1022-00007 · Northgate Telecommunications PLC · Engagement

engagement-letter-ntp-gdpr.docx DOCUMENT Finance & Banking

19 / 39 ← → ✕

Contract analysis Extract to table

CALDERWOOD & HARKNESS LLP Solicitors

One Moorgate Square London EC2R 6AN United Kingdom

Telephone: +44 (0)20 7946 0100 Facsimile: +44 (0)20 7946 0101 www.calderwoodharkness.com

13 February 2023

Reference: SC/NTP/2023-0213/PDS

By email (fiona.gallagher@northgatetelecom.co.uk) and first-class post

Ms Fiona Gallagher General Counsel & Company Secretary Northgate Telecommunications PLC Northgate Tower, 88 Canary Wharf Boulevard London E14 5HN United Kingdom

Dear Ms Gallagher,

Re: Engagement of Calderwood & Harkness LLP — GDPR and UK GDPR Compliance Programme for Northgate Telecommunications PLC

We write further to the recent discussions between Calderwood & Harkness LLP and Northgate Telecommunications PLC regarding the proposed engagement of this Firm in connection with the design and implementation of a comprehensive GDPR and UK GDPR compliance programme for your organisation. We are pleased to confirm our willingness to act on behalf of Northgate Telecommunications PLC and its EU subsidiary operations in this matter, and this letter sets out the terms upon which Calderwood & Harkness LLP ("C&H" or "the Firm") will provide legal services to Northgate Telecommunications PLC ("NTP" or "the Client") in connection with the design, build, and implementation of a comprehensive data protection compliance programme addressing the requirements of the EU General Data Protection Regulation and the UK GDPR.

This engagement letter, together with its appendices, constitutes the agreement between C&H and NTP governing this engagement. This engagement shall become effective as of 13 February 2023 upon countersignature of this letter by an authorised representative of NTP. We would be grateful if you could arrange for the enclosed duplicate copy to be countersigned and returned to us at your earliest convenience.

We set out below the detailed terms of the engagement.

1. THE CLIENT

1.1 The Client is Northgate Telecommunications PLC, a public limited company incorporated in England and Wales under Company Number 04837291, with its registered office at 140 Queensway Place, Reading, Berkshire RG1 4QT, United Kingdom, and its principal office at Northgate Tower, 88 Canary Wharf Boulevard, London E14 5HN, United Kingdom.

1.2 NTP is a UK-headquartered public limited company operating telecommunications infrastructure and enterprise software-as-a-service ("SaaS") solutions across the United Kingdom and the European Union. NTP is registered with the UK Information Commissioner's Office under Registration Number ZA482917.

1.3 This engagement encompasses NTP PLC and its EU subsidiary operations. For the avoidance of doubt, the following subsidiaries fall within the scope of this engagement and are collectively referred to herein (together with NTP PLC) as the "NTP Group":

(a) Northgate Ireland Ltd, a company incorporated in Ireland, CRO Number 587214, with its registered office in Dublin, Ireland;

(b) Northgate GmbH, a company incorporated in the Federal Republic of Germany, registered at the Amtsgericht Charlottenburg under HRB 214503 B, with its registered office in Berlin, Germany;

(c) Northgate B.V., a company incorporated in the Netherlands, KvK Number 72841936, with its registered office in Amsterdam, the Netherlands;

(d) Northgate France SAS, a company incorporated in the French Republic, SIREN 891 247 503, with its registered office in Paris, France; and

(e) Northgate Iberia S.L., a company incorporated in the Kingdom of Spain, CIF B-91847263, with its registered office in Madrid, Spain.

1.4 The primary client contact for the purposes of this engagement shall be Ms Fiona Gallagher, General Counsel & Company Secretary, Northgate Telecommunications PLC. All formal communications, approvals, and instructions relating to this engagement should be channelled through Ms Gallagher unless otherwise agreed in writing.

1.5 References in this engagement letter to "NTP" or the "Client" shall, unless the context otherwise requires, include each of the subsidiaries identified in paragraph 1.3 above.

2. SCOPE OF ENGAGEMENT

2.1 Overview. 2.1.1 C&H is engaged to design, build, and implement a comprehensive data protection compliance programme covering NTP's UK and EU operations (the "Programme"). The Programme is intended to address and satisfy the requirements of:

(a) the EU General Data Protection Regulation (Regulation (EU) 2016/679) (the "EU GDPR"); and

(b) the UK General Data Protection Regulation (as retained EU law pursuant to the European Union (Withdrawal) Act 2018, as amended, read together with the Data Protection Act 2018) (the "UK GDPR"),

(together, the "GDPR Framework").

2.1.2 The scope of the Programme encompasses NTP PLC and each of the five EU subsidiaries identified in Section 1 above. C&H's advisory work will take into account the distinct regulatory requirements applicable in each jurisdiction in which NTP Group entities are established or in which they carry on processing activities.

2.1.3 By way of context, the engagement team notes the following operational characteristics of the NTP Group that are material to the scope and complexity of the Programme:

(a) NTP processes personal data of approximately 6.3 million consumer subscribers, 42,000 enterprise clients, and 11,400 employees across its UK and EU operations;

(b) NTP operates data centres in London, Frankfurt, Amsterdam, and Dublin, and routes significant volumes of personal data across those facilities in connection with the provision of telecommunications services;

(c) NTP operates the NorthCloud unified communications SaaS platform, which is deployed across 14 EU/EEA member states and involves the processing of personal data of enterprise client end-users, including communications metadata, user directory information, and content data;

(d) NTP provides Internet of Things ("IoT") connectivity services, involving the processing of device-level data, geolocation data, and telemetry data that may constitute personal data in certain circumstances; and

(e) NTP maintains contractual relationships with a significant number of third-party data processors and sub-processors, including hyperscale cloud infrastructure providers, analytics vendors, and enterprise software suppliers, a number of which involve international data transfers to jurisdictions outside the UK and EU/EEA.

2.1.4 The engagement is undertaken in the context of, and with reference to, the following regulatory and corporate governance developments:

(a) A resolution of the NTP Board Audit & Risk Committee dated 8 December 2022, mandating the comprehensive build of a GDPR compliance programme with external counsel engagement, with a target completion date of Q3 2023. C&H has been provided with a copy of the relevant board minutes and the accompanying memorandum prepared by Ms Gallagher;

(b) The Data Protection Commission (Ireland) ("DPC") preliminary inquiry (reference IN-22-11-3), opened in November 2022, regarding cross-border data transfers from Northgate Ireland Ltd to third-country recipients. C&H understands that the DPC has issued a request for information under Section 137 of the Data Protection Act 2018 (Ireland) and that NTP has provided an initial response, but the inquiry remains open; and

(c) The Information Commissioner's Office ("ICO") Enforcement Notice (reference ENF/2021/0934), issued on 15 September 2021, relating to deficiencies in NTP's data retention practices for consumer subscriber records processed through NTP's legacy billing platform. C&H understands that NTP has taken remedial steps in response to the Enforcement Notice but that certain outstanding requirements remain to be fully addressed.

2.1.5 The urgency and breadth of the Programme are informed by the regulatory context described above. C&H will work with NTP's internal data protection team and the Client's retained consultants to deliver the Programme within the indicative timeline set out in Appendix A to this letter.

2.2 Five-Phase Structure

2.2.1 The engagement will be structured in five sequential phases, as described below. Each phase will build upon the outputs of the preceding phase, and C&H will coordinate with NTP's internal teams and external consultants to ensure continuity and consistency across the Programme.

Phase 1: Assessment & Gap Analysis. 2.2.2 Phase 1 comprises a comprehensive assessment of NTP's current GDPR and UK GDPR compliance posture across all UK and EU operations. The principal activities and deliverables of Phase 1 are as follows:

(a) Assessment of current compliance posture. C&H will conduct a thorough assessment of NTP's existing data protection practices, governance structures, policies, and procedures against the requirements of the GDPR Framework. This assessment will cover all NTP Group entities and all material processing activities across the NTP Group's operations;

(b) Review of existing documentation. C&H will review NTP's existing data protection documentation, including (without limitation) existing privacy notices, data processing agreements, internal policies and procedures, consent mechanisms, data subject rights procedures, breach notification procedures, and any existing records of processing activities;

(c) Identification of processing activities. C&H will work with NTP's business units to identify and catalogue all processing activities across all business divisions and functions, including the NorthCloud platform, consumer telecommunications services, enterprise services, IoT connectivity, human resources, marketing, and corporate functions;

(d) Data mapping questionnaires. C&H will prepare and distribute data mapping questionnaires to NTP business units to facilitate the identification and documentation of processing activities. NTP will designate business unit data stewards to complete and return the questionnaires within the timescales agreed between the parties;

(e) Coordination with Ashdown Consulting Group Ltd. C&H will coordinate with Ashdown Consulting Group Ltd ("Ashdown"), NTP's retained privacy engineering and data mapping consultancy, on technical data flow inventories, system architecture documentation, and the configuration of the Sundial Solutions privacy management platform. The outputs of Ashdown's technical data mapping work will inform and complement C&H's legal assessment;

(f) Gap Analysis Report. C&H will prepare and deliver a written Gap Analysis Report identifying deficiencies, non-conformities, and areas of risk across the NTP Group's data protection compliance posture, together with prioritised recommendations for remediation. The Gap Analysis Report will be structured to facilitate review by the Audit & Risk Committee and will include a risk-rated action matrix; and

(g) Target completion date. Phase 1 is targeted for completion by 31 March 2023, subject to NTP's timely provision of information and cooperation as described in Section 4 below.

Phase 2: Records of Processing Activities (ROPA) & Data Mapping. 2.2.3 Phase 2 comprises the development of a comprehensive Article 30 records of processing activities framework for the NTP Group. The principal activities and deliverables of Phase 2 are as follows:

(a) ROPA framework development. C&H will design and build a comprehensive ROPA framework compliant with Article 30 of the EU GDPR and Article 30 of the UK GDPR for NTP PLC (UK operations) and all EU subsidiaries. The ROPA will be structured to reflect the organisational and operational structure of the NTP Group and will be designed for implementation within the Sundial Solutions platform;

(b) Cataloguing of processing activities. For each processing activity, the ROPA will document (as a minimum): the purposes of processing; the categories of data subjects and categories of personal data processed; the lawful basis or bases relied upon; the categories of recipients to whom personal data are disclosed; details of international transfers (including the transfer mechanism relied upon and, where applicable, the relevant third country or international organisation); the applicable retention periods or criteria for determining retention periods; and a general description of the technical and organisational security measures implemented;

(c) ROPA methodology and guidance. C&H will prepare ROPA methodology and guidance documentation for NTP's internal teams to enable the ongoing maintenance and updating of the ROPA following completion of the engagement. This documentation will include guidance on identifying new processing activities, updating existing records, and conducting periodic ROPA reviews;

(d) Legitimate Interest Assessment templates. C&H will prepare Legitimate Interest Assessment ("LIA") templates for processing activities that rely on legitimate interests as the lawful basis for processing under Article 6(1)(f) of the GDPR. The LIA templates will be designed for use by NTP's internal teams and will include worked examples relevant to NTP's operations;

(e) Coordination with Ashdown. C&H will coordinate with Ashdown on the outputs of Ashdown's technical data mapping exercises and will integrate technical data flow information into the ROPA;

(f) Delivery of ROPA v1.0. C&H will deliver the completed ROPA v1.0 to NTP, together with supporting documentation; and

(g) Target completion date. Phase 2 is targeted for completion by May 2023.

Phase 3: Data Protection Impact Assessments (DPIAs). 2.2.4 Phase 3 comprises the identification, prioritisation, and completion of data protection impact assessments for high-risk processing activities. The principal activities and deliverables of Phase 3 are as follows:

(a) Identification and prioritisation. C&H will identify and prioritise processing activities that are likely to result in a high risk to the rights and freedoms of natural persons and that accordingly require a DPIA under Article 35 of the GDPR. This identification exercise will draw upon the outputs of Phase 1 (Gap Analysis Report) and Phase 2 (ROPA v1.0), as well as the lists of processing operations published by the ICO and relevant EU supervisory authorities that require DPIAs;

(b) Conduct of DPIAs. C&H will conduct full DPIAs for all processing activities identified as requiring assessment. Each DPIA will include a systematic description of the processing operations and their purposes, an assessment of the necessity and proportionality of the processing, an assessment of the risks to the rights and freedoms of data subjects, and the measures envisaged to address those risks;

(c) Mitigation plans. Where a DPIA identifies residual high risks that cannot be sufficiently mitigated, C&H will prepare detailed mitigation plans setting out the additional technical and organisational measures to be implemented, and will advise NTP on whether prior consultation with the relevant supervisory authority under Article 36 of the GDPR is required;

(d) DPIA Summary Register and Board report. C&H will prepare a DPIA Summary Register documenting all DPIAs conducted, together with a Board-level summary report suitable for presentation to the Audit & Risk Committee; and

(e) Target completion date. Phase 3 is targeted for completion by July 2023.

Phase 4: International Data Transfer Mechanisms. 2.2.5 Phase 4 comprises the review and remediation of all international data transfer mechanisms relied upon by the NTP Group. The principal activities and deliverables of Phase 4 are as follows:

(a) Review of existing transfer mechanisms. C&H will review all existing international data transfer mechanisms in light of the Court of Justice of the European Union's judgment in Data Protection Commissioner v. Kestrel Services Inc. Ireland Limited and Maximillian Schrems (Case C-311/18) ("Schrems II") and subsequent regulatory guidance from the European Data Protection Board ("EDPB"), the ICO, and relevant national supervisory authorities;

(b) EU Standard Contractual Clauses. C&H will prepare, review, and negotiate EU Standard Contractual Clauses ("EU SCCs") in accordance with the European Commission's Implementing Decision (EU) 2021/914 of 4 June 2021, utilising Modules 2 (controller-to-processor) and 3 (processor-to-sub-processor) as appropriate for the relevant transfer relationships;

(c) UK International Data Transfer Agreements. C&H will prepare UK International Data Transfer Agreements ("IDTAs") in the form approved by the ICO for transfers of personal data subject to the UK GDPR to recipients in third countries that are not subject to a UK adequacy regulation;

(d) UK Addendum to EU SCCs. For transfers that are subject to both the UK GDPR and the EU GDPR, C&H will prepare the UK Addendum to the EU SCCs (as approved by the ICO), ensuring that a single contractual mechanism adequately covers both regimes where appropriate;

(e) Transfer Impact Assessments. C&H will conduct Transfer Impact Assessments ("TIAs") for transfers to third countries that are not the subject of an adequacy decision by the European Commission or the UK Secretary of State. Each TIA will assess the legal framework in the recipient country, including relevant surveillance and government access legislation, and will identify any supplementary measures required;

(f) Review and amendment of Data Processing Agreements. C&H will review and, where necessary, prepare amendments to existing Data Processing Agreements ("DPAs") with key processors to ensure compliance with Article 28 of the GDPR and to incorporate updated international data transfer provisions;

(g) International Transfers Policy. C&H will prepare an internal International Transfers Policy and Mechanism Selection Guidance document for use by NTP's internal teams when evaluating new or modified international data transfers;

(h) Coordination with counterparty counsel. Where necessary, C&H will liaise and negotiate with the legal teams or external counsel of NTP's key processors and counterparties in connection with the execution of SCCs, IDTAs, and DPA amendments; and

(i) Target completion date. Phase 4 is targeted for completion by August 2023.

Phase 5: Policies, Training & Governance. 2.2.6 Phase 5 comprises the development of group-wide policies, operational procedures, and governance structures, together with the delivery of Board-level training and the preparation of regulatory submissions. The principal activities and deliverables of Phase 5 are as follows:

(a) Group Data Protection Policy. C&H will draft a comprehensive Group Data Protection Policy for adoption across the NTP Group (including NTP PLC and all EU subsidiaries), addressing the overarching principles, governance structures, roles and responsibilities, and accountability mechanisms required under the GDPR Framework;

(b) Operational procedures. C&H will prepare operational procedures covering the following areas (at a minimum): handling and responding to data subject rights requests (including access, rectification, erasure, restriction, portability, and objection); personal data breach detection, assessment, notification, and documentation procedures (in compliance with Articles 33 and 34 of the GDPR and the requirements of the ICO, DPC, and other relevant supervisory authorities); and data retention and deletion procedures, including retention schedules aligned with the ROPA;

(c) External-facing privacy notices. C&H will review and revise NTP's external-facing privacy notices (including the consumer subscriber privacy notice, enterprise client privacy notice, employee privacy notice, and NorthCloud platform privacy notice) to ensure compliance with Articles 13 and 14 of the GDPR;

(d) Board-level GDPR training. C&H will prepare and deliver a Board-level GDPR training session for NTP's Board of Directors and Audit & Risk Committee members, covering directors' duties and obligations in relation to data protection, the key risks and regulatory landscape, and the principal outputs of the Programme;

(e) DPC inquiry response. C&H will assist NTP in preparing a response to the DPC preliminary inquiry (reference IN-22-11-3) as required, drawing on the outputs of the international data transfer workstreams (Phase 4) and the broader Programme deliverables;

(f) Handover and ongoing obligations summary. Upon completion of the Programme, C&H will conduct a structured handover of all deliverables to NTP's internal data protection team, together with a summary of ongoing obligations and recommended next steps for the maintenance and continuous improvement of the Programme; and

(g) Target completion date. Phase 5 is targeted for completion by September 2023.

2.3 Scope Limitations

2.3.1 The engagement encompasses legal advisory, drafting, and programme design services in the areas described above. For the avoidance of doubt, the engagement does not extend to the following:

(a) IT consultancy and technology implementation. The engagement does not include the provision of IT consultancy, privacy engineering, or technology implementation services. NTP has separately retained Ashdown Consulting Group Ltd for the provision of such services, including technical data flow inventories, system architecture assessments, and Sundial Solutions privacy management platform configuration. C&H is not responsible for the quality, completeness, or timeliness of Ashdown's technical work, and C&H's legal advice will be based on the technical information provided to it by Ashdown and NTP;

(b) Contentious proceedings and regulatory investigations. The engagement does not include representation of NTP in any contentious proceedings, enforcement actions, or formal regulatory investigations (whether before the ICO, the DPC, or any other supervisory authority). Should any such proceedings arise during or as a result of the engagement, separate terms of engagement would be agreed between the parties, including any necessary adjustments to fees and scope. For the avoidance of doubt, the preparation of the DPC inquiry response under Phase 5 is a non-contentious advisory activity; should the DPC inquiry escalate to a formal investigation or enforcement proceeding, separate engagement terms would apply;

(c) Tax advice. The engagement does not include tax advice of any kind. Where tax implications arise in the course of the engagement (including, without limitation, transfer pricing considerations relating to intra-group data processing arrangements, VAT treatment of cross-border data processing services, or the tax characterisation of data assets), NTP should seek independent advice from qualified tax counsel or accountants; and

(d) Non-GDPR regulatory compliance. The scope of the engagement does not extend to NTP's compliance with regulatory obligations other than those arising under the GDPR Framework, including (without limitation) obligations arising under the Regulation of Investigatory Powers Act 2000, the Investigatory Powers Act 2016, the Privacy and Electronic Communications (EC Directive) Regulations 2003, the ePrivacy Directive (Directive 2002/58/EC), the Network and Information Systems Regulations 2018, or applicable telecommunications licensing and regulatory requirements, except insofar as such obligations intersect with or have a direct bearing on NTP's GDPR compliance considerations.

3. ENGAGEMENT TEAM

3.1 The following individuals will comprise the core engagement team for this matter:

3.2 Responsible Partner — Kevin Ostrowski

Mr Ostrowski is a Partner in C&H's Privacy & Data Security practice group, with eighteen years' experience advising on EU and UK data protection law. Mr Ostrowski is a Solicitor of the Senior Courts of England and Wales, admitted in 2005. He has extensive experience advising multinational corporations, financial institutions, and technology companies on the design and implementation of GDPR compliance programmes, international data transfer strategies, and regulatory interactions with the ICO, DPC, and other European supervisory authorities. Mr Ostrowski will have overall supervisory responsibility for the engagement and will serve as the primary relationship partner for NTP.

3.3 Billing Partner — Rachel Bernstein

Ms Bernstein is a Partner in C&H's Privacy & Data Security practice group, specialising in cross-border data transfers and telecommunications regulation. Ms Bernstein is a Solicitor of the Senior Courts of England and Wales, admitted in 2008, and is also admitted to practice in the State of New York. She has significant experience advising telecommunications and technology companies on international data transfer compliance in the post-Schrems II landscape and on regulatory interactions with European supervisory authorities. Ms Bernstein will lead the international data transfer workstreams under Phase 4 and will have primary responsibility for the DPC inquiry response under Phase 5.

3.4 Lead Associate — Sara Hendricks

Ms Hendricks is a Senior Associate in C&H's Privacy & Data Security practice group, with six years of post-qualification experience. Ms Hendricks is a Solicitor of the Senior Courts of England and Wales, admitted in 2017, and holds the Certified Information Privacy Professional/Europe (CIPP/E) and Certified Information Privacy Manager (CIPM) certifications from the International Association of Privacy Professionals ("IAPP"). She has particular expertise in data protection impact assessments and privacy-by-design frameworks. Ms Hendricks will serve as the day-to-day lead for the engagement and will be the primary point of contact for NTP on operational matters throughout the Programme.

3.5 Working Associate — Priscilla Wynn

Ms Wynn is an Associate in C&H's Privacy & Data Security practice group, with three years of post-qualification experience. Ms Wynn is a Solicitor of the Senior Courts of England and Wales, admitted in 2020, and has developed specialist expertise in records of processing activities development, data mapping methodologies, and data processing agreement negotiation. Ms Wynn will lead the ROPA and data mapping workstreams under Phase 2.

3.6 C&H may involve additional fee-earners, including other associates, trainees, and paralegals, as workload demands require during the course of the engagement. C&H will provide prior notice to the Client of any additional fee-earners assigned to material workstreams, together with their applicable hourly rates (which shall not exceed the rates set out in Section 5.1 below for the relevant category of fee-earner).

4. CLIENT CONTACTS AND COOPERATION

4.1 The primary client contact for this engagement is Ms Fiona Gallagher, General Counsel & Company Secretary, Northgate Telecommunications PLC. All formal instructions, approvals, and material communications relating to this engagement should be directed through Ms Gallagher unless otherwise agreed.

4.2 C&H will coordinate directly with the following key client stakeholders in the course of the engagement:

(a) Sanjay Mehta, Data Protection Officer (CIPP/E certified; appointed March 2019). Mr Mehta will be C&H's primary internal counterpart on data protection matters and will facilitate access to NTP's existing data protection documentation, policies, and records;

(b) Thomas Okoye, Chief Information Security Officer. Mr Okoye will liaise with C&H on matters relating to technical and organisational security measures, data centre operations, and the security aspects of DPIAs and TIAs;

(c) Laura Dearden, VP, Product & Engineering (NorthCloud). Ms Dearden will provide C&H with information and access relating to the NorthCloud platform's data processing activities, system architecture, and product roadmap;

(d) Philippa Crane, Head of People & HR. Ms Crane will coordinate with C&H on matters relating to employee data processing, HR systems, and the employee privacy notice; and

(e) Marcus Engström, Head of EU Operations (based in Dublin). Mr Engström will serve as C&H's primary contact for the EU subsidiary operations and will facilitate C&H's engagement with subsidiary management and local data protection contacts.

4.3 NTP agrees to provide timely access to relevant personnel, systems, documentation, and data as may be reasonably necessary for C&H to perform its obligations under this engagement. Without limiting the foregoing, NTP undertakes to:

(a) make available the client stakeholders identified in paragraph 4.2 above for meetings, interviews, and follow-up queries within reasonable timeframes;

(b) facilitate C&H's coordination with Ashdown Consulting Group Ltd (NTP's retained privacy engineering and data mapping consultancy) and Whitmore Kendall LLP (NTP's statutory auditors) where access to technical data mapping outputs or audit-related documentation is necessary for C&H's legal workstreams;

(c) designate business unit data stewards within each relevant NTP business unit to complete and return data mapping questionnaires within the timescales agreed between the parties; and

(d) provide C&H with access to relevant contractual documentation, including existing data processing agreements, service agreements with third-party processors, intra-group data sharing arrangements, and existing privacy notices and policies.

4.4 NTP acknowledges that C&H's ability to meet the indicative timelines set out in Appendix A is contingent upon the timely provision by NTP of the information, documentation, access, and cooperation described in this Section 4. Delays in the provision of such cooperation may result in corresponding delays to the Programme timeline, and C&H shall not be liable for any such delays to the extent attributable to the Client.

5. FEES AND BILLING ARRANGEMENTS

5.1 Hourly Rates

5.1.1 The following blended hourly rates shall apply to this engagement:

5.1.2 The hourly rates set out above are exclusive of Value Added Tax ("VAT"), which will be charged at the applicable rate on all invoices issued by C&H. As at the date of this letter, the standard rate of VAT is 20%.

5.1.3 The hourly rates set out in paragraph 5.1.1 are fixed for the duration of this engagement and will not be subject to annual rate increases or other adjustments during the engagement period.

5.2 Phase-Based Fee Caps

5.2.1 Professional fees for each phase of the engagement shall not exceed the following caps without prior written agreement from the Client:

5.2.2 The total engagement fee cap of £850,000 represents the sum of all individual phase caps (£185,000 + £210,000 + £155,000 + £175,000 + £125,000).

5.2.3 Each phase cap operates independently. Any unused portion of a phase cap shall not carry forward to subsequent phases unless the parties agree otherwise in writing. Similarly, any overspend on one phase may not be offset against an underspend on another phase without the Client's prior written consent.

5.2.4 C&H will monitor time expenditure against each phase cap on an ongoing basis. If it becomes apparent during the course of any phase that work within that phase may approach or is likely to exceed the relevant cap, C&H will promptly notify the Client, providing an estimate of the anticipated additional fees and the reasons therefor, and will seek the Client's written authorisation before incurring any fees in excess of the applicable cap. C&H shall not be obligated to continue work on a phase in respect of which the fee cap has been reached unless the Client has provided written authorisation for additional fees.

5.3 Disbursements and Expenses

5.3.1 In addition to professional fees, NTP shall be liable for reasonable disbursements and out-of-pocket expenses incurred by C&H in connection with the engagement, including (without limitation) travel expenses, accommodation, printing and copying charges, courier and postage costs, and external legal research database charges.

5.3.2 Disbursements for the full engagement are estimated at £32,000. This estimate is provided in good faith based on C&H's current understanding of the likely travel and operational requirements of the Programme, but is not a cap and may vary depending on the actual requirements of the engagement.

5.3.3 Disbursements are not subject to the phase-based fee caps set out in paragraph 5.2.1 and will be invoiced at cost, without mark-up.

5.3.4 Travel to NTP subsidiary offices in Dublin, Berlin, Amsterdam, Paris, and Madrid will be charged at reasonable business-class rates where flights are required and at economy rail rates where rail travel is practical. Hotel accommodation will be charged at reasonable business rates. C&H will exercise reasonable judgement in incurring travel expenses and will endeavour to minimise travel costs through the use of video conferencing where practicable, subject to the operational requirements of the engagement.

5.4 Billing and Payment Terms

5.4.1 C&H will issue invoices to NTP on a monthly basis in arrears. Each invoice will be accompanied by a detailed narrative description of the work performed during the relevant billing period, broken down by fee-earner, including the date, time spent, and a description of each activity.

5.4.2 Invoices are payable within thirty (30) days of the date of the invoice. Payment should be made by electronic bank transfer to C&H's client account, the details of which will be provided on each invoice.

5.4.3 C&H reserves the right to charge interest on any amounts that remain unpaid after the expiry of the 30-day payment period. Interest shall accrue on overdue amounts at the rate of 2% per annum above the Bank of England base rate from time to time, calculated on a daily basis from the due date until the date of actual payment.

5.4.4 All invoices shall be addressed and sent to the attention of Ms Fiona Gallagher, General Counsel & Company Secretary, at NTP's principal office at Northgate Tower, 88 Canary Wharf Boulevard, London E14 5HN, or to such other address or email address as the Client may notify C&H in writing from time to time.

5.4.5 Any queries regarding an invoice should be raised with Mr Kevin Ostrowski within fourteen (14) days of receipt of the invoice. In the event of a bona fide dispute regarding any item on an invoice, NTP shall pay the undisputed portion of the invoice within the 30-day period and shall notify C&H in writing of the specific items in dispute, together with the reasons for the dispute. The parties shall use reasonable endeavours to resolve any billing dispute promptly and in good faith.

6. THIRD-PARTY COORDINATION

6.1 NTP has separately retained Ashdown Consulting Group Ltd (Company Number 11293847), with offices at 15 Bedford Row, London WC1R 4BU (the "Technical Consultant"), as a privacy engineering and data mapping consultancy. Ashdown's scope of work includes technical data flow inventories, system architecture analysis, and the implementation and configuration of the Sundial Solutions privacy management platform for the NTP Group. C&H's engagement team will coordinate with Ashdown's team, including Mr Robert Fairclough, Managing Director, and Ms Anita Chakravarti, Lead Privacy Engineer, on the technical data mapping outputs and system-level information that will inform C&H's legal workstreams across each phase of the Programme.

6.2 For the avoidance of doubt, C&H is not responsible for the quality, completeness, accuracy, or timeliness of Ashdown's technical work. C&H's legal advice and deliverables will be based upon, and may rely upon, the technical data and system information provided to C&H by Ashdown and NTP. Where C&H identifies apparent gaps or inconsistencies in the technical information provided, C&H will raise such matters with NTP and Ashdown, but C&H does not assume responsibility for independently verifying the technical outputs.

6.3 In the course of the engagement, it may be necessary for C&H to interact with the legal teams or external counsel of NTP's third-party processors and counterparties, including but not limited to:

(a) Mr Graham Alderton, Head of Legal, Cloud Services Division, Pinnacle Cloud Services Ltd, in connection with the review and amendment of the data processing agreement between NTP and Pinnacle and the negotiation of international data transfer provisions; and

(b) Ms Natalie Prescott, Partner, Data Privacy & Cybersecurity, Hargrove Lister & Webb LLP (acting as outside counsel for Caldwell Analytics Inc.), in connection with the negotiation of EU Standard Contractual Clauses and related data transfer documentation between NTP and Caldwell Analytics.

6.4 C&H's professional duties run solely to NTP as the Client. C&H does not represent and owes no professional duty to any third party, including (without limitation) NTP's processors, sub-processors, counterparties, the Technical Consultant, or their respective legal advisers. No third party may rely on C&H's advice or work product without C&H's prior written consent.

7. CONFIDENTIALITY

7.1 C&H will treat all information provided by or on behalf of NTP in connection with this engagement as strictly confidential and will not disclose such information to any third party without the prior written consent of NTP, except to the extent that:

(a) disclosure is required by law, regulation, court order, or the rules of any regulatory body (including the Solicitors Regulation Authority) to which C&H is subject;

(b) disclosure is made to C&H's professional advisers, insurers, or auditors, who are bound by equivalent obligations of confidentiality;

(d) disclosure is reasonably necessary for the proper performance of C&H's obligations under this engagement (for example, disclosure to counterparty counsel in the course of SCC negotiations, with the Client's prior approval).

7.2 NTP acknowledges that the existence and terms of this engagement (but not privileged communications or work product) may need to be disclosed to relevant supervisory authorities, including the ICO and the DPC, in the course of regulatory interactions relating to the NTP Group's data protection compliance. C&H will consult with NTP before making any such disclosure and will limit the information disclosed to that which is reasonably necessary in the circumstances.

7.3 The obligations of confidentiality set out in this Section 7 shall survive the termination or expiry of this engagement.

8. LEGAL PROFESSIONAL PRIVILEGE

8.1 C&H will endeavour to maintain legal professional privilege (including, where applicable, litigation privilege and legal advice privilege) over all communications between C&H and NTP, and over all work product prepared by C&H in connection with this engagement, to the fullest extent permitted by law.

8.2 NTP should be aware that certain deliverables prepared by C&H in the course of this engagement are designed for external use or disclosure to third parties and, once so disclosed, will not attract or retain the protection of legal professional privilege. Such deliverables include, without limitation:

(a) the Records of Processing Activities (ROPA);

(b) external-facing privacy notices;

(c) the Group Data Protection Policy and operational procedures (to the extent disseminated within NTP beyond the legal function);

(d) data processing agreements and international data transfer agreements executed with third parties;

(e) the response to the DPC preliminary inquiry (reference IN-22-11-3); and

(f) the DPIA Summary Register (to the extent shared with supervisory authorities).

8.3 C&H will advise NTP on a case-by-case basis where privilege considerations arise, including where there is a risk that privilege may be waived by disclosure, and will work with NTP to structure communications and deliverables so as to preserve privilege to the greatest extent practicable.

8.4 NTP should take care not to disclose privileged communications or work product to third parties (including Ashdown Consulting Group Ltd or Whitmore Kendall LLP) without first consulting C&H, as such disclosure may constitute a waiver of privilege.

9. DATA PROTECTION — C&H AS CONTROLLER

9.1 In the course of providing legal services under this engagement, C&H will process personal data of NTP personnel, NTP data subjects, and other individuals whose personal data is contained in documentation and information provided to C&H by or on behalf of NTP. C&H will act as an independent data controller in respect of such processing, which is carried out for the purposes of providing legal services, complying with C&H's professional obligations, administering the client relationship, and managing C&H's business operations.

9.2 C&H's processing of personal data in connection with this engagement will be conducted in accordance with C&H's own data protection obligations under the UK GDPR and the Data Protection Act 2018. Further details regarding C&H's data processing practices, including the types of personal data processed, the purposes and lawful bases for processing, retention periods, and data subject rights, are set out in C&H's client privacy notice, which is available at www.calderwoodharkness.com/privacy-notice and a copy of which has been provided to NTP under separate cover.

10. CONFLICTS OF INTEREST

10.1 C&H has conducted a comprehensive conflict of interest check in accordance with its internal procedures and the requirements of the SRA Code of Conduct for Solicitors and the SRA Code of Conduct for Firms. C&H confirms that, as at the date of this letter:

(a) C&H does not currently represent, and has not within the preceding twelve months represented, Caldwell Analytics Inc., Pinnacle Cloud Services Ltd, or any of their affiliates, subsidiaries, or related entities in any matter adverse to NTP or any member of the NTP Group;

(b) C&H does not currently represent any party with interests that are adverse to, or may conflict with, the interests of NTP (Company Number 04837291) or any of its subsidiaries identified in Section 1 of this letter; and

(c) no existing client relationship, personal interest, or other circumstance has been identified that gives rise to an actual or potential conflict of interest in connection with this engagement.

10.2 C&H undertakes to monitor for conflicts of interest on an ongoing basis throughout the duration of this engagement and to notify NTP promptly in the event that any actual or potential conflict of interest is identified. In such circumstances, C&H will discuss the nature of the conflict with NTP and the available options, which may include obtaining informed written consent from the affected parties, implementing information barriers, or (in cases where the conflict cannot be adequately managed) terminating the engagement in accordance with Section 12 below.

11. LIMITATION OF LIABILITY

11.1 C&H's aggregate liability to NTP and the NTP Group arising out of or in connection with this engagement, whether in contract, tort (including negligence), breach of statutory duty, or otherwise, shall not exceed £10,000,000 (ten million pounds sterling), or such higher amount as may be required by the Solicitors Regulation Authority's Minimum Terms and Conditions of Professional Indemnity Insurance applicable to C&H at the relevant time.

11.2 C&H shall not be liable to NTP for any indirect, consequential, special, or punitive damages, or for any loss of profits, loss of revenue, loss of business, loss of opportunity, loss of data, or loss of goodwill, in each case whether arising in contract, tort (including negligence), breach of statutory duty, or otherwise, and whether or not such loss was foreseeable, to the maximum extent permitted by applicable law.

11.3 Nothing in this Section 11 shall exclude or limit C&H's liability for:

(a) fraud or wilful misconduct on the part of C&H, its partners, or its employees;

(b) death or personal injury caused by C&H's negligence; or

11.4 The limitations and exclusions set out in this Section 11 apply to C&H's liability to NTP and all members of the NTP Group in the aggregate, and not separately to each entity within the NTP Group.

11.5 NTP acknowledges that C&H's ability to provide the services contemplated by this engagement on the terms and at the fee levels set out herein is contingent upon the limitations of liability set out in this Section 11, which NTP has had the opportunity to consider and which it accepts as reasonable.

12. TERM AND TERMINATION

12.1 This engagement commences on 13 February 2023 (subject to countersignature of this letter by NTP) and shall continue until the completion of all five phases of the Programme (estimated completion: Q3 2023, being September 2023) or until terminated in accordance with this Section 12, whichever occurs first.

12.2 Either party may terminate this engagement at any time by giving the other party not less than thirty (30) days' prior written notice. Notice of termination by NTP should be addressed to Mr Kevin Ostrowski at C&H's address set out at the head of this letter; notice of termination by C&H should be addressed to Ms Fiona Gallagher at NTP's principal office.

12.3 In the event of termination of this engagement (whether by NTP, by C&H, or on completion of the Programme), NTP shall remain liable for:

(a) all professional fees incurred for work performed up to and including the effective date of termination, calculated in accordance with the hourly rates set out in Section 5.1 and subject to the applicable phase fee caps to the extent that work within a phase has been completed or substantially completed; and

(b) all disbursements and out-of-pocket expenses incurred up to and including the effective date of termination.

12.4 C&H reserves the right to terminate this engagement immediately, without the requirement for a 30-day notice period, in the following circumstances:

(a) a conflict of interest arises that cannot be resolved or adequately managed in accordance with C&H's professional obligations and the SRA Code of Conduct;

(b) NTP fails to pay any invoice within sixty (60) days of its due date;

(c) continuing the engagement would require C&H to act contrary to its professional obligations, including the SRA Code of Conduct for Solicitors or the SRA Code of Conduct for Firms; or

(d) NTP provides instructions that C&H reasonably considers to be improper or contrary to law.

12.5 Upon termination or expiry of this engagement, C&H will deliver to NTP all completed work product and, subject to C&H's right to retain copies in accordance with its professional obligations and record-keeping policies, all client documents and materials provided by NTP during the engagement. C&H's obligations of confidentiality under Section 7 shall survive termination.

13. REGULATORY STATUS AND PROFESSIONAL STANDARDS

13.1 Calderwood & Harkness LLP is a limited liability partnership incorporated in England and Wales (registered number OC387415) and is authorised and regulated by the Solicitors Regulation Authority ("SRA"), SRA Number 482716. C&H is subject to the SRA Standards and Regulations, including the SRA Principles, the SRA Code of Conduct for Solicitors, and the SRA Code of Conduct for Firms, copies of which are available at www.sra.org.uk.

13.2 If NTP is unhappy with any aspect of the service provided by C&H, NTP is entitled to make a complaint. In the first instance, complaints should be directed to Mr Kevin Ostrowski, the Responsible Partner for this engagement, or to C&H's Client Care Partner, Ms Eleanor Whitfield, who can be contacted at eleanor.whitfield@calderwoodharkness.com or by post at One Moorgate Square, London EC2R 6AN. C&H operates a formal complaints handling procedure, a copy of which is available upon request. If NTP is not satisfied with C&H's handling of a complaint, NTP may refer the matter to the Legal Ombudsman (www.legalombudsman.org.uk) within the timeframes prescribed by the Legal Ombudsman's scheme rules.

13.3 C&H maintains professional indemnity insurance in accordance with the SRA's Minimum Terms and Conditions. Details of C&H's professional indemnity insurance arrangements, including the identity of the insurer and the territorial coverage, are available upon request.

14. GOVERNING LAW AND JURISDICTION

14.1 This engagement letter and any non-contractual obligations arising out of or in connection with it shall be governed by and construed in accordance with the laws of England and Wales.

14.2 The courts of England and Wales shall have exclusive jurisdiction to settle any dispute arising out of or in connection with this engagement letter, including any dispute relating to any non-contractual obligations arising out of or in connection with it.

15. ACCEPTANCE AND COUNTERPARTS

15.1 We should be grateful if you would confirm NTP's acceptance of the terms set out in this engagement letter by arranging for an authorised signatory of NTP to countersign and return a copy of this letter to us. A duplicate copy is enclosed for this purpose. Alternatively, a scanned copy of the countersigned letter may be returned by email to kevin.ostrowski@calderwoodharkness.com, with the original to follow by post.

15.2 This engagement letter may be executed in any number of counterparts, each of which when so executed and delivered shall constitute an original, and all the counterparts together shall constitute one and the same instrument. Delivery of an executed counterpart by email (in PDF format) shall be as effective as delivery of a manually executed counterpart.

CALDERWOOD & HARKNESS LLP Solicitors
One Moorgate Square London EC2R 6AN United Kingdom
Telephone: +44 (0)20 7946 0100 Facsimile: +44 (0)20 7946 0101 www.calderwoodharkness.com
13 February 2023
Reference: SC/NTP/2023-0213/PDS
By email (fiona.gallagher@northgatetelecom.co.uk) and first-class post
Ms Fiona Gallagher General Counsel & Company Secretary Northgate Telecommunications PLC Northgate Tower, 88 Canary Wharf Boulevard London E14 5HN United Kingdom
Dear Ms Gallagher,
Re: Engagement of Calderwood & Harkness LLP — GDPR and UK GDPR Compliance Programme for Northgate Telecommunications PLC
We write further to the recent discussions between Calderwood & Harkness LLP and Northgate Telecommunications PLC regarding the proposed engagement of this Firm in connection with the design and implementation of a comprehensive GDPR and UK GDPR compliance programme for your organisation. We are pleased to confirm our willingness to act on behalf of Northgate Telecommunications PLC and its EU subsidiary operations in this matter, and this letter sets out the terms upon which Calderwood & Harkness LLP ("C&H" or "the Firm") will provide legal services to Northgate Telecommunications PLC ("NTP" or "the Client") in connection with the design, build, and implementation of a comprehensive data protection compliance programme addressing the requirements of the EU General Data Protection Regulation and the UK GDPR.
This engagement letter, together with its appendices, constitutes the agreement between C&H and NTP governing this engagement. This engagement shall become effective as of 13 February 2023 upon countersignature of this letter by an authorised representative of NTP. We would be grateful if you could arrange for the enclosed duplicate copy to be countersigned and returned to us at your earliest convenience.
We set out below the detailed terms of the engagement.
1. THE CLIENT
1.1 The Client is Northgate Telecommunications PLC, a public limited company incorporated in England and Wales under Company Number 04837291, with its registered office at 140 Queensway Place, Reading, Berkshire RG1 4QT, United Kingdom, and its principal office at Northgate Tower, 88 Canary Wharf Boulevard, London E14 5HN, United Kingdom.
1.2 NTP is a UK-headquartered public limited company operating telecommunications infrastructure and enterprise software-as-a-service ("SaaS") solutions across the United Kingdom and the European Union. NTP is registered with the UK Information Commissioner's Office under Registration Number ZA482917.
1.3 This engagement encompasses NTP PLC and its EU subsidiary operations. For the avoidance of doubt, the following subsidiaries fall within the scope of this engagement and are collectively referred to herein (together with NTP PLC) as the "NTP Group":
(a) Northgate Ireland Ltd, a company incorporated in Ireland, CRO Number 587214, with its registered office in Dublin, Ireland;
(b) Northgate GmbH, a company incorporated in the Federal Republic of Germany, registered at the Amtsgericht Charlottenburg under HRB 214503 B, with its registered office in Berlin, Germany;
(c) Northgate B.V., a company incorporated in the Netherlands, KvK Number 72841936, with its registered office in Amsterdam, the Netherlands;
(d) Northgate France SAS, a company incorporated in the French Republic, SIREN 891 247 503, with its registered office in Paris, France; and
(e) Northgate Iberia S.L., a company incorporated in the Kingdom of Spain, CIF B-91847263, with its registered office in Madrid, Spain.
1.4 The primary client contact for the purposes of this engagement shall be Ms Fiona Gallagher, General Counsel & Company Secretary, Northgate Telecommunications PLC. All formal communications, approvals, and instructions relating to this engagement should be channelled through Ms Gallagher unless otherwise agreed in writing.
1.5 References in this engagement letter to "NTP" or the "Client" shall, unless the context otherwise requires, include each of the subsidiaries identified in paragraph 1.3 above.
2. SCOPE OF ENGAGEMENT
2.1 Overview.  2.1.1 C&H is engaged to design, build, and implement a comprehensive data protection compliance programme covering NTP's UK and EU operations (the "Programme"). The Programme is intended to address and satisfy the requirements of:
(a) the EU General Data Protection Regulation (Regulation (EU) 2016/679) (the "EU GDPR"); and
(b) the UK General Data Protection Regulation (as retained EU law pursuant to the European Union (Withdrawal) Act 2018, as amended, read together with the Data Protection Act 2018) (the "UK GDPR"),
(together, the "GDPR Framework").
2.1.2 The scope of the Programme encompasses NTP PLC and each of the five EU subsidiaries identified in Section 1 above. C&H's advisory work will take into account the distinct regulatory requirements applicable in each jurisdiction in which NTP Group entities are established or in which they carry on processing activities.
2.1.3 By way of context, the engagement team notes the following operational characteristics of the NTP Group that are material to the scope and complexity of the Programme:
(a) NTP processes personal data of approximately 6.3 million consumer subscribers, 42,000 enterprise clients, and 11,400 employees across its UK and EU operations;
(b) NTP operates data centres in London, Frankfurt, Amsterdam, and Dublin, and routes significant volumes of personal data across those facilities in connection with the provision of telecommunications services;
(c) NTP operates the NorthCloud unified communications SaaS platform, which is deployed across 14 EU/EEA member states and involves the processing of personal data of enterprise client end-users, including communications metadata, user directory information, and content data;
(d) NTP provides Internet of Things ("IoT") connectivity services, involving the processing of device-level data, geolocation data, and telemetry data that may constitute personal data in certain circumstances; and
(e) NTP maintains contractual relationships with a significant number of third-party data processors and sub-processors, including hyperscale cloud infrastructure providers, analytics vendors, and enterprise software suppliers, a number of which involve international data transfers to jurisdictions outside the UK and EU/EEA.
2.1.4 The engagement is undertaken in the context of, and with reference to, the following regulatory and corporate governance developments:
(a) A resolution of the NTP Board Audit & Risk Committee dated 8 December 2022, mandating the comprehensive build of a GDPR compliance programme with external counsel engagement, with a target completion date of Q3 2023. C&H has been provided with a copy of the relevant board minutes and the accompanying memorandum prepared by Ms Gallagher;
(b) The Data Protection Commission (Ireland) ("DPC") preliminary inquiry (reference IN-22-11-3), opened in November 2022, regarding cross-border data transfers from Northgate Ireland Ltd to third-country recipients. C&H understands that the DPC has issued a request for information under Section 137 of the Data Protection Act 2018 (Ireland) and that NTP has provided an initial response, but the inquiry remains open; and
(c) The Information Commissioner's Office ("ICO") Enforcement Notice (reference ENF/2021/0934), issued on 15 September 2021, relating to deficiencies in NTP's data retention practices for consumer subscriber records processed through NTP's legacy billing platform. C&H understands that NTP has taken remedial steps in response to the Enforcement Notice but that certain outstanding requirements remain to be fully addressed.
2.1.5 The urgency and breadth of the Programme are informed by the regulatory context described above. C&H will work with NTP's internal data protection team and the Client's retained consultants to deliver the Programme within the indicative timeline set out in Appendix A to this letter.
2.2 Five-Phase Structure
2.2.1 The engagement will be structured in five sequential phases, as described below. Each phase will build upon the outputs of the preceding phase, and C&H will coordinate with NTP's internal teams and external consultants to ensure continuity and consistency across the Programme.
Phase 1: Assessment & Gap Analysis.  2.2.2 Phase 1 comprises a comprehensive assessment of NTP's current GDPR and UK GDPR compliance posture across all UK and EU operations. The principal activities and deliverables of Phase 1 are as follows:
(a) Assessment of current compliance posture. C&H will conduct a thorough assessment of NTP's existing data protection practices, governance structures, policies, and procedures against the requirements of the GDPR Framework. This assessment will cover all NTP Group entities and all material processing activities across the NTP Group's operations;
(b) Review of existing documentation. C&H will review NTP's existing data protection documentation, including (without limitation) existing privacy notices, data processing agreements, internal policies and procedures, consent mechanisms, data subject rights procedures, breach notification procedures, and any existing records of processing activities;
(c) Identification of processing activities. C&H will work with NTP's business units to identify and catalogue all processing activities across all business divisions and functions, including the NorthCloud platform, consumer telecommunications services, enterprise services, IoT connectivity, human resources, marketing, and corporate functions;
(d) Data mapping questionnaires. C&H will prepare and distribute data mapping questionnaires to NTP business units to facilitate the identification and documentation of processing activities. NTP will designate business unit data stewards to complete and return the questionnaires within the timescales agreed between the parties;
(e) Coordination with Ashdown Consulting Group Ltd. C&H will coordinate with Ashdown Consulting Group Ltd ("Ashdown"), NTP's retained privacy engineering and data mapping consultancy, on technical data flow inventories, system architecture documentation, and the configuration of the Sundial Solutions privacy management platform. The outputs of Ashdown's technical data mapping work will inform and complement C&H's legal assessment;
(f) Gap Analysis Report. C&H will prepare and deliver a written Gap Analysis Report identifying deficiencies, non-conformities, and areas of risk across the NTP Group's data protection compliance posture, together with prioritised recommendations for remediation. The Gap Analysis Report will be structured to facilitate review by the Audit & Risk Committee and will include a risk-rated action matrix; and
(g) Target completion date. Phase 1 is targeted for completion by 31 March 2023, subject to NTP's timely provision of information and cooperation as described in Section 4 below.
Phase 2: Records of Processing Activities (ROPA) & Data Mapping.  2.2.3 Phase 2 comprises the development of a comprehensive Article 30 records of processing activities framework for the NTP Group. The principal activities and deliverables of Phase 2 are as follows:
(a) ROPA framework development. C&H will design and build a comprehensive ROPA framework compliant with Article 30 of the EU GDPR and Article 30 of the UK GDPR for NTP PLC (UK operations) and all EU subsidiaries. The ROPA will be structured to reflect the organisational and operational structure of the NTP Group and will be designed for implementation within the Sundial Solutions platform;
(b) Cataloguing of processing activities. For each processing activity, the ROPA will document (as a minimum): the purposes of processing; the categories of data subjects and categories of personal data processed; the lawful basis or bases relied upon; the categories of recipients to whom personal data are disclosed; details of international transfers (including the transfer mechanism relied upon and, where applicable, the relevant third country or international organisation); the applicable retention periods or criteria for determining retention periods; and a general description of the technical and organisational security measures implemented;
(c) ROPA methodology and guidance. C&H will prepare ROPA methodology and guidance documentation for NTP's internal teams to enable the ongoing maintenance and updating of the ROPA following completion of the engagement. This documentation will include guidance on identifying new processing activities, updating existing records, and conducting periodic ROPA reviews;
(d) Legitimate Interest Assessment templates. C&H will prepare Legitimate Interest Assessment ("LIA") templates for processing activities that rely on legitimate interests as the lawful basis for processing under Article 6(1)(f) of the GDPR. The LIA templates will be designed for use by NTP's internal teams and will include worked examples relevant to NTP's operations;
(e) Coordination with Ashdown. C&H will coordinate with Ashdown on the outputs of Ashdown's technical data mapping exercises and will integrate technical data flow information into the ROPA;
(f) Delivery of ROPA v1.0. C&H will deliver the completed ROPA v1.0 to NTP, together with supporting documentation; and
(g) Target completion date. Phase 2 is targeted for completion by May 2023.
Phase 3: Data Protection Impact Assessments (DPIAs).  2.2.4 Phase 3 comprises the identification, prioritisation, and completion of data protection impact assessments for high-risk processing activities. The principal activities and deliverables of Phase 3 are as follows:
(a) Identification and prioritisation. C&H will identify and prioritise processing activities that are likely to result in a high risk to the rights and freedoms of natural persons and that accordingly require a DPIA under Article 35 of the GDPR. This identification exercise will draw upon the outputs of Phase 1 (Gap Analysis Report) and Phase 2 (ROPA v1.0), as well as the lists of processing operations published by the ICO and relevant EU supervisory authorities that require DPIAs;
(b) Conduct of DPIAs. C&H will conduct full DPIAs for all processing activities identified as requiring assessment. Each DPIA will include a systematic description of the processing operations and their purposes, an assessment of the necessity and proportionality of the processing, an assessment of the risks to the rights and freedoms of data subjects, and the measures envisaged to address those risks;
(c) Mitigation plans. Where a DPIA identifies residual high risks that cannot be sufficiently mitigated, C&H will prepare detailed mitigation plans setting out the additional technical and organisational measures to be implemented, and will advise NTP on whether prior consultation with the relevant supervisory authority under Article 36 of the GDPR is required;
(d) DPIA Summary Register and Board report. C&H will prepare a DPIA Summary Register documenting all DPIAs conducted, together with a Board-level summary report suitable for presentation to the Audit & Risk Committee; and
(e) Target completion date. Phase 3 is targeted for completion by July 2023.
Phase 4: International Data Transfer Mechanisms.  2.2.5 Phase 4 comprises the review and remediation of all international data transfer mechanisms relied upon by the NTP Group. The principal activities and deliverables of Phase 4 are as follows:
(a) Review of existing transfer mechanisms. C&H will review all existing international data transfer mechanisms in light of the Court of Justice of the European Union's judgment in Data Protection Commissioner v. Kestrel Services Inc. Ireland Limited and Maximillian Schrems (Case C-311/18) ("Schrems II") and subsequent regulatory guidance from the European Data Protection Board ("EDPB"), the ICO, and relevant national supervisory authorities;
(b) EU Standard Contractual Clauses. C&H will prepare, review, and negotiate EU Standard Contractual Clauses ("EU SCCs") in accordance with the European Commission's Implementing Decision (EU) 2021/914 of 4 June 2021, utilising Modules 2 (controller-to-processor) and 3 (processor-to-sub-processor) as appropriate for the relevant transfer relationships;
(c) UK International Data Transfer Agreements. C&H will prepare UK International Data Transfer Agreements ("IDTAs") in the form approved by the ICO for transfers of personal data subject to the UK GDPR to recipients in third countries that are not subject to a UK adequacy regulation;
(d) UK Addendum to EU SCCs. For transfers that are subject to both the UK GDPR and the EU GDPR, C&H will prepare the UK Addendum to the EU SCCs (as approved by the ICO), ensuring that a single contractual mechanism adequately covers both regimes where appropriate;
(e) Transfer Impact Assessments. C&H will conduct Transfer Impact Assessments ("TIAs") for transfers to third countries that are not the subject of an adequacy decision by the European Commission or the UK Secretary of State. Each TIA will assess the legal framework in the recipient country, including relevant surveillance and government access legislation, and will identify any supplementary measures required;
(f) Review and amendment of Data Processing Agreements. C&H will review and, where necessary, prepare amendments to existing Data Processing Agreements ("DPAs") with key processors to ensure compliance with Article 28 of the GDPR and to incorporate updated international data transfer provisions;
(g) International Transfers Policy. C&H will prepare an internal International Transfers Policy and Mechanism Selection Guidance document for use by NTP's internal teams when evaluating new or modified international data transfers;
(h) Coordination with counterparty counsel. Where necessary, C&H will liaise and negotiate with the legal teams or external counsel of NTP's key processors and counterparties in connection with the execution of SCCs, IDTAs, and DPA amendments; and
(i) Target completion date. Phase 4 is targeted for completion by August 2023.
Phase 5: Policies, Training & Governance.  2.2.6 Phase 5 comprises the development of group-wide policies, operational procedures, and governance structures, together with the delivery of Board-level training and the preparation of regulatory submissions. The principal activities and deliverables of Phase 5 are as follows:
(a) Group Data Protection Policy. C&H will draft a comprehensive Group Data Protection Policy for adoption across the NTP Group (including NTP PLC and all EU subsidiaries), addressing the overarching principles, governance structures, roles and responsibilities, and accountability mechanisms required under the GDPR Framework;
(b) Operational procedures. C&H will prepare operational procedures covering the following areas (at a minimum): handling and responding to data subject rights requests (including access, rectification, erasure, restriction, portability, and objection); personal data breach detection, assessment, notification, and documentation procedures (in compliance with Articles 33 and 34 of the GDPR and the requirements of the ICO, DPC, and other relevant supervisory authorities); and data retention and deletion procedures, including retention schedules aligned with the ROPA;
(c) External-facing privacy notices. C&H will review and revise NTP's external-facing privacy notices (including the consumer subscriber privacy notice, enterprise client privacy notice, employee privacy notice, and NorthCloud platform privacy notice) to ensure compliance with Articles 13 and 14 of the GDPR;
(d) Board-level GDPR training. C&H will prepare and deliver a Board-level GDPR training session for NTP's Board of Directors and Audit & Risk Committee members, covering directors' duties and obligations in relation to data protection, the key risks and regulatory landscape, and the principal outputs of the Programme;
(e) DPC inquiry response. C&H will assist NTP in preparing a response to the DPC preliminary inquiry (reference IN-22-11-3) as required, drawing on the outputs of the international data transfer workstreams (Phase 4) and the broader Programme deliverables;
(f) Handover and ongoing obligations summary. Upon completion of the Programme, C&H will conduct a structured handover of all deliverables to NTP's internal data protection team, together with a summary of ongoing obligations and recommended next steps for the maintenance and continuous improvement of the Programme; and
(g) Target completion date. Phase 5 is targeted for completion by September 2023.
2.3 Scope Limitations
2.3.1 The engagement encompasses legal advisory, drafting, and programme design services in the areas described above. For the avoidance of doubt, the engagement does not extend to the following:
(a) IT consultancy and technology implementation. The engagement does not include the provision of IT consultancy, privacy engineering, or technology implementation services. NTP has separately retained Ashdown Consulting Group Ltd for the provision of such services, including technical data flow inventories, system architecture assessments, and Sundial Solutions privacy management platform configuration. C&H is not responsible for the quality, completeness, or timeliness of Ashdown's technical work, and C&H's legal advice will be based on the technical information provided to it by Ashdown and NTP;
(b) Contentious proceedings and regulatory investigations. The engagement does not include representation of NTP in any contentious proceedings, enforcement actions, or formal regulatory investigations (whether before the ICO, the DPC, or any other supervisory authority). Should any such proceedings arise during or as a result of the engagement, separate terms of engagement would be agreed between the parties, including any necessary adjustments to fees and scope. For the avoidance of doubt, the preparation of the DPC inquiry response under Phase 5 is a non-contentious advisory activity; should the DPC inquiry escalate to a formal investigation or enforcement proceeding, separate engagement terms would apply;
(c) Tax advice. The engagement does not include tax advice of any kind. Where tax implications arise in the course of the engagement (including, without limitation, transfer pricing considerations relating to intra-group data processing arrangements, VAT treatment of cross-border data processing services, or the tax characterisation of data assets), NTP should seek independent advice from qualified tax counsel or accountants; and
(d) Non-GDPR regulatory compliance. The scope of the engagement does not extend to NTP's compliance with regulatory obligations other than those arising under the GDPR Framework, including (without limitation) obligations arising under the Regulation of Investigatory Powers Act 2000, the Investigatory Powers Act 2016, the Privacy and Electronic Communications (EC Directive) Regulations 2003, the ePrivacy Directive (Directive 2002/58/EC), the Network and Information Systems Regulations 2018, or applicable telecommunications licensing and regulatory requirements, except insofar as such obligations intersect with or have a direct bearing on NTP's GDPR compliance considerations.
3. ENGAGEMENT TEAM
3.1 The following individuals will comprise the core engagement team for this matter:
3.2 Responsible Partner — Kevin Ostrowski
Mr Ostrowski is a Partner in C&H's Privacy & Data Security practice group, with eighteen years' experience advising on EU and UK data protection law. Mr Ostrowski is a Solicitor of the Senior Courts of England and Wales, admitted in 2005. He has extensive experience advising multinational corporations, financial institutions, and technology companies on the design and implementation of GDPR compliance programmes, international data transfer strategies, and regulatory interactions with the ICO, DPC, and other European supervisory authorities. Mr Ostrowski will have overall supervisory responsibility for the engagement and will serve as the primary relationship partner for NTP.
3.3 Billing Partner — Rachel Bernstein
Ms Bernstein is a Partner in C&H's Privacy & Data Security practice group, specialising in cross-border data transfers and telecommunications regulation. Ms Bernstein is a Solicitor of the Senior Courts of England and Wales, admitted in 2008, and is also admitted to practice in the State of New York. She has significant experience advising telecommunications and technology companies on international data transfer compliance in the post-Schrems II landscape and on regulatory interactions with European supervisory authorities. Ms Bernstein will lead the international data transfer workstreams under Phase 4 and will have primary responsibility for the DPC inquiry response under Phase 5.
3.4 Lead Associate — Sara Hendricks
Ms Hendricks is a Senior Associate in C&H's Privacy & Data Security practice group, with six years of post-qualification experience. Ms Hendricks is a Solicitor of the Senior Courts of England and Wales, admitted in 2017, and holds the Certified Information Privacy Professional/Europe (CIPP/E) and Certified Information Privacy Manager (CIPM) certifications from the International Association of Privacy Professionals ("IAPP"). She has particular expertise in data protection impact assessments and privacy-by-design frameworks. Ms Hendricks will serve as the day-to-day lead for the engagement and will be the primary point of contact for NTP on operational matters throughout the Programme.
3.5 Working Associate — Priscilla Wynn
Ms Wynn is an Associate in C&H's Privacy & Data Security practice group, with three years of post-qualification experience. Ms Wynn is a Solicitor of the Senior Courts of England and Wales, admitted in 2020, and has developed specialist expertise in records of processing activities development, data mapping methodologies, and data processing agreement negotiation. Ms Wynn will lead the ROPA and data mapping workstreams under Phase 2.
3.6 C&H may involve additional fee-earners, including other associates, trainees, and paralegals, as workload demands require during the course of the engagement. C&H will provide prior notice to the Client of any additional fee-earners assigned to material workstreams, together with their applicable hourly rates (which shall not exceed the rates set out in Section 5.1 below for the relevant category of fee-earner).
4. CLIENT CONTACTS AND COOPERATION
4.1 The primary client contact for this engagement is Ms Fiona Gallagher, General Counsel & Company Secretary, Northgate Telecommunications PLC. All formal instructions, approvals, and material communications relating to this engagement should be directed through Ms Gallagher unless otherwise agreed.
4.2 C&H will coordinate directly with the following key client stakeholders in the course of the engagement:
(a) Sanjay Mehta, Data Protection Officer (CIPP/E certified; appointed March 2019). Mr Mehta will be C&H's primary internal counterpart on data protection matters and will facilitate access to NTP's existing data protection documentation, policies, and records;
(b) Thomas Okoye, Chief Information Security Officer. Mr Okoye will liaise with C&H on matters relating to technical and organisational security measures, data centre operations, and the security aspects of DPIAs and TIAs;
(c) Laura Dearden, VP, Product & Engineering (NorthCloud). Ms Dearden will provide C&H with information and access relating to the NorthCloud platform's data processing activities, system architecture, and product roadmap;
(d) Philippa Crane, Head of People & HR. Ms Crane will coordinate with C&H on matters relating to employee data processing, HR systems, and the employee privacy notice; and
(e) Marcus Engström, Head of EU Operations (based in Dublin). Mr Engström will serve as C&H's primary contact for the EU subsidiary operations and will facilitate C&H's engagement with subsidiary management and local data protection contacts.
4.3 NTP agrees to provide timely access to relevant personnel, systems, documentation, and data as may be reasonably necessary for C&H to perform its obligations under this engagement. Without limiting the foregoing, NTP undertakes to:
(a) make available the client stakeholders identified in paragraph 4.2 above for meetings, interviews, and follow-up queries within reasonable timeframes;
(b) facilitate C&H's coordination with Ashdown Consulting Group Ltd (NTP's retained privacy engineering and data mapping consultancy) and Whitmore Kendall LLP (NTP's statutory auditors) where access to technical data mapping outputs or audit-related documentation is necessary for C&H's legal workstreams;
(c) designate business unit data stewards within each relevant NTP business unit to complete and return data mapping questionnaires within the timescales agreed between the parties; and
(d) provide C&H with access to relevant contractual documentation, including existing data processing agreements, service agreements with third-party processors, intra-group data sharing arrangements, and existing privacy notices and policies.
4.4 NTP acknowledges that C&H's ability to meet the indicative timelines set out in Appendix A is contingent upon the timely provision by NTP of the information, documentation, access, and cooperation described in this Section 4. Delays in the provision of such cooperation may result in corresponding delays to the Programme timeline, and C&H shall not be liable for any such delays to the extent attributable to the Client.
5. FEES AND BILLING ARRANGEMENTS
5.1 Hourly Rates
5.1.1 The following blended hourly rates shall apply to this engagement:
5.1.2 The hourly rates set out above are exclusive of Value Added Tax ("VAT"), which will be charged at the applicable rate on all invoices issued by C&H. As at the date of this letter, the standard rate of VAT is 20%.
5.1.3 The hourly rates set out in paragraph 5.1.1 are fixed for the duration of this engagement and will not be subject to annual rate increases or other adjustments during the engagement period.
5.2 Phase-Based Fee Caps
5.2.1 Professional fees for each phase of the engagement shall not exceed the following caps without prior written agreement from the Client:
5.2.2 The total engagement fee cap of £850,000 represents the sum of all individual phase caps (£185,000 + £210,000 + £155,000 + £175,000 + £125,000).
5.2.3 Each phase cap operates independently. Any unused portion of a phase cap shall not carry forward to subsequent phases unless the parties agree otherwise in writing. Similarly, any overspend on one phase may not be offset against an underspend on another phase without the Client's prior written consent.
5.2.4 C&H will monitor time expenditure against each phase cap on an ongoing basis. If it becomes apparent during the course of any phase that work within that phase may approach or is likely to exceed the relevant cap, C&H will promptly notify the Client, providing an estimate of the anticipated additional fees and the reasons therefor, and will seek the Client's written authorisation before incurring any fees in excess of the applicable cap. C&H shall not be obligated to continue work on a phase in respect of which the fee cap has been reached unless the Client has provided written authorisation for additional fees.
5.3 Disbursements and Expenses
5.3.1 In addition to professional fees, NTP shall be liable for reasonable disbursements and out-of-pocket expenses incurred by C&H in connection with the engagement, including (without limitation) travel expenses, accommodation, printing and copying charges, courier and postage costs, and external legal research database charges.
5.3.2 Disbursements for the full engagement are estimated at £32,000. This estimate is provided in good faith based on C&H's current understanding of the likely travel and operational requirements of the Programme, but is not a cap and may vary depending on the actual requirements of the engagement.
5.3.3 Disbursements are not subject to the phase-based fee caps set out in paragraph 5.2.1 and will be invoiced at cost, without mark-up.
5.3.4 Travel to NTP subsidiary offices in Dublin, Berlin, Amsterdam, Paris, and Madrid will be charged at reasonable business-class rates where flights are required and at economy rail rates where rail travel is practical. Hotel accommodation will be charged at reasonable business rates. C&H will exercise reasonable judgement in incurring travel expenses and will endeavour to minimise travel costs through the use of video conferencing where practicable, subject to the operational requirements of the engagement.
5.4 Billing and Payment Terms
5.4.1 C&H will issue invoices to NTP on a monthly basis in arrears. Each invoice will be accompanied by a detailed narrative description of the work performed during the relevant billing period, broken down by fee-earner, including the date, time spent, and a description of each activity.
5.4.2 Invoices are payable within thirty (30) days of the date of the invoice. Payment should be made by electronic bank transfer to C&H's client account, the details of which will be provided on each invoice.
5.4.3 C&H reserves the right to charge interest on any amounts that remain unpaid after the expiry of the 30-day payment period. Interest shall accrue on overdue amounts at the rate of 2% per annum above the Bank of England base rate from time to time, calculated on a daily basis from the due date until the date of actual payment.
5.4.4 All invoices shall be addressed and sent to the attention of Ms Fiona Gallagher, General Counsel & Company Secretary, at NTP's principal office at Northgate Tower, 88 Canary Wharf Boulevard, London E14 5HN, or to such other address or email address as the Client may notify C&H in writing from time to time.
5.4.5 Any queries regarding an invoice should be raised with Mr Kevin Ostrowski within fourteen (14) days of receipt of the invoice. In the event of a bona fide dispute regarding any item on an invoice, NTP shall pay the undisputed portion of the invoice within the 30-day period and shall notify C&H in writing of the specific items in dispute, together with the reasons for the dispute. The parties shall use reasonable endeavours to resolve any billing dispute promptly and in good faith.
6. THIRD-PARTY COORDINATION
6.1 NTP has separately retained Ashdown Consulting Group Ltd (Company Number 11293847), with offices at 15 Bedford Row, London WC1R 4BU (the "Technical Consultant"), as a privacy engineering and data mapping consultancy. Ashdown's scope of work includes technical data flow inventories, system architecture analysis, and the implementation and configuration of the Sundial Solutions privacy management platform for the NTP Group. C&H's engagement team will coordinate with Ashdown's team, including Mr Robert Fairclough, Managing Director, and Ms Anita Chakravarti, Lead Privacy Engineer, on the technical data mapping outputs and system-level information that will inform C&H's legal workstreams across each phase of the Programme.
6.2 For the avoidance of doubt, C&H is not responsible for the quality, completeness, accuracy, or timeliness of Ashdown's technical work. C&H's legal advice and deliverables will be based upon, and may rely upon, the technical data and system information provided to C&H by Ashdown and NTP. Where C&H identifies apparent gaps or inconsistencies in the technical information provided, C&H will raise such matters with NTP and Ashdown, but C&H does not assume responsibility for independently verifying the technical outputs.
6.3 In the course of the engagement, it may be necessary for C&H to interact with the legal teams or external counsel of NTP's third-party processors and counterparties, including but not limited to:
(a) Mr Graham Alderton, Head of Legal, Cloud Services Division, Pinnacle Cloud Services Ltd, in connection with the review and amendment of the data processing agreement between NTP and Pinnacle and the negotiation of international data transfer provisions; and
(b) Ms Natalie Prescott, Partner, Data Privacy & Cybersecurity, Hargrove Lister & Webb LLP (acting as outside counsel for Caldwell Analytics Inc.), in connection with the negotiation of EU Standard Contractual Clauses and related data transfer documentation between NTP and Caldwell Analytics.
6.4 C&H's professional duties run solely to NTP as the Client. C&H does not represent and owes no professional duty to any third party, including (without limitation) NTP's processors, sub-processors, counterparties, the Technical Consultant, or their respective legal advisers. No third party may rely on C&H's advice or work product without C&H's prior written consent.
7. CONFIDENTIALITY
7.1 C&H will treat all information provided by or on behalf of NTP in connection with this engagement as strictly confidential and will not disclose such information to any third party without the prior written consent of NTP, except to the extent that:
(a) disclosure is required by law, regulation, court order, or the rules of any regulatory body (including the Solicitors Regulation Authority) to which C&H is subject;
(b) disclosure is made to C&H's professional advisers, insurers, or auditors, who are bound by equivalent obligations of confidentiality;
(c) the information is or becomes publicly available other than as a result of a breach of this engagement letter; or
(d) disclosure is reasonably necessary for the proper performance of C&H's obligations under this engagement (for example, disclosure to counterparty counsel in the course of SCC negotiations, with the Client's prior approval).
7.2 NTP acknowledges that the existence and terms of this engagement (but not privileged communications or work product) may need to be disclosed to relevant supervisory authorities, including the ICO and the DPC, in the course of regulatory interactions relating to the NTP Group's data protection compliance. C&H will consult with NTP before making any such disclosure and will limit the information disclosed to that which is reasonably necessary in the circumstances.
7.3 The obligations of confidentiality set out in this Section 7 shall survive the termination or expiry of this engagement.
8. LEGAL PROFESSIONAL PRIVILEGE
8.1 C&H will endeavour to maintain legal professional privilege (including, where applicable, litigation privilege and legal advice privilege) over all communications between C&H and NTP, and over all work product prepared by C&H in connection with this engagement, to the fullest extent permitted by law.
8.2 NTP should be aware that certain deliverables prepared by C&H in the course of this engagement are designed for external use or disclosure to third parties and, once so disclosed, will not attract or retain the protection of legal professional privilege. Such deliverables include, without limitation:
(a) the Records of Processing Activities (ROPA);
(b) external-facing privacy notices;
(c) the Group Data Protection Policy and operational procedures (to the extent disseminated within NTP beyond the legal function);
(d) data processing agreements and international data transfer agreements executed with third parties;
(e) the response to the DPC preliminary inquiry (reference IN-22-11-3); and
(f) the DPIA Summary Register (to the extent shared with supervisory authorities).
8.3 C&H will advise NTP on a case-by-case basis where privilege considerations arise, including where there is a risk that privilege may be waived by disclosure, and will work with NTP to structure communications and deliverables so as to preserve privilege to the greatest extent practicable.
8.4 NTP should take care not to disclose privileged communications or work product to third parties (including Ashdown Consulting Group Ltd or Whitmore Kendall LLP) without first consulting C&H, as such disclosure may constitute a waiver of privilege.
9. DATA PROTECTION — C&H AS CONTROLLER
9.1 In the course of providing legal services under this engagement, C&H will process personal data of NTP personnel, NTP data subjects, and other individuals whose personal data is contained in documentation and information provided to C&H by or on behalf of NTP. C&H will act as an independent data controller in respect of such processing, which is carried out for the purposes of providing legal services, complying with C&H's professional obligations, administering the client relationship, and managing C&H's business operations.
9.2 C&H's processing of personal data in connection with this engagement will be conducted in accordance with C&H's own data protection obligations under the UK GDPR and the Data Protection Act 2018. Further details regarding C&H's data processing practices, including the types of personal data processed, the purposes and lawful bases for processing, retention periods, and data subject rights, are set out in C&H's client privacy notice, which is available at www.calderwoodharkness.com/privacy-notice and a copy of which has been provided to NTP under separate cover.
10. CONFLICTS OF INTEREST
10.1 C&H has conducted a comprehensive conflict of interest check in accordance with its internal procedures and the requirements of the SRA Code of Conduct for Solicitors and the SRA Code of Conduct for Firms. C&H confirms that, as at the date of this letter:
(a) C&H does not currently represent, and has not within the preceding twelve months represented, Caldwell Analytics Inc., Pinnacle Cloud Services Ltd, or any of their affiliates, subsidiaries, or related entities in any matter adverse to NTP or any member of the NTP Group;
(b) C&H does not currently represent any party with interests that are adverse to, or may conflict with, the interests of NTP (Company Number 04837291) or any of its subsidiaries identified in Section 1 of this letter; and
(c) no existing client relationship, personal interest, or other circumstance has been identified that gives rise to an actual or potential conflict of interest in connection with this engagement.
10.2 C&H undertakes to monitor for conflicts of interest on an ongoing basis throughout the duration of this engagement and to notify NTP promptly in the event that any actual or potential conflict of interest is identified. In such circumstances, C&H will discuss the nature of the conflict with NTP and the available options, which may include obtaining informed written consent from the affected parties, implementing information barriers, or (in cases where the conflict cannot be adequately managed) terminating the engagement in accordance with Section 12 below.
11. LIMITATION OF LIABILITY
11.1 C&H's aggregate liability to NTP and the NTP Group arising out of or in connection with this engagement, whether in contract, tort (including negligence), breach of statutory duty, or otherwise, shall not exceed £10,000,000 (ten million pounds sterling), or such higher amount as may be required by the Solicitors Regulation Authority's Minimum Terms and Conditions of Professional Indemnity Insurance applicable to C&H at the relevant time.
11.2 C&H shall not be liable to NTP for any indirect, consequential, special, or punitive damages, or for any loss of profits, loss of revenue, loss of business, loss of opportunity, loss of data, or loss of goodwill, in each case whether arising in contract, tort (including negligence), breach of statutory duty, or otherwise, and whether or not such loss was foreseeable, to the maximum extent permitted by applicable law.
11.3 Nothing in this Section 11 shall exclude or limit C&H's liability for:
(a) fraud or wilful misconduct on the part of C&H, its partners, or its employees;
(b) death or personal injury caused by C&H's negligence; or
(c) any other liability that cannot be excluded or limited by applicable law or professional regulation.
11.4 The limitations and exclusions set out in this Section 11 apply to C&H's liability to NTP and all members of the NTP Group in the aggregate, and not separately to each entity within the NTP Group.
11.5 NTP acknowledges that C&H's ability to provide the services contemplated by this engagement on the terms and at the fee levels set out herein is contingent upon the limitations of liability set out in this Section 11, which NTP has had the opportunity to consider and which it accepts as reasonable.
12. TERM AND TERMINATION
12.1 This engagement commences on 13 February 2023 (subject to countersignature of this letter by NTP) and shall continue until the completion of all five phases of the Programme (estimated completion: Q3 2023, being September 2023) or until terminated in accordance with this Section 12, whichever occurs first.
12.2 Either party may terminate this engagement at any time by giving the other party not less than thirty (30) days' prior written notice. Notice of termination by NTP should be addressed to Mr Kevin Ostrowski at C&H's address set out at the head of this letter; notice of termination by C&H should be addressed to Ms Fiona Gallagher at NTP's principal office.
12.3 In the event of termination of this engagement (whether by NTP, by C&H, or on completion of the Programme), NTP shall remain liable for:
(a) all professional fees incurred for work performed up to and including the effective date of termination, calculated in accordance with the hourly rates set out in Section 5.1 and subject to the applicable phase fee caps to the extent that work within a phase has been completed or substantially completed; and
(b) all disbursements and out-of-pocket expenses incurred up to and including the effective date of termination.
12.4 C&H reserves the right to terminate this engagement immediately, without the requirement for a 30-day notice period, in the following circumstances:
(a) a conflict of interest arises that cannot be resolved or adequately managed in accordance with C&H's professional obligations and the SRA Code of Conduct;
(b) NTP fails to pay any invoice within sixty (60) days of its due date;
(c) continuing the engagement would require C&H to act contrary to its professional obligations, including the SRA Code of Conduct for Solicitors or the SRA Code of Conduct for Firms; or
(d) NTP provides instructions that C&H reasonably considers to be improper or contrary to law.
12.5 Upon termination or expiry of this engagement, C&H will deliver to NTP all completed work product and, subject to C&H's right to retain copies in accordance with its professional obligations and record-keeping policies, all client documents and materials provided by NTP during the engagement. C&H's obligations of confidentiality under Section 7 shall survive termination.
13. REGULATORY STATUS AND PROFESSIONAL STANDARDS
13.1 Calderwood & Harkness LLP is a limited liability partnership incorporated in England and Wales (registered number OC387415) and is authorised and regulated by the Solicitors Regulation Authority ("SRA"), SRA Number 482716. C&H is subject to the SRA Standards and Regulations, including the SRA Principles, the SRA Code of Conduct for Solicitors, and the SRA Code of Conduct for Firms, copies of which are available at www.sra.org.uk.
13.2 If NTP is unhappy with any aspect of the service provided by C&H, NTP is entitled to make a complaint. In the first instance, complaints should be directed to Mr Kevin Ostrowski, the Responsible Partner for this engagement, or to C&H's Client Care Partner, Ms Eleanor Whitfield, who can be contacted at eleanor.whitfield@calderwoodharkness.com or by post at One Moorgate Square, London EC2R 6AN. C&H operates a formal complaints handling procedure, a copy of which is available upon request. If NTP is not satisfied with C&H's handling of a complaint, NTP may refer the matter to the Legal Ombudsman (www.legalombudsman.org.uk) within the timeframes prescribed by the Legal Ombudsman's scheme rules.
13.3 C&H maintains professional indemnity insurance in accordance with the SRA's Minimum Terms and Conditions. Details of C&H's professional indemnity insurance arrangements, including the identity of the insurer and the territorial coverage, are available upon request.
14. GOVERNING LAW AND JURISDICTION
14.1 This engagement letter and any non-contractual obligations arising out of or in connection with it shall be governed by and construed in accordance with the laws of England and Wales.
14.2 The courts of England and Wales shall have exclusive jurisdiction to settle any dispute arising out of or in connection with this engagement letter, including any dispute relating to any non-contractual obligations arising out of or in connection with it.
15. ACCEPTANCE AND COUNTERPARTS
15.1 We should be grateful if you would confirm NTP's acceptance of the terms set out in this engagement letter by arranging for an authorised signatory of NTP to countersign and return a copy of this letter to us. A duplicate copy is enclosed for this purpose. Alternatively, a scanned copy of the countersigned letter may be returned by email to kevin.ostrowski@calderwoodharkness.com, with the original to follow by post.
15.2 This engagement letter may be executed in any number of counterparts, each of which when so executed and delivered shall constitute an original, and all the counterparts together shall constitute one and the same instrument. Delivery of an executed counterpart by email (in PDF format) shall be as effective as delivery of a manually executed counterpart.
15.3 This engagement letter, together with its appendices, constitutes the entire agreement between C&H and NTP in relation to the subject matter hereof and supersedes all prior discussions, negotiations, representations, and agreements (whether oral or written) relating to such subject matter. No variation of this engagement letter shall be effective unless made in writing and signed by both parties.
We very much look forward to working with you and the NTP team on this important initiative. If you have any questions regarding the terms set out in this letter, please do not hesitate to contact me or Sara Hendricks.
Yours sincerely,
CALDERWOOD & HARKNESS LLP
By: ________
Kevin Ostrowski Partner, Privacy & Data Security Calderwood & Harkness LLP One Moorgate Square, London EC2R 6AN
COUNTERSIGNATURE — ACCEPTANCE BY NORTHGATE TELECOMMUNICATIONS PLC
I confirm that I have read and understood the terms of this engagement letter and its appendices, and that I am duly authorised to accept such terms on behalf of Northgate Telecommunications PLC. Northgate Telecommunications PLC hereby accepts the engagement of Calderwood & Harkness LLP on the terms set out herein.
NORTHGATE TELECOMMUNICATIONS PLC
By: ________
Name: Fiona Gallagher
Title: General Counsel & Company Secretary
Northgate Telecommunications PLC
Date: ________
APPENDIX A: KEY MILESTONES (INDICATIVE TIMELINE)
The following table sets out the key milestones and indicative target dates for the Programme. These milestones are provided for planning purposes and are subject to adjustment in accordance with the provisions of this engagement letter, including (without limitation) NTP's timely provision of information and cooperation as described in Section 4.
Note: The milestones set out above are indicative and non-binding. C&H will update the Client promptly if it becomes apparent that any milestone requires adjustment, together with the reasons for the adjustment and a revised target date. In particular, the achievement of the milestones is contingent upon NTP's timely provision of information, documentation, and access to personnel as described in Section 4 of this engagement letter. C&H shall not be liable for delays to the Programme timeline to the extent that such delays are attributable to the Client's failure to provide the required cooperation within agreed timescales.
APPENDIX B: FEE SCHEDULE SUMMARY
The following table summarises the hourly rates and phase-based fee caps applicable to this engagement, as set out in Section 5 of this engagement letter.
Hourly Rates.  
Hourly rates are fixed for the duration of the engagement and are not subject to annual rate increases.
Phase-Based Fee Caps
Disbursements.  
Disbursements are invoiced at cost and are not subject to the phase-based fee caps set out above. The estimate of £32,000 is provided in good faith but is not a cap and may vary depending on the actual requirements of the engagement.
Calderwood & Harkness LLP is a limited liability partnership registered in England and Wales (registered number OC387415). A list of members' names is available for inspection at One Moorgate Square, London EC2R 6AN. Calderwood & Harkness LLP is authorised and regulated by the Solicitors Regulation Authority (SRA Number 482716). The term "partner" refers to a member of Calderwood & Harkness LLP, or to an employee or consultant with equivalent standing and qualifications.
Fee-Earner Level | Hourly Rate (£)
Partner | £895
Senior Associate | £625
Associate | £475
Phase | Description | Fee Cap (£)
Phase 1 | Assessment & Gap Analysis | £185,000
Phase 2 | ROPA & Data Mapping | £210,000
Phase 3 | Data Protection Impact Assessments | £155,000
Phase 4 | International Data Transfer Mechanisms | £175,000
Phase 5 | Policies, Training & Governance | £125,000
Total | All Phases | £850,000
Milestone | Target Date
Phase 1 kick-off meeting | 20 February 2023
Data mapping questionnaires distributed to NTP business units | 1 March 2023
Gap Analysis Report delivered | 31 March 2023
Phase 2 (ROPA & Data Mapping) commenced | 3 April 2023
ROPA v1.0 delivered | May 2023
Phase 3 (DPIAs) commenced | May 2023
All DPIAs completed and DPIA Summary Register delivered | July 2023
Phase 4 (International Data Transfer Mechanisms) commenced | July 2023
All Transfer Impact Assessments completed; SCCs/IDTAs executed | August 2023
Phase 5 (Policies, Training & Governance) commenced | August 2023
Board-level GDPR training session delivered | August 2023
Final policy suite delivered to NTP | September 2023
DPC inquiry response (IN-22-11-3) submitted | September 2023
Programme handover and engagement close | September 2023
Fee-Earner Level | Hourly Rate (£, exclusive of VAT)
Partner | £895
Senior Associate | £625
Associate | £475
Phase | Description | Fee Cap (£, exclusive of VAT)
Phase 1 | Assessment & Gap Analysis | £185,000
Phase 2 | ROPA & Data Mapping | £210,000
Phase 3 | Data Protection Impact Assessments | £155,000
Phase 4 | International Data Transfer Mechanisms | £175,000
Phase 5 | Policies, Training & Governance | £125,000
Total | All Phases | £850,000
Item | Amount (£)
Estimated total disbursements (travel, printing, courier, external research) | £32,000

CALDERWOOD & HARKNESS LLP Solicitors

Record

Parties

Dates

Amounts