Common use of Sub-processing Clause in Contracts

Sub-processing. 11.1 The data importer shall not subcontract any of its processing operations performed on behalf of the data exporter under the Clauses without the prior written consent of the data exporter. Where the data importer subcontracts its obligations under the Clauses, with the consent of the data exporter, it shall do so only by way of a written agreement with the sub-processor which imposes the same obligations on the sub- processor as are imposed on the data importer under the Clauses. Where the sub-processor fails to fulfil its data protection obligations under such written agreement the data importer shall remain fully liable to the data exporter for the performance of the sub-processor’s obligations under such agreement. 11.2 The prior written contract between the data importer and the sub-processor shall also provide for a third-party beneficiary clause as laid down in Clause 3 for cases where the data subject is not able to bring the claim for compensation referred to in paragraph 1 of Clause 6 against the data exporter or the data importer because they have factually disappeared or have ceased to exist in law or have become insolvent and no successor entity has assumed the entire legal obligations of the data exporter or data importer by contract or by operation of law. Such third-party liability of the sub-processor shall be limited to its own processing operations under the Clauses. 11.3 The provisions relating to data protection aspects for sub-processing of the contract referred to in paragraph 1 shall be governed by the law of the Member State in which the data exporter is established, namely ........................................ 11.4 The data exporter shall keep a list of sub-processing agreements concluded under the Clauses and notified by the data importer pursuant to Clause 5(j), which shall be updated at least once a year. The list shall be available to the data exporter’s data protection supervisory authority.

Sub-processing. 11.1 The data importer shall not subcontract any of its processing operations performed on behalf of the data exporter under the Clauses without the prior written consent of the data exporter. Where the data importer subcontracts its obligations under the Clauses, with the consent of the data exporter, it shall do so only by way of a written agreement with the sub-processor which imposes the same obligations on the sub- processor as are imposed on the data importer under the Clauses. Where the sub-processor fails to fulfil fulfill its data protection obligations under such written agreement the data importer shall remain fully liable to the data exporter for the performance of the sub-processor’s obligations under such agreement. 11.2 The prior written contract between the data importer and the sub-processor shall also provide for a third-third- party beneficiary clause as laid down in Clause 3 for cases where the data subject is not able to bring the claim for compensation referred to in paragraph 1 of Clause 6 against the data exporter or the data importer because they have factually disappeared or have ceased to exist in law or have become insolvent and no successor entity has assumed the entire legal obligations of the data exporter or data importer by contract or by operation of law. Such third-party liability of the sub-processor shall be limited to its own processing operations under the Clauses. 11.3 The provisions relating to data protection aspects for sub-processing of the contract referred to in paragraph 1 shall be governed by the law of the Member State in which the data exporter is established, namely ......................................... 11.4 The data exporter shall keep a list of sub-processing agreements concluded under the Clauses and notified by the data importer pursuant to Clause 5(j5.1(j), which shall be updated at least once a year. The list shall be available to the data exporter’s 's data protection supervisory authority.

Sub-processing. 11.1 The data importer shall not subcontract any of its processing operations performed on behalf of the data exporter under the Clauses without the prior written consent of the data exporter. Where the data importer subcontracts its obligations under the Clauses, DocuSign Envelope ID: 393F4E8C-D8A6-4D91-AF12-8AF7DF78F934 with the consent of the data exporter, it shall do so only by way of a written agreement with the sub-processor which imposes the same obligations on the sub- sub-processor as are imposed on the data importer under the Clauses. Where the sub-processor fails to fulfil its data protection obligations under such written agreement the data importer shall remain fully liable to the data exporter for the performance of the sub-processor’s 's obligations under such agreement. 11.2 The prior written contract between the data importer and the sub-processor shall also provide for a third-party beneficiary clause as laid down in Clause 3 for cases where the data subject is not able to bring the claim for compensation referred to in paragraph 1 of Clause 6 against the data exporter or the data importer because they have factually disappeared or have ceased to exist in law or have become insolvent and no successor entity has assumed the entire legal obligations of the data exporter or data importer by contract or by operation of law. Such third-party liability of the sub-processor shall be limited to its own processing operations under the Clauses. 11.3 The provisions relating to data protection aspects for sub-processing of the contract referred to in paragraph 1 shall be governed by the law of the Member State in which the data exporter is established, namely ......................................... 11.4 The data exporter shall keep a list of sub-processing agreements concluded under the Clauses and notified by the data importer pursuant to Clause 5(j5 (j), which shall be updated at least once a year. The list shall be available to the data exporter’s 's data protection supervisory authority.

Sub-processing. 11.1 The data importer shall not subcontract any of its processing operations performed on behalf of the data exporter under the Clauses without the prior written consent of the data exporter. Where the data importer subcontracts its obligations under the Clauses, with the consent of the data exporter, it shall do so only by way of a written agreement with the sub-processor which imposes the same obligations on the sub- sub-processor as are imposed on the data importer under the Clauses. Where the sub-processor fails to fulfil its data protection obligations under such written agreement the data importer shall remain fully liable to the data exporter for the performance of the sub-sub- processor’s 's obligations under such agreement. 11.2 The prior written contract between the data importer and the sub-processor shall also provide for a third-party beneficiary clause as laid down in Clause clause 3 for cases where the data subject is not able to bring the claim for compensation referred to in paragraph 1 of Clause clause 6 against the data exporter or the data importer because they have factually disappeared or have ceased to exist in law or have become insolvent and no successor entity has assumed the entire legal obligations of the data exporter or data importer by contract or by operation of law. Such third-party liability of the sub-processor shall be limited to its own processing operations under the Clauses. 11.3 The provisions relating to data protection aspects for sub-processing of the contract referred to in paragraph 1 shall be governed by the law of the Member State in which the data exporter is established, namely ......................................... 11.4 The data exporter shall keep a list of sub-processing agreements concluded under the Clauses and notified by the data importer pursuant to Clause clause 5(j), which shall be updated at least once a year. The list shall be available to the data exporter’s 's data protection supervisory authority.

Sub-processing. 11.1 (a) The data importer shall not subcontract any of its processing Processing operations performed on behalf of the data exporter under the Clauses Sections without the prior written consent of the data exporter. Where the data importer subcontracts its obligations under the ClausesSections, with the consent of the data exporter, it shall do so only by way of a written agreement with the sub-processor which imposes the same obligations on the sub- sub-processor as are imposed on the data importer under the ClausesSections. Where the sub-processor fails to fulfil fulfill its data protection obligations under such written agreement the data importer shall remain fully liable to the data exporter for the performance of the sub-processor’s obligations under such agreement. 11.2 (b) The prior written contract between the data importer and the sub-processor shall also provide for a third-third party beneficiary clause Section as laid down in Clause Section 3 for cases where the data subject is not able to bring the claim for compensation referred to in paragraph 1 (a) of Clause Section 6 against the data exporter or the data importer because they have factually disappeared or have ceased to exist in law or have become insolvent and no successor entity has assumed the entire legal obligations of the data exporter or data importer by contract or by operation of law. Such third-party liability of the sub-processor shall be limited to its own processing Processing operations under the ClausesSections. 11.3 (c) The provisions relating to data protection aspects for sub-processing Processing of the contract referred to in paragraph 1 shall be governed by the law of the Member State in which the data exporter is established, namely ......................................... 11.4 (d) The data exporter shall keep a list of sub-processing Processing agreements concluded under the Clauses Sections and notified by the data importer pursuant to Clause 5(j)Section 5(a)x, which shall be updated at least once a year. The list shall be available to the data exporter’s 's data protection supervisory authority.

Sub-processing. 11.1 The data importer shall not subcontract any of its processing operations performed on behalf of the data exporter under the Clauses without the prior written consent of the data exporter. Where the data importer subcontracts its obligations under the Clauses, with the consent of the data exporter, it shall do so only by way of a written agreement with the sub-processor which imposes the same obligations on the sub- processor as are imposed on the data importer under the Clauses. Where the sub-processor fails to fulfil fulfill its data protection obligations under such written agreement the data importer shall remain fully liable to the data exporter for the performance of the sub-processor’s obligations under such agreement. 11.2 The prior written contract between the data importer and the sub-processor shall also provide for a third-third- party beneficiary clause as laid down in Clause 3 for cases where the data subject is not able to bring the claim for compensation referred to in paragraph 1 of Clause 6 against the data exporter or the data importer because they have factually disappeared or have ceased to exist in law or have become insolvent and no successor entity has assumed the entire legal obligations of the data exporter or data importer by contract or by operation of law. Such third-party liability of the sub-processor shall be limited to its own processing operations under the Clauses. 11.3 The provisions relating to data protection aspects for sub-processing of the contract referred to in paragraph 1 shall be governed by the law of the Member State in which the data exporter is established, namely ........................................Delaware. 11.4 The data exporter shall keep a list of sub-processing agreements concluded under the Clauses and notified by the data importer pursuant to Clause 5(j5.1(j), which shall be updated at least once a year. The list shall be available to the data exporter’s 's data protection supervisory authority.

Sub-processing. 11.1 The data importer shall not subcontract any of its processing operations performed on behalf of the data exporter under the Clauses without the prior written consent of the data exporter. Where the data importer subcontracts its obligations under the Clauses, with the consent of the data exporter, it shall do so only by way of a written agreement with the sub-processor which imposes the same obligations on the sub- sub-processor as are imposed on the data importer under the Clauses. Where the sub-processor fails to fulfil its data protection obligations under such written agreement the data importer shall remain fully liable to the data exporter for the performance of the sub-sub- processor’s obligations under such agreement. 11.2 The prior written contract between the data importer and the sub-processor shall also provide for a third-party beneficiary clause as laid down in Clause 3 for cases where the data subject is not able to bring the claim for compensation referred to in paragraph 1 of Clause 6 against the data exporter or the data importer because they have factually disappeared or have ceased to exist in law or have become insolvent and no successor entity has assumed the entire legal obligations of the data exporter or data importer by contract or by operation of law. Such third-party liability of the sub-processor shall be limited to its own processing operations under the Clauses. 11.3 The provisions relating to data protection aspects for sub-processing of the contract referred to in paragraph 1 shall be governed by the law of the Member State in which the data exporter is established, namely ........................................the 11.4 The data exporter shall keep a list of sub-processing agreements concluded under the Clauses and notified by the data importer pursuant to Clause 5(j), which shall be updated at least once a year. The list shall be available to the data exporter’s data protection supervisory authority.

Sub-processing. 11.1 The data importer shall not subcontract any of its processing operations performed on behalf of the data exporter under the Clauses without the prior written consent of the data exporter. Where the data importer subcontracts its obligations under the Clauses, with the consent of the data exporter, it shall do so only by way of a written agreement with the sub-processor which imposes the same obligations on the sub- sub-processor as are imposed on the data importer under the Clauses. Where the sub-processor fails to fulfil its data protection obligations under such written agreement the data importer shall remain fully liable to the data exporter for the performance of the sub-processor’s obligations under such agreement. 11.2 The prior written contract between the data importer and the sub-processor shall also provide for a third-party beneficiary clause as laid down in Clause 3 for cases where the data subject is not able to bring the claim for compensation referred to in paragraph 1 of Clause 6 against the data exporter or the data importer because they have factually disappeared or have ceased to exist in law or have become insolvent and no successor entity has assumed the entire legal obligations of the data exporter or data importer by contract or by operation of law. Such third-party liability of the sub-processor shall be limited to its own processing operations under the Clauses. 11.3 The provisions relating to data protection aspects for sub-processing of the contract referred to in paragraph 1 shall be governed by the law of the Member State in which the data exporter is established, namely ................................................................................... 11.4 The data exporter shall keep a list of sub-processing agreements concluded under the Clauses and notified by the data importer pursuant to Clause 5(j), which shall be updated at least once a year. The list shall be available to the data exporter’s data protection supervisory authority.

Sub-processing. 11.1 The data importer shall not subcontract any of its processing operations performed on behalf of the data exporter under the Clauses without the prior written consent of the data exporter. Where the data importer subcontracts its obligations under the Clauses, with the consent of the data exporter, it shall do so only by way of a written agreement with the sub-processor which imposes the same obligations on the sub- sub-processor as are imposed on the data importer under the Clauses. Where the sub-sub- processor fails to fulfil its data protection obligations under such written agreement the data importer shall remain fully liable to the data exporter for the performance of the sub-processor’s obligations under such agreement. 11.2 The prior written contract between the data importer and the sub-processor shall also provide for a third-party beneficiary clause as laid down in Clause 3 for cases where the data subject is not able to bring the claim for compensation referred to in paragraph 1 of Clause 6 against the data exporter or the data importer because they have factually disappeared or have ceased to exist in law or have become insolvent and no successor entity has assumed the entire legal obligations of the data exporter or data importer by contract or by operation of law. Such third-party liability of the sub-sub- processor shall be limited to its own processing operations under the Clauses. 11.3 The provisions relating to data protection aspects for sub-processing of the contract referred to in paragraph 1 shall be governed by the law of the Member State in which the data exporter is established, namely ........................................England and Wales. 11.4 The data exporter shall keep a list of sub-processing agreements concluded under the Clauses and notified by the data importer pursuant to Clause 5(j5.1(j), which shall be updated at least once a year. The list shall be available to the data exporter’s 's data protection supervisory authority.

Sub-processing. 11.1 The data importer shall not subcontract any of its processing operations performed on behalf of the data exporter under the Clauses without the prior written consent of the data exporter. Where the data importer subcontracts its obligations under the Clauses, with the consent of the data exporter, it shall do so only by way of a written agreement with the sub-processor which imposes the same obligations on the sub- sub-processor as are imposed on the data importer under the Clauses. Where the sub-processor fails to fulfil its data protection obligations under such written agreement the data importer shall remain fully liable to the data exporter for the performance of the sub-processor’s obligations under such agreement. 11.2 The prior written contract between the data importer and the sub-processor shall also provide for a third-party beneficiary clause as laid down in Clause 3 for cases where the data subject is not able to bring the claim for compensation referred to in paragraph 1 of Clause 6 against the data exporter or the data importer because they have factually disappeared or have ceased to exist in law or have become insolvent and no successor entity has assumed the entire legal obligations of the data exporter or data importer by contract or by operation of law. Such third-third- party liability of the sub-processor shall be limited to its own processing operations under the Clauses. 11.3 The provisions relating to data protection aspects for sub-processing of the contract referred to in paragraph 1 shall be governed by the law of the Member State in which the data exporter is established, namely ........................................Germany. 11.4 The data exporter shall keep a list of sub-processing agreements concluded under the Clauses and notified by the data importer pursuant to Clause 5(j), which shall be updated at least once a year. The list shall be available to the data exporter’s data protection supervisory authority.

Sub-processing. 11.1 The data importer shall not subcontract any of its processing operations performed on behalf of the data exporter under the Clauses without the prior written consent of the data exporter. Where the data importer subcontracts its obligations under the Clauses, with the consent of the data exporter, it shall do so only by way of a written agreement with the sub-processor which imposes the same obligations on the sub- sub-processor as are imposed on the data importer under the Clauses. Where the sub-processor fails to fulfil its data protection obligations under such written agreement the data importer shall remain fully liable to the data exporter for the performance of the sub-sub- processor’s 's obligations under such agreement. 11.2 The prior written contract between the data importer and the sub-processor shall also provide for a third-party beneficiary clause as laid down in Clause 3 for cases where the data subject is not able to bring the claim for compensation referred to in paragraph 1 of Clause 6 6.1 against the data exporter or the data importer because they have factually disappeared or have ceased to exist in law or have become insolvent and no successor entity has assumed the entire legal obligations of the data exporter or data importer by contract or by operation of law. Such third-party liability of the sub-processor shall be limited to its own processing operations under the Clauses. 11.3 The provisions relating to data protection aspects for sub-processing of the contract referred to in paragraph 1 11.1 shall be governed by the law of the Member State in which the data exporter is established, namely ......................................... 11.4 The data exporter shall keep a list of sub-processing agreements concluded under the Clauses and notified by the data importer pursuant to Clause 5(j), which shall be updated at least once a year. The list shall be available to the data exporter’s 's data protection supervisory authority.

Sub-processing. 11.1 11.1. The data importer shall not subcontract any of its processing operations performed on behalf of the data exporter under the Clauses without the prior written consent of the data exporter. Where the data importer subcontracts its obligations under the Clauses, with the consent of the data exporter, it shall do so only by way of a written agreement with the sub-processor which imposes the same obligations on the sub- sub-processor as are imposed on the data importer under the Clauses. Where the sub-processor fails to fulfil its data protection obligations under such written agreement the data importer shall remain fully liable to the data exporter for the performance of the sub-processor’s obligations under such agreement. 11.2 11.2. The prior written contract between the data importer and the sub-processor shall also provide for a third-party beneficiary clause as laid down in Clause 3 for cases where the data subject is not able to bring the claim for compensation referred to in paragraph 1 of Clause 6 against the data exporter or the data importer because they have factually disappeared or have ceased to exist in law or have become insolvent and no successor entity has assumed the entire legal obligations of the data exporter or data importer by contract or by operation of law. Such third-party liability of the sub-processor shall be limited to its own processing operations under the Clauses. 11.3 11.3. The provisions relating to data protection aspects for sub-processing of the contract referred to in paragraph 1 shall be governed by the law laws of the Member State in which where the data exporter is established, namely ......................................... 11.4 11.4. The data exporter shall keep a list of sub-processing agreements concluded under the Clauses and notified by the data importer pursuant to Clause 5(j5.1(j), which shall be updated at least once a year. The list shall be available to the data exporter’s 's data protection supervisory authority.

Sub-processing. 11.1 The data importer shall not subcontract any of its processing operations performed on behalf of the data exporter under the Clauses without the prior written consent of the data exporter. Where the data importer subcontracts its obligations under the Clauses, with the consent of the data exporter, it shall do so only by way of a written agreement with the sub-processor which imposes the same obligations on the sub- sub-processor as are imposed on the data importer under the Clauses. Where the sub-processor fails to fulfil its data protection obligations under such written agreement the data importer shall remain fully liable to the data exporter for the performance of the sub-processor’s 's obligations under such agreement. 11.2 The prior written contract between the data importer and the sub-processor shall also provide for a third-party beneficiary clause as laid down in Clause clause 3 for cases where the data subject is not able to bring the claim for compensation referred to in paragraph 1 of Clause clause 6 against the data exporter or the data importer because they have factually disappeared or have ceased to exist in law or have become insolvent and no successor entity has assumed the entire legal obligations of the data exporter or data importer by contract or by operation of law. Such third-party liability of the sub-processor shall be limited to its own processing operations under the Clauses. 11.3 The provisions relating to data protection aspects for sub-processing of the contract referred to in paragraph 1 shall be governed by the law of the Member State in which the data exporter is established, namely ......................................... 11.4 The data exporter shall keep a list of sub-processing agreements concluded under the Clauses and notified by the data importer pursuant to Clause clause 5(j), which shall be updated at least once a year. The list shall be available to the data exporter’s 's data protection supervisory authority.

Sub-processing. 11.1 The data importer shall not subcontract any of its processing operations performed on behalf of the data exporter under the Clauses without the prior written consent of the data exporter. Where the data importer subcontracts its obligations under the Clauses, with the consent of the data exporter, it shall do so only by way of a written agreement with the sub-processor which imposes the same obligations on the sub- sub-processor as are imposed on the data importer under the Clauses. Where the sub-processor fails to fulfil fulfill its data protection obligations under such written agreement the data importer shall remain fully liable to the data exporter for the performance of the sub-processor’s obligations under such agreement. 11.2 The prior written contract between the data importer and the sub-processor shall also provide for a third-third- party beneficiary clause as laid down in Clause 3 for cases where the data subject is not able to bring the claim for compensation referred to in paragraph 1 of Clause 6 against the data exporter or the data importer because they have factually disappeared or have ceased to exist in law or have become insolvent and no successor entity has assumed the entire legal obligations of the data exporter or data importer by contract or by operation of law. Such third-party liability of the sub-processor shall be limited to its own processing operations under the Clauses. 11.3 The provisions relating to data protection aspects for sub-processing of the contract referred to in paragraph 1 shall be governed by the law of the Member State in which the data exporter is established, namely ........................................England and Wales. 11.4 The data exporter shall keep a list of sub-processing agreements concluded under the Clauses and notified by the data importer pursuant to Clause 5(j5.1(j), which shall be updated at least once a year. The list shall be available to the data exporter’s 's data protection supervisory authority.

Sub-processing. 11.1 The data importer shall not subcontract any of its processing operations performed on behalf of the data exporter under the Clauses without the prior written consent of the data exporter. Where the data importer subcontracts its obligations under the Clauses, with the consent of the data exporter, it shall do so only by way of a written agreement with the sub-processor which imposes the same obligations on the sub- sub-processor as are imposed on the data importer under the Clauses. Where the sub-processor fails to fulfil its data protection obligations under such written agreement the data importer shall remain fully liable to the data exporter for the performance of the sub-processor’s 's obligations under such agreement. 11.2 The prior written contract between the data importer and the sub-processor shall also provide for a third-party beneficiary clause as laid down in Clause clause 3 for cases where the data subject is not able to bring the claim for compensation referred to in paragraph 1 of Clause 6 clause 6.1 against the data exporter or the data importer because they have factually disappeared or have ceased to exist in law or have become insolvent and no successor entity has assumed the entire legal obligations of the data exporter or data importer by contract or by operation of law. Such third-third- party liability of the sub-processor shall be limited to its own processing operations under the Clauses. 11.3 The provisions relating to data protection aspects for sub-processing of the contract referred to in paragraph 1 clause 11.1 shall be governed by the law of the Member State in which the data exporter is established, namely ......................................... 11.4 The data exporter shall keep a list of sub-processing agreements concluded under the Clauses and notified by the data importer pursuant to Clause clause 5(j), which shall be updated at least once a year. The list shall be available to the data exporter’s 's data protection supervisory authority.

Sub-processing. ‌ 11.1 The data importer shall not subcontract any of its processing operations performed on behalf of the data exporter under the Clauses without the prior written consent of the data exporter. Where the data importer subcontracts its obligations under the Clauses, with the consent of the data exporter, it shall do so only by way of a written agreement with the sub-processor which imposes the same obligations on the sub- sub-processor as are imposed on the data importer under the Clauses. Where the sub-processor fails to fulfil its data protection obligations under such written agreement the data importer shall remain fully liable to the data exporter for the performance of the sub-processor’s 's obligations under such agreement. 11.2 The prior written contract between the data importer and the sub-processor shall also provide for a third-party beneficiary clause as laid down in Clause clause 3 for cases where the data subject is not able to bring the claim for compensation referred to in paragraph 1 of Clause clause 6 against the data exporter or the data importer because they have factually disappeared or have ceased to exist in law or have become insolvent and no successor entity has assumed the entire legal obligations of the data exporter or data importer by contract or by operation of law. Such third-party liability of the sub-processor shall be limited to its own processing operations under the Clauses. 11.3 The provisions relating to data protection aspects for sub-processing of the contract referred to in paragraph 1 shall be governed by the law of the Member State in which the data exporter is established, namely ........................................that Member State listed below in respect of each data exporter. 11.4 The data exporter shall keep a list of sub-processing agreements concluded under the Clauses and notified by the data importer pursuant to Clause clause 5(j), which shall be updated at least once a year. The list shall be available to the data exporter’s 's data protection supervisory authority.

Sub-processing. 11.1 The data importer shall not subcontract any of its processing operations performed on behalf of the data exporter under the Clauses without the prior written consent of the data exporter. Where the data importer subcontracts its obligations under the Clauses, with the consent of the data exporter, it shall do so only by way of a written agreement with the sub-sub- processor which imposes the same obligations on the sub- sub-processor as are imposed on the data importer under the Clauses. Where the sub-processor fails to fulfil fulfill its data protection obligations under such written agreement the data importer shall remain fully liable to the data exporter for the performance of the sub-processor’s obligations under such agreement. 11.2 The prior written contract between the data importer and the sub-processor shall also provide for a third-third party beneficiary clause as laid down in Clause 3 for cases where the data subject is not able to bring the claim for compensation referred to in paragraph 1 of Clause 6 against the data exporter or the data importer because they have factually disappeared or have ceased to exist in law or have become insolvent and no successor entity has assumed the entire legal obligations of the data exporter or data importer by contract or by operation of law. Such third-party liability of the sub-processor shall be limited to its own processing operations under the Clauses. 11.3 The provisions relating to data protection aspects for sub-processing of the contract referred to in paragraph 1 shall be governed by the law of the Member State in which the data exporter is established, namely ......................................... 11.4 The data exporter shall keep a list of sub-processing agreements concluded under the Clauses and notified by the data importer pursuant to Clause 5(j5.1(j), which shall be updated at least once a year. The list shall be available to the data exporter’s data protection supervisory authority.

Sub-processing. 11.1 The data importer shall not subcontract any of its processing operations performed on behalf of the data exporter under the Clauses without the prior written consent of the data exporter. Where the data importer subcontracts its obligations under the Clauses, with the consent of the data exporter, it shall do so only by way of a written agreement with the sub-processor which imposes the same obligations on the sub- sub-processor as are imposed on the data importer under the Clauses. Where the sub-processor fails to fulfil fulfil its data protection obligations under such written agreement the data importer shall remain fully liable to the data exporter for the performance of the sub-processor’s 's obligations under such agreement. 11.2 The prior written contract between the data importer and the sub-processor shall also provide for a third-party beneficiary beneficiary clause as laid down in Clause 3 for cases where the data subject is not able to bring the claim for compensation referred to in paragraph 1 of Clause 6 against the data exporter or the data importer because they have factually disappeared or have ceased to exist in law or have become insolvent and no successor entity has assumed the entire legal obligations of the data exporter or data importer by contract or by operation of law. Such third-party liability of the sub-processor shall be limited to its own processing operations under the Clauses. 11.3 The provisions relating to data protection aspects for sub-processing of the contract referred to in paragraph 1 shall be governed by the law of the Member State in which the data exporter is established, namely ......................................... 11.4 The data exporter shall keep a list of sub-processing agreements concluded under the Clauses and notified notified by the data importer pursuant to Clause 5(j5 (j), which shall be updated at least once a year. The list shall be available to the data exporter’s 's data protection supervisory authority.

Sub-processing. 11.1 The data importer shall not subcontract any of its processing operations performed on behalf of the data exporter under the Clauses without the prior written consent of the data exporter. Where the data importer subcontracts its obligations under the Clauses, with the consent of the data exporter, it shall do so only by way of a written agreement with the sub-processor which imposes the same obligations on the sub- sub-processor as are imposed on the data importer under the Clauses. Where the sub-processor fails to fulfil fulfill its data protection obligations under such written agreement the data importer shall remain fully liable to the data exporter for the performance of the sub-processor’s obligations under such agreement. 11.2 The prior written contract between the data importer and the sub-processor shall also provide for a third-party beneficiary clause as laid down in Clause 3 for cases where the data subject is not able to bring the claim for compensation referred to in paragraph 1 of Clause 6 against the data exporter or the data importer because they have factually disappeared or have ceased to exist in law or have become insolvent and no successor entity has assumed the entire legal obligations of the data exporter or data importer by contract or by operation of law. Such third-party liability of the sub-processor shall be limited to its own processing operations under the Clauses. 11.3 The provisions relating to data protection aspects for sub-processing of the contract referred to in paragraph 1 shall be governed by the law of the Member State in which the data exporter is established, namely ......................................... 11.4 The data exporter shall keep a list of sub-processing agreements concluded under the Clauses and notified by the data importer pursuant to Clause 5(j5.1(j), which shall be updated at least once a year. The list shall be available to the data exporter’s 's data protection supervisory authority.

Sub-processing. 11.1 11.1. The data importer shall Data Importer will not subcontract any of its processing Processing operations performed on behalf of the data exporter under the Clauses Data Exporter without the prior written consent of the data exporterData Exporter. Where the data importer Data Importer subcontracts its obligations under the Clausesthis Appendix, with the consent of the data exporterData Exporter, it shall will do so only by way of a written agreement with the subSub-processor Processor which imposes the same obligations on the sub- processor Sub-Processor as are imposed on the data importer Data Importer under the Clausesthis Appendix. Where the sub-processor Sub- Processor fails to fulfil its data protection obligations under such written agreement the data importer shall Data Importer will remain fully liable to the data exporter Data Exporter for the performance of the sub-processorSub- Processor’s obligations under such agreement. 11.2 11.2. The prior written contract between the data importer Data Importer and the subSub-processor shall Processor will also provide for a third-party beneficiary clause as laid down in Clause Section 3 for cases where the data subject Data Subject is not able to bring the claim for compensation referred to in paragraph 1 of Clause Section 6 against the data exporter Data Exporter or the data importer Data Importer because they have factually disappeared or have ceased to exist in law or have become insolvent and no successor entity has assumed the entire legal obligations of the data exporter Data Exporter or data importer Data Importer by contract or by operation of law. Such third-party liability of the subSub-processor shall Processor will be limited to its own processing operations under the ClausesProcessing operations. 11.3 11.3. The provisions relating to data protection aspects for sub-processing Processing of the contract referred to in paragraph 1 shall will be governed by the law of the Member State in which the data exporter Data Exporter is established, namely ......................................... 11.4 11.4. The data exporter shall Data Exporter will keep a list of sub-processing sub- Processing agreements concluded under the Clauses this Appendix and notified by the data importer Data Importer pursuant to Clause Section 5(j), which shall will be updated at least once a year. The list shall will be available to the data exporterData Exporter’s data protection supervisory authority.Supervisory Authority

Sub-processing. 11.1 1. The data importer shall not subcontract any of its processing operations performed on behalf of the data exporter under the Clauses without the prior written consent of the data exporter. Where the data importer subcontracts its obligations under the Clauses, with the consent of the data exporter, it shall do so only by way of a written agreement with the sub-processor which imposes the same obligations on the sub- sub-processor as are imposed on the data importer under the ClausesClauses (1). Where the sub-sub- processor fails to fulfil its data protection obligations under such written agreement the data importer shall remain fully liable to the data exporter for the performance of the sub-processor’s obligations under such agreement. 11.2 2. The prior written contract between the data importer and the sub-processor shall also provide for a third-third- party beneficiary clause as laid down in Clause 3 for cases where the data subject is not able to bring the claim for compensation referred to in paragraph 1 of Clause 6 against the data exporter or the data importer because they have factually disappeared or have ceased to exist in law or have become insolvent and no successor entity has assumed the entire legal obligations of the data exporter or data importer by contract or by operation of law. Such third-party liability of the sub-processor shall be limited to its own processing operations under the Clauses. 11.3 3. The provisions relating to data protection aspects for sub-processing of the contract referred to in paragraph 1 shall be governed by the law of the Member State in which the data exporter is established, namely ......................................... 11.4 4. The data exporter shall keep a list of sub-processing agreements concluded under the Clauses and notified by the data importer pursuant to Clause 5(j), which shall be updated at least once a year. The list shall be available to the data exporter’s data protection supervisory authority.

Sub-processing. 11.1 The data importer shall not subcontract any of its processing operations performed on behalf of the data exporter under the Clauses without the prior written consent of the data exporter. Where the data importer subcontracts its obligations under the Clauses, with the consent of the data exporter, it shall do so only by way of a written agreement with the sub-processor which imposes the same obligations on the sub- sub-processor as are imposed on the data importer under the Clauses. Where the sub-processor fails to fulfil its data protection obligations under such written agreement the data importer shall remain fully liable to the data exporter for the performance of the sub-processor’s 's obligations under such agreement. 11.2 The prior written contract between the data importer and the sub-processor shall also provide for a third-party beneficiary clause as laid down in Clause clause 3 for cases where the data subject is not able to bring the claim for compensation referred to in paragraph 1 of Clause 6 clause 6.1 against the data exporter or the data importer because they have factually disappeared or have ceased to exist in law or have become insolvent and no successor entity has assumed the entire legal obligations of the data exporter or data importer by contract or by operation of law. Such third-party liability of the sub-processor shall be limited to its own processing operations under the Clauses. 11.3 The provisions relating to data protection aspects for sub-processing of the contract referred to in paragraph 1 clause 6.1 shall be governed by the law of the Member State in which the data exporter is established, namely ......................................... 11.4 The data exporter shall keep a list of sub-processing agreements concluded under the Clauses and notified by the data importer pursuant to Clause clause 5(j), which shall be updated at least once a year. The list shall be available to the data exporter’s 's data protection supervisory authority.

Sub-processing. 11.1 The data importer shall not subcontract any of its processing operations performed on behalf of the data exporter under the Clauses without the prior written consent of the data exporter. Where the data importer subcontracts its obligations under the Clauses, with the consent of the data exporter, it shall do so only by way of a written agreement with the sub-processor which imposes the same obligations on the sub- sub-processor as are imposed on the data importer under the Clauses. Where the sub-processor fails to fulfil fulfill its data protection obligations under such written agreement the data importer shall remain fully liable to the data exporter for the performance of the sub-processor’s obligations under such agreement. 11.2 The prior written contract between the data importer and the sub-processor shall also provide for a third-party beneficiary clause as laid down in Clause 3 for cases where the data subject is not able to bring the claim for compensation referred to in paragraph 1 of Clause 6 against the data exporter or the data importer because they have factually disappeared or have ceased to exist in law or have become insolvent and no successor entity has assumed the entire legal obligations of the data exporter or data importer by contract or by operation of law. Such third-party liability of the sub-processor shall be limited to its own processing operations under the Clauses. 11.3 The provisions relating to data protection aspects for sub-processing of the contract referred to in paragraph 1 shall be governed by the law of the Member State in which the data exporter is established, namely ........................................England and Wales. 11.4 The data exporter shall keep a list of sub-processing agreements concluded under the Clauses and notified by the data importer pursuant to Clause 5(j5.1(j), which shall be updated at least once a year. The list shall be available to the data exporter’s 's data protection supervisory authority.

Sub-processing. 11.1 The data importer shall not subcontract any of its processing operations performed on behalf of the data exporter under the Clauses without the prior written consent of the data exporter. Where the data importer subcontracts its obligations under the Clauses, with the consent of the data exporter, it shall do so only by way of a written agreement with the sub-processor which imposes the same obligations on the sub- sub-processor as are imposed on the data importer under the Clauses. Where the sub-processor fails to fulfil its data protection obligations under such written agreement the data importer shall remain fully liable to the data exporter for the performance of the sub-processor’s obligations under such agreement. 11.2 The prior written contract between the data importer and the sub-processor shall also provide for a third-party beneficiary clause as laid down in Clause 3 for cases where the data subject is not able to bring the claim for compensation referred to in paragraph 1 of Clause 6 against the data exporter or the data importer because they have factually disappeared or have ceased to exist in law or have become insolvent and no successor entity has assumed the entire legal obligations of the data exporter or data importer by contract or by operation of law. Such third-party liability of the sub-processor shall be limited to its own processing operations under the Clauses. 11.3 The provisions relating to data protection aspects for sub-processing of the contract referred to in paragraph 1 shall be governed by the law of the Member State in which the data exporter is established, namely ......................................... 11.4 The data exporter shall keep a list of sub-processing agreements concluded under the Clauses and notified by the data importer pursuant to Clause 5(j), which shall be updated at least once a year. The list shall be available to the data exporter’s data protection supervisory authority.

Sub-processing. 11.1 The data importer shall not subcontract any of its processing operations performed on behalf of the data exporter under the Clauses without the prior written consent of the data exporter. Where the data importer subcontracts its obligations under the Clauses, with the consent of the data exporter, it shall do so only by way of a written agreement with the sub-processor which imposes the same obligations on the sub- sub-processor as are imposed on the data importer under the Clauses. Where the sub-processor fails to fulfil its data protection obligations under such written agreement the data importer shall remain fully liable to the data exporter for the performance of the sub-processor’s obligations under such agreement. 11.2 The prior written contract between the data importer and the sub-processor shall also provide for a third-third- party beneficiary clause as laid down in Clause 3 for cases where the data subject is not able to bring the claim for compensation referred to in paragraph 1 of Clause 6 against the data exporter or the data importer because they have factually disappeared or have ceased to exist in law or have become insolvent and no successor entity has assumed the entire legal obligations of the data exporter or data importer by contract or by operation of law. Such third-party liability of the sub-processor shall be limited to its own processing operations under the Clauses. 11.3 The provisions relating to data protection aspects for sub-processing of the contract referred to in paragraph 1 shall be governed by the law of the Member State in which the data exporter is established, namely ........................................England and Wales. 11.4 The data exporter shall keep a list of sub-processing agreements concluded under the Clauses and notified by the data importer pursuant to Clause 5(j5.1(j), which shall be updated at least once a year. The list shall be available to the data exporter’s 's data protection supervisory authority.

Sub-processing. 11.1 The data importer shall not subcontract any of its processing operations performed on behalf of the data exporter under the Clauses without the prior written consent of the data exporter. Where the data importer subcontracts its obligations under the Clauses, with the consent of the data exporter, it shall do so only by way of a written agreement with the sub-processor which imposes the same obligations on the sub- sub-processor as are imposed on the data importer under the Clauses. Where the sub-processor fails to fulfil fulfill its data protection obligations under such written agreement the data importer shall remain fully liable to the data exporter for the performance of the sub-processor’s obligations under such agreement. 11.2 The prior written contract between the data importer and the sub-processor shall also provide for a third-third party beneficiary clause as laid down in Clause 3 for cases where the data subject is not able to bring the claim for compensation referred to in paragraph 1 of Clause 6 against the data exporter or the data importer because they have factually disappeared or have ceased to exist in law or have become insolvent and no successor entity has assumed the entire legal obligations of the data exporter or data importer by contract or by operation of law. Such third-party liability of the sub-processor shall be limited to its own processing operations under the Clauses. 11.3 The provisions relating to data protection aspects for sub-processing of the contract referred to in paragraph 1 shall be governed by the law of the Member State in which the data exporter is established, namely ......................................... 11.4 The data exporter shall keep a list of sub-processing agreements concluded under the Clauses and notified by the data importer pursuant to Clause 5(j5.1(j), which shall be updated at least once a year. The list shall be available to the data exporter’s data protection supervisory authority.

Sub-processing. 11.1 1. The data importer Data Importer shall not subcontract any of its processing operations performed on behalf of the data exporter Data Exporter under the Clauses without the prior written consent of the data exporterData Exporter. Where the data importer Data Importer subcontracts its obligations under the Clauses, with the consent of the data exporterData Exporter, it shall do so only by way of a written agreement with the subSub-processor which imposes the same obligations on the sub- Sub-processor as are imposed on the data importer Data Importer under the Clauses. Where the subSub-processor fails to fulfil its data protection obligations under such written agreement the data importer Data Importer shall remain fully liable to the data exporter Data Exporter for the performance of the subSub-processor’s 's obligations under such agreement. 11.2 2. The prior written contract between the data importer Data Importer and the subSub-processor shall also provide for a third-party beneficiary clause as laid down in Clause clause 3 for cases where the data subject Data Subject is not able to bring the claim for compensation referred to in paragraph 1 of Clause clause 6 against the data exporter Data Exporter or the data importer Data Importer because they have factually disappeared or have ceased to exist in law or have become insolvent and no successor entity has assumed the entire legal obligations of the data exporter Data Exporter or data importer Data Importer by contract or by operation of law. Such third-party liability of the subSub-processor shall be limited to its own processing operations relating to the Processing conducted under the Clauses. 11.3 3. The provisions relating to data protection aspects for sub-processing of the contract referred to in paragraph 1 shall be governed by the law of the Member State in which the data exporter is established, namely ........................................DIFC. 11.4 4. The data exporter Data Exporter shall keep a list of sub-processing agreements concluded as applicable to Processing carried out under the Clauses and notified by the data importer Data Importer pursuant to Clause 5(j5(1)(j), which shall be updated at least once a year. The list shall be available to the data exporter’s Data Exporter's data protection supervisory authority.

Sub-processing. 11.1 The data importer shall not subcontract any of its processing operations performed on behalf of the data exporter under the Clauses without the prior written consent of the data exporter. Where the data importer subcontracts its obligations under the Clauses, with the consent of the data exporter, it shall do so only by way of a written agreement with the sub-processor which imposes the same obligations on the sub- sub-processor as are imposed on the data importer under the Clauses. Where the sub-processor fails to fulfil its data protection obligations under such written agreement the data importer shall remain fully liable to the data exporter for the performance of the sub-processor’s obligations under such agreement. 11.2 The prior written contract between the data importer and the sub-processor shall also provide for a third-party beneficiary clause as laid down in Clause 3 for cases where the data subject is not able to bring the claim for compensation referred to in paragraph 1 of Clause 6 6.1 against the data exporter or the data importer because they have factually disappeared or have ceased to exist in law or have become insolvent and no successor entity has assumed the entire legal obligations of the data exporter or data importer by contract or by operation of law. Such third-party liability of the sub-processor shall be limited to its own processing operations under the Clauses. 11.3 The provisions relating to data protection aspects for sub-processing of the contract referred to in paragraph 1 Clause 11.1 shall be governed by the law of the Member State in which the data exporter is established, namely ......................................... 11.4 The data exporter shall keep a list of sub-processing agreements concluded under the Clauses and notified by the data importer pursuant to Clause 5(j)5.10, which shall be updated at least once a year. The list shall be available to the data exporter’s data protection supervisory authority.

Sub-processing. 11.1 The data importer shall not subcontract any of its processing operations performed on behalf of the data exporter under the Clauses without the prior written consent of the data exporter. Where the data importer subcontracts its obligations under the Clauses, with the consent of the data exporter, it shall do so only by way of a written agreement with the sub-processor which imposes the same obligations on the sub- sub-processor as are imposed on the data importer under the Clauses. Where the sub-processor fails to fulfil its data protection obligations under such written agreement the data importer shall remain fully liable to the data exporter for the performance of the sub-processor’s 's obligations under such agreement. 11.2 The prior written contract between the data importer and the sub-processor shall also provide for a third-party beneficiary clause as laid down in Clause 3 for cases where the data subject is not able to bring the claim for compensation referred to in paragraph 1 of Clause 6 6.1 against the data exporter or the data importer because they have factually disappeared or have ceased to exist in law or have become insolvent and no successor entity has assumed the entire legal obligations of the data exporter or data importer by contract or by operation of law. Such third-party liability of the sub-processor shall be limited to its own processing operations under the Clauses. 11.3 The provisions relating to data protection aspects for sub-processing of the contract referred to in paragraph 1 Clause 11.1 shall be governed by the law of the Member State in which the data exporter is established, namely ......................................... 11.4 The data exporter shall keep a list of sub-processing agreements concluded under the Clauses and notified by the data importer pursuant to Clause 5(j), which shall be updated at least once a year. The list shall be available to the data exporter’s 's data protection supervisory authority.

Sub-processing. 11.1 The data importer shall not subcontract any of its processing operations performed on behalf of the data exporter under the Clauses without the prior written consent of the data exporter. Where the data importer subcontracts its obligations under the Clauses, with the consent of the data exporter, it shall do so only by way of a written agreement with the sub-processor which imposes the same obligations on the sub- sub-processor as are imposed on the data importer under the Clauses. Where the sub-processor fails to fulfil fulfill its data protection obligations under such written agreement the data importer shall remain fully liable to the data exporter for the performance of the sub-processor’s obligations under such agreement. 11.2 The prior written contract between the data importer and the sub-processor shall also provide for a third-party beneficiary clause as laid down in Clause 3 for cases where the data subject is not able to bring the claim for compensation referred to in paragraph 1 of Clause 6 against the data exporter or the data importer because they have factually disappeared or have ceased to exist in law or have become insolvent and no successor entity has assumed the entire legal obligations of the data exporter or data importer by contract or by operation of law. Such third-party liability of the sub-processor shall be limited to its own processing operations under the Clauses. 11.3 The provisions relating to data protection aspects for sub-processing of the contract referred to in paragraph 1 shall be governed by the law of England and Wales. 00000 xx 0xx, xxxxxxxx, xx This Appendix forms part of the Clauses and must be completed and signed by the parties The Member State States may complete or specify, according to their national procedures, any additional necessary information to be contained in which the this Appendix The data exporter is established, namely ........................................ 11.4 The data exporter shall keep a list of sub-processing agreements concluded under (please specify briefly your activities relevant to the Clauses and notified by the data importer pursuant to Clause 5(j), which shall be updated at least once a year. The list shall be available transfer): An entity that has subscribed to the data importer’s online user authentication and user management platform-as-a-service solution. The data importer is (please specify briefly activities relevant to the transfer): A US company providing an online user authentication and user management platform-as-a-service solution in relation to users of websites, apps and other online properties. The personal data transferred concern the following categories of data subjects (please specify): End users, or those purporting to be end users, of the data exporter's websites, apps or other online properties, or other data subjects with respect to whom Customer elects to collect their personal data, and the data exporter’s, its affiliates, and its and their service providers’, employees, consultants, agents and representatives authorized by data exporter to use the data importer’s services. The personal data protection supervisory authority.transferred concern the following categories of data (please specify): Email addresses, phone numbers or IP addresses, depending on the authentication method selected by data exporter, and such other personal data as data exporter selects, or is required by Customer’s selected identity providers (IdPs). The personal data transferred concern the following special categories of data (please specify): Such categories of data as data exporter selects. The personal data transferred will be subject to the following basic processing activities (please specify): Storage and analysis of user login and related data for the purposes of user authentication and user authorization. Auth0 DPA Rev1.1 (10-17) 15 Confidential Auth0 DPA Rev1.1 (10-17) v1.1 10-20-17 - CLICK-THROUGH DocuSign Envelope ID: 2F4673AF-3A49-447F-B7BB-7BADA77E660D Xxxxx Xxxxxxx

Sub-processing. 11.1 The data importer shall not subcontract any of its processing operations performed on behalf of the data exporter under the Clauses without the prior written consent of the data exporter. Where the data importer subcontracts its obligations under the Clauses, DocuSign Envelope ID: 507F7CDB-79B1-4F17-9DE5-4DFAF9265338 with the consent of the data exporter, it shall do so only by way of a written agreement with the sub-processor which imposes the same obligations on the sub- sub-processor as are imposed on the data importer under the Clauses. Where the sub-processor fails to fulfil its data protection obligations under such written agreement the data importer shall remain fully liable to the data exporter for the performance of the sub-processor’s 's obligations under such agreement. 11.2 The prior written contract between the data importer and the sub-processor shall also provide for a third-party beneficiary clause as laid down in Clause 3 for cases where the data subject is not able to bring the claim for compensation referred to in paragraph 1 of Clause 6 against the data exporter or the data importer because they have factually disappeared or have ceased to exist in law or have become insolvent and no successor entity has assumed the entire legal obligations of the data exporter or data importer by contract or by operation of law. Such third-party liability of the sub-processor shall be limited to its own processing operations under the Clauses. 11.3 The provisions relating to data protection aspects for sub-processing of the contract referred to in paragraph 1 shall be governed by the law of the Member State in which the data exporter is established, namely ......................................... 11.4 The data exporter shall keep a list of sub-processing agreements concluded under the Clauses and notified by the data importer pursuant to Clause 5(j5 (j), which shall be updated at least once a year. The list shall be available to the data exporter’s 's data protection supervisory authority.

Sub-processing. 11.1 The data importer shall not subcontract any of its processing operations performed on behalf of the data exporter under the Clauses without the prior written consent of the data exporter. Where the data importer subcontracts its obligations under the Clauses, with the consent of the data exporter, it shall do so only by way of a written agreement with the sub-processor which imposes the same obligations on the sub- processor as are imposed on the data importer under the Clauses. Where the sub-sub- processor fails to fulfil its data protection obligations under such written agreement the data importer shall remain fully liable to the data exporter for the performance of the sub-processor’s 's obligations under such agreement. 11.2 The prior written contract between the data importer and the sub-processor shall also provide for a third-party beneficiary clause as laid down in Clause clause 3 for cases where the data subject is not able to bring the claim for compensation referred to in paragraph 1 of Clause 6 clause 6.1 against the data exporter or the data importer because they have factually disappeared or have ceased to exist in law or have become insolvent and no successor entity has assumed the entire legal obligations of the data exporter or data importer by contract or by operation of law. Such third-party liability of the sub-sub- processor shall be limited to its own processing operations under the Clauses. 11.3 The provisions relating to data protection aspects for sub-processing of the contract referred to in paragraph 1 clause 11.1 shall be governed by the law of the Member State in which the data exporter is established, namely ......................................... 11.4 The data exporter shall keep a list of sub-processing agreements concluded under the Clauses and notified by the data importer pursuant to Clause clause 5(j), which shall be updated at least once a year. The list shall be available to the data exporter’s 's data protection supervisory authority.

Sub-processing. 11.1 11.1. The data importer shall not subcontract any of its processing operations performed on behalf of the data exporter under the Clauses without the prior written consent of the data exporter. Where the data importer subcontracts its obligations under the Clauses, with the consent of the data exporter, it shall do so only by way of a written agreement with the sub-processor which imposes the same obligations on the sub- sub-processor as are imposed on the data importer under the Clauses. Where the sub-processor fails to fulfil its data protection obligations under such written agreement the data importer shall remain fully liable to the data exporter for the performance of the sub-processor’s 's obligations under such agreement. 11.2 11.2. The prior written contract between the data importer and the sub-processor shall also provide for a third-party beneficiary clause as laid down in Clause 3 for cases where the data subject is not able to bring the claim for compensation referred to in paragraph 1 of Clause 6 against the data exporter or the data importer because they have factually disappeared or have ceased to exist in law or have become insolvent and no successor entity has assumed the entire legal obligations of the data exporter or data importer by contract or by operation of law. Such third-party liability of the sub-sub- processor shall be limited to its own processing operations under the Clauses. 11.3 11.3. The provisions relating to data protection aspects for sub-processing of the contract referred to in paragraph 1 shall be governed by the law of the Member State in which the data exporter is established, namely ......................................... 11.4 11.4. The data exporter shall keep a list of sub-processing agreements concluded under the Clauses and notified by the data importer pursuant to Clause 5(j), which shall be updated at least once a year. The list shall be available to the data exporter’s 's data protection supervisory authority.

Sub-processing. 11.1 a. The data importer shall not subcontract any of its processing operations performed on behalf of the data exporter under the Clauses without the prior written consent of the data exporter. Where the data importer subcontracts its obligations under the Clauses, with the consent of the data exporter, it shall do so only by way of a written agreement with the sub-processor which imposes the same obligations on the sub- sub-processor as are imposed on the data importer under the Clauses. Where the sub-processor fails to fulfil its data protection obligations under such written agreement the data importer shall remain fully liable to the data exporter for the performance of the sub-processor’s obligations under such agreement. 11.2 b. The prior written contract between the data importer and the sub-processor shall also provide for a third-party beneficiary clause as laid down in Clause 3 for cases where the data subject is not able to bring the claim for compensation referred to in paragraph 1 of Clause 6 against the data exporter or the data importer because they have factually disappeared or have ceased to exist in law or have become insolvent and no successor entity has assumed the entire legal obligations of the data exporter or data importer by contract or by operation of law. Such third-party liability of the sub-processor shall be limited to its own processing operations under the Clauses. 11.3 c. The provisions relating to data protection aspects for sub-processing of the contract referred to in paragraph 1 shall be governed by the law of the Member State in which the data exporter is established, namely ......................................... 11.4 d. The data exporter shall keep a list of sub-processing agreements concluded under the Clauses and notified by the data importer pursuant to Clause 5(j), which shall be updated at least once a year. The list shall be available to the data exporter’s data protection supervisory authority.

Sub-processing. 11.1 11(1) The data importer shall not subcontract any of its processing operations performed on behalf of the data exporter under the Clauses without the prior written consent of the data exporter. Where the data importer subcontracts its obligations under the Clauses, with the consent of the data exporter, it shall do so only by way of a written agreement with the sub-processor which imposes the same obligations on the sub- sub-processor as are imposed on the data importer under the ClausesClauses3. Where the sub-processor fails to fulfil its data protection obligations under such written agreement the data importer shall remain fully liable to the data exporter for the performance of the sub-processor’s obligations under such agreement. 11.2 11(2) The prior written contract between the data importer and the sub-processor shall also provide for a third-party beneficiary clause as laid down in Clause 3 for cases where the data subject is not able to bring the claim for compensation referred to in paragraph 1 of Clause 6 against the data exporter or the data importer because they have factually disappeared or have ceased to exist in law or have become insolvent and no successor entity has assumed the entire legal obligations of the data exporter or data importer by contract or by operation of law. Such third-party liability of the sub-processor shall be limited to its own processing operations under the Clauses. 11.3 11(3) The provisions relating to data protection aspects for sub-processing of the contract referred to in paragraph 1 shall be governed by the law of the Member State in which the data exporter is established, namely ......................................... 11.4 11(4) The data exporter shall keep a list of sub-processing agreements concluded under the Clauses and notified by the data importer pursuant to Clause 5(j), which shall be updated at least once a year. The list shall be available to the data exporter’s data protection supervisory authority. This requirement may be satisfied by the sub-processor co-signing the contract entered into between the data exporter and the data importer under this Decision. 12(1) The parties agree that on the termination of the provision of data-processing services, the data importer and the sub-processor shall, at the choice of the data exporter, return all the personal data transferred and the copies thereof to the data exporter or shall destroy all the personal data and certify to the data exporter that it has done so, unless legislation imposed upon the data importer prevents it from returning or destroying all or part of the personal data transferred. In that case, the data importer warrants that it will guarantee the confidentiality of the personal data transferred and will not actively process the personal data transferred anymore. 12(2) The data importer and the sub-processor warrant that upon request of the data exporter and/or of the supervisory authority, it will submit its data-processing facilities for an audit of the measures referred to in paragraph 1.

Sub-processing. 11.1 The data importer shall not subcontract any of its processing operations performed on behalf of the data exporter under the Clauses without the prior written consent of the data exporter. Where the data importer subcontracts its obligations under the Clauses, with the consent of the data exporter, it shall do so only by way of a written agreement with the sub-processor which imposes the same obligations on the sub- sub-processor as are imposed on the data importer under the Clauses. Where the sub-processor fails to fulfil its data protection obligations under such written agreement the data importer shall remain fully liable to the data exporter for the performance of the sub-processor’s 's obligations under such agreement. 11.2 The prior written contract between the data importer and the sub-processor shall also provide for a third-party beneficiary clause as laid down in Clause clause 3 for cases where the data subject is not able to bring the claim for compensation referred to in paragraph 1 of Clause clause 6 against the data exporter or the data importer because they have factually disappeared or have ceased to exist in law or have become insolvent and no successor entity has assumed the entire legal obligations of the data exporter or data importer by contract or by operation of law. Such third-party liability of the sub-processor shall be limited to its own processing operations under the Clauses. 11.3 The provisions relating to data protection aspects for sub-processing of the contract referred to in paragraph 1 shall be governed by the law of the Member State in which the data exporter is established, namely ........................................that Member State listed below in respect of each data exporter. 11.4 The data exporter shall keep a list of sub-processing agreements concluded under the Clauses and notified by the data importer pursuant to Clause clause 5(j), which shall be updated at least once a year. The list shall be available to the data exporter’s 's data protection supervisory authority.

Sub-processing. 11.1 A. The data importer shall not subcontract any of its processing operations performed on behalf of the data exporter under the Clauses without the prior written consent of the data exporter. Where the data importer subcontracts its obligations under the Clauses, with the consent of the data exporter, it shall do so only by way of a written agreement with the sub-processor which imposes the same obligations on the sub- sub-processor as are imposed on the data importer under the Clauses. Where the sub-processor fails to fulfil its data protection obligations under such written agreement the data importer shall remain fully liable to the data exporter for the performance of the sub-processor’s 's obligations under such agreement. 11.2 B. The prior written contract between the data importer and the sub-processor shall also provide for a third-party beneficiary clause as laid down in Clause 3 clause (Standard Contractual Clauses)3 for cases where the data subject is not able to bring the claim for compensation referred to in paragraph 1 A of Clause 6 clause (Standard Contractual Clauses)6 against the data exporter or the data importer because they have factually disappeared or have ceased to exist in law or have become insolvent and no successor entity has assumed the entire legal obligations of the data exporter or data importer by contract or by operation of law. Such third-third- party liability of the sub-processor shall be limited to its own processing operations under the Clauses. 11.3 C. The provisions relating to data protection aspects for sub-processing of the contract referred to in paragraph 1 11A shall be governed by the law of the Member State in which the data exporter is established, namely ......................................... 11.4 D. The data exporter shall keep a list of sub-processing agreements concluded under the Clauses and notified by the data importer pursuant to Clause 5(jclause (Standard Contractual Clauses)5(i), which shall be updated at least once a year. The list shall be available to the data exporter’s 's data protection supervisory authority.

Sub-processing. 11.1 The data importer shall not subcontract any of its processing operations performed on behalf of the data exporter under the Clauses without the prior written consent of the data exporter. Where the data importer subcontracts its obligations under the Clauses, with the consent of the data exporter, it shall do so only by way of a written agreement with the sub-processor which imposes the same obligations on the sub- sub-processor as are imposed on the data importer under the Clauses. Where the sub-processor fails to fulfil its data protection obligations under such written agreement the data importer shall remain fully liable to the data exporter for the performance of the sub-processor’s 's obligations under such agreement. 11.2 The prior written contract between the data importer and the sub-processor shall also provide for a third-party beneficiary clause as laid down in Clause 3 for cases where the data subject is not able to bring the claim for compensation referred to in paragraph 1 of Clause 6 against the data exporter or the data importer because they have factually disappeared or have ceased to exist in law or have become insolvent and no successor entity has assumed the entire legal obligations of the data exporter or data importer by contract or by operation of law. Such third-party liability of the sub-processor shall be limited to its own processing operations under the Clauses.entire 11.3 The provisions relating to data protection aspects for sub-processing of the contract referred to in paragraph 1 shall be governed by the law of the Member State in which the data exporter is established, namely ......................................... 11.4 The data exporter shall keep a list of sub-processing agreements concluded under the Clauses and notified by the data importer pursuant to Clause 5(j5 (j), which shall be updated at least once a year. The list shall be available to the data exporter’s 's data protection supervisory authority.

Sub-processing. 11.1 1. The data importer shall not subcontract any of its processing operations performed on behalf of the data exporter under the Clauses without the prior written consent of the data exporter. Where the data importer subcontracts its obligations under the Clauses, with the consent of the data exporter, it shall do so only by way of a written agreement with the sub-processor which imposes the same obligations on the sub- sub-processor as are imposed on the data importer under the ClausesClauses (1). Where the sub-processor fails to fulfil its data protection obligations under such written agreement the data importer shall remain fully liable to the data exporter for the performance of the sub-processor’s obligations under such agreement. 11.2 2. The prior written contract between the data importer and the sub-processor shall also provide for a third-party beneficiary clause as laid down in Clause 3 for cases where the data subject is not able to bring the claim for compensation referred to in paragraph 1 of Clause 6 against the data exporter or the data importer because they have factually disappeared or have ceased to exist in law or have become insolvent and no successor entity has assumed the entire legal obligations of the data exporter or data importer by contract or by operation of law. Such third-party liability of the sub-processor shall be limited to its own processing operations under the Clauses. 11.3 3. The provisions relating to data protection aspects for sub-processing of the contract referred to in paragraph 1 shall be governed by the law of the Member State in which the data exporter is established, namely ......................................... 11.4 4. The data exporter shall keep a list of sub-processing agreements concluded under the Clauses and notified by the data importer pursuant to Clause 5(j), which shall be updated at least once a year. The list shall be available to the data exporter’s data protection supervisory authority.

Sub-processing. 11.1 The data importer shall not subcontract any of its processing operations performed on behalf of the data exporter under the Clauses without the prior written consent of the data exporter. Where the data importer subcontracts its obligations under the Clauses, with the consent of the data exporter, it shall do so only by way of a written agreement with the sub-processor which imposes the same obligations on the sub- sub-processor as are imposed on the data importer under the Clauses. Where the sub-processor fails to fulfil its data protection obligations under such written agreement the data importer shall remain fully liable to the data exporter for the performance of the sub-sub- processor’s 's obligations under such agreement. 11.2 The prior written contract between the data importer and the sub-processor shall also provide for a third-party beneficiary clause as laid down in Clause 3 for cases where the data subject is not able to bring the claim for compensation referred to in paragraph 1 of Clause 6 6.1 against the data exporter or the data importer because they have factually disappeared or have ceased to exist in law or have become insolvent and no successor entity has assumed the entire legal obligations of the data exporter or data importer by contract or by operation of law. Such third-party liability of the sub-sub- processor shall be limited to its own processing operations under the Clauses. 11.3 The provisions relating to data protection aspects for sub-processing of the contract referred to in paragraph 1 11.1 shall be governed by the law of the Member State in which the data exporter is established, namely ......................................... 11.4 The data exporter shall keep a list of sub-processing agreements concluded under the Clauses and notified by the data importer pursuant to Clause 5(j), which shall be updated at least once a year. The list shall be available to the data exporter’s 's data protection supervisory authority.

Sub-processing. 11.1 a. The data importer shall not subcontract any of its processing operations performed on behalf of the data exporter under the Clauses without the prior written consent of the data exporter. Where the data importer subcontracts its obligations under the Clauses, with the consent of the data exporter, it shall do so only by way of a written agreement with the sub-processor which imposes the same obligations on the sub- sub-processor as are imposed on the data importer under the Clauses. Where the sub-processor fails to fulfil its data protection obligations under such written agreement the data importer shall remain fully liable to the data exporter for the performance of the sub-processor’s obligations under such agreement. 11.2 b. The prior written contract between the data importer and the sub-processor shall also provide for a third-party beneficiary clause as laid down in Clause 3 for cases where the data subject is not able to bring the claim for compensation referred to in paragraph 1 6.a of Clause 6 against the data exporter or the data importer because they have factually disappeared or have ceased to exist in law or have become insolvent and no successor entity has assumed the entire legal obligations of the data exporter or data importer by contract or by operation of law. Such third-party liability of the sub-processor shall be limited to its own processing operations under the Clauses. 11.3 c. The provisions relating to data protection aspects for sub-processing of the contract referred to in paragraph 1 11.a shall be governed by the law of the Member State in which the data exporter is established, namely ......................................... 11.4 d. The data exporter shall keep a list of sub-processing agreements concluded under the Clauses and notified by the data importer pursuant to Clause 5(j5.a(x), which shall be updated at least once a year. The list shall be available to the data exporter’s 's data protection supervisory authority.

Sub-processing. 11.1 The data importer Data Importer shall not subcontract any of its processing operations performed on behalf of the data exporter Data Exporter under the Clauses without the prior written consent of the data exporterData Exporter. Where the data importer Data Importer subcontracts its obligations under the Clauses, with the consent of the data exporterData Exporter, it shall do so only by way of a written agreement with the sub-processor which imposes the same obligations on the sub- sub-processor as are imposed on the data importer Data Importer under the Clauses. Where the sub-processor fails to fulfil its data protection obligations under such written agreement the data importer Data Importer shall remain fully liable to the data exporter Data Exporter for the performance of the sub-processor’s 's obligations under such agreement. 11.2 The prior written contract between the data importer Data Importer and the sub-processor shall also provide for a third-party beneficiary clause as laid down in Clause 3 for cases where the data subject is not able to bring the claim for compensation referred to in paragraph 1 of Clause 6 6.1 against the data exporter Data Exporter or the data importer Data Importer because they have factually disappeared or have ceased to exist in law or have become insolvent Insolvent and no successor entity has assumed the entire legal obligations of the data exporter Data Exporter or data importer Data Importer by contract or by operation of law. Such third-party liability of the sub-processor shall be limited to its own processing operations under the Clauses. 11.3 The provisions relating to data protection aspects for sub-processing of the contract referred to in paragraph 1 Claus11.1 shall be governed by the law of the Member State in which the data exporter Data Exporter is established, namely ........................................England. 11.4 The data exporter Data Exporter shall keep a list of sub-processing agreements concluded under the Clauses and notified by the data importer Data Importer pursuant to Clause 5(j)5.10, which shall be updated at least once a year. The list shall be available to the data exporter’s Data Exporter's data protection supervisory authority.

Sub-processing. 11.1 The data importer shall not subcontract any of its processing operations performed on behalf of the data exporter under the Clauses clauses without the prior written consent of the data exporter. Where the data importer subcontracts its obligations under the Clausesclauses, with the consent of the data exporter, it shall do so only by way of a written agreement with the sub-processor which imposes the same obligations on the sub- sub-processor as are imposed on the data importer under the Clausesclauses. Where the sub-processor fails to fulfil its data protection obligations under such written agreement the data importer shall remain fully liable to the data exporter for the performance of the sub-processor’s obligations under such agreement. 11.2 The prior written contract between the data importer and the sub-processor shall also provide for a third-party beneficiary clause as laid down in Clause clause 3 for cases where the data subject is not able to bring the claim for compensation referred to in paragraph 1 of Clause clause 6 against the data exporter or the data importer because they have factually disappeared or have ceased to exist in law or have become insolvent and no successor entity has assumed the entire legal obligations of the data exporter or data importer by contract or by operation of law. Such third-party liability of the sub-processor shall be limited to its own processing operations under the Clausesclauses. 11.3 11.4 The provisions relating to data protection aspects for sub-processing of the contract referred to in paragraph 1 shall be governed by the law of the Member State in which the data exporter is established, namely ......................................... 11.4 11.5 The data exporter shall keep a list of sub-processing agreements concluded under the Clauses clauses and notified by the data importer pursuant to Clause clause 5(j), which shall be updated at least once a year. The list shall be available to the data exporter’s data protection supervisory authority.

Sub-processing. 11.1 The data importer shall not subcontract any of its processing operations performed on behalf of the data exporter under the Clauses without the prior written consent of the data exporter. Where the data importer subcontracts its obligations under the Clauses, with the consent of the data exporter, it shall do so only by way of a written agreement with the sub-sub- processor which imposes the same obligations on the sub- sub-processor as are imposed on the data importer under the Clauses. Where the sub-processor fails to fulfil its data protection obligations under such written agreement the data importer shall remain fully liable to the data exporter for the performance of the sub-processor’s obligations under such agreement. 11.2 The prior written contract between the data importer and the sub-processor shall also provide for a third-party beneficiary clause as laid down in Clause 3 for cases where the data subject is not able to bring the claim for compensation referred to in paragraph 1 of Clause 6 6.1 against the data exporter or the data importer because they have factually disappeared or have ceased to exist in law or have become insolvent and no successor entity has assumed the entire legal obligations of the data exporter or data importer by contract or by operation of law. Such third-party liability of the sub-processor shall be limited to its own processing operations under the Clauses. 11.3 The provisions relating to data protection aspects for sub-processing of the contract referred to in paragraph 1 11.1 shall be governed by the law of the Member State in which the data exporter is established, namely ......................................... 11.4 The data exporter shall keep a list of sub-processing agreements concluded under the Clauses and notified by the data importer pursuant to Clause 5(j), which shall be updated at least once a year. The list shall be available to the data exporter’s data protection supervisory authority.

Sub-processing. 11.1 (1) The data importer shall not subcontract any of its processing operations performed on behalf of the data exporter under the Clauses without the prior written consent of the data exporter. Where the data importer subcontracts its obligations under the Clauses, with the consent of the data exporter, it shall do so only by way of a written agreement with the sub-processor which imposes the same obligations on the sub- sub-processor as are imposed on the data importer under the Clauses. Where the sub-processor fails to fulfil its data protection obligations under such written agreement the data importer shall remain fully liable to the data exporter for the performance of the sub-processor’s obligations under such agreement. 11.2 (2) The prior written contract between the data importer and the sub-processor shall also provide for a third-party beneficiary clause as laid down in Clause 3 for cases where the data subject is not able to bring the claim for compensation referred to in paragraph 1 of Clause 6 against the data exporter or the data importer because they have factually disappeared or have ceased to exist in law or have become insolvent and no successor entity has assumed the entire legal obligations of the data exporter or data importer by contract or by operation of law. Such third-party liability of the sub-processor shall be limited to its own processing operations under the Clauses. 11.3 (3) The provisions relating to data protection aspects for sub-processing of the contract referred to in paragraph 1 shall be governed by the law laws of the Member State in which county of the data United Kingdom where the exporter is established, namely ......................................... 11.4 (4) The data exporter shall keep a list of sub-processing agreements concluded under the Clauses and notified by the data importer pursuant to Clause 5(j), which shall be updated at least once a year. The list shall be available to the data exporter’s data protection supervisory authority.

Sub-processing. 11.1 The data importer shall not subcontract any of its processing operations performed on behalf of the data exporter under the Clauses without the prior written consent of the data exporter. Where the data importer subcontracts its obligations under the Clauses, with the consent of the data exporter, it shall do so only by way of a written agreement with the sub-processor which imposes the same obligations on the sub- sub-processor as are imposed on the data importer under the Clauses. Where the sub-processor fails to fulfil its data protection obligations under such written agreement the data importer shall remain fully liable to the data exporter for the performance of the sub-processor’s 's obligations under such agreement. 11.2 The prior written contract between the data importer and the sub-processor shall also provide for a third-party beneficiary clause as laid down in Clause clause 3 for cases where the data subject is not able to bring the claim for compensation referred to in paragraph 1 of Clause clause 6 against the data exporter or the data importer because they have factually disappeared or have ceased to exist in law or have become insolvent and no successor entity has assumed the entire legal obligations of the data exporter or data importer by contract or by operation of law. Such third-party liability of the sub-processor shall be limited to its own processing operations under the Clauses. 11.3 The provisions relating to data protection aspects for sub-processing of the contract referred to in paragraph 1 shall be governed by the law of the Member State in which the data exporter is established, namely ........................................England. 11.4 The data exporter shall keep a list of sub-processing agreements concluded under the Clauses and notified by the data importer pursuant to Clause clause 5(j), which shall be updated at least once a year. The list shall be available to the data exporter’s 's data protection supervisory authority.

Sub-processing. 11.1 The data importer shall not subcontract any of its processing operations performed on behalf of the data exporter under the Clauses clauses without the prior written consent of the data exporter. Where the data importer subcontracts its obligations under the Clausesclauses, with the consent of the data exporter, it shall do so only by way of a written agreement with the sub-processor which imposes the same obligations on the sub- sub-processor as are imposed on the data importer under the Clausesclauses. Where the sub-processor fails to fulfil its data protection obligations under such written agreement the data importer shall remain fully liable to the data exporter for the performance of the sub-processor’s obligations under such agreement. 11.2 The prior written contract between the data importer and the sub-processor shall also provide for a third-third party beneficiary clause as laid down in Clause clause 3 for cases where the data subject is not able to bring the claim for compensation referred to in paragraph 1 of Clause 6 clause 6.2 against the data exporter or the data importer because they have factually disappeared or have ceased to exist in law or have become insolvent and no successor entity has assumed the entire legal obligations of the data exporter or data importer by contract or by operation of law. Such third-party liability of the sub-processor shall be limited to its own processing operations under the Clausesclauses. 11.3 The provisions relating to data protection aspects for sub-processing of the contract referred to in paragraph 1 clause 11.1 shall be governed by the law of the Member State in which the data exporter is established, namely ........................................namely 11.4 The data exporter shall keep a list of sub-processing agreements concluded under the Clauses clauses and notified by the data importer pursuant to Clause clause 5(j), which shall be updated at least once a year. The list shall be available to the data exporter’s data protection supervisory authority.

Sub-processing. 11.1 11.1. The data importer shall Data Importer will not subcontract any of its processing Processing operations performed on behalf of the data exporter under the Clauses Data Exporter without the prior written consent of the data exporterData Exporter. Where the data importer Data Importer subcontracts its obligations under the Clausesthis Appendix, with the consent of the data exporterData Exporter, it shall will do so only by way of a written agreement with the subSub-processor Processor which imposes the same obligations on the sub- processor Sub-Processor as are imposed on the data importer Data Importer under the Clausesthis Appendix. Where the subSub-processor Processor fails to fulfil its data protection obligations under such written agreement the data importer shall Data Importer will remain fully liable to the data exporter Data Exporter for the performance of the subSub-processor’s Processor's obligations under such agreement. 11.2 11.2. The prior written contract between the data importer Data Importer and the subSub-processor shall Processor will also provide for a third-party beneficiary clause as laid down in Clause Section 3 for cases where the data subject Data Subject is not able to bring the claim for compensation referred to in paragraph 1 of Clause Section 6 against the data exporter Data Exporter or the data importer Data Importer because they have factually disappeared or have ceased to exist in law or have become insolvent and no successor entity has assumed the entire legal obligations of the data exporter Data Exporter or data importer Data Importer by contract or by operation of law. Such third-party liability of the subSub-processor shall Processor will be limited to its own processing operations under the ClausesProcessing operations. 11.3 11.3. The provisions relating to data protection aspects for sub-processing Processing of the contract referred to in paragraph 1 shall will be governed by the law of the Member State in which the data exporter Data Exporter is established, namely ......................................... 11.4 11.4. The data exporter shall Data Exporter will keep a list of sub-processing Processing agreements concluded under the Clauses this Appendix and notified by the data importer Data Importer pursuant to Clause Section 5(j), which shall will be updated at least once a year. The list shall will be available to the data exporter’s Data Exporter's data protection supervisory authority.Supervisory Authority

Sub-processing. 11.1 1. The data importer shall not subcontract any of its processing operations performed on behalf of the data exporter under the Clauses without the prior written consent of the data exporter. Where the data importer subcontracts its obligations under the Clauses, with the consent of the data exporter, it shall do so only by way of a written agreement with the sub-processor which imposes the same obligations on the sub- sub-processor as are imposed on the data importer under the Clauses (1). Where the sub-processor fails to fulfil its data protection obligations under such written agreement the data importer shall remain fully liable to the data exporter for the performance of the sub-processor’s obligations under such agreement. 11.2 2. The prior written contract between the data importer and the sub-processor shall also provide for a third-party beneficiary clause as laid down in Clause 3 for cases where the data subject is not able to bring the claim for compensation referred to in paragraph 1 of Clause 6 against the data exporter or the data importer because they have factually disappeared or have ceased to exist in law or have become insolvent and no successor entity has assumed the entire legal obligations of the data exporter or data importer by contract or by operation of law. Such third-party liability of the sub-processor shall be limited to its own processing operations under the Clauses. 11.3 3. The provisions relating to data protection aspects for sub-processing of the contract referred to in paragraph 1 shall be governed by the law of the Member State in which the data exporter is established, namely ......................................... 11.4 4. The data exporter shall keep a list of sub-processing agreements concluded under the Clauses and notified by the data importer pursuant to Clause 5(j), which shall be updated at least once a year. The list shall be available to the data exporter’s data protection supervisory authority. 1. The parties agree that on the termination of the provision of data-processing services, the data importer and the sub-processor shall, at the choice of the data exporter, return all the personal data transferred and the copies thereof to the data exporter or shall destroy all the personal data and certify to the data exporter that it has done so, unless legislation imposed upon the data importer prevents it from returning or destroying all or part of the personal data transferred. In that case, the data importer warrants that it will guarantee the confidentiality of the personal data transferred and will not actively process the personal data transferred anymore. 2. The data importer and the sub-processor warrant that upon request of the data exporter and/or of the supervisory authority, it will submit its data-processing facilities for an audit of the measures referred to in paragraph 1.

Sub-processing. 11.1 11.1. The data importer shall Data Importer will not subcontract any of its processing Processing operations performed on behalf of the data exporter under the Clauses Data Exporter without the prior written consent of the data exporterData Exporter. Where the data importer Data Importer subcontracts its obligations under the Clausesthis Appendix, with the consent of the data exporterData Exporter, it shall will do so only by way of a written agreement with the subSub-processor Processor which imposes the same obligations on the sub- processor Sub-Processor as are imposed on the data importer Data Importer under the Clausesthis Appendix. Where the subSub-processor Processor fails to fulfil fulfil its data protection obligations under such written agreement the data importer shall Data Importer will remain fully liable to the data exporter Data Exporter for the performance of the subSub-processorProcessor’s obligations under such agreement. 11.2 11.2. The prior written contract between the data importer Data Importer and the subSub-processor shall Processor will also provide for a third-party beneficiary beneficiary clause as laid down in Clause Section 3 for cases where the data subject Data Subject is not able to bring the claim for compensation referred to in paragraph 1 of Clause Section 6 against the data exporter Data Exporter or the data importer Data Importer because they have factually disappeared or have ceased to exist in law or have become insolvent and no successor entity has assumed the entire legal obligations of the data exporter Data Exporter or data importer Data Importer by contract or by operation of law. Such third-party liability of the subSub-processor shall Processor will be limited to its own processing operations under the ClausesProcessing operations. 11.3 11.3. The provisions relating to data protection aspects for sub-processing Processing of the contract referred to in paragraph 1 shall will be governed by the law of the Member State in which the data exporter Data Exporter is established, namely ......................................... 11.4 11.4. The data exporter shall Data Exporter will keep a list of sub-processing Processing agreements concluded under the Clauses this Appendix and notified notified by the data importer Data Importer pursuant to Clause Section 5(j), which shall will be updated at least once a year. The list shall will be available to the data exporterData Exporter’s data protection supervisory authority.Supervisory Authority

Sub-processing. 11.1 1. The data importer Data Importer shall not subcontract any of its processing operations performed on behalf of the data exporter Data Exporter under the Clauses without the prior written consent of the data exporterData Exporter. Where the data importer Data Importer subcontracts its obligations under the Clauses, with the consent of the data exporterData Exporter, it shall do so only by way of a written agreement with the sub-processor Subprocessor which imposes the same obligations on the sub- processor Subprocessor as are imposed on the data importer Data Importer under the Clauses. Where the sub-processor Subprocessor fails to fulfil its data protection obligations under such written agreement the data importer Data Importer shall remain fully liable to the data exporter Data Exporter for the performance of the sub-processorSubprocessor’s obligations under such agreement. 11.2 2. The prior written contract between the data importer Data Importer and the sub-processor Subprocessor shall also provide for a third-party beneficiary clause as laid down in Clause 3 for cases where the data subject Data Subject is not able to bring the claim for compensation referred to in paragraph 1 of Clause 6 against the data exporter Data Exporter or the data importer Data Importer because they have factually disappeared or have ceased to exist in law or have become insolvent and no successor entity has assumed the entire legal obligations of the data exporter Data Exporter or data importer Data Importer by contract or by operation of law. Such third-party liability of the sub-processor Subprocessor shall be limited to its own processing operations under the Clauses. 11.3 3. The provisions relating to data protection aspects for sub-processing of the contract referred to in paragraph 1 shall be governed by the law of the Member State in which the data exporter Data Exporter is established, namely ......................................... 11.4 4. The data exporter Data Exporter shall keep a list of sub-processing agreements concluded under the Clauses and notified by the data importer Data Importer pursuant to Clause 5(j), which shall be updated at least once a year. The list shall be available to the data exporterData Exporter’s data protection supervisory authority. 1. The parties agree that on the termination of the provision of data processing services, the Data Importer and the Subprocessor shall, at the choice of the Data Exporter, return all the personal data transferred and the copies thereof to the Data Exporter or shall destroy all the personal data and certify to the Data Exporter that it has done so, unless legislation imposed upon the Data Importer prevents it from returning or destroying all or part of the personal data transferred. In that case, the Data Importer warrants that it will guarantee the confidentiality of the personal data transferred and will not actively process the personal data transferred anymore. 2. The Data Importer and the Subprocessor warrant that upon request of the Data Exporter and/or of the supervisory authority, it will submit its data processing facilities for an audit of the measures referred to in paragraph 1. On behalf of the Data Exporter: On behalf of the Data Importer: Insert Legal Name of Customer By: BetterCloud, Inc. By: Authorized Signature Authorized Signature Print Name: Print Name: Title: Title: Address: Address: 000 0xx Xxxxxx, 00xx Xxxxx Xxx Xxxx, XX 00000, XXX This Appendix forms part of the Clauses to which it is attached and must be completed and signed by the Parties. Capitalized but undefined terms used in this Appendix 1 have the meaning assigned to those terms in, as applicable: (1) the Clauses, (2) the Addendum to which the Clauses are attached, and (3) the Services Agreement (as defined in the Addendum). • The Data Exporter is Customer. In the course of using the Services during the term of the Services Agreement, the Data Exporter may submit, collect, or provide personal data to the Data Importer. • The Data Importer is BetterCloud, a provider of automated management and intelligent data security for cloud office platforms. In the course of providing the Services to Data Exporter pursuant to the Services Agreement, the Data Importer may process personal data controlled by the Data Exporter in accordance with the Data Exporter’s instructions as set forth in the Addendum. • The personal data transferred concern the following categories of Data Subjects: (a) Data Exporter’s Users, (b) individuals collaborating and communicating with the Data Exporter’s Users, and (c) individuals whose personal data is possessed by Customer and stored within Customer Data. • The personal data transferred by Data Exporter to Data Importer concern the following categories of data: first and last name, users IDs, email, documents, presentations, images, calendar entries, tasks and other electronic information or data submitted, stored, sent or received by Users via the Services. • The personal data transferred concern the following special categories of data: data transmitted or displayed by Users via the Services may include any of the special categories of data, the type and extent of which is determined and controlled by the User in its sole discretion. The personal data transferred will be subject to the following basic processing activities: • Scope of Processing: o The Clauses reflect the parties’ agreement with respect to the processing and transfer of personal data specified in this Appendix pursuant to the provision of the Services. o Personal data may be processed for the following purposes: (a) to provide the Services, (which may include the detection, prevention and resolution of security and technical issues); (b) to respond to customer support requests; and (c) otherwise to fulfill the obligations under the Services Agreement. o The Data Exporter instructs the Data Importer to process personal data in countries in which the Data Importer or its Sub-processors maintain facilities as necessary for it to provide the Services. • Term of Data Processing. o Data processing will be for the term specified in the Services Agreement. For an additional fee (unless otherwise provided in the Services Agreement), during the term of the Services Agreement the Data Importer will provide the Data Exporter with access to, and the ability to export, the Data Exporter’s personal data processed pursuant to the Services Agreement to the extent such personal data is in Data Importer’s possession or control. Data Exporter: Data Importer: Insert Legal Name of Customer By: BetterCloud, Inc. By: Authorized Signature Authorized Signature Print Name: Print Name: This Appendix forms part of the Clauses to which it is attached and must be completed and signed by the Parties. Capitalized but undefined terms used in this Appendix 1 have the meaning assigned to those terms in, as applicable: (1) the Clauses, (2) the Addendum to which the Clauses are attached, and (3) the Services Agreement (as defined in the Addendum). The Data Importer currently abides by the Technical and Organisational Security Measures in this Appendix 2. The Data Importer may update or modify these Technical and Organisational Security Measures from time to time provided such updates and modifications will not result in a material degradation in the security of the Services during the term of the Services Agreement.

Sub-processing. 11.1 1. The data importer shall not subcontract any of its processing operations performed on behalf of the data exporter under the Clauses without the prior written consent of the data exporter. Where the data importer subcontracts its obligations under the Clauses, with the consent of the data exporter, it shall do so only by way of a written agreement with the sub-processor Subprocessor which imposes the same obligations on the sub- processor Subprocessor as are imposed on the data importer under the Clauses. Where the sub-processor Subprocessor fails to fulfil its data protection obligations under such written agreement the data importer shall remain fully liable to the data exporter for the performance of the sub-processorSubprocessor’s obligations under such agreement. 11.2 2. The prior written contract between the data importer and the sub-processor Subprocessor shall also provide for a third-party beneficiary clause as laid down in Clause 3 for cases where the data subject is not able to bring the claim for compensation referred to in paragraph 1 of Clause 6 against the data exporter or the data importer because they have factually disappeared or have ceased to exist in law or have become insolvent and no successor entity has assumed the entire legal obligations of the data exporter or data importer by contract or by operation of law. Such third-party liability of the sub-processor Subprocessor shall be limited to its own processing operations under the Clauses. 11.3 3. The provisions relating to data protection aspects for sub-processing of the contract referred to in paragraph 1 shall be governed by the law of the Member State in which the data exporter is established, namely ......................................... 11.4 4. The data exporter shall keep a list of sub-processing agreements concluded under the Clauses and notified by the data importer pursuant to Clause 5(j), which shall be updated at least once a year. The list shall be available to the data exporter’s data protection supervisory authority.

Sub-processing. 11.1 The data importer shall not subcontract any of its processing operations performed on behalf of the data exporter under the Clauses without the prior written consent of the data exporter. Where the data importer subcontracts its obligations under the Clauses, with the consent of the data exporter, it shall do so only by way of a written agreement with the sub-processor which imposes the same obligations on the sub- sub-processor as are imposed on the data importer under the Clauses. Where the sub-processor fails to fulfil fulfill its data protection obligations under such written agreement the data importer shall remain fully liable to the data exporter for the performance of the sub-processor’s 's obligations under such agreement. 11.2 The prior written contract between the data importer and the sub-processor shall also provide for a third-party beneficiary clause as laid down in Clause clause 3 for cases where the data subject is not able to bring the claim for compensation referred to in paragraph 1 of Clause clause 6 against the data exporter or the data importer because they have factually disappeared or have ceased to exist in law or have become insolvent and no successor entity has assumed the entire legal obligations of the data exporter or data importer by contract or by operation of law. Such third-party liability of the sub-processor shall be limited to its own processing operations under the Clauses. 11.3 The provisions relating to data protection aspects for sub-processing of the contract referred to in paragraph 1 shall be governed by the law of the Member State in which the data exporter is established, namely ......................................... 11.4 The data exporter shall keep a list of sub-processing agreements concluded under the Clauses and notified by the data importer pursuant to Clause 5(jclause 5.1(j), which shall be updated at least once a year. The list shall be available to the data exporter’s 's data protection supervisory authority.

Sub-processing. 11.1 The data importer shall not subcontract any of its processing operations performed on behalf of the data exporter under the Clauses without the prior written consent of the data exporter. Where the data importer subcontracts its obligations under the Clauses, with the consent of the data exporter, it shall do so only by way of a written agreement with the sub-processor which imposes the same obligations on the sub- sub-processor as are imposed on the data importer under the Clauses. Where the sub-processor fails to fulfil fulfill its data protection obligations under such written agreement the data importer shall remain fully liable to the data exporter for the performance of the sub-processor’s obligations under such agreement. 11.2 The prior written contract between the data importer and the sub-processor shall also provide for a third-third party beneficiary clause as laid down in Clause 3 for cases where the data subject is not able to bring the claim for compensation referred to in paragraph 1 of Clause 6 against the data exporter or the data importer because they have factually disappeared or have ceased to exist in law or have become insolvent and no successor entity has assumed the entire legal obligations of the data exporter or data importer by contract or by operation of law. Such third-party liability of the sub-processor shall be limited to its own processing operations under the Clauses. 11.3 The provisions relating to data protection aspects for sub-processing of the contract referred to in paragraph 1 shall be governed by the law of the Member State in which the data exporter is established, namely ......................................... 11.4 The data exporter shall keep a list of sub-processing agreements concluded under the Clauses and notified by the data importer pursuant to Clause 5(j5.1(j), which shall be updated at least once a year. The list shall be available to the data exporter’s 's data protection supervisory authority.

Sub-processing. 11.1 The data importer shall not subcontract any of its processing operations performed on behalf of the data exporter under the Clauses without the prior written consent of the data exporter. Where the data importer subcontracts its obligations under the Clauses, with the consent of the data exporter, it shall do so only by way of a written agreement with the sub-processor which imposes the same obligations on the sub- sub-processor as are imposed on the data importer under the Clauses. Where the sub-processor fails to fulfil its data protection obligations under such written agreement the data importer shall remain fully liable to the data exporter for the performance of the sub-processor’s 's obligations under such agreement. 11.2 The prior written contract between the data importer and the sub-processor shall also provide for a third-party beneficiary clause as laid down in Clause clause 3 for cases where the data subject is not able to bring the claim for compensation referred to in paragraph 1 of Clause clause 6 against the data exporter or the data importer because they have factually disappeared or have ceased to exist in law or have become insolvent and no successor entity has assumed the entire legal obligations of the data exporter or data importer by contract or by operation of law. Such third-third- party liability of the sub-processor shall be limited to its own processing operations under the Clauses. 11.3 The provisions relating to data protection aspects for sub-processing of the contract referred to in paragraph 1 shall be governed by the law of the Member State in which the data exporter is established, namely ........................................ 11.4 The data exporter shall keep a list of sub-processing agreements concluded under the Clauses and notified by the data importer pursuant to Clause clause 5(j), which shall be updated at least once a year. The list shall be available to the data exporter’s 's data protection supervisory authority.

Sub-processing. 11.1 (1) The data importer shall not subcontract any of its processing operations performed on behalf of the data exporter under the Clauses without the prior written consent of the data exporter. Where the data importer subcontracts its obligations under the Clauses, with the consent of the data exporter, it shall do so only by way of a written agreement with the sub-processor which imposes the same obligations on the sub- sub-processor as are imposed on the data importer under the ClausesClauses2. Where the sub-processor fails to fulfil its data protection obligations under such written agreement the data importer shall remain fully liable to the data exporter for the performance of the sub-processor’s obligations under such agreement. 11.2 (2) The prior written contract between the data importer and the sub-processor shall also provide for a third-party beneficiary clause as laid down in Clause 3 for cases where the data subject is not able to bring the claim for compensation referred to in paragraph 1 of Clause 6 against the data exporter or the 2This requirement may be satisfied by the sub-processor co-signing the contract entered into between the data exporter and the data importer under this Decision. data importer because they have factually disappeared or have ceased to exist in law or have become insolvent and no successor entity has assumed the entire legal obligations of the data exporter or data importer by contract or by operation of law. Such third-party liability of the sub-processor shall be limited to its own processing operations under the Clauses. 11.3 (3) The provisions relating relation to data protection aspects for sub-processing of the contract referred to in paragraph 1 shall be by governed by the law laws of the Member State in which country of the data UK where the exporter is established, namely ........................................ 11.4 (4) The data exporter shall keep a list of sub-processing agreements concluded under the Clauses and notified by the data importer pursuant to Clause 5(j), which shall be updated at least once a year. The list shall be available to the data exporter’s data protection supervisory authorityCommissioner.

Sub-processing. 11.1 The data importer shall not subcontract any of its processing operations performed on behalf of the data exporter under the Clauses without the prior written consent of the data exporter. Where the data importer subcontracts its obligations under the Clauses, with the consent of the data exporter, it shall do so only by way of a written agreement with the sub-processor which imposes the same obligations on the sub- processor as are imposed on the data importer under the Clauses. Where the sub-processor fails to fulfil fulfill its data protection obligations under such written agreement the data importer shall remain fully liable to the data exporter for the performance of the sub-processor’s obligations under such agreement. 11.2 The prior written contract between the data importer and the sub-processor shall also provide for a third-party beneficiary clause as laid down in Clause 3 for cases where the data subject is not able to bring the claim for compensation referred to in paragraph 1 of Clause 6 against the data exporter or the data importer because they have factually disappeared or have ceased to exist in law or have become insolvent and no successor entity has assumed the entire legal obligations of the data exporter or data importer by contract or by operation of law. Such third-party liability of the sub-processor shall be limited to its own processing operations under the Clauses. 11.3 The provisions relating to data protection aspects for sub-processing of the contract referred to in paragraph 1 shall be governed by the law of the Member State in which the data exporter is established, namely ......................................... 11.4 The data exporter shall keep a list of sub-processing agreements concluded under the Clauses and notified by the data importer pursuant to Clause 5(j5.1(j), which shall be updated at least once a year. The list shall be available to the data exporter’s 's data protection supervisory authority.

Sub-processing. 11.1 The data importer shall not subcontract any of its processing operations performed on behalf of the data exporter under the Clauses without the prior written consent of the data exporter. Where the data importer subcontracts its obligations under the Clauses, with the consent of the data exporter, it shall do so only by way of a written agreement with the sub-processor which imposes the same obligations on the sub- sub-processor as are imposed on the data importer under the Clauses. Where the sub-processor fails to fulfil its data protection obligations under such written agreement the data importer shall remain fully liable to the data exporter for the performance of the sub-processor’s 's obligations under such agreement. 11.2 The prior written contract between the data importer and the sub-processor shall also provide for a third-party beneficiary clause as laid down in Clause 3 for cases where the data subject is not able to bring the claim for compensation referred to in paragraph 1 of Clause 6 against the data exporter or the data importer because they have factually disappeared or have ceased to exist in law or have become insolvent and no successor entity has assumed the entire legal obligations of the data exporter or data importer by contract or by operation of law. Such third-party liability of the sub-processor shall be limited to its own processing operations under the Clauses. 11.3 The provisions relating to data protection aspects for sub-processing of the contract referred to in paragraph 1 shall be governed by the law of the Member State in which the data exporter is established, namely ................................................................................... 11.4 The data exporter shall keep a list of sub-processing agreements concluded under the Clauses and notified by the data importer pursuant to Clause 5(j), which shall be updated at least once a year. The list shall be available to the data exporter’s 's data protection supervisory authority.

Sub-processing. 11.1 1. The data importer Data Importer shall not subcontract any of its processing operations performed on behalf of the data exporter Data Exporter under the Clauses without the prior written consent of the data exporterData Exporter. Where the data importer Data Importer subcontracts its obligations under the Clauses, with the consent of the data exporterData Exporter, it shall do so only by way of a written agreement with the sub-processor Subprocessor which imposes the same obligations on the sub- processor Subprocessor as are imposed on the data importer Data Importer under the Clauses. Where the sub-processor Subprocessor fails to fulfil its data protection obligations under such written agreement the data importer Data Importer shall remain fully liable to the data exporter Data Exporter for the performance of the sub-processorSubprocessor’s obligations under such agreement. 11.2 2. The prior written contract between the data importer Data Importer and the sub-processor Subprocessor shall also provide for a third-party beneficiary clause as laid down in Clause 3 for cases where the data subject Data Subject is not able to bring the claim for compensation referred to in paragraph 1 of Clause 6 against the data exporter Data Exporter or the data importer Data Importer because they have factually disappeared or have ceased to exist in law or have become insolvent and no successor entity has assumed the entire legal obligations of the data exporter Data Exporter or data importer Data Importer by contract or by operation of law. Such third-party liability of the sub-processor Subprocessor shall be limited to its own processing operations under the Clauses. 11.3 3. The provisions relating to data protection aspects for sub-processing of the contract referred to in paragraph 1 shall be governed by the law of the Member State in which the data exporter Data Exporter is established, namely ......................................... 11.4 4. The data exporter Data Exporter shall keep a list of sub-processing agreements concluded under the Clauses and notified by the data importer Data Importer pursuant to Clause 5(j), which shall be updated at least once a year. The list shall be available to the data exporterData Exporter’s data protection supervisory authority. 1. The parties agree that on the termination of the provision of data processing services, the Data Importer and the Subprocessor shall, at the choice of the Data Exporter, return all the personal data transferred and the copies thereof to the Data Exporter or shall destroy all the personal data and certify to the Data Exporter that it has done so, unless legislation imposed upon the Data Importer prevents it from returning or destroying all or part of the personal data transferred. In that case, the Data Importer warrants that it will guarantee the confidentiality of the personal data transferred and will not actively process the personal data transferred anymore. 2. The Data Importer and the Subprocessor warrant that upon request of the Data Exporter and/or of the supervisory authority, it will submit its data processing facilities for an audit of the measures referred to in paragraph 1.

Sub-processing. 11.1 The data importer shall not subcontract any of its processing operations performed on behalf of the data exporter under the Clauses without the prior written consent of the data exporter. Where the data importer subcontracts its obligations under the Clauses, with the consent of the data exporter, it shall do so only by way of a written agreement with the sub-processor which imposes the same obligations on the sub- sub-processor as are imposed on the data importer under the Clauses. Where the sub-processor fails to fulfil its data protection obligations under such written agreement the data importer shall remain fully liable to the data exporter for the performance of the sub-processor’s 's obligations under such agreement. 11.2 . The prior written contract between the data importer and the sub-processor shall also provide for a third-party beneficiary clause as laid down in Clause clause 3 for cases where the data subject is not able to bring the claim for compensation referred to in paragraph 1 of Clause clause 6 against the data exporter or the data importer because they have factually disappeared or have ceased to exist in law or have become insolvent and no successor entity has assumed the entire legal obligations of the data exporter or data importer by contract or by operation of law. Such third-party liability of the sub-processor shall be limited to its own processing operations under the Clauses. 11.3 . The provisions relating to data protection aspects for sub-processing of the contract referred to in paragraph 1 shall be governed by the law of the Member State in which the data exporter is established, namely ........................................ 11.4 ........................................... The data exporter shall keep a list of sub-processing agreements concluded under the Clauses and notified by the data importer pursuant to Clause clause 5(j), which shall be updated at least once a year. The list shall be available to the data exporter’s 's data protection supervisory authority.

Sub-processing. 11.1 1. The data importer shall not subcontract any of its processing operations performed on behalf of the data exporter under exporterunder the Clauses without the prior written consent of the data exporter. Where the data importer subcontracts its obligations under the Clauses, with the consent of the data exporter, it shall do so only by way of a written agreement with the sub-processor which imposes the same obligations on the sub- sub-processor as are imposed on the data importer under the ClausesClauses (3). Where the sub-processor fails to fulfil its data protection obligations under such written agreement the data importer shall remain fully liable to the data exporter for the performance of the sub-processor’s obligations under such agreement. 11.2 2. The prior written contract between the data importer and the sub-processor shall also provide for a third-party beneficiary clause as laid down in Clause 3 for cases where the data subject is not able to bring the claim for compensation referred to in paragraph 1 of Clause 6 against the data exporter or the data importer because they have factually disappeared or have ceased to exist in law or have become insolvent and no successor entity has assumed the entire legal obligations of the data exporter or data importer by contract or by operation of law. Such third-party liability of the sub-processor shall be limited to its own processing operations under the Clauses. 11.3 3. The provisions relating to data protection aspects for sub-processing of the contract referred to in paragraph 1 shall be shallbe governed by the law of the Member State in which the data exporter is established, namely ........................................… 11.4 4. The data exporter shall keep a list of sub-processing agreements concluded under the Clauses and notified by the data importer pursuant to Clause 5(j), which shall be updated at least once a year. The list shall be available to the data exporter’s data protection supervisory authority.

Sub-processing. 11.1 The data importer shall not subcontract any of its processing operations performed on behalf of the data exporter under the Clauses without the prior written consent of the data exporter. Where the data importer subcontracts its obligations under the Clauses, with the consent of the data exporter, it shall do so only by way of a written agreement with the sub-processor which imposes the same obligations on the sub- sub-processor as are imposed on the data importer under the Clauses. Where the sub-processor fails to fulfil its data protection obligations under such written agreement the data importer shall remain fully liable to the data exporter for the performance of the sub-processor’s obligations under such agreement. 11.2 The prior written contract between the data importer and the sub-processor shall also provide for a third-party beneficiary clause as laid down in Clause 3 for cases where the data subject is not able to bring the claim for compensation referred to in paragraph 1 of Clause 6 against the data exporter or the data importer because they have factually disappeared or have ceased to exist in law or have become insolvent and no successor entity has assumed the entire legal obligations of the data exporter or data importer by contract or by operation of law. Such third-third- party liability of the sub-processor shall be limited to its own processing operations under the Clauses. 11.3 The provisions relating to data protection aspects for sub-processing of the contract referred to in paragraph 1 shall be governed by the law of the Member State in which the data exporter is established, namely ......................................... 11.4 The data exporter shall keep a list of sub-processing agreements concluded under the Clauses and notified by the data importer pursuant to Clause 5(j), which shall be updated at least once a year. The list shall be available to the data exporter’s data protection supervisory authority.