2. Administrative Personal data of the Contractor shall be processed solely for the purpose of performance and management of the Framework Contract , without prejudice to Europol’s right/obligation to transmit certain data to internal audit services, to the European Court of Auditors, the Financial Irregularities Panel, the European Data Protection Supervisor and to the European Anti-Fraud Office (OLAF) for the purposes of safeguarding the financial interests of the Union or other legitimate purposes. 

3. The Contractor or any other person whose Personal data is processed by the Data controller in relation to this FWC has specific rights as a data subject under Chapter III (Articles 14-25) of Regulation (EU) No 2018/1725, in particular the right to access, rectify or erase their personal data and the right to restrict or, where applicable, the right to object to processing and the right to data portability. Should a member of Contractor’s Personnel  have any queries concerning the processing of its Personal data , it shall address them to Europol’s Data Protection Officer as referred to the following contact point: DPO@europol.europa.eu. With regard to the processing of Personal data , the Contractor’s Personnel  have the right to recourse at any time to the European Data Protection Supervisor: edps@edps.europa.eu. Details concerning the processing of Personal data are available in the data protection notice referred to in Article I-9 and the Contractor shall ensure that Contractor’s Personnel are informed of the legal basis for Europol’s processing of their Personal data . 

4. As the entity commissioning the Services and/or Supplies, Europol is the Data controller unless otherwise specified in the Special Conditions. As regards any Personal data inputted by Europol into Europol operational systems, Europol is always the Data controller with responsibilities as defined in Regulation (EU) 2016/794. 

## II.17.2 Processing of personal data by the Contractor 

1. The processing of Personal data by the Contractor shall meet the requirements of Regulation (EU) No 2018/1725 and be processed solely for the purposes set out by the Data Controller. 

2. For the purpose of this Article II.17.2, 

(a) the subject matter and purpose of the processing of Personal data by the Contractor are described in the tender specifications as may be supplemented by the Special Conditions; 

(b) Without prejudice to the locations specified in the Special Conditions, the localisation of and access to the Personal data  processed by the Contractor shall comply with the following: 

i. the Personal data  shall only be processed within the territory of the European Union and the European Economic Area and will not leave that territory; 

ii. the Personal data shall only be held in data centres located within the territory of the European Union and the European Economic Area; 

iii. no access shall be given to such data outside of the European Union and the European Economic Area; 

iv. the Contractor may not change the location of data processing without the prior written authorisation of Europol; 

v. any transfer of Personal data  under the FWC to third countries or international organisations shall comply with the requirements laid down in Chapter V of Regulation (EU)2018/1725. 

3. The Contractor  may not process Personal data  derived from Europol [i.e. act as a Data processor ] except insofar as it is necessary for the performance of its contractual obligations and/or in 

