1022-00007 · Northgate Telecommunications PLC · Transfer Mechanisms

uk-idta-ntp-caldwell-executed.docx DOCUMENT Finance & Banking

39 / 39 ← ✕

Contract analysis Extract to table

UK INTERNATIONAL DATA TRANSFER AGREEMENT

Approved under Section 119A of the Data Protection Act 2018

Reference: SC/NTP/2023-0213/PDS — Schedule 4 (UK IDTA)

Execution Date: 17 July 2023

Between

NORTHGATE TELECOMMUNICATIONS PLC (the "Exporter")

and

CALDWELL ANALYTICS INC. (the "Importer")

This UK International Data Transfer Agreement (this "IDTA") is entered into between the parties identified above to provide appropriate safeguards for the transfer of personal data from the United Kingdom to the United States of America in accordance with Article 46 of the United Kingdom General Data Protection Regulation (the "UK GDPR"), as incorporated into United Kingdom domestic law by virtue of the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 and as further amended by the Data Protection Act 2018.

This IDTA complements and operates alongside the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), Module 2 (Controller to Processor), executed between the same parties on 17 July 2023 for the same data flows (the "EU SCCs"). This IDTA governs transfers of personal data that are subject to the UK GDPR. The EU SCCs govern transfers of personal data that are subject to the EU GDPR. Where a single data flow involves personal data subject to both regimes, this IDTA provides the UK GDPR safeguards and the EU SCCs provide the EU GDPR safeguards; neither instrument supersedes the other.

This IDTA is based on the template issued by the Information Commissioner's Office (the "ICO") pursuant to Section 119A of the Data Protection Act 2018, as laid before Parliament on 2 February 2022.

RECITALS

(A) Northgate Telecommunications PLC (Company Number 04837291), a public limited company incorporated in England and Wales with its registered office at 140 Queensway Place, Reading, Berkshire RG1 4QT, United Kingdom, and its principal office at Northgate Tower, 88 Canary Wharf Boulevard, London E14 5HN, United Kingdom (the "Exporter"), operates telecommunications infrastructure and enterprise Software-as-a-Service solutions (including the NorthCloud platform) across the United Kingdom and serves a customer base comprising approximately 6.3 million consumer subscribers, approximately 42,000 enterprise clients, and approximately 11,400 employees. The Exporter is a data controller within the meaning of Article 4(7) of the UK GDPR with respect to the personal data that is the subject of this IDTA.

(B) Caldwell Analytics Inc., a C-Corporation incorporated in the State of Delaware, United States of America, with its registered agent at 1209 Orange Street, Wilmington, New Castle County, Delaware 19801, USA, and its principal office at 2700 Technology Drive, Suite 400, San Jose, California 95134, USA (the "Importer"), provides AI-driven network analytics and predictive maintenance services to telecommunications operators globally. The Importer acts as a data processor within the meaning of Article 4(8) of the UK GDPR with respect to the personal data transferred under this IDTA, processing such data solely on behalf of, and in accordance with the documented instructions of, the Exporter.

(C) The Exporter and the Importer entered into a Master Services Agreement dated 1 June 2021 (as amended from time to time, the "MSA"), pursuant to which the Importer processes network performance data — including subscriber metadata, location data, and device identifiers — on behalf of the Exporter for the purpose of AI-driven network analytics, predictive maintenance modelling, anomaly detection, and network optimisation reporting. The data processing activities contemplated by this IDTA arise directly from, and are ancillary to, the services provided under the MSA.

(D) The Exporter's Data Protection Officer is Sanjay Mehta (CIPP/E certified), who may be contacted at dpo@northgatetelecom.co.uk and by telephone at +44 (0)20 7946 0123. The Importer's designated data protection contact is Jennifer Huang, VP, Legal & Privacy, who may be contacted at j.huang@caldwellanalytics.com and by telephone at +1 (408) 555-7200. Each party has ensured that its designated data protection contact has sufficient authority and resources to oversee compliance with this IDTA.

(E) The Exporter is registered with the ICO under registration number ZA482917, and maintains its registration in compliance with Part III of the Data Protection Act 2018.

(F) The parties wish to enter into this IDTA to provide appropriate safeguards under Article 46(1) of the UK GDPR for the restricted transfer (within the meaning of Section 18 of the Data Protection Act 2018, as read with Article 46 of the UK GDPR) of personal data from the Exporter in the United Kingdom to the Importer in the United States of America. At the date of execution of this IDTA, the United States of America has not been the subject of an adequacy regulation under Section 17A of the Data Protection Act 2018 with respect to the categories of data and processing activities contemplated by this IDTA, and accordingly the parties are required to put in place appropriate safeguards for the transfer.

(G) This IDTA is entered into in conjunction with the EU Standard Contractual Clauses (Module 2: Controller to Processor) executed between the parties on 17 July 2023, but this IDTA operates independently of the EU SCCs to govern transfers of personal data that are subject to UK GDPR. To the extent that any provision of this IDTA is inconsistent with the EU SCCs, this IDTA shall prevail with respect to personal data subject to UK GDPR, and the EU SCCs shall prevail with respect to personal data subject to EU GDPR.

(H) The parties have completed a Transfer Impact Assessment, referenced internally as TIA-001, assessing the laws and practices of the United States of America as they relate to the transfer of personal data under this IDTA, including an analysis of the Foreign intelligence Surveillance Act (FISA) Section 702, Executive Order 12333, the Clarifying Lawful Overseas Use of Data Act (the "CLOUD Act"), and the EU-US Data Privacy Framework. TIA-001 was completed on 4 August 2023 and concluded that, taking into account the supplementary measures implemented under this IDTA, the residual risk to the rights and freedoms of data subjects is reduced to an acceptable level. The parties acknowledge their ongoing obligation to monitor developments in the legal framework of the United States and to reassess TIA-001 on at least an annual basis or upon any material change in relevant law or practice.

NOW, THEREFORE, the parties agree as follows:

Right-click to update Table of Contents

PART 1: TABLES

Table 1: Parties and Key Contacts

Start Date: 17 July 2023

Table 2: Transfer Details

1. UK Country's Law that Governs the IDTA

The laws of England and Wales shall govern this IDTA, including its formation, validity, interpretation, and performance. For the avoidance of doubt, this governing law clause does not affect the application of mandatory data protection laws applicable to the Exporter or the Importer, including UK GDPR.

2. Primary Place for Legal Claims to be Made by the Parties

The courts of England and Wales shall have non-exclusive jurisdiction to hear and determine any legal claims arising out of or in connection with this IDTA. Data subjects who are third-party beneficiaries of this IDTA may bring claims before the courts of England and Wales or, where applicable, in any other court of competent jurisdiction.

3. Status of the Exporter

The Exporter is a Controller under UK GDPR with respect to the personal data transferred under this IDTA. The Exporter determines the purposes and means of processing of the personal data that is the subject of the restricted transfer.

4. Status of the Importer

The Importer is a Processor under UK GDPR with respect to the personal data transferred under this IDTA. The Importer processes the personal data solely on behalf of, and in accordance with the documented instructions of, the Exporter.

5. Whether the EU SCCs are Also Being Used for the Transfer

Yes. The EU Standard Contractual Clauses adopted under Commission Implementing Decision (EU) 2021/914 of 4 June 2021, Module 2 (Controller to Processor), have been executed between the parties on 17 July 2023 and apply in parallel to this IDTA for data flows that are also subject to EU GDPR.

The parties acknowledge and agree that:

(a) This IDTA governs restricted transfers of personal data that are subject exclusively to UK GDPR, providing the appropriate safeguards required by Article 46(1) of the UK GDPR;

(b) The EU SCCs govern transfers of personal data that are subject to EU GDPR, providing the appropriate safeguards required by Article 46(1) of the EU GDPR;

(c) Where a single data flow involves personal data that is simultaneously subject to both UK GDPR and EU GDPR, this IDTA provides the UK GDPR safeguards and the EU SCCs provide the EU GDPR safeguards; neither instrument supersedes the other; and

(d) The parties have also considered the use of the UK Addendum to the EU SCCs (issued by the ICO on 21 March 2022) as an alternative mechanism for providing UK GDPR safeguards, but have elected to use this standalone IDTA for the transfers described herein. The parties may elect to use the UK Addendum approach for future transfers at their discretion.

6. Link to Tool for Review of the Importer's Legal Framework

The parties have completed a Transfer Impact Assessment referenced as TIA-001, which was finalised and dated 4 August 2023. TIA-001 analyses the following aspects of United States law and practice as they relate to the transfer of personal data under this IDTA:

(a) FISA Section 702 — an assessment of the scope and application of Section 702 of the Foreign intelligence Surveillance Act, including the categories of electronic communications service providers subject to directives under Section 702, and the relevance (or lack thereof) of Section 702 to the Importer's processing activities;

(b) Executive Order 12333 — an assessment of signals intelligence collection activities conducted under Executive Order 12333, including the availability (or lack thereof) of individual remedies and the practical risk of bulk collection affecting the transferred personal data;

(c) The CLOUD Act — an assessment of the Clarifying Lawful Overseas Use of Data Act, including the extraterritorial reach of US legal process for data held by US-headquartered entities; and

(d) The EU-US Data Privacy Framework — an assessment of the adequacy decision adopted by the European Commission on 10 July 2023 (Commission Implementing Decision (EU) 2023/1795) and the extent to which the safeguards introduced by Executive Order 14086 may offer additional protections to UK data subjects, noting that the EU-US Data Privacy Framework adequacy decision is an EU GDPR (not UK GDPR) instrument.

Conclusion of TIA-001: Taking into account (i) the pseudonymisation applied by the Exporter prior to transfer, (ii) the encryption measures implemented by the Importer, (iii) the contractual commitments contained in this IDTA (including the government access request provisions), and (iv) the practical likelihood of government access to the transferred personal data, the parties have concluded that the supplementary measures described in Part 2 of this IDTA reduce the residual risk to the rights and freedoms of data subjects to an acceptable level. Accordingly, the transfer may proceed subject to ongoing monitoring and annual reassessment.

Table 3: The Transferred Data

1. Description of the Transfer

The Exporter transfers pseudonymised subscriber analytics data to the Importer for the purpose of AI-driven network analytics and predictive maintenance services under the Master Services Agreement dated 1 June 2021. The transfer enables the Importer to perform network performance analysis, predictive maintenance modelling, anomaly detection, and network optimisation reporting on behalf of the Exporter, supporting the Exporter's obligations to its subscribers and enterprise clients to maintain and improve the quality and reliability of its telecommunications infrastructure and NorthCloud SaaS platform.

2. Categories of Data Subjects

The personal data transferred under this IDTA relates to the following categories of data subjects:

(a) Consumer subscribers of the Exporter's telecommunications and NorthCloud SaaS services who are located in the United Kingdom, representing a subset of the Exporter's approximately 6.3 million total consumer subscribers; and

(b) Enterprise client end-users in the United Kingdom, being individual users associated with the Exporter's approximately 42,000 enterprise client accounts who access the Exporter's network infrastructure and NorthCloud services.

For the avoidance of doubt, the personal data of the Exporter's employees is not transferred to the Importer under this IDTA.

3. Categories of Personal Data Transferred

The following categories of personal data are transferred to the Importer under this IDTA:

(a) Network performance data (including latency, bandwidth utilisation, packet loss, jitter, and signal strength metrics);

(b) Subscriber metadata (pseudonymised) — including subscriber identifiers that have been replaced with pseudonymous tokens by the Exporter;

(c) Location data (pseudonymised) — cell-level location data and IP-based geolocation data, pseudonymised such that precise identification of an individual's location is not possible without the pseudonymisation keys retained by the Exporter;

(d) Device identifiers (pseudonymised) — derivatives of International Mobile Equipment Identity (IMEI) numbers, International Mobile Subscriber Identity (IMSI) numbers, and device type information, pseudonymised by the Exporter;

(e) Usage and traffic patterns — including data volume, session duration, time-of-day usage patterns, and protocol-level traffic classifications (in aggregate and pseudonymised form); and

(f) Service quality metrics — including dropped connection rates, call setup success rates, data throughput measurements, and service interruption logs.

Important note regarding pseudonymisation: Direct identifiers (including subscriber names, postal addresses, email addresses, telephone numbers, account numbers, and payment information) are pseudonymised by the Exporter prior to transfer. The Importer does not receive and has no access to the pseudonymisation keys. The pseudonymisation keys are retained exclusively by the Exporter within its UK-based systems, and no mechanism exists for the Importer to re-identify individual data subjects from the transferred data without obtaining the pseudonymisation keys from the Exporter.

4. Sensitive Data (Special Categories) Transferred

None. The transfer does not include special category data as defined in Article 9 of UK GDPR (including, without limitation, data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, health data, or data concerning a person's sex life or sexual orientation), nor does it include personal data relating to criminal convictions and offences within the meaning of Article 10 of UK GDPR.

5. Frequency of the Transfer

The transfer is continuous and ongoing. Personal data is transmitted via automated, secure API connections operating on a 24-hour, 7-day-a-week basis. Data feeds are initiated by the Exporter's systems and are pushed to the Importer's processing environment through encrypted channels. The volume of data transferred varies based on network activity but typically comprises approximately 2.5 terabytes of pseudonymised data per calendar month.

6. Nature and Purpose of the Processing

The Importer processes the transferred personal data for the following purposes, as documented in the MSA and the Exporter's data processing instructions:

(a) AI-driven network analytics — applying machine learning algorithms to identify patterns, trends, and correlations in network performance data for the purpose of optimising the Exporter's telecommunications infrastructure;

(b) Predictive maintenance modelling — developing predictive models to anticipate network equipment failures, capacity constraints, and service degradation, enabling the Exporter to undertake proactive maintenance;

(c) Anomaly detection — identifying unusual patterns in network traffic and performance data that may indicate security incidents, equipment faults, or service quality issues; and

(d) Network optimisation reporting — generating periodic and ad hoc reports for the Exporter's network operations team summarising network performance, identifying areas for improvement, and recommending optimisation strategies.

The processing activities are further described in DPIA-011 (Caldwell Analytics Network Performance Data Transfer), which was completed by the Exporter in consultation with the Importer and approved by the Exporter's Data Protection Officer prior to the commencement of the transfer.

7. Retention Period / Deletion Criteria

The Importer shall retain transferred personal data for a maximum period of 24 months from the date of transfer, after which time the data shall be securely deleted or returned to the Exporter in accordance with the MSA and the Exporter's documented instructions. The Importer shall implement automated deletion processes to ensure that personal data exceeding the 24-month retention period is identified and securely erased on a rolling basis.

Upon termination or expiry of this IDTA or the underlying MSA (whichever occurs first), the Importer shall delete or return all transferred personal data within 30 calendar days of the effective date of termination or expiry, and shall provide the Exporter with a written certification of deletion signed by an authorised officer of the Importer. Deletion shall be carried out using methods that render the personal data permanently unrecoverable, in compliance with NIST SP 800-88 (Guidelines for Media Sanitization) or an equivalent standard.

8. Sub-Processors

The Importer engages sub-processors for the processing of transferred personal data as listed in the approved sub-processor list set out in Annex 3 to this IDTA. The sub-processor list is maintained and updated by the Importer in accordance with Clause 9(a) of the EU SCCs (Module 2) and the corresponding provisions of this IDTA.

The Exporter has approved the sub-processors listed in Annex 3 as of the Start Date. The Importer shall provide the Exporter with at least 14 calendar days' prior written notice of any intended changes to the sub-processor list, including the engagement of any new sub-processor or the replacement of an existing sub-processor. The Exporter shall have the right to object to the engagement of any new sub-processor within the 14-day notice period. If the Exporter objects on reasonable data protection grounds and the parties are unable to resolve the objection, the Exporter may terminate this IDTA and the relevant data processing services under the MSA without penalty.

PART 2: EXTRA PROTECTION CLAUSES

The parties have agreed the following supplementary measures to provide additional protections for the personal data transferred under this IDTA, taking into account the findings of TIA-001 and the specific risks associated with the transfer of personal data to the United States of America.

Section 1: Supplementary Measures — Technical

2.1 Encryption at Rest. All transferred personal data stored by the Importer — whether in primary storage, backup storage, archival storage, or any other form of persistent storage — shall be encrypted using the Advanced Encryption Standard with a key length of 256 bits (AES-256) or an equivalent or stronger encryption standard as may be adopted from time to time in accordance with industry best practice. Encryption keys shall be managed in accordance with a documented key management policy, and shall be stored separately from the encrypted data. The Importer shall ensure that encryption at rest is applied across all environments in which transferred personal data is processed, including production, staging, development (where live data is used), and disaster recovery environments.

2.2 Encryption in Transit. All transferred personal data shall be encrypted in transit using Transport Layer Security version 1.3 (TLS 1.3) or any successor protocol that provides equivalent or greater cryptographic strength. The use of deprecated or compromised protocols (including, without limitation, SSL 2.0, SSL 3.0, TLS 1.0, and TLS 1.1) is strictly prohibited. The Importer shall ensure that all API endpoints used for receiving transferred personal data support only TLS 1.3 or above, and that certificate pinning or certificate transparency mechanisms are employed to mitigate man-in-the-middle attack risks.

2.3 Pseudonymisation. The Exporter shall pseudonymise all direct identifiers — including but not limited to subscriber names, postal addresses, email addresses, telephone numbers, account numbers, and payment card details — prior to transferring personal data to the Importer. The pseudonymisation process shall be carried out using cryptographic hash functions or tokenisation techniques that render the direct identifiers unintelligible without access to the pseudonymisation keys. The pseudonymisation keys shall be retained exclusively by the Exporter within its UK-based systems and infrastructure, and shall not be transferred to, shared with, or made accessible to the Importer at any time. The Importer acknowledges that it does not hold, and shall not seek to obtain, the pseudonymisation keys, and shall not attempt to re-identify any data subject from the transferred pseudonymised data.

2.4 Access Controls. The Importer shall implement and maintain robust access controls to protect transferred personal data from unauthorised access, use, or disclosure. These access controls shall include, at a minimum:

(a) Role-based access controls (RBAC) — access to transferred personal data shall be restricted to personnel who require such access for the performance of their duties in connection with the services provided under the MSA, and access privileges shall be assigned on the basis of each individual's role and responsibilities;

(b) Multi-factor authentication (MFA) — all personnel accessing systems that store or process transferred personal data shall be required to authenticate using at least two independent authentication factors (e.g., password plus hardware token, or password plus biometric verification);

(c) Least-privilege principle — each individual's access privileges shall be limited to the minimum level of access necessary to perform their assigned duties, and elevated or administrative access privileges shall be subject to additional approval and monitoring; and

(d) Periodic access reviews — the Importer shall conduct reviews of access privileges at least quarterly to ensure that access is limited to currently authorised personnel and that former personnel or personnel who have changed roles have had their access privileges promptly revoked or adjusted.

2.5 Logging and Monitoring. The Importer shall maintain comprehensive audit logs of all access to and processing of transferred personal data. Audit logs shall record, at a minimum, the identity of the individual or system accessing the data, the date and time of access, the nature of the access (e.g., read, write, modify, delete), and the specific data records or datasets accessed. Audit logs shall be retained for a minimum period of 12 months from the date of creation, shall be protected against tampering or unauthorised modification, and shall be made available to the Exporter (or its appointed auditor) upon reasonable request as part of any audit conducted under this IDTA. The Importer shall implement automated monitoring and alerting systems to detect and respond to suspicious or anomalous access patterns.

Section 2: Supplementary Measures — Contractual

2.6 Government Access Requests — Notification. The Importer shall promptly notify the Exporter of any legally binding request for disclosure of transferred personal data by a public authority, including but not limited to requests from law enforcement agencies, intelligence services, or regulatory authorities (a "Government Access Request"), unless the Importer is prohibited from providing such notification under the applicable law of the Importer's country. In the event that the Importer is prohibited from notifying the Exporter, the Importer shall use all reasonable legal efforts to challenge or seek a modification of the prohibition, including by seeking a court order or other legal remedy to permit disclosure of the existence of the Government Access Request to the Exporter. Where the Importer is permitted to provide notification, such notification shall be made without undue delay and shall include, to the extent permitted by law, the nature of the request, the personal data requested, the requesting authority, and the legal basis for the request.

2.7 Challenging Government Access Requests. The Importer shall challenge any Government Access Request that it reasonably considers to be unlawful, disproportionate, or inconsistent with the safeguards provided by this IDTA and/or the UK GDPR. In particular, the Importer shall:

(a) review each Government Access Request to assess its legality under the laws of the Importer's country and its compatibility with international law and the principles of proportionality and necessity;

(b) where the Importer reasonably considers that the Government Access Request is unlawful or disproportionate, challenge the request through all available legal channels, including by filing motions to quash, seeking protective orders, or pursuing appeals;

(c) seek interim measures to suspend the disclosure of personal data pending judicial determination of the legality or proportionality of the Government Access Request; and

(d) provide only the minimum amount of personal data necessary to comply with a Government Access Request that is ultimately determined to be lawful and enforceable, and shall not disclose personal data in bulk or on a generalised basis.

2.8 Transparency Reporting. The Importer shall provide the Exporter with periodic reports, at least annually, on Government Access Requests received by the Importer in respect of transferred personal data during the preceding 12-month period (the "Transparency Report"). The Transparency Report shall include, to the extent permitted by applicable law, the total number of Government Access Requests received, the categories of requesting authorities, the categories of personal data requested, and the outcome of each request (i.e., whether the request was complied with, challenged, or withdrawn). The Importer shall deliver each Transparency Report to the Exporter's Data Protection Officer within 60 days of the end of the reporting period. Where the Importer is prohibited by law from disclosing certain information in the Transparency Report, it shall disclose as much information as is legally permissible and shall indicate the categories of information that have been redacted and the legal basis for the redaction.

2.9 Contractual Audit Rights. The Exporter, or an independent third-party auditor appointed by the Exporter and approved by the Importer (such approval not to be unreasonably withheld), shall have the right to conduct audits of the Importer's processing operations, security measures, and compliance with this IDTA. Audits may be conducted on-site at the Importer's facilities (including its principal office in San Jose, California, and any sub-processor facility where transferred personal data is processed) or remotely (including through the review of documentation, certifications, and audit reports). The following provisions shall apply to audits:

(a) The Exporter shall provide the Importer with not less than 30 calendar days' prior written notice of an intended audit, specifying the scope, duration, and proposed auditors;

(b) In the case of an urgent data protection concern — including a suspected personal data breach, a material change in the Importer's processing environment, or a direction from the ICO — the Exporter may conduct an audit on shorter notice (not less than 5 business days), and the Importer shall cooperate fully with such audit;

(c) Audits shall be conducted during normal business hours and shall be designed to minimise disruption to the Importer's operations;

(d) The costs of audits shall be borne by the Exporter, except where an audit reveals material non-compliance by the Importer with this IDTA, in which case the Importer shall bear the reasonable costs of the audit (including the Exporter's reasonable travel and third-party auditor expenses);

(e) The Importer shall make available to the Exporter or its auditor all information, systems, and personnel reasonably necessary to demonstrate compliance with this IDTA; and

(f) The Importer may, as an alternative to an on-site audit, provide the Exporter with the results of a recent independent third-party audit (such as a SOC 2 Type II report or an ISO 27001 certification audit), provided that the scope of such audit covers the matters relevant to this IDTA and that the Exporter consents to the substitution (such consent not to be unreasonably withheld).

2.10 Data Localisation. Certain categories of transferred personal data, as specified by the Exporter from time to time by written notice to the Importer, may be subject to data localisation requirements restricting the processing of such data to specified geographic locations. Where the Exporter issues a data localisation instruction, the Importer shall ensure that the specified categories of personal data are processed and stored only within the geographic locations identified in the instruction, and shall not transfer, copy, replicate, or otherwise make such data accessible outside the specified locations without the Exporter's prior written consent. As of the Start Date, no data localisation restrictions have been imposed by the Exporter beyond the general requirement that transferred personal data be processed within the continental United States.

Section 3: Supplementary Measures — Organisational

2.11 Personnel Obligations. The Importer shall ensure that all personnel authorised to process transferred personal data — including employees, contractors, and temporary staff — are bound by legally enforceable contractual obligations of confidentiality that are at least as protective as the confidentiality obligations set out in this IDTA. The Importer shall further ensure that all such personnel have received appropriate data protection training, including training on:

(a) the principles of data protection and the requirements of UK GDPR (to the extent relevant to the Importer's processing activities);

(b) the specific obligations of the Importer under this IDTA, including the supplementary measures set out in this Part 2;

(d) the handling of data subject requests and Government Access Requests.

Data protection training shall be provided to all relevant personnel upon commencement of their involvement in the processing of transferred personal data, and refresher training shall be provided at least annually thereafter. The Importer shall maintain records of training provided and shall make such records available to the Exporter upon request.

2.12 Incident Response. The Importer shall maintain a documented incident response plan that covers the identification, assessment, containment, remediation, and reporting of personal data breaches and security incidents affecting transferred personal data. The Importer shall notify the Exporter of any personal data breach (as defined in Article 4(12) of the UK GDPR) affecting transferred personal data without undue delay and in any event within 36 hours of becoming aware of the breach. The notification shall include:

(a) a description of the nature of the personal data breach, including, where possible, the categories and approximate number of data subjects concerned and the categories and approximate number of personal data records concerned;

(b) the name and contact details of the Importer's data protection contact or other point of contact from whom more information can be obtained;

(d) a description of the measures taken or proposed to be taken by the Importer to address the personal data breach, including, where appropriate, measures to mitigate its possible adverse effects.

Where it is not possible to provide all of the above information at the time of the initial notification, the Importer shall provide the information in phases without further undue delay. The Importer shall cooperate fully with the Exporter in investigating and remedying the breach and in fulfilling the Exporter's notification obligations to the ICO under Article 33 of the UK GDPR and to affected data subjects under Article 34 of the UK GDPR.

PART 3: COMMERCIAL CLAUSES

Section 1: Relationship with the Underlying Agreement

3.1 This IDTA supplements and forms an integral part of the data protection obligations established under the Master Services Agreement dated 1 June 2021 between the Exporter and the Importer (the "MSA"), including any data processing addendum, schedule, or annex thereto. The provisions of this IDTA shall be read and construed in conjunction with the MSA, and terms defined in the MSA shall have the same meaning in this IDTA unless otherwise defined herein.

3.2 In the event of any conflict or inconsistency between the provisions of this IDTA and the provisions of the MSA (including any data processing addendum, schedule, or annex thereto), the provisions of this IDTA shall prevail to the extent necessary to ensure compliance with UK GDPR and to maintain the appropriate safeguards for the restricted transfer of personal data. This principle of precedence applies irrespective of whether the conflicting provision of the MSA was executed before or after the date of this IDTA.

3.3 Nothing in this IDTA shall be construed as relieving either party of its obligations under the MSA, except to the extent that such obligations are inconsistent with the requirements of UK GDPR or this IDTA.

Section 2: Liability

3.4 Liability as between the Exporter and the Importer for breach of this IDTA shall be governed by the liability provisions set out in the MSA, subject to the following modifications:

(a) Liability for breaches of the data protection clauses of this IDTA — including the supplementary measures set out in Part 2 and the mandatory clauses set out in Part 4 — shall not be subject to any contractual liability cap, limitation of liability, or exclusion of liability to the extent that the application of such cap, limitation, or exclusion would undermine the protections afforded to data subjects under this IDTA or UK GDPR;

(b) Each party acknowledges that the removal of liability caps in respect of data protection breaches is necessary to ensure the effectiveness of this IDTA as an appropriate safeguard under Article 46 of the UK GDPR, and to preserve the enforceability of data subject rights as third-party beneficiaries of this IDTA; and

3.5 Each party shall indemnify and hold harmless the other party against all claims, actions, proceedings, losses, damages, liabilities, costs, and expenses (including reasonable legal fees and disbursements) arising from or in connection with a breach by the indemnifying party of its obligations under this IDTA, including any breach that results in a claim by a data subject, the ICO, or any other supervisory authority. This indemnification obligation shall not be subject to any contractual liability cap to the extent described in Section 3.4(a) above.

Section 3: Costs

3.6 The costs of compliance with this IDTA — including the implementation, maintenance, and ongoing operation of the supplementary measures set out in Part 2, the costs of conducting Transfer Impact Assessments, and the costs of any modifications to the Importer's systems or processes required to comply with this IDTA — shall be borne by the Importer, unless otherwise agreed in writing by the parties. For the avoidance of doubt, this provision does not affect the allocation of costs for services under the MSA, which shall be governed by the MSA.

3.7 The costs of audits conducted by the Exporter (or its appointed auditor) under Section 2.9 of this IDTA shall be borne by the Exporter, except where an audit reveals material non-compliance by the Importer with this IDTA, in which case the Importer shall bear the reasonable costs of the audit, including the Exporter's reasonable travel expenses and the fees of any third-party auditor engaged by the Exporter.

Section 4: Confidentiality

3.8 Each party shall treat the personal data transferred under this IDTA, and all information relating to the other party's data protection measures, security measures, and compliance with this IDTA, as confidential information. Such confidential information shall not be disclosed to any third party except:

(a) to the extent necessary for the performance of the party's obligations under this IDTA or the MSA;

(b) to the party's professional advisers, auditors, or insurers on a need-to-know basis, subject to appropriate confidentiality obligations;

(c) to the extent required by applicable law, regulation, court order, or the lawful direction of a competent regulatory authority (including the ICO); or

(d) with the prior written consent of the other party.

3.9 The obligations of confidentiality set out in this Section 4 are in addition to, and do not replace or limit, any confidentiality obligations imposed on the parties under the MSA, applicable data protection law, or this IDTA.

Section 5: Dispute Resolution

3.10 Governing Law. This IDTA and any dispute or claim arising out of or in connection with it or its subject matter, existence, negotiation, validity, termination, or enforceability (including non-contractual disputes or claims) shall be governed by and construed in accordance with the laws of England and Wales.

3.11 Jurisdiction. The courts of England and Wales shall have non-exclusive jurisdiction to hear and determine any suit, action, or proceeding, and to settle any dispute, which may arise out of or in connection with this IDTA. The submission to the jurisdiction of the courts of England and Wales shall not limit the right of the Exporter, the Importer, or any data subject to take proceedings in any other court of competent jurisdiction, nor shall the taking of proceedings in one or more jurisdictions preclude the taking of proceedings in any other jurisdiction.

3.12 Third-Party Beneficiary Rights. Data subjects whose personal data is transferred under this IDTA shall have the right to enforce the provisions of this IDTA that are intended for their benefit as third-party beneficiaries in accordance with the Contracts (Rights of Third Parties) Act 1999. This right of enforcement includes, without limitation, the right to bring proceedings before the courts of England and Wales, the right to lodge a complaint with the ICO, and the right to claim compensation for damages suffered as a result of a breach of this IDTA. The consent of data subjects shall not be required for any amendment, variation, waiver, or termination of this IDTA, provided that any such amendment, variation, waiver, or termination does not adversely affect the rights or protections afforded to data subjects by this IDTA.

PART 4: MANDATORY CLAUSES

Section 1: Compliance with UK GDPR

4.1 The Importer shall comply with all applicable provisions of UK GDPR as if it were a processor established in the United Kingdom, to the extent relevant to its processing of transferred personal data under this IDTA. This obligation includes, without limitation, compliance with the principles relating to processing of personal data set out in Article 5 of the UK GDPR (lawfulness, fairness and transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality, and accountability), the obligations of processors set out in Article 28 of the UK GDPR, and the security of processing requirements set out in Article 32 of the UK GDPR.

4.2 The Importer represents and warrants that, as of the Start Date, it has no reason to believe that the laws and practices in the United States of America applicable to its processing of transferred personal data — including any requirements to disclose personal data to public authorities or measures authorising access to personal data by public authorities (whether for law enforcement, intelligence, national security, or other purposes) — prevent it from fulfilling its obligations under this IDTA. This representation is informed by and based upon the Transfer Impact Assessment (TIA-001) completed by the parties on 4 August 2023, and the Importer confirms that it has disclosed to the Exporter all information in its possession that is relevant to the assessment of the legal framework in the United States as it applies to the transferred personal data.

4.3 The Importer shall promptly inform the Exporter if, at any time during the term of this IDTA, it has reason to believe that it is or has become subject to laws or practices in the United States that are inconsistent with the requirements of this IDTA, including changes to applicable law, new government surveillance programmes, or new legal process requirements that may affect the protections afforded to the transferred personal data. Upon receiving such notification, the parties shall consult in good faith to determine whether supplementary measures can be implemented to address the change, and if not, the Exporter shall have the right to suspend or terminate the transfer in accordance with Section 5 of this Part 4.

Section 2: Data Subject Rights

4.4 The Importer shall promptly assist the Exporter in responding to requests from data subjects to exercise their rights under UK GDPR in relation to the transferred personal data. Data subject rights for which the Importer shall provide assistance include:

(a) the right of access under Article 15 of the UK GDPR;

(b) the right to rectification under Article 16 of the UK GDPR;

(d) the right to restriction of processing under Article 18 of the UK GDPR;

(e) the right to data portability under Article 20 of the UK GDPR;

(f) the right to object to processing under Article 21 of the UK GDPR; and

(g) rights in relation to automated decision-making and profiling under Article 22 of the UK GDPR.

4.5 The Importer's assistance shall include, without limitation, promptly providing the Exporter with all information necessary to respond to data subject requests, implementing appropriate technical measures to facilitate the exercise of data subject rights (including the ability to search, extract, rectify, erase, restrict, or port personal data upon the Exporter's instruction), and cooperating with the Exporter in responding to data subject requests within the timeframes prescribed by UK GDPR (generally, without undue delay and in any event within one month of receipt).

4.6 Where the Importer receives a request directly from a data subject (whether through the Importer's own systems, a contact form, or otherwise), the Importer shall:

(a) promptly redirect the data subject to the Exporter's Data Protection Officer (Sanjay Mehta, dpo@northgatetelecom.co.uk);

(b) notify the Exporter of the request without undue delay and in any event within 3 business days of receipt; and

(c) refrain from responding to the data subject's request on the merits unless expressly instructed to do so by the Exporter in writing.

Section 3: ICO Powers and Data Subject Remedies

4.7 The Importer agrees to submit to the jurisdiction of the Information Commissioner's Office and the courts of England and Wales for the purposes of any investigation, inquiry, enforcement action, or proceedings arising out of or in connection with this IDTA, the Importer's processing of transferred personal data, or the exercise of data subject rights under this IDTA or UK GDPR.

4.8 Data subjects who are beneficiaries of this IDTA shall have the following rights and remedies:

(a) the right to lodge a complaint with the ICO in accordance with Article 77 of the UK GDPR;

(b) the right to an effective judicial remedy before the courts of England and Wales in accordance with Article 79 of the UK GDPR; and

(c) the right to receive compensation from the Exporter or the Importer (or both) for material or non-material damage suffered as a result of a breach of this IDTA or UK GDPR, in accordance with Article 82 of the UK GDPR.

4.9 The Importer shall comply with any decision of the ICO or a competent court of England and Wales relating to this IDTA, including decisions ordering the Importer to take specific action (such as suspending or ceasing processing, erasing personal data, or implementing additional safeguards), decisions imposing administrative fines or penalties, and decisions requiring the Importer to provide information or submit to an audit or inspection. The Importer acknowledges that non-compliance with a decision of the ICO or a competent court may result in the suspension or termination of the transfer under this IDTA.

Section 4: Onward Transfers

4.10 The Importer shall not transfer, disclose, or otherwise make available the personal data received under this IDTA to any third party (including any sub-processor, affiliate, or other entity) located outside the United Kingdom (an "Onward Transfer") unless one or more of the following conditions is satisfied:

(a) the third party recipient has entered into an appropriate safeguard mechanism for the Onward Transfer that provides protections for the personal data that are materially equivalent to those provided by this IDTA, including by entering into a standalone IDTA with the Importer, or by the Importer ensuring that the third party is bound by a UK Addendum to the EU SCCs;

(b) the Onward Transfer is to a country, territory, sector, or international organisation that is the subject of an adequacy regulation made by the Secretary of State under Section 17A of the Data Protection Act 2018; or

(c) the Onward Transfer is permitted under a derogation set out in Article 49 of the UK GDPR, and the conditions for relying on such derogation are satisfied.

4.11 The Importer shall ensure that any contract entered into with a sub-processor or other third party recipient in connection with an Onward Transfer includes obligations that are materially equivalent to those imposed on the Importer under this IDTA, including the supplementary measures set out in Part 2 and the mandatory clauses set out in this Part 4.

4.12 The Importer's current sub-processor list, as set out in Annex 3 to this IDTA, shall be maintained and updated by the Importer in accordance with Section 2.9 and Table 3 of this IDTA. The Exporter retains the right to object to the engagement of any new sub-processor within 14 calendar days of receiving notification from the Importer. The procedures for sub-processor notification and objection are set out in Table 3, Section 8 of this IDTA.

Section 5: Suspension and Termination

4.13 Suspension by the Exporter. The Exporter may suspend the transfer of personal data under this IDTA, in whole or in part, immediately upon written notice to the Importer if any of the following circumstances arise:

(a) the ICO (or any competent court or tribunal) issues a decision that the safeguards relied upon for the transfer under this IDTA are no longer adequate or do not provide an essentially equivalent level of protection to that guaranteed within the United Kingdom;

(b) the Exporter has reasonable grounds to believe that the Importer is in material breach of this IDTA, including a material failure to implement or maintain the supplementary measures set out in Part 2;

(c) the Importer notifies the Exporter, or the Exporter otherwise becomes aware, that the Importer is unable to comply with the supplementary measures or mandatory clauses set out in this IDTA, whether due to changes in applicable law, government directives, or other circumstances beyond the Importer's control; or

(d) the laws or practices in the United States of America change in a manner that materially and adversely impacts the protections afforded to transferred personal data by this IDTA, including the introduction of new surveillance powers, the expansion of existing government access mechanisms, or the curtailment of judicial oversight or individual redress mechanisms.

4.14 During any period of suspension, the Importer shall:

(a) cease all processing of transferred personal data, except to the extent necessary to securely store and protect the data pending the Exporter's instructions;

(b) take all reasonable steps to protect the transferred personal data from unauthorised access, use, or disclosure; and

(c) cooperate with the Exporter to assess whether the circumstances giving rise to the suspension can be resolved and, if so, to implement any additional safeguards necessary to permit the resumption of transfers.

4.15 Termination by Either Party. Either party may terminate this IDTA:

(a) upon written notice to the other party if the other party is in material breach of this IDTA and fails to cure such breach within 30 calendar days of receiving written notice specifying the nature of the breach and the steps required to cure it; or

(b) upon written notice to the other party if the underlying MSA is terminated or expires, in which case this IDTA shall terminate on the same date as the MSA, subject to the survival provisions set out below.

4.16 Consequences of Termination or Suspension. Upon termination of this IDTA (whether by expiry, mutual agreement, or notice under Section 4.15) or upon suspension under Section 4.13, the Importer shall:

(a) immediately cease all processing of transferred personal data (except as necessary for secure storage and protection pending the Exporter's instructions);

(b) at the Exporter's election (to be communicated to the Importer in writing within 15 calendar days of the effective date of termination or suspension), either:

(i) return all transferred personal data to the Exporter in a commonly used, machine-readable format, securely transmitted via encrypted channels; or

(ii) securely delete all transferred personal data, including all copies, backups, and replications, using methods that render the data permanently unrecoverable in compliance with NIST SP 800-88 or an equivalent standard;

(c) complete the return or deletion of all transferred personal data within 30 calendar days of the effective date of termination or receipt of the Exporter's election (whichever is later); and

UK INTERNATIONAL DATA TRANSFER AGREEMENT
Approved under Section 119A of the Data Protection Act 2018
Reference: SC/NTP/2023-0213/PDS — Schedule 4 (UK IDTA)
Execution Date: 17 July 2023
Between
NORTHGATE TELECOMMUNICATIONS PLC (the "Exporter")
and
CALDWELL ANALYTICS INC. (the "Importer")
This UK International Data Transfer Agreement (this "IDTA") is entered into between the parties identified above to provide appropriate safeguards for the transfer of personal data from the United Kingdom to the United States of America in accordance with Article 46 of the United Kingdom General Data Protection Regulation (the "UK GDPR"), as incorporated into United Kingdom domestic law by virtue of the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 and as further amended by the Data Protection Act 2018.
This IDTA complements and operates alongside the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), Module 2 (Controller to Processor), executed between the same parties on 17 July 2023 for the same data flows (the "EU SCCs"). This IDTA governs transfers of personal data that are subject to the UK GDPR. The EU SCCs govern transfers of personal data that are subject to the EU GDPR. Where a single data flow involves personal data subject to both regimes, this IDTA provides the UK GDPR safeguards and the EU SCCs provide the EU GDPR safeguards; neither instrument supersedes the other.
This IDTA is based on the template issued by the Information Commissioner's Office (the "ICO") pursuant to Section 119A of the Data Protection Act 2018, as laid before Parliament on 2 February 2022.
RECITALS
(A) Northgate Telecommunications PLC (Company Number 04837291), a public limited company incorporated in England and Wales with its registered office at 140 Queensway Place, Reading, Berkshire RG1 4QT, United Kingdom, and its principal office at Northgate Tower, 88 Canary Wharf Boulevard, London E14 5HN, United Kingdom (the "Exporter"), operates telecommunications infrastructure and enterprise Software-as-a-Service solutions (including the NorthCloud platform) across the United Kingdom and serves a customer base comprising approximately 6.3 million consumer subscribers, approximately 42,000 enterprise clients, and approximately 11,400 employees. The Exporter is a data controller within the meaning of Article 4(7) of the UK GDPR with respect to the personal data that is the subject of this IDTA.
(B) Caldwell Analytics Inc., a C-Corporation incorporated in the State of Delaware, United States of America, with its registered agent at 1209 Orange Street, Wilmington, New Castle County, Delaware 19801, USA, and its principal office at 2700 Technology Drive, Suite 400, San Jose, California 95134, USA (the "Importer"), provides AI-driven network analytics and predictive maintenance services to telecommunications operators globally. The Importer acts as a data processor within the meaning of Article 4(8) of the UK GDPR with respect to the personal data transferred under this IDTA, processing such data solely on behalf of, and in accordance with the documented instructions of, the Exporter.
(C) The Exporter and the Importer entered into a Master Services Agreement dated 1 June 2021 (as amended from time to time, the "MSA"), pursuant to which the Importer processes network performance data — including subscriber metadata, location data, and device identifiers — on behalf of the Exporter for the purpose of AI-driven network analytics, predictive maintenance modelling, anomaly detection, and network optimisation reporting. The data processing activities contemplated by this IDTA arise directly from, and are ancillary to, the services provided under the MSA.
(D) The Exporter's Data Protection Officer is Sanjay Mehta (CIPP/E certified), who may be contacted at dpo@northgatetelecom.co.uk and by telephone at +44 (0)20 7946 0123. The Importer's designated data protection contact is Jennifer Huang, VP, Legal & Privacy, who may be contacted at j.huang@caldwellanalytics.com and by telephone at +1 (408) 555-7200. Each party has ensured that its designated data protection contact has sufficient authority and resources to oversee compliance with this IDTA.
(E) The Exporter is registered with the ICO under registration number ZA482917, and maintains its registration in compliance with Part III of the Data Protection Act 2018.
(F) The parties wish to enter into this IDTA to provide appropriate safeguards under Article 46(1) of the UK GDPR for the restricted transfer (within the meaning of Section 18 of the Data Protection Act 2018, as read with Article 46 of the UK GDPR) of personal data from the Exporter in the United Kingdom to the Importer in the United States of America. At the date of execution of this IDTA, the United States of America has not been the subject of an adequacy regulation under Section 17A of the Data Protection Act 2018 with respect to the categories of data and processing activities contemplated by this IDTA, and accordingly the parties are required to put in place appropriate safeguards for the transfer.
(G) This IDTA is entered into in conjunction with the EU Standard Contractual Clauses (Module 2: Controller to Processor) executed between the parties on 17 July 2023, but this IDTA operates independently of the EU SCCs to govern transfers of personal data that are subject to UK GDPR. To the extent that any provision of this IDTA is inconsistent with the EU SCCs, this IDTA shall prevail with respect to personal data subject to UK GDPR, and the EU SCCs shall prevail with respect to personal data subject to EU GDPR.
(H) The parties have completed a Transfer Impact Assessment, referenced internally as TIA-001, assessing the laws and practices of the United States of America as they relate to the transfer of personal data under this IDTA, including an analysis of the Foreign intelligence Surveillance Act (FISA) Section 702, Executive Order 12333, the Clarifying Lawful Overseas Use of Data Act (the "CLOUD Act"), and the EU-US Data Privacy Framework. TIA-001 was completed on 4 August 2023 and concluded that, taking into account the supplementary measures implemented under this IDTA, the residual risk to the rights and freedoms of data subjects is reduced to an acceptable level. The parties acknowledge their ongoing obligation to monitor developments in the legal framework of the United States and to reassess TIA-001 on at least an annual basis or upon any material change in relevant law or practice.
NOW, THEREFORE, the parties agree as follows:
Right-click to update Table of Contents
PART 1: TABLES
Table 1: Parties and Key Contacts
Start Date: 17 July 2023
Table 2: Transfer Details
1. UK Country's Law that Governs the IDTA
The laws of England and Wales shall govern this IDTA, including its formation, validity, interpretation, and performance. For the avoidance of doubt, this governing law clause does not affect the application of mandatory data protection laws applicable to the Exporter or the Importer, including UK GDPR.
2. Primary Place for Legal Claims to be Made by the Parties
The courts of England and Wales shall have non-exclusive jurisdiction to hear and determine any legal claims arising out of or in connection with this IDTA. Data subjects who are third-party beneficiaries of this IDTA may bring claims before the courts of England and Wales or, where applicable, in any other court of competent jurisdiction.
3. Status of the Exporter
The Exporter is a Controller under UK GDPR with respect to the personal data transferred under this IDTA. The Exporter determines the purposes and means of processing of the personal data that is the subject of the restricted transfer.
4. Status of the Importer
The Importer is a Processor under UK GDPR with respect to the personal data transferred under this IDTA. The Importer processes the personal data solely on behalf of, and in accordance with the documented instructions of, the Exporter.
5. Whether the EU SCCs are Also Being Used for the Transfer
Yes. The EU Standard Contractual Clauses adopted under Commission Implementing Decision (EU) 2021/914 of 4 June 2021, Module 2 (Controller to Processor), have been executed between the parties on 17 July 2023 and apply in parallel to this IDTA for data flows that are also subject to EU GDPR.
The parties acknowledge and agree that:
(a) This IDTA governs restricted transfers of personal data that are subject exclusively to UK GDPR, providing the appropriate safeguards required by Article 46(1) of the UK GDPR;
(b) The EU SCCs govern transfers of personal data that are subject to EU GDPR, providing the appropriate safeguards required by Article 46(1) of the EU GDPR;
(c) Where a single data flow involves personal data that is simultaneously subject to both UK GDPR and EU GDPR, this IDTA provides the UK GDPR safeguards and the EU SCCs provide the EU GDPR safeguards; neither instrument supersedes the other; and
(d) The parties have also considered the use of the UK Addendum to the EU SCCs (issued by the ICO on 21 March 2022) as an alternative mechanism for providing UK GDPR safeguards, but have elected to use this standalone IDTA for the transfers described herein. The parties may elect to use the UK Addendum approach for future transfers at their discretion.
6. Link to Tool for Review of the Importer's Legal Framework
The parties have completed a Transfer Impact Assessment referenced as TIA-001, which was finalised and dated 4 August 2023. TIA-001 analyses the following aspects of United States law and practice as they relate to the transfer of personal data under this IDTA:
(a) FISA Section 702 — an assessment of the scope and application of Section 702 of the Foreign intelligence Surveillance Act, including the categories of electronic communications service providers subject to directives under Section 702, and the relevance (or lack thereof) of Section 702 to the Importer's processing activities;
(b) Executive Order 12333 — an assessment of signals intelligence collection activities conducted under Executive Order 12333, including the availability (or lack thereof) of individual remedies and the practical risk of bulk collection affecting the transferred personal data;
(c) The CLOUD Act — an assessment of the Clarifying Lawful Overseas Use of Data Act, including the extraterritorial reach of US legal process for data held by US-headquartered entities; and
(d) The EU-US Data Privacy Framework — an assessment of the adequacy decision adopted by the European Commission on 10 July 2023 (Commission Implementing Decision (EU) 2023/1795) and the extent to which the safeguards introduced by Executive Order 14086 may offer additional protections to UK data subjects, noting that the EU-US Data Privacy Framework adequacy decision is an EU GDPR (not UK GDPR) instrument.
Conclusion of TIA-001: Taking into account (i) the pseudonymisation applied by the Exporter prior to transfer, (ii) the encryption measures implemented by the Importer, (iii) the contractual commitments contained in this IDTA (including the government access request provisions), and (iv) the practical likelihood of government access to the transferred personal data, the parties have concluded that the supplementary measures described in Part 2 of this IDTA reduce the residual risk to the rights and freedoms of data subjects to an acceptable level. Accordingly, the transfer may proceed subject to ongoing monitoring and annual reassessment.
Table 3: The Transferred Data
1. Description of the Transfer
The Exporter transfers pseudonymised subscriber analytics data to the Importer for the purpose of AI-driven network analytics and predictive maintenance services under the Master Services Agreement dated 1 June 2021. The transfer enables the Importer to perform network performance analysis, predictive maintenance modelling, anomaly detection, and network optimisation reporting on behalf of the Exporter, supporting the Exporter's obligations to its subscribers and enterprise clients to maintain and improve the quality and reliability of its telecommunications infrastructure and NorthCloud SaaS platform.
2. Categories of Data Subjects
The personal data transferred under this IDTA relates to the following categories of data subjects:
(a) Consumer subscribers of the Exporter's telecommunications and NorthCloud SaaS services who are located in the United Kingdom, representing a subset of the Exporter's approximately 6.3 million total consumer subscribers; and
(b) Enterprise client end-users in the United Kingdom, being individual users associated with the Exporter's approximately 42,000 enterprise client accounts who access the Exporter's network infrastructure and NorthCloud services.
For the avoidance of doubt, the personal data of the Exporter's employees is not transferred to the Importer under this IDTA.
3. Categories of Personal Data Transferred
The following categories of personal data are transferred to the Importer under this IDTA:
(a) Network performance data (including latency, bandwidth utilisation, packet loss, jitter, and signal strength metrics);
(b) Subscriber metadata (pseudonymised) — including subscriber identifiers that have been replaced with pseudonymous tokens by the Exporter;
(c) Location data (pseudonymised) — cell-level location data and IP-based geolocation data, pseudonymised such that precise identification of an individual's location is not possible without the pseudonymisation keys retained by the Exporter;
(d) Device identifiers (pseudonymised) — derivatives of International Mobile Equipment Identity (IMEI) numbers, International Mobile Subscriber Identity (IMSI) numbers, and device type information, pseudonymised by the Exporter;
(e) Usage and traffic patterns — including data volume, session duration, time-of-day usage patterns, and protocol-level traffic classifications (in aggregate and pseudonymised form); and
(f) Service quality metrics — including dropped connection rates, call setup success rates, data throughput measurements, and service interruption logs.
Important note regarding pseudonymisation: Direct identifiers (including subscriber names, postal addresses, email addresses, telephone numbers, account numbers, and payment information) are pseudonymised by the Exporter prior to transfer. The Importer does not receive and has no access to the pseudonymisation keys. The pseudonymisation keys are retained exclusively by the Exporter within its UK-based systems, and no mechanism exists for the Importer to re-identify individual data subjects from the transferred data without obtaining the pseudonymisation keys from the Exporter.
4. Sensitive Data (Special Categories) Transferred
None. The transfer does not include special category data as defined in Article 9 of UK GDPR (including, without limitation, data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, health data, or data concerning a person's sex life or sexual orientation), nor does it include personal data relating to criminal convictions and offences within the meaning of Article 10 of UK GDPR.
5. Frequency of the Transfer
The transfer is continuous and ongoing. Personal data is transmitted via automated, secure API connections operating on a 24-hour, 7-day-a-week basis. Data feeds are initiated by the Exporter's systems and are pushed to the Importer's processing environment through encrypted channels. The volume of data transferred varies based on network activity but typically comprises approximately 2.5 terabytes of pseudonymised data per calendar month.
6. Nature and Purpose of the Processing
The Importer processes the transferred personal data for the following purposes, as documented in the MSA and the Exporter's data processing instructions:
(a) AI-driven network analytics — applying machine learning algorithms to identify patterns, trends, and correlations in network performance data for the purpose of optimising the Exporter's telecommunications infrastructure;
(b) Predictive maintenance modelling — developing predictive models to anticipate network equipment failures, capacity constraints, and service degradation, enabling the Exporter to undertake proactive maintenance;
(c) Anomaly detection — identifying unusual patterns in network traffic and performance data that may indicate security incidents, equipment faults, or service quality issues; and
(d) Network optimisation reporting — generating periodic and ad hoc reports for the Exporter's network operations team summarising network performance, identifying areas for improvement, and recommending optimisation strategies.
The processing activities are further described in DPIA-011 (Caldwell Analytics Network Performance Data Transfer), which was completed by the Exporter in consultation with the Importer and approved by the Exporter's Data Protection Officer prior to the commencement of the transfer.
7. Retention Period / Deletion Criteria
The Importer shall retain transferred personal data for a maximum period of 24 months from the date of transfer, after which time the data shall be securely deleted or returned to the Exporter in accordance with the MSA and the Exporter's documented instructions. The Importer shall implement automated deletion processes to ensure that personal data exceeding the 24-month retention period is identified and securely erased on a rolling basis.
Upon termination or expiry of this IDTA or the underlying MSA (whichever occurs first), the Importer shall delete or return all transferred personal data within 30 calendar days of the effective date of termination or expiry, and shall provide the Exporter with a written certification of deletion signed by an authorised officer of the Importer. Deletion shall be carried out using methods that render the personal data permanently unrecoverable, in compliance with NIST SP 800-88 (Guidelines for Media Sanitization) or an equivalent standard.
8. Sub-Processors
The Importer engages sub-processors for the processing of transferred personal data as listed in the approved sub-processor list set out in Annex 3 to this IDTA. The sub-processor list is maintained and updated by the Importer in accordance with Clause 9(a) of the EU SCCs (Module 2) and the corresponding provisions of this IDTA.
The Exporter has approved the sub-processors listed in Annex 3 as of the Start Date. The Importer shall provide the Exporter with at least 14 calendar days' prior written notice of any intended changes to the sub-processor list, including the engagement of any new sub-processor or the replacement of an existing sub-processor. The Exporter shall have the right to object to the engagement of any new sub-processor within the 14-day notice period. If the Exporter objects on reasonable data protection grounds and the parties are unable to resolve the objection, the Exporter may terminate this IDTA and the relevant data processing services under the MSA without penalty.
PART 2: EXTRA PROTECTION CLAUSES
The parties have agreed the following supplementary measures to provide additional protections for the personal data transferred under this IDTA, taking into account the findings of TIA-001 and the specific risks associated with the transfer of personal data to the United States of America.
Section 1: Supplementary Measures — Technical
2.1 Encryption at Rest. All transferred personal data stored by the Importer — whether in primary storage, backup storage, archival storage, or any other form of persistent storage — shall be encrypted using the Advanced Encryption Standard with a key length of 256 bits (AES-256) or an equivalent or stronger encryption standard as may be adopted from time to time in accordance with industry best practice. Encryption keys shall be managed in accordance with a documented key management policy, and shall be stored separately from the encrypted data. The Importer shall ensure that encryption at rest is applied across all environments in which transferred personal data is processed, including production, staging, development (where live data is used), and disaster recovery environments.
2.2 Encryption in Transit. All transferred personal data shall be encrypted in transit using Transport Layer Security version 1.3 (TLS 1.3) or any successor protocol that provides equivalent or greater cryptographic strength. The use of deprecated or compromised protocols (including, without limitation, SSL 2.0, SSL 3.0, TLS 1.0, and TLS 1.1) is strictly prohibited. The Importer shall ensure that all API endpoints used for receiving transferred personal data support only TLS 1.3 or above, and that certificate pinning or certificate transparency mechanisms are employed to mitigate man-in-the-middle attack risks.
2.3 Pseudonymisation. The Exporter shall pseudonymise all direct identifiers — including but not limited to subscriber names, postal addresses, email addresses, telephone numbers, account numbers, and payment card details — prior to transferring personal data to the Importer. The pseudonymisation process shall be carried out using cryptographic hash functions or tokenisation techniques that render the direct identifiers unintelligible without access to the pseudonymisation keys. The pseudonymisation keys shall be retained exclusively by the Exporter within its UK-based systems and infrastructure, and shall not be transferred to, shared with, or made accessible to the Importer at any time. The Importer acknowledges that it does not hold, and shall not seek to obtain, the pseudonymisation keys, and shall not attempt to re-identify any data subject from the transferred pseudonymised data.
2.4 Access Controls. The Importer shall implement and maintain robust access controls to protect transferred personal data from unauthorised access, use, or disclosure. These access controls shall include, at a minimum:
(a) Role-based access controls (RBAC) — access to transferred personal data shall be restricted to personnel who require such access for the performance of their duties in connection with the services provided under the MSA, and access privileges shall be assigned on the basis of each individual's role and responsibilities;
(b) Multi-factor authentication (MFA) — all personnel accessing systems that store or process transferred personal data shall be required to authenticate using at least two independent authentication factors (e.g., password plus hardware token, or password plus biometric verification);
(c) Least-privilege principle — each individual's access privileges shall be limited to the minimum level of access necessary to perform their assigned duties, and elevated or administrative access privileges shall be subject to additional approval and monitoring; and
(d) Periodic access reviews — the Importer shall conduct reviews of access privileges at least quarterly to ensure that access is limited to currently authorised personnel and that former personnel or personnel who have changed roles have had their access privileges promptly revoked or adjusted.
2.5 Logging and Monitoring. The Importer shall maintain comprehensive audit logs of all access to and processing of transferred personal data. Audit logs shall record, at a minimum, the identity of the individual or system accessing the data, the date and time of access, the nature of the access (e.g., read, write, modify, delete), and the specific data records or datasets accessed. Audit logs shall be retained for a minimum period of 12 months from the date of creation, shall be protected against tampering or unauthorised modification, and shall be made available to the Exporter (or its appointed auditor) upon reasonable request as part of any audit conducted under this IDTA. The Importer shall implement automated monitoring and alerting systems to detect and respond to suspicious or anomalous access patterns.
Section 2: Supplementary Measures — Contractual
2.6 Government Access Requests — Notification. The Importer shall promptly notify the Exporter of any legally binding request for disclosure of transferred personal data by a public authority, including but not limited to requests from law enforcement agencies, intelligence services, or regulatory authorities (a "Government Access Request"), unless the Importer is prohibited from providing such notification under the applicable law of the Importer's country. In the event that the Importer is prohibited from notifying the Exporter, the Importer shall use all reasonable legal efforts to challenge or seek a modification of the prohibition, including by seeking a court order or other legal remedy to permit disclosure of the existence of the Government Access Request to the Exporter. Where the Importer is permitted to provide notification, such notification shall be made without undue delay and shall include, to the extent permitted by law, the nature of the request, the personal data requested, the requesting authority, and the legal basis for the request.
2.7 Challenging Government Access Requests. The Importer shall challenge any Government Access Request that it reasonably considers to be unlawful, disproportionate, or inconsistent with the safeguards provided by this IDTA and/or the UK GDPR. In particular, the Importer shall:
(a) review each Government Access Request to assess its legality under the laws of the Importer's country and its compatibility with international law and the principles of proportionality and necessity;
(b) where the Importer reasonably considers that the Government Access Request is unlawful or disproportionate, challenge the request through all available legal channels, including by filing motions to quash, seeking protective orders, or pursuing appeals;
(c) seek interim measures to suspend the disclosure of personal data pending judicial determination of the legality or proportionality of the Government Access Request; and
(d) provide only the minimum amount of personal data necessary to comply with a Government Access Request that is ultimately determined to be lawful and enforceable, and shall not disclose personal data in bulk or on a generalised basis.
2.8 Transparency Reporting. The Importer shall provide the Exporter with periodic reports, at least annually, on Government Access Requests received by the Importer in respect of transferred personal data during the preceding 12-month period (the "Transparency Report"). The Transparency Report shall include, to the extent permitted by applicable law, the total number of Government Access Requests received, the categories of requesting authorities, the categories of personal data requested, and the outcome of each request (i.e., whether the request was complied with, challenged, or withdrawn). The Importer shall deliver each Transparency Report to the Exporter's Data Protection Officer within 60 days of the end of the reporting period. Where the Importer is prohibited by law from disclosing certain information in the Transparency Report, it shall disclose as much information as is legally permissible and shall indicate the categories of information that have been redacted and the legal basis for the redaction.
2.9 Contractual Audit Rights. The Exporter, or an independent third-party auditor appointed by the Exporter and approved by the Importer (such approval not to be unreasonably withheld), shall have the right to conduct audits of the Importer's processing operations, security measures, and compliance with this IDTA. Audits may be conducted on-site at the Importer's facilities (including its principal office in San Jose, California, and any sub-processor facility where transferred personal data is processed) or remotely (including through the review of documentation, certifications, and audit reports). The following provisions shall apply to audits:
(a) The Exporter shall provide the Importer with not less than 30 calendar days' prior written notice of an intended audit, specifying the scope, duration, and proposed auditors;
(b) In the case of an urgent data protection concern — including a suspected personal data breach, a material change in the Importer's processing environment, or a direction from the ICO — the Exporter may conduct an audit on shorter notice (not less than 5 business days), and the Importer shall cooperate fully with such audit;
(c) Audits shall be conducted during normal business hours and shall be designed to minimise disruption to the Importer's operations;
(d) The costs of audits shall be borne by the Exporter, except where an audit reveals material non-compliance by the Importer with this IDTA, in which case the Importer shall bear the reasonable costs of the audit (including the Exporter's reasonable travel and third-party auditor expenses);
(e) The Importer shall make available to the Exporter or its auditor all information, systems, and personnel reasonably necessary to demonstrate compliance with this IDTA; and
(f) The Importer may, as an alternative to an on-site audit, provide the Exporter with the results of a recent independent third-party audit (such as a SOC 2 Type II report or an ISO 27001 certification audit), provided that the scope of such audit covers the matters relevant to this IDTA and that the Exporter consents to the substitution (such consent not to be unreasonably withheld).
2.10 Data Localisation. Certain categories of transferred personal data, as specified by the Exporter from time to time by written notice to the Importer, may be subject to data localisation requirements restricting the processing of such data to specified geographic locations. Where the Exporter issues a data localisation instruction, the Importer shall ensure that the specified categories of personal data are processed and stored only within the geographic locations identified in the instruction, and shall not transfer, copy, replicate, or otherwise make such data accessible outside the specified locations without the Exporter's prior written consent. As of the Start Date, no data localisation restrictions have been imposed by the Exporter beyond the general requirement that transferred personal data be processed within the continental United States.
Section 3: Supplementary Measures — Organisational
2.11 Personnel Obligations. The Importer shall ensure that all personnel authorised to process transferred personal data — including employees, contractors, and temporary staff — are bound by legally enforceable contractual obligations of confidentiality that are at least as protective as the confidentiality obligations set out in this IDTA. The Importer shall further ensure that all such personnel have received appropriate data protection training, including training on:
(a) the principles of data protection and the requirements of UK GDPR (to the extent relevant to the Importer's processing activities);
(b) the specific obligations of the Importer under this IDTA, including the supplementary measures set out in this Part 2;
(c) the procedures for identifying and reporting personal data breaches and security incidents; and
(d) the handling of data subject requests and Government Access Requests.
Data protection training shall be provided to all relevant personnel upon commencement of their involvement in the processing of transferred personal data, and refresher training shall be provided at least annually thereafter. The Importer shall maintain records of training provided and shall make such records available to the Exporter upon request.
2.12 Incident Response. The Importer shall maintain a documented incident response plan that covers the identification, assessment, containment, remediation, and reporting of personal data breaches and security incidents affecting transferred personal data. The Importer shall notify the Exporter of any personal data breach (as defined in Article 4(12) of the UK GDPR) affecting transferred personal data without undue delay and in any event within 36 hours of becoming aware of the breach. The notification shall include:
(a) a description of the nature of the personal data breach, including, where possible, the categories and approximate number of data subjects concerned and the categories and approximate number of personal data records concerned;
(b) the name and contact details of the Importer's data protection contact or other point of contact from whom more information can be obtained;
(c) a description of the likely consequences of the personal data breach; and
(d) a description of the measures taken or proposed to be taken by the Importer to address the personal data breach, including, where appropriate, measures to mitigate its possible adverse effects.
Where it is not possible to provide all of the above information at the time of the initial notification, the Importer shall provide the information in phases without further undue delay. The Importer shall cooperate fully with the Exporter in investigating and remedying the breach and in fulfilling the Exporter's notification obligations to the ICO under Article 33 of the UK GDPR and to affected data subjects under Article 34 of the UK GDPR.
PART 3: COMMERCIAL CLAUSES
Section 1: Relationship with the Underlying Agreement
3.1 This IDTA supplements and forms an integral part of the data protection obligations established under the Master Services Agreement dated 1 June 2021 between the Exporter and the Importer (the "MSA"), including any data processing addendum, schedule, or annex thereto. The provisions of this IDTA shall be read and construed in conjunction with the MSA, and terms defined in the MSA shall have the same meaning in this IDTA unless otherwise defined herein.
3.2 In the event of any conflict or inconsistency between the provisions of this IDTA and the provisions of the MSA (including any data processing addendum, schedule, or annex thereto), the provisions of this IDTA shall prevail to the extent necessary to ensure compliance with UK GDPR and to maintain the appropriate safeguards for the restricted transfer of personal data. This principle of precedence applies irrespective of whether the conflicting provision of the MSA was executed before or after the date of this IDTA.
3.3 Nothing in this IDTA shall be construed as relieving either party of its obligations under the MSA, except to the extent that such obligations are inconsistent with the requirements of UK GDPR or this IDTA.
Section 2: Liability
3.4 Liability as between the Exporter and the Importer for breach of this IDTA shall be governed by the liability provisions set out in the MSA, subject to the following modifications:
(a) Liability for breaches of the data protection clauses of this IDTA — including the supplementary measures set out in Part 2 and the mandatory clauses set out in Part 4 — shall not be subject to any contractual liability cap, limitation of liability, or exclusion of liability to the extent that the application of such cap, limitation, or exclusion would undermine the protections afforded to data subjects under this IDTA or UK GDPR;
(b) Each party acknowledges that the removal of liability caps in respect of data protection breaches is necessary to ensure the effectiveness of this IDTA as an appropriate safeguard under Article 46 of the UK GDPR, and to preserve the enforceability of data subject rights as third-party beneficiaries of this IDTA; and
(c) The foregoing does not affect any limitation or exclusion of liability that is prohibited by applicable law.
3.5 Each party shall indemnify and hold harmless the other party against all claims, actions, proceedings, losses, damages, liabilities, costs, and expenses (including reasonable legal fees and disbursements) arising from or in connection with a breach by the indemnifying party of its obligations under this IDTA, including any breach that results in a claim by a data subject, the ICO, or any other supervisory authority. This indemnification obligation shall not be subject to any contractual liability cap to the extent described in Section 3.4(a) above.
Section 3: Costs
3.6 The costs of compliance with this IDTA — including the implementation, maintenance, and ongoing operation of the supplementary measures set out in Part 2, the costs of conducting Transfer Impact Assessments, and the costs of any modifications to the Importer's systems or processes required to comply with this IDTA — shall be borne by the Importer, unless otherwise agreed in writing by the parties. For the avoidance of doubt, this provision does not affect the allocation of costs for services under the MSA, which shall be governed by the MSA.
3.7 The costs of audits conducted by the Exporter (or its appointed auditor) under Section 2.9 of this IDTA shall be borne by the Exporter, except where an audit reveals material non-compliance by the Importer with this IDTA, in which case the Importer shall bear the reasonable costs of the audit, including the Exporter's reasonable travel expenses and the fees of any third-party auditor engaged by the Exporter.
Section 4: Confidentiality
3.8 Each party shall treat the personal data transferred under this IDTA, and all information relating to the other party's data protection measures, security measures, and compliance with this IDTA, as confidential information. Such confidential information shall not be disclosed to any third party except:
(a) to the extent necessary for the performance of the party's obligations under this IDTA or the MSA;
(b) to the party's professional advisers, auditors, or insurers on a need-to-know basis, subject to appropriate confidentiality obligations;
(c) to the extent required by applicable law, regulation, court order, or the lawful direction of a competent regulatory authority (including the ICO); or
(d) with the prior written consent of the other party.
3.9 The obligations of confidentiality set out in this Section 4 are in addition to, and do not replace or limit, any confidentiality obligations imposed on the parties under the MSA, applicable data protection law, or this IDTA.
Section 5: Dispute Resolution
3.10 Governing Law. This IDTA and any dispute or claim arising out of or in connection with it or its subject matter, existence, negotiation, validity, termination, or enforceability (including non-contractual disputes or claims) shall be governed by and construed in accordance with the laws of England and Wales.
3.11 Jurisdiction. The courts of England and Wales shall have non-exclusive jurisdiction to hear and determine any suit, action, or proceeding, and to settle any dispute, which may arise out of or in connection with this IDTA. The submission to the jurisdiction of the courts of England and Wales shall not limit the right of the Exporter, the Importer, or any data subject to take proceedings in any other court of competent jurisdiction, nor shall the taking of proceedings in one or more jurisdictions preclude the taking of proceedings in any other jurisdiction.
3.12 Third-Party Beneficiary Rights. Data subjects whose personal data is transferred under this IDTA shall have the right to enforce the provisions of this IDTA that are intended for their benefit as third-party beneficiaries in accordance with the Contracts (Rights of Third Parties) Act 1999. This right of enforcement includes, without limitation, the right to bring proceedings before the courts of England and Wales, the right to lodge a complaint with the ICO, and the right to claim compensation for damages suffered as a result of a breach of this IDTA. The consent of data subjects shall not be required for any amendment, variation, waiver, or termination of this IDTA, provided that any such amendment, variation, waiver, or termination does not adversely affect the rights or protections afforded to data subjects by this IDTA.
PART 4: MANDATORY CLAUSES
Section 1: Compliance with UK GDPR
4.1 The Importer shall comply with all applicable provisions of UK GDPR as if it were a processor established in the United Kingdom, to the extent relevant to its processing of transferred personal data under this IDTA. This obligation includes, without limitation, compliance with the principles relating to processing of personal data set out in Article 5 of the UK GDPR (lawfulness, fairness and transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality, and accountability), the obligations of processors set out in Article 28 of the UK GDPR, and the security of processing requirements set out in Article 32 of the UK GDPR.
4.2 The Importer represents and warrants that, as of the Start Date, it has no reason to believe that the laws and practices in the United States of America applicable to its processing of transferred personal data — including any requirements to disclose personal data to public authorities or measures authorising access to personal data by public authorities (whether for law enforcement, intelligence, national security, or other purposes) — prevent it from fulfilling its obligations under this IDTA. This representation is informed by and based upon the Transfer Impact Assessment (TIA-001) completed by the parties on 4 August 2023, and the Importer confirms that it has disclosed to the Exporter all information in its possession that is relevant to the assessment of the legal framework in the United States as it applies to the transferred personal data.
4.3 The Importer shall promptly inform the Exporter if, at any time during the term of this IDTA, it has reason to believe that it is or has become subject to laws or practices in the United States that are inconsistent with the requirements of this IDTA, including changes to applicable law, new government surveillance programmes, or new legal process requirements that may affect the protections afforded to the transferred personal data. Upon receiving such notification, the parties shall consult in good faith to determine whether supplementary measures can be implemented to address the change, and if not, the Exporter shall have the right to suspend or terminate the transfer in accordance with Section 5 of this Part 4.
Section 2: Data Subject Rights
4.4 The Importer shall promptly assist the Exporter in responding to requests from data subjects to exercise their rights under UK GDPR in relation to the transferred personal data. Data subject rights for which the Importer shall provide assistance include:
(a) the right of access under Article 15 of the UK GDPR;
(b) the right to rectification under Article 16 of the UK GDPR;
(c) the right to erasure (the "right to be forgotten") under Article 17 of the UK GDPR;
(d) the right to restriction of processing under Article 18 of the UK GDPR;
(e) the right to data portability under Article 20 of the UK GDPR;
(f) the right to object to processing under Article 21 of the UK GDPR; and
(g) rights in relation to automated decision-making and profiling under Article 22 of the UK GDPR.
4.5 The Importer's assistance shall include, without limitation, promptly providing the Exporter with all information necessary to respond to data subject requests, implementing appropriate technical measures to facilitate the exercise of data subject rights (including the ability to search, extract, rectify, erase, restrict, or port personal data upon the Exporter's instruction), and cooperating with the Exporter in responding to data subject requests within the timeframes prescribed by UK GDPR (generally, without undue delay and in any event within one month of receipt).
4.6 Where the Importer receives a request directly from a data subject (whether through the Importer's own systems, a contact form, or otherwise), the Importer shall:
(a) promptly redirect the data subject to the Exporter's Data Protection Officer (Sanjay Mehta, dpo@northgatetelecom.co.uk);
(b) notify the Exporter of the request without undue delay and in any event within 3 business days of receipt; and
(c) refrain from responding to the data subject's request on the merits unless expressly instructed to do so by the Exporter in writing.
Section 3: ICO Powers and Data Subject Remedies
4.7 The Importer agrees to submit to the jurisdiction of the Information Commissioner's Office and the courts of England and Wales for the purposes of any investigation, inquiry, enforcement action, or proceedings arising out of or in connection with this IDTA, the Importer's processing of transferred personal data, or the exercise of data subject rights under this IDTA or UK GDPR.
4.8 Data subjects who are beneficiaries of this IDTA shall have the following rights and remedies:
(a) the right to lodge a complaint with the ICO in accordance with Article 77 of the UK GDPR;
(b) the right to an effective judicial remedy before the courts of England and Wales in accordance with Article 79 of the UK GDPR; and
(c) the right to receive compensation from the Exporter or the Importer (or both) for material or non-material damage suffered as a result of a breach of this IDTA or UK GDPR, in accordance with Article 82 of the UK GDPR.
4.9 The Importer shall comply with any decision of the ICO or a competent court of England and Wales relating to this IDTA, including decisions ordering the Importer to take specific action (such as suspending or ceasing processing, erasing personal data, or implementing additional safeguards), decisions imposing administrative fines or penalties, and decisions requiring the Importer to provide information or submit to an audit or inspection. The Importer acknowledges that non-compliance with a decision of the ICO or a competent court may result in the suspension or termination of the transfer under this IDTA.
Section 4: Onward Transfers
4.10 The Importer shall not transfer, disclose, or otherwise make available the personal data received under this IDTA to any third party (including any sub-processor, affiliate, or other entity) located outside the United Kingdom (an "Onward Transfer") unless one or more of the following conditions is satisfied:
(a) the third party recipient has entered into an appropriate safeguard mechanism for the Onward Transfer that provides protections for the personal data that are materially equivalent to those provided by this IDTA, including by entering into a standalone IDTA with the Importer, or by the Importer ensuring that the third party is bound by a UK Addendum to the EU SCCs;
(b) the Onward Transfer is to a country, territory, sector, or international organisation that is the subject of an adequacy regulation made by the Secretary of State under Section 17A of the Data Protection Act 2018; or
(c) the Onward Transfer is permitted under a derogation set out in Article 49 of the UK GDPR, and the conditions for relying on such derogation are satisfied.
4.11 The Importer shall ensure that any contract entered into with a sub-processor or other third party recipient in connection with an Onward Transfer includes obligations that are materially equivalent to those imposed on the Importer under this IDTA, including the supplementary measures set out in Part 2 and the mandatory clauses set out in this Part 4.
4.12 The Importer's current sub-processor list, as set out in Annex 3 to this IDTA, shall be maintained and updated by the Importer in accordance with Section 2.9 and Table 3 of this IDTA. The Exporter retains the right to object to the engagement of any new sub-processor within 14 calendar days of receiving notification from the Importer. The procedures for sub-processor notification and objection are set out in Table 3, Section 8 of this IDTA.
Section 5: Suspension and Termination
4.13 Suspension by the Exporter. The Exporter may suspend the transfer of personal data under this IDTA, in whole or in part, immediately upon written notice to the Importer if any of the following circumstances arise:
(a) the ICO (or any competent court or tribunal) issues a decision that the safeguards relied upon for the transfer under this IDTA are no longer adequate or do not provide an essentially equivalent level of protection to that guaranteed within the United Kingdom;
(b) the Exporter has reasonable grounds to believe that the Importer is in material breach of this IDTA, including a material failure to implement or maintain the supplementary measures set out in Part 2;
(c) the Importer notifies the Exporter, or the Exporter otherwise becomes aware, that the Importer is unable to comply with the supplementary measures or mandatory clauses set out in this IDTA, whether due to changes in applicable law, government directives, or other circumstances beyond the Importer's control; or
(d) the laws or practices in the United States of America change in a manner that materially and adversely impacts the protections afforded to transferred personal data by this IDTA, including the introduction of new surveillance powers, the expansion of existing government access mechanisms, or the curtailment of judicial oversight or individual redress mechanisms.
4.14 During any period of suspension, the Importer shall:
(a) cease all processing of transferred personal data, except to the extent necessary to securely store and protect the data pending the Exporter's instructions;
(b) take all reasonable steps to protect the transferred personal data from unauthorised access, use, or disclosure; and
(c) cooperate with the Exporter to assess whether the circumstances giving rise to the suspension can be resolved and, if so, to implement any additional safeguards necessary to permit the resumption of transfers.
4.15 Termination by Either Party. Either party may terminate this IDTA:
(a) upon written notice to the other party if the other party is in material breach of this IDTA and fails to cure such breach within 30 calendar days of receiving written notice specifying the nature of the breach and the steps required to cure it; or
(b) upon written notice to the other party if the underlying MSA is terminated or expires, in which case this IDTA shall terminate on the same date as the MSA, subject to the survival provisions set out below.
4.16 Consequences of Termination or Suspension. Upon termination of this IDTA (whether by expiry, mutual agreement, or notice under Section 4.15) or upon suspension under Section 4.13, the Importer shall:
(a) immediately cease all processing of transferred personal data (except as necessary for secure storage and protection pending the Exporter's instructions);
(b) at the Exporter's election (to be communicated to the Importer in writing within 15 calendar days of the effective date of termination or suspension), either:
(i) return all transferred personal data to the Exporter in a commonly used, machine-readable format, securely transmitted via encrypted channels; or
(ii) securely delete all transferred personal data, including all copies, backups, and replications, using methods that render the data permanently unrecoverable in compliance with NIST SP 800-88 or an equivalent standard;
(c) complete the return or deletion of all transferred personal data within 30 calendar days of the effective date of termination or receipt of the Exporter's election (whichever is later); and
(d) provide the Exporter with a written certification, signed by an authorised officer of the Importer, confirming that all transferred personal data has been returned or deleted in accordance with this Section 4.16.
4.17 Survival. The obligations of confidentiality and data protection under this IDTA, including the supplementary measures set out in Part 2, the data subject rights provisions set out in Section 2 of this Part 4, the ICO powers and data subject remedies provisions set out in Section 3 of this Part 4, and the liability and indemnification provisions set out in Part 3, shall survive the termination or expiry of this IDTA and shall continue in full force and effect for so long as the Importer retains any transferred personal data or until all such data has been securely deleted or returned to the Exporter.
Section 6: Review and Update
4.18 The parties shall review this IDTA at least annually, or more frequently if there is a material change in the laws or practices of the Importer's country that may affect the adequacy of the safeguards provided by this IDTA, to ensure that the protections afforded to transferred personal data remain adequate and effective.
4.19 The first annual review shall take place no later than 17 July 2024. Subsequent annual reviews shall take place on or before the anniversary of the Start Date in each subsequent year during the term of this IDTA.
4.20 Each annual review shall include, at a minimum:
(a) a reassessment of the Transfer Impact Assessment (TIA-001), taking into account:
(i) developments in United States surveillance law and practice, including any amendments to FISA, Executive Order 12333, or the CLOUD Act;
(ii) regulatory guidance, decisions, or opinions issued by the ICO or other relevant supervisory authorities;
(iii) relevant court decisions in the United Kingdom, the United States, or the European Union; and
(iv) any changes in the Importer's business operations, sub-processor arrangements, or processing environment that may affect the risk profile of the transfer;
(b) a review of the supplementary measures set out in Part 2 to determine whether they remain sufficient to address the identified risks, and the implementation of any additional or modified measures as necessary; and
(c) a review of the Importer's sub-processor list to confirm that all sub-processors continue to meet the requirements of this IDTA and the applicable onward transfer provisions.
4.21 The outcome of each annual review shall be documented in writing and signed by the key contacts of both parties (or their designated representatives). Where the review identifies that the safeguards are no longer adequate, the parties shall agree and implement a remediation plan within a reasonable timeframe or, if remediation is not feasible, the Exporter may exercise its rights of suspension or termination under Section 5 of this Part 4.
ANNEXES
Annex 1: Description of Transfer
This Annex sets out the details of the transfer of personal data from the Exporter to the Importer, cross-referencing and restating the information provided in Table 3 of Part 1 of this IDTA.
1. Nature of the Transfer
The transfer described in this IDTA constitutes a "restricted transfer" within the meaning of Section 18 of the Data Protection Act 2018, read in conjunction with Article 46 of the UK GDPR. The personal data is transferred from the Exporter, which is established in the United Kingdom, to the Importer, which is established in the United States of America. As of the Start Date, the United States has not been the subject of an adequacy regulation under Section 17A of the Data Protection Act 2018 with respect to the categories of data and processing activities described in this Annex.
2. Categories of Data Subjects
(a) Consumer subscribers of the Exporter's telecommunications and NorthCloud SaaS services located in the United Kingdom (a subset of the Exporter's approximately 6.3 million total consumer subscribers); and
(b) Enterprise client end-users in the United Kingdom (individual users associated with a subset of the Exporter's approximately 42,000 enterprise client accounts).
3. Categories of Personal Data
(a) Network performance data;
(b) Subscriber metadata (pseudonymised);
(c) Location data (pseudonymised — cell-level and IP-based);
(d) Device identifiers (pseudonymised — IMEI and IMSI derivatives, device type);
(e) Usage and traffic patterns; and
(f) Service quality metrics.
All direct identifiers are pseudonymised by the Exporter prior to transfer. The Importer does not receive pseudonymisation keys.
4. Special Category Data
No special category data (Article 9, UK GDPR) or criminal conviction/offence data (Article 10, UK GDPR) is transferred.
5. Purposes of the Transfer
AI-driven network analytics, predictive maintenance modelling, anomaly detection, and network optimisation reporting, as described in DPIA-011 and the MSA.
6. Frequency
Continuous / ongoing — automated data feeds via secure API connection operating 24/7.
7. Retention Period
Maximum 24 months from the date of transfer, with secure deletion or return thereafter. Upon termination or expiry, deletion or return within 30 calendar days, with written certification.
Annex 2: Technical and Organisational Measures
This Annex describes the technical and organisational security measures implemented by the Importer to protect the transferred personal data. The Importer's Chief Technology Officer, Derek Rawlings, is responsible for overseeing the technical security infrastructure described in this Annex and for ensuring its ongoing adequacy and effectiveness.
1. Encryption
(a) Encryption at rest: All transferred personal data stored by the Importer is encrypted using AES-256 encryption. This applies to all storage media, including primary databases, data warehouses, file systems, backup storage, and archival storage. Encryption keys are managed through a dedicated hardware security module (HSM) infrastructure with key rotation on a quarterly cycle.
(b) Encryption in transit: All transferred personal data is encrypted in transit using TLS 1.3. Deprecated protocols (SSL 2.0, SSL 3.0, TLS 1.0, TLS 1.1) are disabled across all endpoints. Certificate pinning is implemented for API connections between the Exporter and the Importer.
2. Pseudonymisation
Pseudonymisation of direct identifiers is applied by the Exporter prior to transfer. The pseudonymisation process uses HMAC-SHA256 tokenisation. Pseudonymisation keys are retained exclusively by the Exporter within its UK-based systems. The Importer does not hold, and has no mechanism to obtain, the pseudonymisation keys. The Importer's systems are designed to process pseudonymised data without the capability to re-identify individual data subjects.
3. Access Controls
(a) Role-based access controls (RBAC): Access to systems containing transferred personal data is restricted to authorised personnel based on role assignments. Roles are defined in accordance with the least-privilege principle.
(b) Multi-factor authentication (MFA): All access to systems containing transferred personal data requires MFA, using hardware tokens (FIDO2/WebAuthn-compliant) in combination with strong passwords.
(c) Least-privilege principle: Access privileges are assigned at the minimum level necessary for each individual's role. Administrative and elevated access privileges require additional approval from the Importer's Information Security team and are subject to enhanced monitoring.
(d) Periodic access reviews: Access privileges are reviewed at least quarterly. Accounts of personnel who have left the organisation or changed roles are deactivated or adjusted within 24 hours of the change.
4. Network Security
(a) Firewalls: Enterprise-grade firewalls are deployed at all network perimeters, with rule sets reviewed and updated at least quarterly.
(b) Intrusion detection and prevention systems (IDS/IPS): Network-based and host-based IDS/IPS are deployed across the Importer's infrastructure, with real-time alerting and automated response capabilities.
(c) Network segmentation: The Importer's network is segmented to isolate systems processing transferred personal data from other systems and environments. Access between network segments is controlled by firewall rules and access control lists.
5. Data Centre Security
The Importer's primary data processing facility is located at its principal office at 2700 Technology Drive, San Jose, California 95134, USA. Physical access controls include:
(a) 24/7 on-site security personnel;
(b) Biometric access controls (fingerprint and iris recognition) for entry to data centre areas;
(c) Mantrap entry systems with anti-tailg

UK INTERNATIONAL DATA TRANSFER AGREEMENT

RECITALS

PART 1: TABLES

PART 2: EXTRA PROTECTION CLAUSES

PART 3: COMMERCIAL CLAUSES

PART 4: MANDATORY CLAUSES

Record

Parties

Dates

Amounts