EIB Strictly Confidential  Contract CC___/PO___  (c)  Upon a period of 1 (one) year following the expiry or termination of a Contract, the Service  Provider shall effectively delete all personal data processed on behalf of the controller,  and any copies thereof, unless Union or national law requires a longer storage of  personal data;  d)  Written instructions from the Users include: In case the services provided by the Service  Provider include a platform via which the personal data will be processed, the necessary  EIB Group IT Security and Data Protection risk assessments, ensuring compliance with  EIB policies, shall be carried out before its implementation. Further written instructions in  relation to the processing operations to be performed in implementation of the  Agreement, or a Contract can be communicated to the Service Provider by the User at  any time.  8.2  [In case the Service Provider is established in a third country (as defined in Chapter V of Regulation (EU) 2018/1725) or in a country that becomes a third country during the term of the  Agreement or a Contract, and as long as such third country is not covered by an adequacy  decision referred to in Article 47 of Regulation (EU) 2018/1725, the Service Provider agrees to  be bound by the provisions of Appendix E. References to Directive 95/46/EC included in  Appendix E shall be understood as references to the equivalent provisions of Regulation (EU)  2016/679 and Regulation (EU) 2018/1725. Alternatively, the Service Provider is obliged to provide EIB with evidence of its adherence to the binding corporate rules, codes of conduct or  certification mechanisms referred to in Article 48 point(b), (e) and (f) of Regulation (EU) 2018/1725. Contractual references to obligations at law assumed by the Service Provider as per  the application of Union data protection law will be considered as non-applicable to it.]  $^{3}$  9.1  The Agreement and each Contract shall be governed and construed in accordance with the laws  of Luxembourg.  9.2  The Parties hereby submit to the exclusive jurisdiction of the courts of the judicial district of  Luxembourg city ( arrondissement judiciaire de Luxembourg ) to settle any dispute arising out of  or in connexion with this Agreement or a Contract.  10.1 Notices and other communications given hereunder addressed to either party shall be in writing  and shall be served by hand delivery, registered letter, e-mail or other means of transmission  which affords evidence of receipt by the addressee to its address set out below, or to such other  address as it previously notifies to the other in writing:  10.2 The date of registration or, as the case may be, the stated date of receipt of transmission shall  be conclusive for the determination of a period.  $^{3}$ This sub-clause will apply if the successful tenderer is a service provider established in a third country, or in a  country likely to become a third country during the term of the Agreement or a Contract. 8  Article 10 – Notices; Contact Person  Article 9 – Law and Jurisdiction  for the Bank:  for the Service Provider:  Attention: [ name of recipient] 98-100, boulevard Konrad Adenauer  L-2950 Luxembourg  E-mail: [ l ]  Attention: [ name of recipient] [address ]  E-mail: [ l ] 