p10

8. Compliance with Laws and Audit Right

1. Each party will comply with all applicable laws and regulations, in the provision of their respective obligations and activities hereunder.
2. Once every 12 months during the Term of the Clauses, each party shall have the right, at its own cost and expense, to perform a reasonable audit of performance under and in compliance with the Clauses of this Agreement (although such audits may
   be conducted more frequently if required by applicable law, a court order, a regulatory authority with jurisdiction or if a breach is suspected).

9. Governing Law

The Clauses shall be governed by and construed in accordance with the laws of the Netherlands.

10. Variation of the Contract

The parties undertake not to vary or modify the Clauses. This does not preclude the parties from adding clauses on business related issues where required as long as they do not contradict the Clause.

11. Sub-processing

11.1 The data exporter shall keep a list of sub-processing agreements concluded under the Clauses and notified by the data importer pursuant to Clause 5.1(i), which shall be updated at least once a year.

12. Obligation after the Termination of Personal Data-Processing Services

12.1 The parties agree that on the termination of the provision of data-processing services, the data importer and the sub-processor shall, at the choice of the data exporter, return all the personal data transferred and
the copies thereof to the data exporter or shall destroy all the personal data and certify to the data exporter that it has done so, unless legislation imposed upon the data importer prevents it from returning or destroying all or part of the
personal data transferred. In that case, the data importer warrants that it will guarantee the confidentiality of the personal data transferred and will not actively process the personal data transferred anymore.

12.2 The data importer and the sub-processor warrant that upon request of the data exporter and/or of the supervisory authority, it will submit its data-processing facilities for an audit of the measures referred to in paragraph
2 of Clause 8.

Appendix 1

This Appendix forms part of the Clauses.

Data Exporter

The data exporter is: The counterparty agreeing to these terms and all affiliates of such entity established within the EEA, which have purchased services from CP or its Affiliates.

Data Importer

The data importer is: CP, which processes Personal Data upon the instruction of the data exporter in accordance with the terms of the agreement between the data exporter and CP.