p9

That it has implemented the technical and organisational security measures before processing the personal data transferred;

That it will promptly notify the data exporter about:hat it will promptly notify the data exporter about:

1. Any legally binding request for disclosure of the personal data by a law enforcement authority unless otherwise prohibited, such as a prohibition under criminal law to preserve the confidentiality of a law enforcement investigation;
2. Any accidental or unauthorised access; and
3. Any request received directly from the data subjects without responding to that request, unless it has been otherwise authorised to do so;

To deal promptly and properly with all inquiries from the data exporter relating to its processing of the personal data subject to the transfer and to abide by the advice of the supervisory authority with regard to the processing of the data transferred;

At the request of the data exporter to submit its data-processing facilities for audit of the processing activities covered by the Clauses which shall be carried out by the data exporter or an inspection body composed of independent members and
in possession of the required professional qualifications bound by a duty of confidentiality, selected by the data exporter, where applicable, in agreement with the supervisory authority;

That, in the event of sub-processing, it has previously informed the data exporter and obtained its prior written consent;

That the processing services by the sub-processor will be carried out in accordance with Clause 11;

To send when requested a copy of any sub-processor agreement it concludes under the Clauses to the data exporter.

6. Liability

• Each party’s and all of its Affiliates’ liability, taken together in the aggregate, arising out of or related to the clauses mentioned in this agreement, and all DPAs between Authorized Affiliates and CP, whether in contract, tort or under any
  other theory of liability, is subject to the ‘Limitation of Liability’ section of the Agreement, and any reference in such section to the liability of a party means the aggregate liability of that party and all of its Affiliates under the
  Clauses and all DPAs together.
• The maximum liability of CP under the clauses mentioned in this Agreement shall not exceed in the aggregate an amount equal to the Fees paid by or on behalf of Client to CP for providing Services during the last two (2) months prior to the claim
  arising.

7. Mediation and Jurisdiction

The Clauses shall be governed by and construed in accordance with the laws of TheNetherlands. The Parties agree that the courts of Amsterdam have jurisdiction to settle any disputes in connection herewith and accordingly submit to the jurisdiction
of such courts.