Reference: SC/NTP/2023-0213/PDS Execution Date: 17 July 2023

Reference: SC/NTP/2023-0213/PDS Execution Date: 17 July 2023
Standard Contractual Clauses — Controller to Processor
Pursuant to Commission Implementing Decision (EU) 2021/914 of 4 June 2021
Data Exporter: Northgate Telecommunications PLC
Data Importer: Caldwell Analytics Inc.
Third Country of Destination: United States of America
Document Status: Executed Appendix to International Transfer Framework
SECTION I — GENERAL PROVISIONS
Clause 1 — Purpose and Scope
(a) These Standard Contractual Clauses (the “Clauses”) are entered into by and between Northgate Telecommunications PLC, as data exporter, and Caldwell Analytics Inc., as data importer, for the purpose of ensuring compliance with Regulation (EU) 2016/679 of the European Parliament and of the Council (“Regulation (EU) 2016/679” or the “GDPR”) in connection with the transfer of personal data to a third country.
(b) The parties acknowledge that the personal data covered by these Clauses is transferred to the United States of America, which, for purposes of the specific transfer described herein, does not benefit from an adequacy decision covering the transfer in question. These Clauses are therefore intended to provide appropriate safeguards for such transfer, including enforceable data subject rights and effective legal remedies, pursuant to Article 46(1) and Article 46(2)(c) of Regulation (EU) 2016/679.
(c) The parties further acknowledge and agree that these Clauses are concluded using Module 2 (Controller to Processor). Accordingly, the data exporter acts as a controller with respect to the transferred personal data, and the data importer acts solely as a processor processing personal data on behalf of, and under the documented instructions of, the data exporter.
(d) These Clauses apply solely to the transfers of personal data described in Annex I.B and to any processing operations strictly necessary for the provision by Caldwell Analytics Inc. of AI-driven network analytics and predictive maintenance services to Northgate Telecommunications PLC pursuant to the parties’ contractual arrangements.
Clause 2 — Effect and Invariability of the Clauses
(a) These Clauses constitute appropriate safeguards within the meaning of Article 46(1) and Article 46(2)(c) of Regulation (EU) 2016/679 for the transfer of personal data from the data exporter to the data importer.
(b) The parties shall not modify the text of these Clauses, except as expressly permitted under Commission Implementing Decision (EU) 2021/914, including to select the appropriate module, to complete or update the Annexes, or to add supplementary safeguards, provided that such additions or updates do not directly or indirectly contradict these Clauses or prejudice the fundamental rights or freedoms of data subjects.
(c) Nothing in these Clauses prevents the parties from incorporating these Clauses into a broader commercial or services arrangement, or from adding other contractual provisions, provided that such provisions are consistent with, and do not contradict, these Clauses.
Clause 3 — Third-Party Beneficiaries
(a) Data subjects may invoke and enforce these Clauses, as third-party beneficiaries, against the data exporter, in particular the following provisions to the extent applicable: Clause 8.1 (Module 2), Clause 8.2(a) through (f), Clause 8.3, Clause 8.9, Clause 9, Clause 10, Clause 11, Clause 12, Clause 13, Clause 15(1)(a) through (e), Clause 16(e), and Clause 18.
(b) Data subjects may invoke and enforce these Clauses, as third-party beneficiaries, against the data importer, in particular the following provisions to the extent applicable: Clause 8.1 (Module 2), Clause 8.2(a) through (f), Clause 8.3, Clause 8.9, Clause 9, Clause 10, Clause 11, Clause 12, Clause 13, Clause 15(1)(a) through (e), Clause 16(e), and Clause 18.
(c) The parties shall not prevent a data subject from exercising rights as a third-party beneficiary under these Clauses. Any contractual arrangement between the parties shall be interpreted consistently with this Clause 3.
Clause 4 — Interpretation
(a) Where these Clauses use terms that are defined in Regulation (EU) 2016/679, those terms shall have the same meaning as in that Regulation.
(b) These Clauses shall be read and interpreted in light of the provisions of Regulation (EU) 2016/679.
(c) These Clauses shall not be interpreted in a manner that conflicts with rights and obligations provided for in Regulation (EU) 2016/679.
Clause 5 — Hierarchy
In the event of any contradiction between these Clauses and the provisions of related agreements between the parties, whether entered into at the same time as, before, or after these Clauses, these Clauses shall prevail to the extent of the inconsistency. This includes, without limitation, the Master Services Agreement entered into between Northgate Telecommunications PLC and Caldwell Analytics Inc. dated 1 June 2021, as amended from time to time.
Clause 6 — Description of the Transfer(s)
The details of the transfer or transfers of personal data, including the categories of personal data transferred, the categories of data subjects concerned, the frequency of the transfer, the nature of the processing, the purposes of the transfer and further processing, and the applicable retention periods, are set out in Annex I.B to these Clauses. Annex I.B forms an integral part of these Clauses.
Clause 7 — Docking Clause
(a) The parties agree that the docking clause shall apply to these Clauses.
(b) An entity that is not a party to these Clauses may, with the agreement of all existing parties, accede to these Clauses at any time, either as a data exporter or as a data importer, by completing the appropriate Annexes and signing Annex I.A.
(c) Upon completion of Annex I.A and execution by the acceding entity, that entity shall have the rights and obligations of a data exporter or data importer, as applicable, under these Clauses, from the effective date of accession.
(d) The parties acknowledge that this docking clause is intended, among other things, to permit the accession, where operationally required, of Northgate group entities including Northgate Ireland Ltd, Northgate GmbH, Northgate B.V., Northgate France SAS, and Northgate Iberia S.L. as additional data exporters in respect of transfers falling within the same processing framework.
SECTION II — OBLIGATIONS OF THE PARTIES
Clause 8 — Data Protection Safeguards
Clause 8.1 — Instructions
(a) The data importer shall process the personal data only on documented instructions from the data exporter. This includes processing for the purposes described in Annex I.B and such other documented instructions as the data exporter may issue from time to time in connection with the services covered by the Master Services Agreement dated 1 June 2021.
(b) The data exporter hereby instructs the data importer to process personal data solely for the purpose of providing AI-driven network analytics and predictive maintenance services, including related network anomaly detection, aggregation, reporting, and service support activities, as described in Annex I.B and the Master Services Agreement.
(c) If the data importer is required to process personal data by EU law or Member State law to which it is subject, the data importer shall inform the data exporter of that legal requirement before processing, unless the law prohibits such information on important grounds of public interest.
(d) If the data importer cannot follow the documented instructions of the data exporter for any reason, including as a result of legal, technical, or operational constraints, the data importer shall promptly inform the data exporter without undue delay. In such event, the data exporter shall be entitled to suspend the transfer of personal data and/or terminate the relevant processing arrangement or the broader contract insofar as it concerns the processing of personal data.
Clause 8.2 — Purpose Limitation
The data importer shall process the personal data only for the specific purposes of the transfer set out in Annex I.B. The data importer shall not process the personal data for any other purpose unless:
(a) it has obtained further documented instructions from the data exporter;
(b) the processing is necessary for the establishment, exercise, or defence of legal claims; or
(c) the processing is necessary in order to protect the vital interests of the data subject or of another natural person.
In all cases, any processing outside the initial purpose shall be interpreted narrowly and shall remain subject to the general obligations of these Clauses.
Clause 8.3 — Transparency
(a) The data importer shall make available to the data subject, upon request, a copy of these Clauses, including the completed Annexes.
(b) To the extent necessary to protect business secrets or other confidential information, including personal data, the data importer may redact portions of the text of the Annexes before disclosing a copy. Where such redactions would otherwise prevent the data subject from understanding the substance of the Clauses, the data importer shall provide a meaningful summary of the redacted content.
(c) The data importer shall refer any data subject seeking further information regarding the processing, the transfer, or these Clauses to the data exporter, while also providing reasonable assistance to facilitate an informed response.
Clause 8.4 — Accuracy
If the data importer becomes aware that the personal data it has received is inaccurate or has become outdated, it shall inform the data exporter without undue delay. The data importer shall cooperate with the data exporter, including by implementing correction, deletion, suppression, or replacement measures, in order to erase or rectify the data as appropriate.
Clause 8.5 — Duration of Processing and Erasure or Return of Data
(a) Processing by the data importer shall take place only for the duration specified in Annex I.B and only for so long as necessary to perform the documented processing activities.
(b) Upon termination of the data processing services, or upon the data exporter’s written instruction following expiration or termination of the relevant contractual relationship, the data importer shall, at the choice of the data exporter:
1.  delete all personal data processed on behalf of the data exporter and certify to the data exporter in writing that it has done so; or
2.  return all such personal data to the data exporter and delete existing copies.
(c) The foregoing shall not apply to the extent the data importer is required by applicable EU or Member State law to retain some or all of the personal data. In such case, the data importer shall inform the data exporter of the legal basis for such retention, unless legally prohibited from doing so, and shall continue to ensure compliance with these Clauses for as long as the retained data remains in its possession or control.
(d) Until the data has been returned or deleted, the data importer shall continue to comply fully with these Clauses.
(e) For purposes of verifying deletion, the data importer shall make available to the data exporter any existing audit reports, certifications, or other records demonstrating deletion, and where reasonably required, shall permit and contribute to an audit in accordance with these Clauses.
Clause 8.6 — Security of Processing
(a) The data importer, and the data exporter during transmission, shall implement appropriate technical and organisational measures to ensure the security of the personal data, including protection against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or unauthorised access.
(b) The measures implemented by the data importer are those set out in Annex II. Those measures have been selected taking into account the state of the art, the costs of implementation, the nature, scope, context, and purposes of the processing, and the risks posed to data subjects.
(c) Without limitation to Annex II, the parties specifically acknowledge the following core safeguards:
1.  encryption at rest using AES-256;
2.  encryption in transit using TLS 1.3;
3.  pseudonymisation of direct identifiers, including subscriber IDs, names, and contact details, by replacement with pseudonymous tokens before transfer;
4.  access controls based on least privilege and role-based access principles;
5.  regular security testing and vulnerability assessments.
(d) The data importer shall grant access to the transferred personal data only to those personnel for whom such access is strictly necessary for performance of the services. Such personnel shall be subject to appropriate confidentiality obligations, whether contractual or statutory, and shall receive appropriate training concerning the secure handling of personal data.
Clause 8.7 — Sensitive Data
(a) The parties confirm that the transfers covered by these Clauses do not involve personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health, or data concerning a natural person’s sex life or sexual orientation within the meaning of Article 9 GDPR.
(b) The parties further confirm that the data transferred to the data importer comprises network performance data, subscriber metadata, location data, and device identifiers, and does not include special category data or data relating to criminal convictions and offences.
(c) Accordingly, specific restrictions applicable to sensitive data are not applicable to the transfers under these Clauses.
Clause 8.8 — Onward Transfers
The data importer shall disclose personal data to a third party only on documented instructions from the data exporter. Any onward transfer to a sub-processor shall be governed exclusively by Clause 9 and the related Annexes. No onward transfer shall be made in a manner that undermines the level of protection guaranteed by these Clauses.
Clause 8.9 — Documentation and Compliance
(a) The data importer shall promptly and adequately deal with inquiries from the data exporter relating to the processing of personal data under these Clauses.
(b) The data importer shall make available to the data exporter all information necessary to demonstrate compliance with these Clauses, including relevant policies, records, certifications, and audit materials, and shall allow for and contribute to audits by the data exporter or its mandated auditor.
(c) The data importer shall immediately inform the data exporter if it is unable to comply with these Clauses, whether for legal, technical, or operational reasons.
Clause 9 — Use of Sub-processors
Clause 9(a) — General Written Authorisation
(a) The parties select Option 2: General Written Authorisation.
(b) The data exporter hereby grants the data importer general written authorisation to engage sub-processors listed in Annex III for the performance of processing activities covered by these Clauses.
(c) The data importer shall specifically inform the data exporter in writing of any intended changes to that list through the addition or replacement of sub-processors at least thirty (30) calendar days in advance of the proposed engagement, thereby giving the data exporter sufficient time to assess the proposed change and, where appropriate, to object before the new sub-processor begins processing.
(d) The data importer shall provide the data exporter with the information reasonably necessary to enable the data exporter to exercise its right to object, including the identity of the proposed sub-processor, the processing activities to be delegated, the location of processing, and a summary of the safeguards to be applied.
(e) The data exporter may object in writing to the engagement of a proposed sub-processor within fourteen (14) calendar days of receiving notice. If the objection is not resolved within a further thirty (30) calendar days, the data exporter may terminate the relevant services or the contract insofar as it concerns the processing of personal data affected by the unresolved objection.
Clause 9(b) — Sub-processor Contract Requirements
(a) Where the data importer engages a sub-processor, it shall do so only by way of a written contract that imposes on the sub-processor the same data protection obligations as those set out in these Clauses, to the extent applicable to the nature of the delegated processing.
(b) The data importer shall ensure that each sub-processor provides sufficient guarantees to implement appropriate technical and organisational measures in such a manner that the processing will meet the requirements of Regulation (EU) 2016/679 and these Clauses.
(c) Upon the data exporter’s reasonable request, the data importer shall provide a copy of the relevant sub-processing agreement, or relevant excerpts thereof, subject to redactions strictly necessary to protect confidential commercial information.
Clause 9(c) — Liability
The data importer shall remain fully liable to the data exporter for the performance of each sub-processor’s obligations under its sub-processing agreement. Delegation of processing to a sub-processor shall not relieve the data importer of any duty, responsibility, or liability under these Clauses.
Clause 9(d) — Back-up Mechanism
Where a sub-processor fails to fulfil its data protection obligations, the data importer shall remain fully liable to the data exporter for the performance of those obligations and for any resulting non-compliance, damage, or remediation required under these Clauses.
Clause 10 — Data Subject Rights
(a) Taking into account the nature of the processing, the data importer shall assist the data exporter by appropriate technical and organisational measures, insofar as this is possible, for the fulfilment of the data exporter’s obligations to respond to requests for exercising data subject rights under the GDPR.
(b) The data importer shall deal promptly, and in any event within one month, with requests from data subjects to exercise their rights under Regulation (EU) 2016/679, including rights of access, rectification, erasure, restriction of processing, data portability, and objection, to the extent that the data importer is in a position to do so.
(c) If the data importer is unable to respond directly to a request, or if the request should more appropriately be handled by the data exporter as controller, the data importer shall promptly forward the request to the data exporter and shall not respond on the merits except on documented instructions from the data exporter or as otherwise required by law.
(d) The data importer shall assist the data exporter in providing information to the data subject about the processing of the transferred personal data in the third country, including information regarding applicable safeguards and relevant aspects of these Clauses.
Clause 11 — Redress
(a) The data importer shall inform data subjects, in a transparent and easily accessible format, of a contact point authorised to handle complaints arising under these Clauses.
(b) For purposes of this Clause, the designated contact point at the data importer is:
Jennifer Huang VP, Legal & Privacy Caldwell Analytics Inc. 2700 Technology Drive, Suite 400 San Jose, CA 95134 USA
(c) The data importer shall deal promptly with any complaints received from a data subject and, in any event, within one month of receipt.
(d) The data importer agrees that, where a dispute cannot be resolved amicably, data subjects may refer the matter to the competent supervisory authority or lodge a complaint before the competent courts in the Member State of their habitual residence, place of work, or place of the alleged infringement, as provided under applicable law.
Clause 12 — Liability
(a) Each party shall be liable to the other party or parties for any damages it causes by any breach of these Clauses.
(b) Each party shall be liable to the data subject, and the data subject shall be entitled to receive compensation for any material or non-material damage that the party causes the data subject by breaching these Clauses.
(c) Where the data importer is liable for damage caused to a data subject in relation to a breach of third-party beneficiary rights under these Clauses, the data exporter shall, where the data subject so requests, bring a claim against the data importer on behalf of the data subject, unless the data subject chooses to bring the claim directly.
(d) Where more than one party is responsible for any damage caused to a data subject as a result of a breach of these Clauses, all responsible parties shall be jointly and severally liable, and the data subject may bring an action against any of them.
(e) A party that has paid full compensation shall be entitled to claim back from the other responsible party or parties that part of the compensation corresponding to their responsibility for the damage.
Clause 13 — Supervision
Clause 13(a) — Competent Supervisory Authority
(a) The supervisory authority with responsibility for ensuring compliance by the data exporter with Regulation (EU) 2016/679 shall act as competent supervisory authority for purposes of these Clauses.
(b) The parties identify the competent supervisory authority in Annex I.C as the Data Protection Commission (Ireland), acting in light of Northgate Telecommunications PLC’s EU establishment through Northgate Ireland Ltd, Unit 12, Grand Canal Dock Business Centre, Barrow Street, Dublin 2, D02 KV92, Ireland.
Clause 13(b) — Data Importer’s Obligations Re Supervisory Authority
The data importer agrees:
(a) to submit itself to the jurisdiction of the competent supervisory authority;
(b) to cooperate with the competent supervisory authority in any procedures aimed at ensuring compliance with these Clauses;
(c) to abide by any decision of the competent supervisory authority that is binding under applicable EU or Member State law; and
(d) that data subjects may lodge a complaint with the competent supervisory authority.
SECTION III — LOCAL LAWS AND OBLIGATIONS IN CASE OF ACCESS BY PUBLIC AUTHORITIES
Clause 14 — Local Laws and Practices Affecting Compliance with the Clauses
Clause 14(a) — Warranty of No Reason to Believe
(a) The parties warrant that they have no reason to believe that the laws and practices in the third country of destination, namely the United States of America, applicable to the processing of the personal data by the data importer, including any requirements to disclose personal data or measures authorising access by public authorities, prevent the data importer from fulfilling its obligations under these Clauses.
(b) This warranty is based on the understanding that laws and practices that respect the essence of fundamental rights and freedoms and do not exceed what is necessary and proportionate in a democratic society to safeguard one of the objectives listed in Article 23(1) of Regulation (EU) 2016/679 are not in contradiction with these Clauses.
(c) In reaching this conclusion, the parties have relied in particular on the documented findings of Transfer Impact Assessment TIA-001 (NTP → Caldwell Analytics (US)), which analysed, among other matters, Section 702 of the Foreign intelligence Surveillance Act, Executive Order 12333, the Clarifying Lawful Overseas Use of Data Act (CLOUD Act), and the EU-US Data Privacy Framework, including relevant redress developments.
Clause 14(b) — Relevant Assessment Elements
In carrying out the assessment required under this Clause 14, the parties have taken into account, and agree that the following elements are materially relevant:
(a) the specific circumstances of the transfer, including the nature of the personal data transferred, namely network performance data, pseudonymised subscriber metadata, approximate location data, and device identifiers; the type of recipient, namely a business-to-business analytics processor; the sector, namely telecommunications; and the data importer’s documented history regarding government access requests;
(b) the laws and practices of the United States, including FISA Section 702, Executive Order 12333, the CLOUD Act, and the recently established EU-US Data Privacy Framework, including the Data Protection Review Court mechanism implemented under Executive Order 14086; and
(c) the contractual, technical, and organisational safeguards implemented as supplementary measures to these Clauses, including those detailed in Annex II, such as pseudonymisation of direct identifiers before transfer, AES-256 encryption at rest, TLS 1.3 encryption in transit, contractual audit rights, and data localisation measures for designated categories of data.
Clause 14(c) — Documentation Obligation
(a) The data importer warrants that it has made best efforts to provide the data exporter with all relevant information reasonably available to it concerning the laws and practices of the United States insofar as they may affect compliance with these Clauses.
(b) The data importer shall continue to cooperate with the data exporter on an ongoing basis to ensure continued compliance, including by providing updated information where relevant circumstances change.
(c) The parties agree to document the assessment conducted under Clause 14(b) and to make that assessment available to the competent supervisory authority upon request.
(d) The parties specifically reference TIA-001, conducted by Calderwood & Harkness LLP through Rachel Bernstein and Sara Hendricks, completed as part of the NTP GDPR compliance program build under engagement reference SC/NTP/2023-0213/PDS.
Clause 14(d) — Ongoing Review
(a) The data importer agrees to notify the data exporter promptly if it has reason to believe that it is or has become subject to laws or practices not in line with the requirements under Clause 14(a), including any legal developments, changes in governmental practice, or other circumstances that may materially impair its ability to comply with these Clauses.
(b) Following such notification, or otherwise where the data exporter has reason to question continued compliance, the data exporter shall identify and take appropriate measures, including technical, organisational, or contractual measures, to address the situation and ensure the security and confidentiality of the transferred personal data.
(c) If no appropriate supplementary measures can reasonably be implemented to restore compliance, the data exporter shall be entitled to suspend the transfer of personal data and/or terminate the relevant contractual arrangement insofar as it concerns the affected processing.
Clause 14(e) — Data Importer Notification If Unable to Comply
If, after having agreed to these Clauses, the data importer has reason to believe that it can no longer fulfil its obligations under these Clauses, including as a result of changes in United States law, regulatory practice, government access mechanisms, or judicial interpretation, it shall notify the data exporter without undue delay. The parties agree that such notice shall constitute notice of a substantive breach and shall trigger the data exporter’s rights to suspend transfers and terminate the arrangement as provided in these Clauses.
Clause 15 — Obligations of the Data Importer in Case of Access by Public Authorities
Clause 15.1 — Notification
(a) The data importer shall notify the data exporter promptly, and where possible before any disclosure, if it:
1.  receives a legally binding request from a public authority, including a judicial authority, under United States law for the disclosure of personal data transferred pursuant to these Clauses; or
2.  becomes aware of any direct access by public authorities to such personal data in accordance with United States law.
(b) If the data importer is prohibited from notifying the data exporter, it shall use its best efforts to obtain a waiver of the prohibition so as to communicate as much information as possible, as soon as possible.
(c) The data importer shall preserve available information concerning any such request or access, including the legal basis invoked, the authority making the request, the categories of data affected, and the response provided, and shall make such information available to the data exporter upon request to the extent legally permissible.
(d) The data importer agrees to provide the data exporter with sufficient information regarding requests for access to enable the data exporter to assess the implications of the request and to respond promptly to any supervisory authority inquiry, contractual concern, or data subject issue arising from the request.
Clause 15.2 — Review of Legality and Data Minimisation
(a) The data importer shall review the legality of any request for disclosure, including whether the request remains within the powers granted to the requesting public authority under the applicable law of the requesting country.
(b) If, after careful assessment, the data importer concludes that there are reasonable grounds to consider the request unlawful under the law of the requesting country, applicable international obligations, or principles of international comity, it shall challenge the request.
(c) The data importer shall, where appropriate, pursue available possibilities of appeal or other review in order to resist unlawful or disproportionate disclosure.
(d) The data importer shall document its legal assessment, any challenge made, and the outcome of such challenge, and shall make that documentation available to the data exporter upon request to the extent legally permissible.
(e) Where the data importer is ultimately required to respond to a lawful request, it shall provide only the minimum amount of information permissible and strictly required by the request.
Clause 15.3 — Transparency
(a) The data importer agrees to provide the data exporter, at regular intervals and at least annually, with as much relevant information as possible concerning the requests received from public authorities for access to personal data processed under these Clauses.
(b) Such information shall include, to the extent legally permissible, the number of requests received, the categories or type of data requested, the requesting authority, whether the requests were challenged, and the outcome of any such challenge.
(c) If the data importer is prohibited from providing some or all of this information, it shall use its best efforts to obtain a waiver of the prohibition and to disclose the maximum amount of information permissible.
SECTION IV — FINAL PROVISIONS
Clause 16 — Non-compliance with the Clauses and Termination
(a) Where the data importer is in breach of these Clauses, the data exporter shall suspend the transfer of personal data to the data importer until compliance is again ensured or the relevant contract is terminated.
(b) Where the data importer is in substantial or persistent breach of these Clauses, the data exporter shall be entitled to terminate the contract insofar as it concerns the processing of personal data under these Clauses.
(c) If the contract involves more than two parties, the data exporter may exercise its right to terminate only with respect to the relevant party in breach, unless the parties have expressly agreed otherwise.
(d) Upon termination under this Clause, the data importer shall promptly return or delete all personal data, at the choice of the data exporter, and shall certify in writing that such return or deletion has been completed, except to the extent retention is required by applicable law.
(e) The rights set out in this Clause are without prejudice to any other rights or remedies available to the data exporter, the data subject, or a competent supervisory authority under these Clauses or applicable law.
Clause 17 — Governing Law
These Clauses shall be governed by the laws of Ireland, being the law of a Member State that allows for third-party beneficiary rights. The parties select Irish law in light of the data exporter’s EU establishment through Northgate Ireland Ltd and the designation of the Data Protection Commission (Ireland) as competent supervisory authority.
Clause 18 — Choice of Forum and Jurisdiction
(a) Any dispute arising from these Clauses shall be resolved by the courts of a Member State of the European Union.
(b) The parties agree that the courts of Ireland shall have jurisdiction to resolve disputes arising from these Clauses.
(c) Nothing in this Clause shall prejudice the right of a data subject to bring proceedings against the data exporter and/or the data importer before the courts of the Member State in which the data subject has his or her habitual residence, place of work, or, where applicable, before the courts of the place of the alleged infringement.
SIGNATURES PAGE
The undersigned, being duly authorised to sign on behalf of their respective organisations, hereby execute these Standard Contractual Clauses, including Annexes I, II, and III, as of 17 July 2023.
NORTHGATE TELECOMMUNICATIONS PLC
By: ________
Name: Fiona Gallagher
Title: General Counsel & Company Secretary
Date: 17 July 2023
Place: London, United Kingdom
CALDWELL ANALYTICS INC.
By: ________
Name: Jennifer Huang
Title: VP, Legal & Privacy
Date: 17 July 2023
Place: San Jose, California, USA
These Clauses were prepared and negotiated by Calderwood & Harkness LLP, One Moorgate Square, London EC2R 6AN, United Kingdom, on behalf of the Data Exporter, and reviewed by Hargrove Lister & Webb LLP, 555 Mission Street, Suite 3100, San Francisco, CA 94105, USA, on behalf of the Data Importer.
ANNEX I — DETAILS OF THE TRANSFER
Annex I.A — List of Parties
1. Data Exporter
Name: Northgate Telecommunications PLC
Addresses: Registered Office: 140 Queensway Place, Reading, Berkshire RG1 4QT, United Kingdom Principal Office: Northgate Tower, 88 Canary Wharf Boulevard, London E14 5HN, United Kingdom
Contact person: Sanjay Mehta Data Protection Officer Northgate Tower, 88 Canary Wharf Boulevard, London E14 5HN, United Kingdom
Activities relevant to the data transferred: Northgate Telecommunications PLC operates telecommunications infrastructure and the NorthCloud SaaS platform across the United Kingdom and the European Union. In the course of providing fixed-line, mobile, and cloud-based unified communications services to approximately 6.3 million consumer subscribers and 42,000 enterprise clients, it processes network performance data, subscriber metadata, location data, and device identifiers. The transfers covered by these Clauses are undertaken to support advanced analytics, performance optimisation, and predictive maintenance activities carried out by the data importer on behalf of the data exporter.
Role: Controller pursuant to Article 4(7) GDPR
Company Number: 04837291 (England and Wales)
ICO Registration Number: ZA482917
2. Data Importer
Name: Caldwell Analytics Inc.
Addresses: Principal Office: 2700 Technology Drive, Suite 400, San Jose, CA 95134, USA Registered Agent: 1209 Orange Street, Wilmington, New Castle County, Delaware 19801, USA
Contact person: Jennifer Huang VP, Legal & Privacy 2700 Technology Drive, Suite 400, San Jose, CA 95134, USA
Activities relevant to the data transferred: Caldwell Analytics Inc. provides AI-driven network analytics and predictive maintenance services to telecommunications operators. In that capacity, it receives, stores, structures, analyses, and reports on network performance data transferred by the data exporter in order to support service optimisation, failure prediction, anomaly detection, and operational reporting.
Role: Processor pursuant to Article 4(8) GDPR
Legal counsel: Hargrove Lister & Webb LLP 555 Mission Street, Suite 3100, San Francisco, CA 94105, USA London Office: 30 Fenchurch Street, London EC3M 3BD, UK Contact: Natalie Prescott, Partner, Data Privacy & Cybersecurity
Annex I.B — Description of the Transfer
1. Categories of data subjects whose personal data is transferred
The categories of data subjects whose personal data may be transferred under these Clauses are as follows:
•  consumer subscribers of Northgate Telecommunications PLC telecommunications services and NorthCloud services, representing approximately 6.3 million individuals across the United Kingdom and the European Union; and
•  end-users of enterprise clients whose use of telecommunications or cloud communications services generates network metadata.
For the avoidance of doubt, employee data is not included in the transfer described in these Clauses.
2. Categories of personal data transferred
The categories of personal data transferred to the data importer are limited to those necessary for the defined analytics purposes and include:
•  network performance data, including call data records, session logs, and bandwidth utilisation metrics;
•  subscriber metadata in pseudonymised form, including pseudonymised subscriber identifiers, with direct identifiers such as names and contact details replaced by tokenised values before transfer;
•  location data, limited to cell tower identifiers and approximate geolocation of network sessions, and expressly excluding precise geocoordinates;
•  device identifiers, including IMEI numbers, MAC addresses, device type information, and operating system identifiers; and
•  network usage patterns and associated timestamps.
3. Sensitive data transferred
No sensitive data is transferred. The transfer does not include special categories of personal data within the meaning of Article 9 GDPR, nor data relating to criminal convictions and offences within the meaning of Article 10 GDPR.
4. Frequency of the transfer
The transfer takes place on a continuous or near real-time basis through operational data feeds used for analytics processing. In addition, batch transfers occur daily at 02:00 UTC for reconciliation, model refresh, and reporting support purposes.
5. Nature of the processing
The nature of the processing includes collection, receipt, storage, organisation, structuring, analysis, machine-learning-assisted and AI-driven analytics, aggregation, reporting, dashboard generation, and erasure or anonymisation upon completion of the relevant processing cycle or retention period.
6. Purpose(s) of the transfer and further processing
The personal data is transferred and further processed solely for the following purposes on behalf of the data exporter and subject to its documented instructions:
•  AI-driven network analytics to optimise network performance and capacity planning;
•  predictive maintenance modelling to identify risks of network infrastructure failure;
•  network anomaly detection and alerting;
•  generation of aggregated analytics reports and dashboards for Northgate operational teams; and
•  related service support activities necessary to provide the contracted analytics services.
All processing is carried out on behalf of, and under the documented instructions of, the data exporter.
7. Retention period
The data importer shall retain personal data for no longer than necessary for the purposes for which it is processed, as specified in the Master Services Agreement dated 1 June 2021 and related instructions.
The default retention period is 12 months from the date of ingestion, after which the personal data is either irreversibly anonymised or deleted. Aggregated or anonymised outputs that no longer constitute personal data may be retained indefinitely for trend analysis, service improvement, benchmarking, and longitudinal reporting.
8. Transfers to sub-processors
Where personal data is transferred onward to approved sub-processors, the subject matter, nature, and duration of the processing are as specified in Annex III. Sub-processors are engaged only for infrastructure hosting, data storage, managed support, and computational processing in support of Caldwell Analytics Inc.’s provision of services to Northgate Telecommunications PLC. Such sub-processors may process the data only for the same purposes and for no longer than the periods specified in this Annex I.B and the applicable sub-processing agreements.
Annex I.C — Competent Supervisory Authority
Competent supervisory authority: Data Protection Commission (Ireland)
The parties designate the Data Protection Commission (Ireland) as the competent supervisory authority for purposes of these Clauses on the basis that the data exporter’s EU establishment is Northgate Ireland Ltd (CRO Number: 587214), registered at Unit 12, Grand Canal Dock Business Centre, Barrow Street, Dublin 2, D02 KV92, Ireland, and that the Data Protection Commission acts as lead supervisory authority for Northgate’s cross-border processing within the European Union pursuant to Article 56 GDPR.
For clarity, for processing activities subject exclusively to the UK GDPR, the Information Commissioner’s Office (“ICO”), Registration Number ZA482917, is the relevant supervisory authority, and a separate UK International Data Transfer Agreement executed between the same parties on 17 July 2023 governs those transfers.
ANNEX II — TECHNICAL AND ORGANISATIONAL MEASURES INCLUDING TECHNICAL AND ORGANISATIONAL MEASURES TO ENSURE THE SECURITY OF THE DATA
Preamble
This Annex II describes the technical and organisational measures implemented by Caldwell Analytics Inc., as data importer, to ensure an appropriate level of security for the personal data transferred under these Clauses, taking into account the nature, scope, context, and purposes of the processing and the risks for the rights and freedoms of natural persons.
These measures are intended not only to satisfy the requirements of Article 32 GDPR as incorporated through these Clauses, but also to function as supplementary measures within the meaning of EDPB Recommendations 01/2020 on measures that supplement transfer tools to ensure compliance with the EU level of protection of personal data. The measures described herein were evaluated in connection with Transfer Impact Assessment TIA-001 (NTP → Caldwell Analytics (US)).
The parties record that these measures were reviewed during due diligence by Thomas Okoye, Chief Information Security Officer of Northgate Telecommunications PLC, and Ashdown Consulting Group Ltd through Anita Chakravarti, Lead Privacy Engineer.
1. Pseudonymisation and Data Minimisation
(a) All direct identifiers, including subscriber names, contact details, addresses, and account numbers, are pseudonymised by the data exporter prior to transfer through tokenisation or equivalent transformation methods.
(b) The pseudonymisation key, token vault, and any mapping capability permitting reversal of the pseudonymisation are retained exclusively by the data exporter and are not shared with the data importer.
(c) The data importer processes only pseudonymised subscriber ID tokens, approximate location data, device identifiers, network performance data, and associated operational metrics necessary for the defined analytics purposes.
(d) The data importer is prohibited from attempting to re-identify data subjects and shall impose the same prohibition contractually on all approved sub-processors.
(e) Data minimisation principles are applied at ingestion, schema design, analytics workflow design, and retention stages to avoid collection or retention of data beyond what is necessary for the defined processing purposes.
2. Encryption
(a) Encryption at rest: All personal data stored on systems operated by or for the data importer is encrypted using AES-256 or an equivalent industry-recognised standard affording comparable protection.
(b) Encryption in transit: All personal data transmitted between the data exporter and data importer, and between internal systems within the data importer’s environment, is encrypted using TLS 1.3.
(c) Encryption keys are managed through a dedicated key management system supported by hardware security modules (HSMs) or equivalent hardened key storage technologies.
(d) Encryption keys are rotated at least annually and additionally upon security events, personnel changes affecting privileged roles, or other circumstances warranting rotation under the data importer’s security policies.
3. Access Controls
(a) Role-based access control (RBAC) is enforced across systems that store, process, or otherwise handle transferred personal data.
(b) Multi-factor authentication (MFA) is mandatory for all personnel with access to systems containing transferred personal data.
(c) Access is restricted to personnel with a demonstrated business need and is subject to approval under internal access governance procedures overseen by Caldwell’s Chief Technology Officer, Derek Rawlings, or designated delegates acting under equivalent authority.
(d) Administrative and privileged access is separately controlled, logged, and subject to periodic review.
(e) Access logs are retained for a minimum period of twenty-four (24) months and are made available for audit by the data exporter, subject to reasonable confidentiality and security protections.
4. Network Security
(a) Intrusion detection and prevention systems (IDS/IPS) are deployed at relevant network perimeters and within internal network segments associated with transferred personal data.
(b) Network segmentation is maintained between environments processing transferred data and other corporate or development environments to reduce lateral movement risk.
(c) Independent third-party penetration testing is conducted at least annually, with remediation tracking for identified findings.
(d) Web application firewalls (WAFs) are deployed for API endpoints and ingestion interfaces receiving data from Northgate Telecommunications PLC.
(e) Vulnerability scanning is performed on a regular basis, and identified critical vulnerabilities are remediated in accordance with defined service levels under the data importer’s information security program.
5. Physical Security
(a) Data centres hosting transferred personal data are SOC 2 Type II certified or hosted in facilities providing equivalent audited assurance standards.
(b) Physical access controls include biometric or similarly robust authentication controls, 24/7 CCTV monitoring, visitor management procedures, and on-site or contracted security staffing.
(c) As of the execution date, the primary data centre locations for the relevant processing environment are in San Jose, California, USA.
6. Personnel Security
(a) All Caldwell personnel with access to transferred personal data are subject to pre-engagement background checks to the extent permitted by applicable law.
(b) Such personnel are required to sign confidentiality agreements or are otherwise bound by enforceable confidentiality obligations.
(c) Annual data protection, privacy, and security awareness training is mandatory for personnel handling personal data.
(d) The data importer maintains disciplinary procedures for unauthorised access, misuse of systems, failure to follow security procedures, or breaches of confidentiality and data protection obligations.
7. Incident Detection and Response
(a) The data importer maintains a Security Operations Centre operating 24 hours a day, 7 days a week, 365 days a year for real-time monitoring and detection of security events.
(b) A documented incident response plan defines severity levels, escalation procedures, containment protocols, evidence preservation requirements, stakeholder notification processes, and post-incident review obligations.
(c) Personal data breaches affecting transferred personal data shall be notified to the data exporter without undue delay and, in any event, within thirty-six (36) hours after the data importer becomes aware of the breach.
(d) Incident records are maintained and may be reviewed by the data exporter in connection with audits or incident investigations.
8. Data Deletion and Anonymisation
(a) Secure deletion procedures are implemented using methods aligned with NIST SP 800-88 or equivalent recognised standards.
(b) Personal data is subject to automatic anonymisation or deletion after the twelve-month default retention period, unless a shorter period or specific deletion instruction applies.
(c) Anonymisation is designed to be irreversible and to prevent re-identification by the data importer using means reasonably available to it.
(d) Upon request by the data exporter and upon termination of services, the data importer shall provide certification of deletion.
9. Business Continuity and Disaster Recovery
(a) The data importer maintains documented business continuity and disaster recovery plans covering systems relevant to the transferred personal data.
(b) Backups are performed regularly and are encrypted using AES-256 or an equivalent standard.
(c) The target recovery point objective (RPO) for the relevant environment is four (4) hours.
(d) The target recovery time objective (RTO) for the relevant environment is eight (8) hours.
(e) Disaster recovery testing is conducted at least annually, and corrective actions are tracked to completion.
10. Sub-processor Controls
(a) Due diligence assessments are conducted on all sub-processors before engagement, including reviews of security posture, privacy controls, incident response maturity, and relevant certifications or independent assessments.
(b) Sub-processor agreements require implementation of technical and organisational measures equivalent in substance to those described in this Annex, insofar as relevant to the delegated processing.
(c) The data importer conducts annual security reviews of sub-processors and maintains contractual rights to audit or otherwise assess sub-processor compliance.
11. Audit Rights
(a) The data exporter, and/or its appointed auditor, advisor, or agent acting under confidentiality obligations, shall have the right to conduct audits, including on-site inspections where reasonably necessary, of the data importer’s processing facilities, systems, records, and relevant practices relating to the transferred personal data.
(b) Routine audits may be conducted no more than once per calendar year unless an audit is triggered by a specific incident, data subject complaint, material control failure, or supervisory authority inquiry.
(c) The data importer shall cooperate fully with such audits and shall provide access, as reasonably necessary, to relevant records, systems, personnel, and premises.
(d) The costs of routine annual audits shall be borne by the data exporter. The costs of incident-triggered audits shall be borne by the data importer if the audit reveals non-compliance with these Clauses or with the data importer’s documented obligations.
12. Data Localisation
(a) Certain categories of data designated by the data exporter, specifically precise location data should such data ever be included in future data flows, and any data relating to minors or vulnerable persons, shall be processed only within the data importer’s facilities in the United States and shall not be further transferred to any other jurisdiction without the prior written consent of the data exporter.
(b) As of the execution date, the current transfer does not include data relating to minors and does not include precise location data.
(c) Any proposed change to the scope of transferred data implicating this localisation restriction shall be subject to prior written review and approval by the data exporter and, where appropriate, updated transfer assessments and contractual documentation.
ANNEX III — LIST OF SUB-PROCESSORS
Preamble
Pursuant to Clause 9(a) of these Clauses, the data exporter has authorised the use of the sub-processors listed in this Annex III as of the execution date. The data importer shall not engage additional sub-processors, or replace listed sub-processors, without providing at least thirty (30) calendar days’ prior written notice to the data exporter in accordance with Clause 9(a).
The data importer confirms that, as of 17 July 2023, no approved sub-processors used for the processing covered by these Clauses are located outside the United States of America. Any future engagement of sub-processors in another jurisdiction shall require prior notice and the implementation of appropriate transfer mechanisms and safeguards.
Approved Sub-processors as of 17 July 2023
APPENDIX — SUPPLEMENTARY MEASURES DOCUMENTATION
Reference to Transfer Impact Assessment
These Clauses are supplemented by Transfer Impact Assessment TIA-001 (NTP → Caldwell Analytics Inc. (US)), prepared by Calderwood & Harkness LLP, through Rachel Bernstein, Billing Partner, and Sara Hendricks, Lead Associate, as part of the Northgate Telecommunications PLC GDPR Compliance Program Build under engagement reference SC/NTP/2023-0213/PDS.
TIA-001 assessed the implications for the transferred personal data of Section 702 of FISA, Executive Order 12333, the CLOUD Act, and the EU-US Data Privacy Framework. Based on the specific categories of data transferred, the nature of the recipient, the telecommunications context, Caldwell Analytics Inc.’s processing model, and the supplementary safeguards described in these Clauses and Annex II, the assessment concluded that the combined contractual, technical, and organisational measures reduce residual transfer risk to an acceptable level for the specific processing operations described herein.
The parties agree that TIA-001 shall be reviewed and updated at least annually, and sooner if there is any material change in applicable United States law, regulatory interpretation, governmental practice, technical architecture, or processing operations that could affect the data importer’s ability to comply with these Clauses.
Reference to DPIA
These Clauses relate to processing assessed under Data Protection Impact Assessment DPIA-011 (Caldwell Analytics Network Performance Data Transfer (US)), which was classified as high-risk. DPIA-011 evaluated the risks to data subjects arising from the transfer, including cross-border access risk, re-identification risk, and data concentration risk, and identified the supplementary measures embodied in these Clauses and Annex II as necessary mitigations to reduce such risks to an acceptable operational level.
Relationship with UK IDTA
A separate UK International Data Transfer Agreement (IDTA) between the same parties, executed on the same date, 17 July 2023, governs transfers of personal data that are subject to the UK GDPR. These Clauses and the UK IDTA are intended to operate in parallel and to be read consistently wherever possible. In the event of any inconsistency, the instrument applicable to the relevant legal regime shall prevail with respect to the data subject to that regime, such that these Clauses govern EU GDPR transfers and the UK IDTA governs UK GDPR transfers.
Relationship with Master Services Agreement
These Clauses are entered into in connection with the Master Services Agreement between Northgate Telecommunications PLC and Caldwell Analytics Inc. dated 1 June 2021, as amended. In accordance with Clause 5, in the event of any conflict between these Clauses and the Master Services Agreement, these Clauses shall prevail to the extent of the inconsistency.
EXECUTION ATTESTATION
This document, together with Annexes I, II, and III, has been executed in two counterparts, one retained by each party, each of which shall be deemed an original, as of 17 July 2023.
NORTHGATE TELECOMMUNICATIONS PLC
By: ________
Name: Fiona Gallagher
Title: General Counsel & Company Secretary
Date: 17 July 2023
CALDWELL ANALYTICS INC.
By: ________
Name: Jennifer Huang
Title: VP, Legal & Privacy
Date: 17 July 2023
Sub-processor | Address | Description of Processing | Country of Processing | Transfer Mechanism
Caldwell Infrastructure Services LLC | 2700 Technology Drive, Suite 200, San Jose, CA 95134, USA | Data centre hosting, storage, and computational infrastructure supporting analytics processing performed on behalf of the data importer | United States of America | N/A (intra-group, same jurisdiction as data importer)
Redwood Managed Services Inc. | 4100 International Boulevard, Suite 600, Atlanta, GA 30354, USA | Managed IT support services, infrastructure monitoring, and incident response support | United States of America | N/A (same jurisdiction as data importer)