This Numerix Local Country Addendum (“Local Country Addendum”) is supplemental to (in order of precedence, as applicable): (i) the fully executed Master Services Agreement entered by and between the parties governing the Services located at: https://nation.numerix.com/ (the “Agreement”) between Numerix and Customer. Except as set forth in this Local Country Addendum, the Agreement will remain in full force and effect. Any defined terms used herein but not defined will have the meaning as defined in the Agreement. In the event of conflict between the terms in this Local Country Addendum and the Agreement, the terms in this Local Country Addendum will control with respect to the subject matter herein.

1. United Kingdom

1.1.  The following changes will be made to the Agreement if Customer is executing its Order Form with Numerix Software Ltd. and such changes shall only apply in connection with such Order Form:

1.1.1    The definition of “Data Protection Legislation” in Section 1.1 shall be deleted in its entirety and replaced as follows:

Data Protection Legislation” means: the UK GDPR (as defined in the Data Protection Act 2018); the Data Protection Act 2018; the Privacy and Electronic Communications Regulations 2003 (SI 2003/2426); the General Data Protection Regulation ((EU) 2016/679) (to the extent applicable) as updated and amended from time to time”.

1.1.2    Section 11.3.1 shall be deleted in its entirety and replaced as follows:

“11.3.1 it has all necessary and appropriate rights, consents (for, without limitation but including, transfer out of United Kingdom and EEA, third party provision, and collection of sensitive information), lawful bases and notices to enable Numerix to use and transfer Personal Data in connection with this Agreement”;

1.1.3 Section 11.4.5 through to Section 11.7 shall be inserted as follows:

“11.4.5  use reasonable endeavours to notify the Customer without undue delay on becoming aware of a personal data breach including data breach (as defined in the UK GDPR) relating to Personal Data processed in connection with this Agreement and assist the Customer, at the Customer's cost, in ensuring compliance with the Customer's obligations under the Data Protection Legislation in relation to any personal data breach;

11.4.6  use reasonable endeavours to notify the Customer without undue delay on becoming aware of a personal data breach (as defined in the UK GDPR) relating to Personal Data processed in connection with this Agreement and assist the Customer, at the Customer's cost, in ensuring compliance with the Customer's obligations under the Data Protection Legislation in relation to any personal data breach;

11.4.7  at the written direction and cost of the Customer, delete or return Personal Data and copies thereof to the Customer on termination of the Agreement unless otherwise required by Data Protection Legislation; and

11.5        The parties acknowledge that the Customer must be able to assess Numerix’s compliance with its obligations under the Data Protection Legislation and Section 11 of this Agreement, insofar as Numerix is acting as a processor on behalf of Customer. The following provisions shall apply when the Customer is exercising such right: 

(a)        Numerix may, in its sole discretion, engage external auditors to verify the adequacy of its security measures with respect to its processing of Personal Data. Where such audits result in the generation of a confidential audit report (“Audit Report”), Numerix shall, upon prior written request and no more than once per year, and subject to the confidentiality provisions of the Agreement, make available to Customer (or Customer’s Third-Party’s Auditor) a copy of the summary of the then-current Audit Report. Such Audit Reports may also be shared with Customer’s competent supervisory authority on its request and where required under Data Protection Legislation. 

(b)        Customer may contact Numerix to request a remote audit of Numerix’s processing activities covered by this Agreement (“Remote Audit”). A Remote Audit may be conducted by Customer through a Third-Party Auditors (as defined below in Section 11.4.7(d) selected by Customer when:

(i)                     Numerix’s provision of an Audit Report is not sufficient to demonstrate compliance with the obligations set out in this Section 11; or

(ii)                    Such an audit is required by Customer’s competent supervisory authority

Any Remote Audit will be limited to Customer’s Personal Data processing by Numerix.

(c)        Customer acknowledges that Numerix operates a multi-tenant data storage environment. Accordingly, Numerix shall have the right to reasonably adapt the scope of any Remote Audit to avoid or mitigate risks with respect to, and including, service levels, availability, and confidentiality of other Numerix’s customers’ information.

(d)        A Remote Audit shall be conducted by Customer’s Third-Party Auditor: (i) acting reasonably, in good faith, and in a proportional manner, taking into account the nature and complexity of the Services used by Customer; (ii) up to one time per year with at least four (4) weeks’ advance written notice and (iii) during Numerix’s normal business hours, under reasonable duration and shall not unreasonably interfere with Numerix’s day-to-day operations. Before any Remote Audit commences, Customer and Numerix shall mutually agree upon the scope, timing, and duration of the audit and the reimbursement rate for which Customer shall be responsible. All reimbursement rates shall be reasonable, taking into account the resources expended by or on behalf of Numerix.  A “Third-Party Auditor” means a third-party independent contractor that is not a competitor of Numerix and who has entered into a non-disclosure agreement containing confidentiality provisions no less protective than those set forth in this Agreement to protect Numerix’s Confidential Information prior to the conduct of the Remote Audit. The costs of the Third-Party Auditor are at Customer’s expense. 

(e)        All information gathered during the Remote Audit and the Audit Report is confidential and cannot be divulged to third parties (unless mandated by applicable law) without Numerix’s prior written consent. Customer must promptly provide Numerix with information regarding any non-compliance discovered during the course of a Remote Audit.

11.6        Sub-Processors.

11.6.1  To the extent Numerix processes Personal Data as a processor, Customer consents to Numerix engaging, and transferring Personal Data to, the Third Party Providers (as sub-processors), including as identified in [Schedule 1] (each a Sub-Processor). Upon prior notification to Customer, Numerix may engage additional or replacement Sub-Processors to process Personal Data. To the extent Customer reasonably objects in writing to the appointment of a Sub-Processor it shall notify Numerix in writing and Numerix will either: (i) work with the Customer to address the Customer’s objections to its reasonable satisfaction, (ii) instruct the Sub-Processor not to process Personal Data, provided that the Customer accepts that this may impair the Services (for which Numerix shall bear no responsibility or liability).

11.6.2  Numerix shall enter into a written agreement with each Sub-Processor incorporating terms which are substantially similar to those set out in this Section 11 (Data Protection).

11.6.3  Notwithstanding Section 12.2, Numerix shall be liable for the performance of a Sub-Processor's obligations in connection with the processing of Personal Data on Customer's behalf, only to the same extent Numerix would be liable if performing the services or processing of each Sub-Processor directly under the terms of this Agreement. 

11.7     Personal Data may be transferred to, stored and/or processed in any country or territory where one or more of Numerix's Third Party Providers are located or maintain facilities, including countries outside the United Kingdom (UK), or European Economic Area (EEA). Where such Personal Data is transferred to a country outside of the UK, or EEA, Numerix shall take reasonable steps to ensure such Personal Data is treated securely and in accordance with the Data Protection Legislation.  Numerix shall monitor how Personal Data transferred from UK to a third country (other than EEA) is treated and the Data Protection Legislation of a country where the Third Party Provider is located. if Numerix finds that it becomes difficult to ensure such Personal Data is treated securely and in accordance with the Data Protection Legislation of UK, Numerix shall stop transfer Personal Data to the relevant Third Party Provider”. 

1.1.4   Section 19.7 is deleted in its entirety and replaced as follows:

“19.7    Without affecting any other right or remedy available to it, a party may terminate this Agreement (including all Order Forms under it) with immediate effect by giving written notice to the other party if:

19.7.1  that other party is deemed unable to pay its debts within the meaning of section 123 of the Insolvency Act 1986;”;

19.7.2  that other party takes any step in connection with its inability to pay debts or its winding up; 

19.7.3  that other party is the subject of the appointment of a receiver or administrator or administrative receiver; or

19.7.4  that other party commences negotiations with all or any of its creditors;

19.7.5  any event occurs, or proceeding is taken, with respect to the other party in any jurisdiction to which it is subject that has an effect equivalent or similar to any of the events mentioned in Section 19.7.1 to Section 19.7.4 (inclusive);”

1.1.5  Section 22.18 The words “State of New York, USA” is replaced with the words “England and Wales”.

1.1.6 Section 22.19 The words “federal or state courts having jurisdiction over New York County, New York” is replaced with the words “courts of England and Wales”.

2. Japan

2.1       The following changes will be made to the Agreement if Customer is executing its Order Form with Numerix Japan Co., Limited. and such changes shall only apply in connection with such Order Form:

2.1.1.   The definition of “Data Protection Legislation” shall be deleted in its entirety and replaced as follows:

Data Protection Legislation” means all applicable data protection and privacy legislation in force from time to time in Japan including without limitation the Act on the Protection of Personal Information (“Japan APPI”) as updated and amended from time to time. 

2.1.2.  Section 7.4 shall be prefaced with the following:

“7.4      To the extent permissible under the Applicable Law”.

2.1.3.  Section 11.3.1 shall be deleted in its entirety and replaced as follows:

“11.3.1 it has all necessary and appropriate rights, consents (for, without limitation but including, transfer out of Japan, third party provision, and collection of sensitive information), lawful bases and notices to enable Numerix to use and transfer Personal Data in connection with this Agreement”;

2.1.4    Section 11.4.2 shall have the words “Physical, human” inserted after the word “technical” on line one. 

2.1.5    Sections 11.4.5 through to 11.6 shall be inserted as follows:

“11.4.5 use reasonable endeavours to notify the Customer without undue delay on becoming aware of a personal data breach including data leaking (as defined in the Japan APPI) relating to Personal Data processed in connection with this Agreement and assist the Customer, at the Customer's cost, in ensuring compliance with the Customer's obligations under the Data Protection Legislation in relation to any personal data breach;

11.4.6  at the written direction and cost of the Customer, delete or return Personal Data and copies thereof to the Customer on termination of the Agreement unless otherwise required by Data Protection Legislation; =

11.5 Sub-Processors.

11.5.1  To the extent Numerix processes Personal Data as a processor, Customer consents to Numerix engaging, and transferring Personal Data to, the Third Party Providers (as sub-processors), including as identified in [Schedule 1] (each a Sub-Processor). Upon prior notification to Customer, Numerix may engage additional or replacement Sub-Processors to process Personal Data. To the extent Customer reasonably objects in writing to the appointment of a Sub-Processor it shall notify Numerix in writing and Numerix will either: (i) work with the Customer to address the Customer’s objections to its reasonable satisfaction, (ii) instruct the Sub-Processor not to process Personal Data, provided that the Customer accepts that this may impair the Services (for which Numerix shall bear no responsibility or liability).

11.5.2  Numerix shall enter into a written agreement with each Sub-Processor incorporating terms which are substantially similar to those set out in this Section 11 (Data Protection).

11.5.3  Notwithstanding Section 12.2, Numerix shall be liable for the performance of a Sub-Processor's obligations in connection with the processing of Personal Data on Customer's behalf, only to the same extent Numerix would be liable if performing the services or processing of each Sub-Processor directly under the terms of this Agreement. 

11.6      Personal Data may be transferred to, stored and/or processed in any country or territory where one or more of Numerix's Third Party Providers are located or maintain facilities, including countries outside Japan. Where such Personal Data is transferred to a country outside of Japan, Numerix shall take reasonable steps to ensure such Personal Data is treated securely and in accordance with the Data Protection Legislation.  Numerix shall monitor how Personal Data transferred from Japan to a third country  is treated and the Data Protection Legislation of a country where the Third Party Provider is located. if Numerix finds that it becomes difficult to ensure such Personal Data is treated securely and in accordance with the Data Protection Legislation of Japan, Numerix shall stop transfer Personal Data to the relevant Third Party Provider.” 

2.1.6    Section 14.6.1 is deleted and replaced in its entirety as follows:

14.6.1 charge interest from the invoice due date on the overdue sum at the rate of 4% per annum above The Bank of Japan's base rate from time to time to the extent permissible under applicable law; and”

2.1.7    Section 15.7 – the following sentence shall be appended to this section as follows:

“and do all necessary acts for assignment and perfection thereof at its own costs”.

2.1.8  Section 16.2 – the following sentence shall be appended to this section as follows:

“to the extent permissible under applicable law”

2.1.9 Section 16.4.3 shall be deleted in its entirety and replaced as follows:

“16.4.3  The Customer provides Numerix with all the details of the preparation and relevant documents/information of the negotiation, dispute and settlement about the Claim, throughout the contentious process and always consults with and take advise from, Numerix to the maximum extent permissible under the Applicable Law”;

2.1.10  Section 16.5 – the following sentence shall be appended to this section as  follows:

“to the extent permissible under applicable law”

2.1.11  Section 17.4 the following words “at law or in equity” are hereby deleted in their entirety and replaced as follows:

under the Applicable Law”

2.1.12  In Section 19.8.5, the following words are inserted after the words “by way of liquidated damages”:

“to the extent permissible under applicable law”

2.1.13  Section 20.3 the following words are inserted after the words “in its own costs”:

“to the extent permissible under applicable law)”

2.1.14  Section 22.17.2 the following words “Chief Executive Officer of the Customer” are hereby deleted in their entirety and replaced as follows:

“Representative Director of the Customer”

2.1.15  Section 22.18 The words “the law of the State of New York, USA” is replaced with the words “the laws of Japan”.

2.1.16  Section 22.19 The words “federal or state courts having jurisdiction over New York County, New York” is replaced with the words “Tokyo District Courts”.

3. Singapore

3.1.      The following changes will be made to the Agreement if Customer is executing its Order Form with Numerix Singapore Pte. Ltd. and such changes shall only apply in connection with such Order Form:

3.1.1     The definition of “Data Protection Legislation” shall be deleted in its entirety and replaced as follows:

Data Protection Legislation” means all applicable data protection and privacy legislation in force from time to time in Singapore including without limitation the Personal Data Protection Act 2012 as updated and amended from time to time”.

3.1.2   Section 11.3.1 shall be deleted in its entirety and replaced as follows:

“11.3.1 it has all necessary and appropriate rights, consents (for, without limitation but including, transfer out of Singapore, third party provision, and collection of sensitive information), lawful bases and notices to enable Numerix to use  and transfer Personal Data in connection with this Agreement”;

3.1.3    Section 11.4.5 through to Section 11.6 shall be inserted as follows:

“11.4.5 use reasonable endeavours to notify the Customer within three calendar days upon completing the assessment that a suspected breach is a notifiable personal data breach (as defined in the Data Protection Legislation) relating to Personal Data processed in connection with this Agreement and assist the Customer, at the Customer's cost, in ensuring compliance with the Customer's obligations under the Data Protection Legislation in relation to any personal data breach”;

11.4.6  at the written direction and cost of the Customer, delete or return Personal Data and copies thereof to the Customer on termination of the Agreement unless otherwise required by Data Protection Legislation; 

11.5     Sub-Processors. 

11.5.1  To the extent Numerix processes Personal Data as a processor, Customer consents to Numerix engaging, and transferring Personal Data to, the Third Party Providers (as sub-processors), including as identified in [Schedule 1] (each a Sub-Processor). Upon prior notification to Customer, Numerix may engage additional or replacement Sub-Processors to process Personal Data. To the extent Customer reasonably objects in writing to the appointment of a Sub-Processor it shall notify Numerix in writing and Numerix will either: (i) work with the Customer to address the Customer’s objections to its reasonable satisfaction, (ii) instruct the Sub-Processor not to process Personal Data, provided that the Customer accepts that this may impair the Services (for which Numerix shall bear no responsibility or liability).

11.5.2  Numerix shall enter into a written agreement with each Sub-Processor incorporating terms which are substantially similar to those set out in this Section 11 (Data Protection).

11.5.3  Notwithstanding Section 12.2, Numerix shall be liable for the performance of a Sub-Processor's obligations in connection with the processing of Personal Data on Customer's behalf, only to the same extent Numerix would be liable if performing the services or processing of each Sub-Processor directly under the terms of this Agreement. 

11.6     Personal Data may be transferred to, stored and/or processed in any country or territory where one or more of Numerix's Third Party Providers are located or maintain facilities, including countries outside Singapore. Where such Personal Data is transferred to a country outside of Singapore, Numerix shall take reasonable steps to ensure such Personal Data is treated securely and in accordance with the Data Protection Legislation.  Numerix shall monitor how Personal Data transferred from Singapore to a third country is treated and the Data Protection Legislation of a country where the Third Party Provider is located. if Numerix finds that it becomes difficult to ensure such Personal Data is treated securely and in accordance with the Data Protection Legislation of Singapore, Numerix shall stop transfer Personal Data to the relevant Third Party Provider.” 

3.1.4    Section 14.6.1 shall be deleted in its entirety and replaced as follows:

“14.6.1 charge interest from the invoice due date on the overdue sum at the rate of 4% per annum above the prime lending rate of the Bank of Singapore from time to time (as displayed on the website of the Association of Banks in Singapore at https://www.abs.org.sg/benchmark-rates/prime-lending-rates)”;

3.1.5    Section 19.7 is deleted in its entirety and replaced as follows:

“19.7    Without affecting any other right or remedy available to it, a party may terminate this Agreement (including all Order Forms under it) with immediate effect by giving written notice to the other party if:

19.7.1  that other party is deemed unable to pay its debts within the meaning of section 125(2)(c) of the Insolvency, Restructuring and Dissolution Act, 2018;

19.7.2  that other party takes any step in connection with its inability to pay debts or its winding up; 

19.7.3  that other party is the subject of the appointment of a receiver or administrator or administrative receiver; or

19.7.4  that other party commences negotiations with all or any of its creditors;

19.7.5  any event occurs, or proceeding is taken, with respect to the other party in any jurisdiction to which it is subject that has an effect equivalent or similar to any of the events mentioned in Section 19.7.1 to Section 19.7.4 (inclusive);”

3.1.6    Section 22.18 The words “law of the State of New York, USA” is replaced with the words “laws of Singapore”.

3.1.7    Section 22.19 The words “federal or state courts having jurisdiction over New York County, New York” is replaced with the words “courts of Singapore”.

4. People’s Republic of China (“PRC”)

4.1       The following relates only to changes to Data Protection Legislation for PRC located customers however all PRC located customers will contract with Numerix (Hong Kong) Limited for Subscription Services under the Agreement.

4.1.1    The definition of “Data Protection Legislation” shall be deleted in its entirety and replaced as follows:

Data Protection Legislation” means: Personal Information Protection Law of the People’s Republic of China as updated and amended from time to time”.

4.1.2   Section 11.4.1 shall be deleted in its entirety and replaced as follows:

“11.4.1 it has all necessary and appropriate rights, consents (for, without limitation but including, transfer out of PRC, third party provision, and collection of sensitive information), lawful bases and notices to enable Numerix to use and transfer Personal Data in connection with this Agreement”;

4.1.3    Section 11.4.5 through to Section 11.6 shall be inserted as follows:

“11.4.5 use reasonable endeavours to notify the Customer without undue delay on becoming aware of a personal data breach including data breach (as defined in the Data Protection Legislation) relating to Personal Data processed in connection with this Agreement and assist the Customer, at the Customer's cost, in ensuring compliance with the Customer's obligations under the Data Protection Legislation in relation to any personal data breach”;

11.4.6  at the written direction and cost of the Customer, delete or return Personal Data and copies thereof to the Customer on termination of the Agreement unless otherwise required by Data Protection Legislation; and

11.5     Sub-Processors

11.5.1  To the extent Numerix processes Personal Data as a processor, Customer consents to Numerix engaging, and transferring Personal Data to, the Third Party Providers (as sub-processors), including as identified in [Schedule 1] (each a Sub-Processor). Upon prior notification to Customer, Numerix may engage additional or replacement Sub-Processors to process Personal Data. To the extent Customer reasonably objects in writing to the appointment of a Sub-Processor it shall notify Numerix in writing and Numerix will either: (i) work with the Customer to address the Customer’s objections to its reasonable satisfaction, (ii) instruct the Sub-Processor not to process Personal Data, provided that the Customer accepts that this may impair the Services (for which Numerix shall bear no responsibility or liability).

11.5.2  Numerix shall enter into a written agreement with each Sub-Processor incorporating terms which are substantially similar to those set out in this Section 11 (Data Protection).

11.5.3  Notwithstanding Section 12.2, Numerix shall be liable for the performance of a Sub-Processor's obligations in connection with the processing of Personal Data on Customer's behalf, only to the same extent Numerix would be liable if performing the services or processing of each Sub-Processor directly under the terms of this Agreement. 

11.6   Personal Data may be transferred to, stored and/or processed in any country or territory where one or more of Numerix's Third Party Providers are located or maintain facilities, including countries outside PRC. Where such Personal Data is transferred to a country outside of PRC, Numerix shall take reasonable steps to ensure such Personal Data is treated securely and in accordance with the Data Protection Legislation.  Numerix shall monitor how Personal Data transferred from PRC to a third country is treated and the Data Protection Legislation of a country where the Third Party Provider is located. If Numerix finds that it becomes difficult to ensure such Personal Data is treated securely and in accordance with the Data Protection Legislation of Singapore, Numerix shall stop transfer Personal Data to the relevant Third Party Provider”. 

5. Hong Kong 

5.1. The following changes will be made to the Agreement if Customer is executing its Order Form with Numerix (Hong Kong) Limited and such changes shall only apply in connection with such Order Form:

5.1.1     The definition of “Data Protection Legislation” shall be deleted in its entirety and replaced as follows:

“Data Protection Legislation” means all applicable data protection and privacy legislation in force from time to time in Hong Kong including without limitation the Personal Data (Privacy) Ordinance (Chapter 486 of the Laws of Hong Kong) as updated and amended from time to time”.

5.1.2    Section 11.4.2 shall be deleted in its entirety and replaced as follows:

“11.4.2 take all practical steps to ensure that Personal Data is not kept longer than is necessary for the fulfilment of the purpose (including any directly related purpose) for which the data is or is to be used and take all practical steps to protect against unauthorised or unlawful processing of Personal Data and against accidental loss or destruction of, or damage to, Personal Data, appropriate to the harm that might result from the unauthorised or unlawful processing or accidental loss, destruction or damage and the nature of the data to be protected, having regard to the state of technological development and the cost of implementing any measures in accordance with the applicable Numerix computer system access and use policies, guidelines, procedures and requirements, as well as the Numerix security and privacy policies, as described in the Numerix Trust Center”.

5.1.3    Section 11.3.1 shall be deleted in its entirety and replaced as follows:

“11.3.1 it has all necessary and appropriate rights, consents (for, without limitation but including, transfer out of Hong Kong, third party provision, and collection of sensitive information), lawful bases and notices to enable Numerix to use  and transfer Personal Data in connection with this Agreement”;

5.1.4    Section 11.4.5 through to Section 11.6 shall be inserted as follows:

“11.4.5 use reasonable endeavours to notify the Customer without undue delay on becoming aware of a personal data breach (i.e. a suspected breach of data security of personal data held by a data user, exposing the data to the risk of unauthorised or accidental access, processing erasure, loss or use) relating to Personal Data processed in connection with this Agreement and assist the Customer, at the Customer's cost, in ensuring compliance with the Customer's obligations under the Data Protection Legislation in relation to any personal data breach”;

11.4.6  at the written direction and cost of the Customer, delete or return Personal Data and copies thereof to the Customer on termination of the Agreement unless otherwise required by Data Protection Legislation; 

11.5     Sub-Processors

11.5.1  To the extent Numerix processes Personal Data as a processor, Customer consents to Numerix engaging, and transferring Personal Data to, the Third Party Providers (as sub-processors), including as identified in [Schedule 1] (each a Sub-Processor). Upon prior notification to Customer, Numerix may engage additional or replacement Sub-Processors to process Personal Data. To the extent Customer reasonably objects in writing to the appointment of a Sub-Processor it shall notify Numerix in writing and Numerix will either: (i) work with the Customer to address the Customer’s objections to its reasonable satisfaction, (ii) instruct the Sub-Processor not to process Personal Data, provided that the Customer accepts that this may impair the Services (for which Numerix shall bear no responsibility or liability).

11.5.2  Numerix shall enter into a written agreement with each Sub-Processor incorporating terms which are substantially similar to those set out in this Section 11 (Data Protection).

11.5.3  Notwithstanding Section 12.2, Numerix shall be liable for the performance of a Sub-Processor's obligations in connection with the processing of Personal Data on Customer's behalf, only to the same extent Numerix would be liable if performing the services or processing of each Sub-Processor directly under the terms of this Agreement. 

11.6     Personal Data may be transferred to, stored and/or processed in any country or territory where one or more of Numerix's Third Party Providers are located or maintain facilities, including countries outside Singapore. Where such Personal Data is transferred to a country outside of Singapore, Numerix shall take reasonable steps to ensure such Personal Data is treated securely and in accordance with the Data Protection Legislation.  Numerix shall monitor how Personal Data transferred from Hong Kong to a third country is treated and the Data Protection Legislation of a country where the Third Party Provider is located. if Numerix finds that it becomes difficult to ensure such Personal Data is treated securely and in accordance with the Data Protection Legislation of Hong Kong, Numerix shall stop transfer Personal Data to the relevant Third Party Provider.” 

5.1.5    Section 14.6.1 shall be deleted in its entirety and replaced as follows:

“14.6.1 charge interest from the invoice due date on the overdue sum at the rate of 4% per annum above the prime lending rate of  Barclays Bank PLC's/Hongkong and Shanghai Banking Corporation from time to time”;

5.1.6    Section 19.7 shall be deleted in its entirety and replaced as follows:

“19.7    Without affecting any other right or remedy available to it, a party may terminate this Agreement (including all Order Forms under it) with immediate effect by giving written notice to the other party if:

19.7.1  that other party is deemed unable to pay its debts within the meaning of Section 178 of the Companies (Winding Up and Miscellaneous Provisions) Ordinance (Chapter 32 of the Laws of Hong Kong);

19.7.2  that other party takes any step in connection with its inability to pay debts or its winding up; 

19.7.3  that other party is the subject of the appointment of a receiver or administrator or administrative receiver; or

19.7.4  that other party commences negotiations with all or any of its creditors;

19.7.5  any event occurs, or proceeding is taken, with respect to the other party in any jurisdiction to which it is subject that has an effect equivalent or similar to any of the events mentioned in Section 19.7.1 to Section 19.7.4 (inclusive);”

5.1.7    Section 22.18 The words “law of the State of New York, USA” is replaced with the words “laws of Hong Kong”.

5.1.8    Section 22.19 The words “federal or state courts having jurisdiction over New York County, New York” is replaced with the words “courts of Hong Kong”.

6. Ireland

6.1.   The following changes will be made to the Agreement if Customer is executing its Order Form with Numerix Software Ireland Ltd. and such changes shall only apply in connection with such Order Form:

6.1.1  The definition of “Data Protection Legislation” shall be deleted in its entirety and replaced as follows:

Data Protection Legislation” means all applicable data protection and privacy legislation in force from time to time in Ireland including without limitation without limitation: the General Data Protection Regulation (EU) 2016/679) (“GDPR”) as updated and amended from time to time”.

6.1.2 Section 11.3.1 shall be deleted in its entirety and replaced as follows:

“11.3.1 it has all necessary and appropriate rights, consents (for, without limitation but including, transfer out of Ireland, third party provision, and collection of sensitive information), lawful bases and notices to enable Numerix to use  and transfer Personal Data in connection with this Agreement”;

6.1.3 Section 11.4.5 through to Section 11.7 shall be inserted as follows:

“11.4.5  use reasonable endeavours to notify the Customer without undue delay on becoming aware of a personal data breach including data breach (as defined in the GDPR) relating to Personal Data processed in connection with this Agreement and assist the Customer, at the Customer's cost, in ensuring compliance with the Customer's obligations under the Data Protection Legislation in relation to any personal data breach”;

11.4.6  use reasonable endeavours to notify the Customer without undue delay on becoming aware of a personal data breach (as defined in the GDPR) relating to Personal Data processed in connection with this Agreement and assist the Customer, at the Customer's cost, in ensuring compliance with the Customer's obligations under the Data Protection Legislation in relation to any personal data breach;

11.4.7  at the written direction and cost of the Customer, delete or return Personal Data and copies thereof to the Customer on termination of the Agreement unless otherwise required by Data Protection Legislation; and

11.5             The parties acknowledge that the Customer must be able to assess Numerix’s compliance with its obligations under the Data Protection Legislation and Section 11 of this Agreement, insofar as Numerix is acting as a processor on behalf of Customer. The following provisions shall apply when the Customer is exercising such right: 

(a)        Numerix may, in its sole discretion, engage external auditors to verify the adequacy of its security measures with respect to its processing of Personal Data. Where such audits result in the generation of a confidential audit report (“Audit Report”), Numerix shall, upon prior written request and no more than once per year, and subject to the confidentiality provisions of the Agreement, make available to Customer (or Customer’s Third-Party’s Auditor) a copy of the summary of the then-current Audit Report. Such Audit Reports may also be shared with Customer’s competent supervisory authority on its request and where required under Data Protection Legislation. 

(b)        Customer may contact Numerix to request a remote audit of Numerix’s processing activities covered by this Agreement (“Remote Audit”). A Remote Audit may be conducted by Customer through a Third-Party Auditors (as defined below in Section 11.4.7(d) selected by Customer when:

(i)                     Numerix’s provision of an Audit Report is not sufficient to demonstrate compliance with the obligations set out in this Section 11; or

(ii)                    Such an audit is required by Customer’s competent supervisory authority

Any Remote Audit will be limited to Customer’s Personal Data processing by Numerix.

(c)        Customer acknowledges that Numerix operates a multi-tenant data storage environment. Accordingly, Numerix shall have the right to reasonably adapt the scope of any Remote Audit to avoid or mitigate risks with respect to, and including, service levels, availability, and confidentiality of other Numerix’s customers’ information.

(d)        A Remote Audit shall be conducted by Customer’s Third-Party Auditor: (i) acting reasonably, in good faith, and in a proportional manner, taking into account the nature and complexity of the Services used by Customer; (ii) up to one time per year with at least four (4) weeks’ advance written notice and (iii) during Numerix’s normal business hours, under reasonable duration and shall not unreasonably interfere with Numerix’s day-to-day operations. Before any Remote Audit commences, Customer and Numerix shall mutually agree upon the scope, timing, and duration of the audit and the reimbursement rate for which Customer shall be responsible. All reimbursement rates shall be reasonable, taking into account the resources expended by or on behalf of Numerix.  A “Third-Party Auditor” means a third-party independent contractor that is not a competitor of Numerix and who has entered into a non-disclosure agreement containing confidentiality provisions no less protective than those set forth in this Agreement to protect Numerix’s Confidential Information prior to the conduct of the Remote Audit. The costs of the Third-Party Auditor are at Customer’s expense. 

(e)        All information gathered during the Remote Audit and the Audit Report is confidential and cannot be divulged to third parties (unless mandated by applicable law) without Numerix’s prior written consent. Customer must promptly provide Numerix with information regarding any non-compliance discovered during the course of a Remote Audit.

11.6                 Sub-Processors. 

11.6.1  To the extent Numerix processes Personal Data as a processor, Customer consents to Numerix engaging, and transferring Personal Data to, the Third Party Providers (as sub-processors), including as identified in [Schedule 1] (each a Sub-Processor). Upon prior notification to Customer, Numerix may engage additional or replacement Sub-Processors to process Personal Data. To the extent Customer reasonably objects in writing to the appointment of a Sub-Processor it shall notify Numerix in writing and Numerix will either: (i) work with the Customer to address the Customer’s objections to its reasonable satisfaction, (ii) instruct the Sub-Processor not to process Personal Data, provided that the Customer accepts that this may impair the Services (for which Numerix shall bear no responsibility or liability).

11.6.2  Numerix shall enter into a written agreement with each Sub-Processor incorporating terms which are substantially similar to those set out in this Section 11 (Data Protection).

11.6.3  Notwithstanding Section 12.2, Numerix shall be liable for the performance of a Sub-Processor's obligations in connection with the processing of Personal Data on Customer's behalf, only to the same extent Numerix would be liable if performing the services or processing of each Sub-Processor directly under the terms of this Agreement. 

11.7               Personal Data may be transferred to, stored and/or processed in any country or territory where one or more of Numerix's Third Party Providers are located or maintain facilities, including countries outside Ireland or European Union (EU). Where such Personal Data is transferred to a country outside of Ireland or the EU, Numerix shall take reasonable steps to ensure such Personal Data is treated securely and in accordance with the Data Protection Legislation.  Numerix shall monitor how Personal Data transferred from Ireland to a third country (other than the EU) is treated and the Data Protection Legislation of a country where the Third Party Provider is located. if Numerix finds that it becomes difficult to ensure such Personal Data is treated securely and in accordance with the Data Protection Legislation of Ireland, Numerix shall stop transfer Personal Data to the relevant Third Party Provider”. 

6.1.4    Section 19.7 is deleted in its entirety and replaced as follows:

“19.7    Without affecting any other right or remedy available to it, a party may terminate this Agreement (including all Order Forms under it) with immediate effect by giving written notice to the other party if:

19.7.1  that other party is deemed unable to pay its debts within the meaning of section 570 of the Companies Act 2014;

19.7.2  that other party takes any step in connection with its inability to pay debts or its winding up; 

19.7.3  that other party is the subject of the appointment of a receiver or administrator or administrative receiver; or

19.7.4  that other party commences negotiations with all or any of its creditors;

19.7.5  any event occurs, or proceeding is taken, with respect to the other party in any jurisdiction to which it is subject that has an effect equivalent or similar to any of the events mentioned in Section 19.7.1 to Section 19.7.4 (inclusive);”

6.1.5     Section 22.18 The words “State of New York, USA” is replaced with the words “Republic of Ireland”.

6.1.6    Section 22.19 The words “federal or state courts having jurisdiction over New York County, New York” is replaced with the words “courts of Dublin, located in the Republic of Ireland”.