Attachments: - Draft EU SCCs (Module 2 — Controller to Processor) — NTP to Caldwell Analytics [DRAFT 27.06.2023].docx - Draft Annex I — List of Parties and Description of Transfer [DRAFT 27.06.2023].docx - Draft Annex II — Technical and Organisational Measures [DRAFT 27.06.2023].docx - Draft Annex III — List of Sub-Processors [DRAFT 27.06.2023].docx - Draft UK International Data Transfer Agreement (IDTA) — NTP to Caldwell Analytics [DRAFT 27.06.2023].docx
Dear Natalie,
I hope you are well. I am writing on behalf of our client, Northgate Telecommunications PLC ("NTP"), in connection with the international data transfer arrangements between NTP and Caldwell Analytics Inc. ("Caldwell"). This follows on from the recent discussions between the parties regarding the need to put in place appropriate transfer mechanisms for the ongoing data flows under the Master Services Agreement dated 1 June 2021 (the "MSA").
**Background**
By way of brief context, NTP, acting as controller, transfers network performance data — including subscriber metadata, location data, and device identifiers — to Caldwell, acting as processor, for the purpose of AI-driven network analytics and predictive maintenance services. The data is transferred from the UK and EU to Caldwell's facilities in San Jose, California, USA (principal office: 2700 Technology Drive, Suite 400, San Jose, CA 95134). Although the data is pseudonymised prior to transfer, it nonetheless constitutes personal data under both the UK GDPR and the EU GDPR. Given the absence of a general adequacy decision covering the United States for EU GDPR purposes, and the requirements established following Schrems II, NTP requires the execution of EU Standard Contractual Clauses and a UK International Data Transfer Agreement to provide a lawful basis for these transfers. I should also note that NTP has completed a comprehensive Data Protection Impact Assessment covering this specific data flow and is in the process of finalising a Transfer Impact Assessment of the US legal framework, which will be shared separately once completed.
**Attached Draft Documents**
Please find attached the following five draft documents for Caldwell's review and comment:
**1. Draft EU SCCs (Module 2 — Controller to Processor)**
These have been prepared on the basis of the European Commission's implementing decision of 4 June 2021 (Standard Contractual Clauses for international transfers under Article 46(2)(c) GDPR). We have selected Module 2 (Controller to Processor) to reflect NTP's role as data exporter and controller and Caldwell's role as data importer and processor. The main body of the clauses follows the Commission's standard text; NTP has populated the optional and variable provisions as set out in the accompanying annexes.
The data exporter is identified as Northgate Telecommunications PLC, registered at 140 Queensway Place, Reading, Berkshire RG1 4QT, United Kingdom, with its principal office at Northgate Tower, 88 Canary Wharf Boulevard, London E14 5HN (Company Number 04837291; ICO Registration Number ZA482917). The data importer is identified as Caldwell Analytics Inc., incorporated in Delaware, USA, with its principal office at 2700 Technology Drive, Suite 400, San Jose, CA 95134, USA.
The competent supervisory authority designated in the clauses is the Data Protection Commission (Ireland), as NTP's lead supervisory authority for EU operations through its establishment in Dublin (Northgate Ireland Ltd, Unit 12, Grand Canal Dock Business Centre, Barrow Street, Dublin 2, D02 KV92, Ireland; CRO Number 587214).
**2. Draft Annex I — List of Parties and Description of Transfer**
This annex identifies the data exporter as NTP (together with relevant EU subsidiaries, including Northgate Ireland Ltd and Northgate GmbH, as applicable) and the data importer as Caldwell Analytics Inc. The description of the transfer covers network performance data including subscriber metadata, location data, and device identifiers, processed for network analytics, anomaly detection, and predictive maintenance purposes. The categories of data subjects encompass approximately 6.3 million consumer subscribers and approximately 42,000 enterprise clients across NTP's UK and EU operations. The transfer operates on a continuous, real-time basis. The nature and purpose of processing are as described in the MSA, and the retention period is as specified in the MSA and consistent with NTP's data retention schedule.
**3. Draft Annex II — Technical and Organisational Measures**
This annex sets out the technical and organisational measures applicable to the transfer, including:
- Encryption at rest (AES-256) and in transit (TLS 1.3); - Pseudonymisation of direct identifiers prior to transfer; - Access controls and role-based access limitations; - Audit logging and monitoring; - Contractual audit rights for NTP, including on-site and remote audit mechanisms; - Data localisation requirements for certain categories of data; - Incident response and breach notification procedures.
These measures have been developed in consultation with NTP's Chief Information Security Officer, Thomas Okoye, and in coordination with the supplementary measures analysis forming part of the Transfer Impact Assessment.
**4. Draft Annex III — List of Sub-Processors**
The draft includes placeholder fields for Caldwell to populate with a complete and current list of sub-processors engaged in the processing of NTP personal data, including each sub-processor's name, address, description of processing, and location of processing. We would be grateful if Caldwell could complete this annex as part of its review. I would emphasise that NTP requires a specific authorisation mechanism for any changes to sub-processors, with adequate prior notice to enable NTP to object — a point addressed further below.
**5. Draft UK International Data Transfer Agreement (IDTA)**
This has been prepared in accordance with the ICO's template IDTA issued under Section 119A of the Data Protection Act 2018 and covers transfers of UK personal data from NTP to Caldwell under the UK GDPR. It is designed to complement and operate alongside the EU SCCs for the same data flows, ensuring comprehensive coverage under both the UK and EU regimes. The IDTA includes the mandatory tables (Parts 1 through 4) setting out parties, transfer details, security requirements, and termination provisions. NTP-specific fields have been pre-populated where possible.
**Specific Points for Caldwell's Attention**
I wanted to flag a few points where we anticipate Caldwell may have comments, or where NTP has taken a particular position:
- **Audit rights (Clause 8.9 of the SCCs):** NTP has included robust audit rights, including the right to conduct on-site inspections of Caldwell's facilities with reasonable notice. This reflects NTP's regulatory obligations and the importance it places on demonstrable compliance, particularly in light of the active DPC preliminary inquiry regarding cross-border transfers from NTP's Irish operations.
- **Sub-processor notification period:** NTP has proposed a 30-day prior written notice period for any changes to sub-processors, together with a right for NTP to object to such changes.
- **Data breach notification:** The draft requires Caldwell to notify NTP without undue delay and in any event within 24 hours of becoming aware of a personal data breach.
- **Data deletion / return:** Upon termination, the draft requires Caldwell to delete or return all personal data within 30 days, together with certification of deletion.
**Timeline**
We would be grateful if Caldwell, through Hargrove Lister & Webb, could provide comments on the draft EU SCCs, annexes, and UK IDTA within 10 business days — that is, by **11 July 2023**. NTP is working to have all international transfer mechanisms finalised and executed during Phase 4 of its GDPR compliance programme, which is due to commence on 10 July 2023, and its objective is to have the SCCs and IDTA fully executed as promptly as possible thereafter.
I should also mention that the Transfer Impact Assessment — covering the US legal framework, including analysis of FISA Section 702, Executive Order 12333, and the CLOUD Act — is being finalised separately by my colleague Rachel Bernstein and will be shared with Caldwell's team for reference once completed.
**Availability**
If it would be helpful, we would be very happy to arrange a call to walk through the drafts in more detail. We would suggest that such a call could include myself, Kevin Ostrowski (Responsible Partner on this matter), yourself, and Jennifer Huang. Please do let me know if you would find that useful, and we can coordinate diaries.
Thank you, Natalie. I look forward to hearing from you and to working together on getting these transfer mechanisms in place.
Kind regards,
**Sara Hendricks** Lead Associate, Privacy & Data Security Calderwood & Harkness LLP One Moorgate Square London EC2R 6AN
Solicitor (England & Wales)
T: +44 (0)20 7946 0283 E: s.hendricks@calderwoodharkness.co.uk
---
*This email and any attachments are confidential and may be subject to legal professional privilege. It is intended solely for the named recipient(s). If you have received this email in error, please notify the sender immediately and delete it from your system. You must not copy, distribute, or take any action in reliance on it. Calderwood & Harkness LLP is a limited liability partnership registered in England and Wales (OC 314728) and is authorised and regulated by the Solicitors Regulation Authority (SRA Number 487219). A list of members is available at the registered office.*