## A. Processing of personal data by the Bank 

## Processing of personal data 

Any personal data included in or relating to the Framework Agreement or a Contract, including its implementation, shall be processed in accordance with Regulation (EU) No 2018/1725. Such data shall be processed solely for the purposes of the implementation, management and monitoring of the Framework Agreement and any Contract by the data controller. 

The Service Provider or any other person whose personal data is processed by the data controller in relation to this Framework Agreement or a Contract has specific rights as a data subject under Chapter III (Articles 14-25) of Regulation (EU) No 2018/1725, in particular the right to access, rectify or erase their personal data and the right to restrict or, where applicable, the right to object to processing or the right to data portability. 

Should the Service Provider or any other person whose personal data is processed in relation to this Framework Agreement or a Contract have any queries concerning the processing of its personal data, it shall address itself to the data controller. They may also address themselves to the Data Protection Officer of the data controller. They have the right to lodge a complaint at any time to the European Data Protection Supervisor. 

Details concerning the processing of personal data are available in the data protection notice referred to in the Framework Agreement. 

## B. Processing of personal data by the Service Provider 

The processing of personal data by the Service Provider shall meet the requirements of Regulation (EU) No 2018/1725 and be processed solely for the purposes set out by the data controller. 

The Service Provider shall assist the controller for the fulfilment of the controller’s obligation to respond to requests for exercising rights of person whose personal data is processed in relation to this Framework Agreement or a Contract as laid down in Chapter III (Articles 14-25) of Regulation (EU) No 2018/1725. The Service Provider shall inform without delay the controller about such requests. 

The Service Provider may act only on documented written instructions and under the supervision of the controller, in particular with regard to the purposes of the processing, the categories of data that may be processed, the recipients of the data and the means by which the data subject may exercise its rights. 

The Service Provider shall grant personnel access to the data to the extent strictly necessary for the implementation, management and monitoring of the Framework Agreement or a Contract. The Service Provider must ensure that personnel authorised to process personal data has committed itself to confidentiality or is under appropriate statutory obligation of confidentiality in accordance with the provisions of § 12 of these General Terms and Conditions. 

The Service Provider shall adopt appropriate technical and organisational security measures, giving due regard to the risks inherent in the processing and to the nature, scope, context and purposes of processing, in order to ensure, in particular, as appropriate: 

(a) the pseudonymisation and encryption of personal data; 

(b) the ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services; 

(c) the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident; 

(d) a process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures for ensuring the security of the processing; 

(e) measures to protect personal data from accidental or unlawful destruction, loss, alteration, unauthorised disclosure of or access to personal data transmitted, stored or otherwise processed. 

