ANNEX II  to General Terms  and Conditions  Processing of personal data A. Processing of personal data by the Bank  B. Processing of personal data by the Service Provider  Version dated 26-03-2021  11  (e)  measures to protect personal data from accidental or unlawful destruction, loss, alteration, unauthorised  disclosure of or access to personal data transmitted, stored or otherwise processed.  (d)  a process for regularly testing, assessing and evaluating the effectiveness of technical and  organisational measures for ensuring the security of the processing;  (c)  the ability to restore the availability and access to personal data in a timely manner in the event of a  physical or technical incident;  (b)  the ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing  systems and services;  (a)  the pseudonymisation and encryption of personal data;  The Service Provider shall adopt appropriate technical and organisational security measures, giving due  regard to the risks inherent in the processing and to the nature, scope, context and purposes of processing, in  order to ensure, in particular, as appropriate:  The Service Provider shall grant personnel access to the data to the extent strictly necessary for the  implementation, management and monitoring of the Framework Agreement or a Contract. The Service  Provider must ensure that personnel authorised to process personal data has committed itself to confidentiality  or is under appropriate statutory obligation of confidentiality in accordance with the provisions of § 12 of these  General Terms and Conditions.  The Service Provider may act only on documented written instructions and under the supervision of the  controller, in particular with regard to the purposes of the processing, the categories of data that may be  processed, the recipients of the data and the means by which the data subject may exercise its rights.  The Service Provider shall assist the controller for the fulfilment of the controller’s obligation to respond to  requests for exercising rights of person whose personal data is processed in relation to this Framework  Agreement or a Contract as laid down in Chapter III (Articles 14-25) of Regulation (EU) No 2018/1725. The  Service Provider shall inform without delay the controller about such requests.  The processing of personal data by the Service Provider shall meet the requirements of Regulation (EU) No  2018/1725 and be processed solely for the purposes set out by the data controller.  Details concerning the processing of personal data are available in the data protection notice referred to in  the Framework Agreement.  Should the Service Provider or any other person whose personal data is processed in relation to this  Framework Agreement or a Contract have any queries concerning the processing of its personal data, it shall  address itself to the data controller. They may also address themselves to the Data Protection Officer of the  data controller. They have the right to lodge a complaint at any time to the European Data Protection  Supervisor.  The Service Provider or any other person whose personal data is processed by the data controller in relation  to this Framework Agreement or a Contract has specific rights as a data subject under Chapter III (Articles  14-25) of Regulation (EU) No 2018/1725, in particular the right to access, rectify or erase their personal data  and the right to restrict or, where applicable, the right to object to processing or the right to data portability.  Any personal data included in or relating to the Framework Agreement or a Contract, including its  implementation, shall be processed in accordance with Regulation (EU) No 2018/1725. Such data shall be  processed solely for the purposes of the implementation, management and monitoring of the Framework  Agreement and any Contract by the data controller. 