firm from the Engagement or the affected workstream.
10. Confidentiality
Calderwood & Harkness will treat all information received from or on behalf of AGMG in connection with this Engagement as strictly confidential. This obligation is subject to any overriding obligations imposed by law, regulation, court order, or the firm's professional rules (including the SRA Standards and Regulations).
The firm will not disclose confidential information to any third party without AGMG's prior written consent, except:
(a) as required by applicable law or regulation;
(b) as required by the firm's professional regulatory obligations;
(c) to the extent necessary to perform the Engagement, including communications with the CNIL and the ICO on AGMG's behalf (which will be made with AGMG's prior knowledge and approval) and communications with Thistlewood Consulting Ltd under the common-interest protocol described in Section 8; and
(d) to the firm's professional indemnity insurers, auditors, or legal advisers, to the extent reasonably necessary.
This confidentiality obligation shall continue in force following the completion or termination of the Engagement, without limitation of time.
11. Regulatory Context and Risk Exposure
For context, and to frame the urgency of the Engagement, Calderwood & Harkness draws AGMG's attention to the following regarding the Company's potential regulatory exposure:
CNIL Exposure. Under Article 83(5) GDPR, the CNIL has the power to impose administrative fines of up to the higher of €20 million or 4% of the total worldwide annual turnover of the undertaking in the preceding financial year, for infringements of the provisions identified in the CNIL's formal notice. Based on AGMG's reported FY 2023 annual revenue of approximately £1.42 billion, the 4% threshold equates to approximately £56.8 million (approximately €64.7 million at prevailing exchange rates). In addition to monetary fines, the CNIL may impose corrective measures including orders to bring processing into compliance, temporary or definitive bans on processing, and orders to communicate a data breach to data subjects. The CNIL may also publish any resulting decision, which carries significant reputational risk for a listed media company.
ICO Exposure. Under the UK GDPR and the Data Protection Act 2018, the ICO has the power to impose monetary penalty notices of up to the higher of £17.5 million or 4% of total annual worldwide turnover for the most serious infringements. The ICO also has powers to issue enforcement notices, assessment notices, and information notices.
The compliance deadline imposed by CNIL formal notice MED-2023-097 is 14 March 2024, being three months from the date of issuance on 14 December 2023. Calderwood & Harkness will assess at an early stage of the Engagement whether it is advisable to seek an extension of this deadline from the CNIL, taking into account the complexity of the remediation programme, the scale of AGMG's digital operations, and the regulatory practice of the CNIL in granting extensions of mise en demeure deadlines. Any recommendation in this regard will be communicated to AGMG promptly.
12. Limitation of Liability
Calderwood & Harkness's aggregate liability to AGMG arising out of or in connection with this Engagement, whether in contract, tort (including negligence), breach of statutory duty, or otherwise, shall not exceed the greater of:
(a) £5,000,000 (five million pounds sterling); or
(b) three times the total fees actually paid to Calderwood & Harkness under this engagement letter.
This limitation applies to the aggregate of all claims arising out of or in connection with the Engagement and not separately to each claim or cause of action.
This limitation of liability does not apply to any loss arising from:
(a) fraud or dishonesty on the part of Calderwood & Harkness or any of its partners, employees, or agents;
(b) wilful misconduct; or
(c) any breach of the firm's regulatory obligations where the applicable regulatory framework prohibits contractual limitation of liability in respect of such breach.
Nothing in this section shall be construed as excluding or limiting any liability that cannot lawfully be excluded or limited under English law or the regulatory requirements applicable to Calderwood & Harkness.
13. Data Protection — Firm as Controller
In providing legal services under this Engagement, Calderwood & Harkness will process personal data relating to individuals associated with AGMG and its business partners (including employees, officers, directors, and vendor representatives) as an independent controller for the purposes of the UK GDPR and the Data Protection Act 2018.
The firm processes such personal data for the purposes of providing legal services, managing the client relationship, complying with legal and regulatory obligations (including anti-money laundering and sanctions screening requirements), and administering the firm's business. The firm's privacy notice, which sets out further details of how the firm processes personal data in the course of its legal practice, is available at www.calderwoodharkness.com/privacy-notice. A copy will be provided on request.
14. Termination
Either party may terminate this Engagement upon 14 calendar days' written notice to the other party, such notice to be sent to the addresses specified in this letter (or such other address as may be notified in writing from time to time).
In the event of termination:
(a) AGMG will be liable for all professional fees and disbursements properly incurred up to the effective date of termination, subject to the fee cap for professional fees incurred prior to termination;
(b) AGMG will be liable for any irrevocable commitments made on AGMG's behalf prior to the effective date of termination (including, for example, commitments to Thistlewood Consulting Ltd or disbursements already incurred); and
(c) upon termination, Calderwood & Harkness will, subject to any applicable law or regulation or the firm's professional obligations (including document retention requirements), return or make available to AGMG all client documents and materials in the firm's possession.
Calderwood & Harkness's obligations regarding privilege, confidentiality, and data protection shall survive the termination of this Engagement and continue in full force and effect.
15. Governing Law and Jurisdiction
This engagement letter, and any non-contractual obligations arising out of or in connection with it, shall be governed by and construed in accordance with the laws of England and Wales.
The courts of England and Wales shall have exclusive jurisdiction in relation to any dispute, claim, or matter arising out of or in connection with this engagement letter, including any dispute as to its existence, validity, or termination.
16. Acceptance and Execution
We should be grateful if you would indicate AGMG's acceptance of the terms of this engagement letter by signing and returning the acknowledgment below. A countersigned copy may be returned by post, courier, or scanned e-mail to Rachel Bernstein at r.bernstein@calderwoodharkness.com. This engagement letter will become binding upon receipt of the countersigned copy.
If you have any questions about the terms of this letter or any aspect of the proposed Engagement, please do not hesitate to contact Rachel Bernstein or Priscilla Wynn. We look forward to working with you and the AGMG team on this important matter.
Yours sincerely,
CALDERWOOD & HARKNESS LLP
By: ________
Name: Rachel Bernstein
Title: Partner, Privacy & Data Security Practice
Date: 12 January 2024
ACKNOWLEDGMENT AND ACCEPTANCE
I have read and agree to the terms of this engagement letter on behalf of Aurelius Global Media Group PLC (Companies House No. 08741562). I confirm that I am duly authorised to accept these terms on behalf of the Company.
AURELIUS GLOBAL MEDIA GROUP PLC
By: ________
Name: Sanjay Redworth
Title: Group General Counsel & Company Secretary
Date: ________
ENCLOSURES
The following annexes are enclosed with or appended to this engagement letter:
Annex A: Calderwood & Harkness LLP — Standard Terms of Business
Annex B: Engagement Team Biographies
Annex C: Thistlewood Consulting Ltd — Scope of Technical Audit (summary)
Team Member | Role | Hourly Rate (£) | Estimated Hours | Estimated Fees (£)
Rachel Bernstein | Partner | 895 | 85 | 76,075
Kevin Ostrowski | Partner | 875 | 40 | 35,000
Priscilla Wynn | Senior Associate | 625 | 260 | 162,500
Alan Burke | Associate | 475 | 310 | 147,250
Total | 420,825
Component | Estimated Amount (£)
Calderwood & Harkness professional fees (capped) | 425,000
Thistlewood Consulting Ltd fee (pass-through disbursement) | 145,000
Total estimated client cost | 570,000

PRIVATE & CONFIDENTIAL — SUBJECT TO LEGAL PROFESSIONAL PRIVILEGE

CALDERWOOD & HARKNESS LLP

Record

Parties

Dates

Amounts