Contract number: ECHA/2020/666  I.24 PROCESSING OF PERSONAL DATA UNDER THIS FWC 17  I.24.7  The contractor may only store (incl. back-up storage) and treat personal data using  datacentres or similar premises, located on the territory of the European Union member  states. Every additional data storage and/or treatment location within the European Union  member states envisaged during the period of implementation of the contract, must be  (f)  design its organisational structure in such a way that it meets data protection  requirements.  (e)  ensure that, during communication of personal data and transport of storage  media, the data cannot be read, copied or erased without authorisation;  (d)  ensure that personal data being processed on behalf of third parties can be  processed only in the manner prescribed by the contracting authority;  (c)  record which personal data have been communicated, when and to whom;  (b)  ensure that authorised users of a data-processing system can access only  the personal data to which their access right refers;  (iii)  unauthorised use of data processing systems by means of data  transmission facilities;  (ii)  unauthorised data inputting, as well as any unauthorised disclosure,  alteration or erasure of stored personal data;  (i)  unauthorised reading, copying, alteration or removal of storage  media;  (a)  prevent any unauthorised person from gaining access to computer systems  processing personal data, and especially:  I.24.6 The contractor must adopt appropriate technical and organisational security  measures, giving due regard to the risks inherent in the processing and to the nature of  the personal data concerned, in order to:  I.24.5 The contractor must grant  personnel access to the data to the extent strictly  necessary for the implementation, management and monitoring of the FWC.  I.24.4 If the FWC requires the contractor to process any personal data, the contractor  may act only under the supervision of the data controller, in particular with regard to the  purposes of the processing, the categories of data that may be processed, the recipients  of the data, the means by which the data subject may exercise its rights and with regard  to transfers of personal data to a third country or an international organisation, unless  required to do so by Union or Member State law to which the processor is subject.  I.24.3  The contractor has right of recourse at any time to the European Data Protection  Supervisor.  I.24.2  The contractor has the right to access its personal data and the right to rectify any  such data. Under certain conditions, a right to erasure, restriction, objection and/or data  portability also applies. The contractor should address any queries concerning the  processing of its personal data to the data controller. I.24.1 Any personal data included in the FWC must be processed in accordance with  Regulation (EC) No 45/2001 of the European Parliament and of the Council of  18 December 2000 on the protection of individuals with regard to the processing of  personal data by the Community institutions and bodies and on the free movement of  such data or any legal statute that may replace it. Such data must be processed by the  data controller solely for the purposes of the implementation, management and  monitoring of the FWC. This does not affect its possible transmission to bodies entrusted  with monitoring or inspection tasks in application of Union law.