 2019  Contract number: [ complete ]  ANNEX VII- DATA PROTECTION CLAUSES  A - Description of the processing supported  B - Applicable data protection law C - Location of datacentres  The Contractor shall only process those categories of personal data identified as required by  ECDC. The categories include contact details for ESAC-Net network members.  The processing of the personal data shall be carried out in accordance with the relevant  provisions of  Regulation (EU) 2018/1725 $^{8}$. In particular, and among others, the Contractor  shall provide data subjects with specific rights (under Chapter III, Articles 14-25) and as  determined in the Contract, the SLA (if applicable) and its annexes. Where applicable, the Contractor shall also comply with  Regulation (EU) 2016/679 9 (hereinafter “the General Data Protection Regulation”). Where reference is made to Regulation  2018/1725 throughout these clauses, it is implicit that the equivalent provisions of the General  Data Protection Regulation are also intended to apply and shall be complied with. Any change in legislation applicable to the Contractor preventing it from fulfilling the  instructions received from the ECDC and the obligations provided under the Contract which is  likely to have a substantial adverse effect on the warranties and obligations provided by the  Clauses, shall promptly be notified by the Contractor to the ECDC as soon as the Contractor is  aware of the legislative change, even before its entry into force. In this case the ECDC is entitled  to suspend and/or terminate the Contract. The Contractor and any sub-contractor shall preferably only process personal data (incl. back- up storage) using datacentres or similar premises, located on the territory of the European Union  or European Economic Area. In the event that the datacentres or similar premises are located  in a third country, the Centre’s permission shall first be obtained prior to any processing,  including storage, in the third country and the requirements laid down in Chapter V of  Regulation (EU) 2018/1725 shall be complied with in full. The Contractor shall provide the ECDC with  comprehensive information on the physical  location  of the servers used by the Contractor and its sub-processors for the provided services  (including for backup, business continuity purposes and transit) as well as locations from where  8  Regulation (EU) 2018/1725 of the European Parliament and the Council of 23 October 2018 on the protection of  natural persons with regard to the processing of personal data by the Union, institutions, bodies, offices and  agencies and on the free movement of such data and repealing Regulation (EC) No 45/2001 and Decision No  1247/2002/EC.  9  Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of  natural persons with regard to the processing of personal data and on the free movement of such data, and  repealing Directive 95/46/EC (General Data Protection Regulation).  51 