 2019  Contract number: [ complete ]  I.9.2 Processing of personal data by the contractor  https://ecdc.europa.eu/sites/portal/files/media/en/aboutus/calls/Procurement%20Relate d%20Documents/ECDC%20-%20Privacy%20Statement.pdf  (b) the data protection notice is available at: (a) the data controller is the European Centre for Disease Prevention and Control (the  Centre)  (a) the subject matter and purpose of the processing of personal data by the contractor are  to coordinate, communicate, distribute material, analyse data, feedback/support to the  participants and report to ECDC for the provision of EQA schemes of  Salmonella ,  STEC and  Listeria monocytogenes . The categories of personal data shall include contact  information (names, emails, phone numbers and addresses).  (b) The localisation of and access to the personal data processed by the contractor shall  comply with the following:  i. the personal data shall preferably only be processed within the territory of the  European Union and the European Economic Area or in the case of a need for  processing within a third country, the Centre’s permission shall first be obtained  prior to any processing and the requirements laid down in Chapter V of  Regulation (EU) 2018/1725 2 shall be complied with in full, including  compliance with appropriate safeguards as further described in Annex  V-  additional data protection clauses ;  ii. the data shall preferably only be stored in data centres located with the territory  of the European Union and the European Economic Area or in the case of a need  for their location in a third country, the Centre’s permission shall first be  obtained prior to any processing, including storage, in the third country and the  requirements laid down in Chapter V of Regulation (EU) 2018/1725 shall be  complied with in full;  iii. access to data may be given on a need to know basis only to authorised persons  established in a country which has been recognised by the European  Commission as providing adequate protection to personal data or where the  controller and processor have provided appropriate safeguards and on condition  that enforceable data subjects rights and effective legal remedies for data  subjects are available. The requirements laid down in Chapter V of Regulation  (EU) 2018/1725 shall be complied with in full;  iv. the contractor may not change the location of data processing without the prior  written authorisation of the contracting authority;  v. any transfer of personal data under the FWC to third countries or international  organisations shall fully comply with the requirements laid down in Chapter V  of Regulation (EU) 2018/1725.  For the purpose of Article II.9.2, 2  Regulation (EU) 2018/1725 of 23 October 2018 on the protection of natural persons with regard to the processing of personal  data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing  Regulation (EC) No 45/2001 and Decision No 1247/2002/EC, OJ L 295/39, 21.11.2018, https://eur-lex.europa.eu/legal- content/EN/TXT/PDF/?uri=CELEX:32018R1725&from=EN  10 