(c) not disclose, directly or indirectly, confidential information or documents to third parties without the prior written agreement of the other party. 

II.8.3 The confidentiality obligations set out in this Article are binding on the contracting authority and the contractor during the implementation of the FWC  and for as long as the information or documents remain confidential unless: 

(a) the disclosing party agrees to release the receiving party from the confidentiality obligation earlier; 

(b) the confidential information or documents  become public through other means than a breach of the confidentiality obligation; 

(c) the applicable law requires the disclosure of the confidential information or documents . 

II.8.4  The contractor must obtain from any natural person with the power to represent it or take decisions on its behalf, as well as from third parties involved in the implementation of the FWC  a commitment that they will comply with this Article. At the request of the contracting authority, the contractor must provide a document providing evidence of this commitment. 

## II.9. PROCESSING OF PERSONAL DATA 

II.9.1 Any personal data included in the FWC must be processed in accordance with Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data or any legal statute that may replace it. Such data must be processed by the data controller solely for the purposes of the implementation, management and monitoring of the FWC. This does not affect its possible transmission to bodies entrusted with monitoring or inspection tasks in application of Union law. 

II.9.2 The contractor has the right to access its personal data and the right to rectify any such data. Under certain conditions, a right to erasure, restriction, objection and/or data portability also applies. The contractor should address any queries concerning the processing of its personal data to the data controller. 

II.9.3 The contractor has right of recourse at any time to the European Data Protection Supervisor. 

II.9.4 If the FWC requires the contractor to process any personal data, the contractor may act only under the supervision of the data controller, in particular with regard to the purposes of the processing, the categories of data that may be processed, the recipients of the data, the means by which the data subject may exercise its rights and with regard to transfers of personal data to a third country or an international organisation, unless required to do so by Union or Member State law to which the processor is subject. 

II.9.5 The contractor must grant personnel access to the data to the extent strictly necessary for the implementation, management and monitoring of the FWC. 

II.9.6 The contractor must adopt appropriate technical and organisational security measures, giving due regard to the risks inherent in the processing and to the nature of the personal data concerned, in order to: 

(a) prevent any unauthorised person from gaining access to computer systems processing personal data, and especially: 

