DATA PROCESSING AGREEMENT

Dated 6 February 2026

BETWEEN:

(1) NORTHGATE LOGISTICS LIMITED, a company incorporated in England and Wales
(company number 09123456) whose registered office is at Unit 7 Calder Park,
Manchester M17 1TR ("Northgate" or the "Controller"); and

(2) ARKWRIGHT SYSTEMS LIMITED, a company incorporated in England and Wales
(company number 08776655) whose registered office is at 3 Deansgate Square,
Manchester M15 4GB ("Arkwright" or the "Processor").

IT IS AGREED:

1. DEFINITIONS

1.1 Terms used in this Agreement have the meanings given in the UK GDPR and the
Data Protection Act 2018.

2. PROCESSING OF PERSONAL DATA

2.1 The Processor shall process personal data only on the documented
instructions of the Controller, including as to international transfers.

2.2 The Processor shall ensure that persons authorised to process the personal
data are bound by an appropriate duty of confidence.

2.3 The Processor shall implement appropriate technical and organisational
measures under Article 32 of the UK GDPR.

3. SUB-PROCESSORS

3.1 The Processor shall not engage any sub-processor without the prior written
consent of the Controller.

3.2 Where consent is given, the Processor shall impose on the sub-processor the
same data protection obligations as are set out in this Agreement.

4. INTERNATIONAL TRANSFERS

4.1 The Processor shall not transfer personal data outside the United Kingdom
unless the transfer is to a country subject to UK adequacy regulations or is
made under the International Data Transfer Addendum to the EU standard
contractual clauses.

5. ASSISTANCE AND AUDIT

5.1 The Processor shall assist the Controller in responding to data subject
requests and shall make available all information necessary to demonstrate
compliance with Article 28 of the UK GDPR.

5.2 The Processor shall permit audits by the Controller on reasonable notice.

6. BREACH NOTIFICATION

6.1 The Processor shall notify the Controller without undue delay and in any
event within twenty-four (24) hours of becoming aware of a personal data breach.

7. DELETION AND RETURN

7.1 On termination the Processor shall, at the Controller's option, delete or
return all personal data.

8. GOVERNING LAW

8.1 This Agreement is governed by the laws of England and Wales and the parties
submit to the exclusive jurisdiction of the courts of England and Wales.

SIGNED for and on behalf of the parties.
