(c) Upon a period of 1 (one) year following the expiry or termination of a Contract, the Service Provider shall effectively delete all personal data processed on behalf of the controller, and any copies thereof, unless Union or national law requires a longer storage of personal data; 

d) Written instructions from the Users include: In case the services provided by the Service Provider include a platform via which the personal data will be processed, the necessary EIB Group IT Security and Data Protection risk assessments, ensuring compliance with EIB policies, shall be carried out before its implementation. Further written instructions in relation to the processing operations to be performed in implementation of the Agreement, or a Contract can be communicated to the Service Provider by the User at any time. 

8.2 [In case the Service Provider is established in a third country (as defined in Chapter V of Regulation (EU) 2018/1725) or in a country that becomes a third country during the term of the Agreement or a Contract, and as long as such third country is not covered by an adequacy decision referred to in Article 47 of Regulation (EU) 2018/1725, the Service Provider agrees to be bound by the provisions of Appendix E. References to Directive 95/46/EC included in Appendix E shall be understood as references to the equivalent provisions of Regulation (EU) 2016/679 and Regulation (EU) 2018/1725. Alternatively, the Service Provider is obliged to provide EIB with evidence of its adherence to the binding corporate rules, codes of conduct or certification mechanisms referred to in Article 48 point(b), (e) and (f) of Regulation (EU) 2018/1725. Contractual references to obligations at law assumed by the Service Provider as per the application of Union data protection law will be considered as non-applicable to it.] $^{3}$ 

## Article 9 – Law and Jurisdiction 

9.1 The Agreement and each Contract shall be governed and construed in accordance with the laws of Luxembourg. 

9.2 The Parties hereby submit to the exclusive jurisdiction of the courts of the judicial district of Luxembourg city ( arrondissement judiciaire de Luxembourg ) to settle any dispute arising out of or in connexion with this Agreement or a Contract. 

## Article 10 – Notices; Contact Person 

10.1 Notices and other communications given hereunder addressed to either party shall be in writing and shall be served by hand delivery, registered letter, e-mail or other means of transmission which affords evidence of receipt by the addressee to its address set out below, or to such other address as it previously notifies to the other in writing: 

for the Bank: 

for the Service Provider: 

Attention: [ name of recipient] 98-100, boulevard Konrad Adenauer L-2950 Luxembourg E-mail: [ l ] 

Attention: [ name of recipient] [address ] E-mail: [ l ] 

10.2 The date of registration or, as the case may be, the stated date of receipt of transmission shall be conclusive for the determination of a period. 

