In the contract between the controller and processor for the processing of personal data, which...

Erase all personal data after the completion of treatment-related services, deleting existing copies.

Treat personal data only through documented instructions, including with regard to data transfers to third countries or international organizations.

Ensure that the persons authorized to process personal data have made a commitment to confidentiality.

Apply technical and organizational measures to ensure that only personal data that are necessary for each specific purpose of processing are processed.