FWC conditions of October 2018  Contract number: [ complete ]  II.9. PROCESSING OF PERSONAL DATA II.9.1 Any personal data included in the FWC must be processed in accordance with  Regulation (EC) No 45/2001 of the European Parliament and of the Council of  18 December 2000 on the protection of individuals with regard to the processing of  personal data by the Community institutions and bodies and on the free movement of  such data. Such data must be processed by the data controller solely for the purposes of  the implementation, management and monitoring of the FWC. This does not affect its  possible transmission to bodies entrusted with monitoring or inspection tasks in  application of Union law. II.9.2 The contractor has the right to access its personal data and the right to rectify any such  data. The contractor should address any queries concerning the processing of its  personal data to the data controller. II.9.3 The contractor has right of recourse at any time to the European Data Protection  Supervisor. II.9.4 If the FWC requires the contractor to process any personal data, the contractor may act  only under the supervision of the data controller, in particular with regard to the  purposes of the processing, the categories of data that may be processed, the recipients  of the data and the means by which the data subject may exercise its rights.  II.9.5 The contractor must grant  personnel  access to the data to the extent strictly necessary  for the implementation, management and monitoring of the FWC.  II.9.6 The contractor must adopt appropriate technical and organisational security measures,  giving due regard to the risks inherent in the processing and to the nature of the personal  data concerned, in order to:  (a)  prevent any unauthorised person from gaining access to computer systems processing  personal data, and especially:  (i)  unauthorised reading, copying, alteration or removal of storage media;  (ii)  unauthorised data inputting, as well as any unauthorised disclosure, alteration or erasure  of stored personal data;  (iii)  unauthorised use of data processing systems by means of data transmission facilities;  (b)  ensure that authorised users of a data-processing system can access only the personal  data to which their access right refers;  (c)  record which personal data have been communicated, when and to whom;  (d)  ensure that personal data being processed on behalf of third parties can be processed  only in the manner prescribed by the contracting authority;  (e)  ensure that, during communication of personal data and transport of storage media, the  data cannot be read, copied or erased without authorisation;  20 