Europol Public Information  2. Administrative  Personal data of the Contractor shall be processed solely for the purpose of  performance and management of the  Framework Contract , without prejudice to Europol’s  right/obligation to transmit certain data to internal audit services, to the European Court of  Auditors, the Financial Irregularities Panel, the European Data Protection Supervisor and to the  European Anti-Fraud Office (OLAF) for the purposes of safeguarding the financial interests of the  Union or other legitimate purposes. 3. The Contractor or any other person whose  Personal data is processed by the Data controller in  relation to this FWC has specific rights as a data subject under Chapter III (Articles 14-25) of  Regulation (EU) No 2018/1725, in particular the right to access, rectify or erase their personal data  and the right to restrict or, where applicable, the right to object to processing and the right to data  portability. Should a member of  Contractor’s Personnel  have any queries concerning the processing  of its  Personal data , it shall address them to Europol’s Data Protection Officer as referred to the  following contact point:  DPO@europol.europa.eu. With regard to the processing of  Personal data ,  the  Contractor’s Personnel  have the right to recourse at any time to the European Data Protection  Supervisor: edps@edps.europa.eu. Details concerning the processing of Personal data are available  in the data protection notice referred to in Article I-9 and the Contractor shall ensure that  Contractor’s Personnel  are informed of the legal basis for Europol’s processing of their  Personal  data .  4. As the entity commissioning the  Services  and/or  Supplies,  Europol is the  Data controller  unless  otherwise specified in the Special Conditions. As regards any  Personal data  inputted by Europol into  Europol operational systems, Europol is always the  Data controller  with responsibilities as defined in  Regulation (EU) 2016/794.  1. The processing of Personal data by the Contractor shall meet the requirements of Regulation (EU)  No 2018/1725 and be processed solely for the purposes set out by the Data Controller.  2. For the purpose of this Article II.17.2,  (a) the subject matter and purpose of the processing of  Personal data by the Contractor are  described in the tender specifications as may be supplemented by the Special Conditions;  (b) Without prejudice to the locations specified in the Special Conditions, the localisation of and  access to the  Personal data  processed by the  Contractor  shall comply with the following:  i. the  Personal data  shall only be processed within the territory of the European Union and the  European Economic Area and will not leave that territory;  ii. the  Personal data shall only be held in data centres located within the territory of the  European Union and the European Economic Area;  iii. no access shall be given to such data outside of the European Union and the European  Economic Area;  iv. the  Contractor may not change the location of data processing without the prior written  authorisation of Europol;  v. any transfer of  Personal data  under the FWC to third countries or international organisations  shall comply with the requirements laid down in Chapter V of Regulation (EU)2018/1725.  3. The  Contractor  may not process  Personal data  derived from Europol [i.e. act as a  Data processor ]  except insofar as it is necessary for the performance of its contractual obligations and/or in  Page 47 of 79  Europol’s initials:  Contractor’s initials:  II.17.2 Processing of personal data by the Contractor 