APPENDIX [ D ] to [ Contract / Agreement] Clause 8 - Cooperation with supervisory authorities  Clause 9 - Governing law  Clause 10 - Variation of the contract  Clause 11 - Sub-processing  Clause 12 - Obligation after the termination of personal data-processing services  Version 1.2: COMMISSION DECISION 2010/87/EU of 5 February 2010 on standard contractual clauses for the transfer of  personal data to processors established in third countries under Directive 95/46/EC of the European Parliament and of the  Council, as amended. $^{1}$ This requirement may be satisfied by the sub-processor co-signing the contract entered into between  the data exporter and the data importer under this Decision.  1. The parties agree that on the termination of the provision of data-processing services, the data  importer and the sub-processor shall, at the choice of the data exporter, return all the personal data  transferred and the copies thereof to the data exporter or shall destroy all the personal data and certify  to the data exporter that it has done so, unless legislation imposed upon the data importer prevents it  4. The data exporter shall keep a list of sub-processing agreements concluded under the Clauses and  notified by the data importer pursuant to Clause 5(j), which shall be updated at least once a year. The  list shall be available to the data exporter’s data protection supervisory authority.  3. The provisions relating to data protection aspects for sub-processing of the contract referred to in  paragraph 1 shall be governed by the law of the Member State in which the data exporter is established,  namely Luxembourg. 2. The prior written contract between the data importer and the sub-processor shall also provide for a  third-party beneficiary clause as laid down in Clause 3 for cases where the data subject is not able to  bring the claim for compensation referred to in paragraph 1 of Clause 6 against the data exporter or the  data importer because they have factually disappeared or have ceased to exist in law or have become  insolvent and no successor entity has assumed the entire legal obligations of the data exporter or data  importer by contract or by operation of law. Such third-party liability of the sub-processor shall be limited  to its own processing operations under the Clauses.  1. The data importer shall not subcontract any of its processing operations performed on behalf of the  data exporter under the Clauses without the prior written consent of the data exporter. Where the data  importer subcontracts its obligations under the Clauses, with the consent of the data exporter, it shall  do so only by way of a written agreement with the sub-processor which imposes the same obligations  on the sub-processor as are imposed on the data importer under the Clauses $^{1}$. Where the sub- processor fails to fulfil its data protection obligations under such written agreement the data importer  shall remain fully liable to the data exporter for the performance of the sub-processor’s obligations under  such agreement.  The parties undertake not to vary or modify the Clauses. This does not preclude the parties from adding  clauses on business related issues where required as long as they do not contradict the Clause.  The Clauses shall be governed by the law of the Member State in which the data exporter is established,  namely Luxembourg.  3. The data importer shall promptly inform the data exporter about the existence of legislation applicable  to it or any sub-processor preventing the conduct of an audit of the data importer, or any sub-processor,  pursuant to paragraph 2. In such a case the data exporter shall be entitled to take the measures  foreseen in Clause 5(b).  2. The parties agree that the supervisory authority has the right to conduct an audit of the data importer,  and of any sub-processor, which has the same scope and is subject to the same conditions as would  apply to an audit of the data exporter under the applicable data protection law.  1. The data exporter agrees to deposit a copy of this contract with the supervisory authority if it so  requests or if such deposit is required under the applicable data protection law. 