Contract number: ECHA/2020/666  (c) not disclose, directly or indirectly,  confidential information or documents to  third parties without the prior written agreement of the other party.  II.8.3  The confidentiality obligations set out in this Article are binding on the contracting  authority and the contractor during the  implementation of the FWC  and for as long  as the information or documents remain confidential unless: (a) the disclosing party agrees to release the receiving party from the  confidentiality obligation earlier; (b) the  confidential information or documents  become public through other means  than a breach of the confidentiality obligation; (c) the applicable law requires the disclosure of the  confidential information or  documents . II.8.4  The contractor must obtain from any natural person with the power to represent it  or take decisions on its behalf, as well as from third parties involved in the  implementation of the FWC  a commitment that they will comply with this Article. At  the request of the contracting authority, the contractor must provide a document  providing evidence of this commitment.  II.9.1 Any personal data included in the FWC must be processed in accordance with  Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18 December  2000 on the protection of individuals with regard to the processing of personal data by the  Community institutions and bodies and on the free movement of such data or any legal  statute that may replace it. Such data must be processed by the data controller solely for  the purposes of the implementation, management and monitoring of the FWC. This does  not affect its possible transmission to bodies entrusted with monitoring or inspection tasks  in application of Union law.  II.9.2 The contractor has the right to access its personal data and the right to rectify any  such data. Under certain conditions, a right to erasure, restriction, objection and/or data  portability also applies. The contractor should address any queries concerning the  processing of its personal data to the data controller.  II.9.3 The contractor has right of recourse at any time to the European Data Protection  Supervisor.  II.9.4 If the FWC requires the contractor to process any personal data, the contractor may  act only under the supervision of the data controller, in particular with regard to the  purposes of the processing, the categories of data that may be processed, the recipients  of the data, the means by which the data subject may exercise its rights and with regard  to transfers of personal data to a third country or an international organisation, unless  required to do so by Union or Member State law to which the processor is subject.  II.9.5 The contractor must grant personnel access to the data to the extent strictly  necessary for the implementation, management and monitoring of the FWC.  II.9.6 The contractor must adopt appropriate technical and organisational security  measures, giving due regard to the risks inherent in the processing and to the nature of  the personal data concerned, in order to:  (a) prevent any unauthorised person from gaining access to computer systems  processing personal data, and especially:  28  II.9. PROCESSING OF PERSONAL DATA