(a) the data controller is the European Centre for Disease Prevention and Control (the Centre) 

(b) the data protection notice is available at: 

https://ecdc.europa.eu/sites/portal/files/media/en/aboutus/calls/Procurement%20Relate d%20Documents/ECDC%20-%20Privacy%20Statement.pdf 

## I.9.2 Processing of personal data by the contractor 

For the purpose of Article II.9.2, 

(a) the subject matter and purpose of the processing of personal data by the contractor are to coordinate, communicate, distribute material, analyse data, feedback/support to the participants and report to ECDC for the provision of EQA schemes of Salmonella , STEC and Listeria monocytogenes . The categories of personal data shall include contact information (names, emails, phone numbers and addresses). 

(b) The localisation of and access to the personal data processed by the contractor shall comply with the following: 

i. the personal data shall preferably only be processed within the territory of the European Union and the European Economic Area or in the case of a need for processing within a third country, the Centre’s permission shall first be obtained prior to any processing and the requirements laid down in Chapter V of Regulation (EU) 2018/1725 2 shall be complied with in full, including compliance with appropriate safeguards as further described in Annex V- additional data protection clauses ; 

ii. the data shall preferably only be stored in data centres located with the territory of the European Union and the European Economic Area or in the case of a need for their location in a third country, the Centre’s permission shall first be obtained prior to any processing, including storage, in the third country and the requirements laid down in Chapter V of Regulation (EU) 2018/1725 shall be complied with in full; 

iii. access to data may be given on a need to know basis only to authorised persons established in a country which has been recognised by the European Commission as providing adequate protection to personal data or where the controller and processor have provided appropriate safeguards and on condition that enforceable data subjects rights and effective legal remedies for data subjects are available. The requirements laid down in Chapter V of Regulation (EU) 2018/1725 shall be complied with in full; 

iv. the contractor may not change the location of data processing without the prior written authorisation of the contracting authority; 

v. any transfer of personal data under the FWC to third countries or international organisations shall fully comply with the requirements laid down in Chapter V of Regulation (EU) 2018/1725. 

