definiens: ,,, and have the meaning given them in the Data Protection Directive, The Parties agree that ARCA is the Data Controller for the processing of the Personal Data for the purpose of conducting the Study, and [COMPANY] is the Data Processor acting on behalf and under instructions of ARCA, ARCA is responsible for compliance with the Data Protection Directive and the national laws implementing the Data Protection Directive, ARCA is responsible for the lawfulness of the Processing of Personal Data, including obtaining explicit consent from the Patients for the Processing of the health data of the Patients by [COMPANY] . ARCA shall answer patients ' requests, and, if and to the extent applicable, update and mOdify the notification to, or obtain approval from, the competent data protection authonty, ARCA shall issue written instructions, regarding the scope and the specific requirements for the Processing of the Personal Data by [COMPANY] . Medtronlc shall not be obliged to conduct any Processing of Personal Data In the absence of such written instructions, Medtronlc shall Process the Personal Data In compliance with this Agreement . and the written Instructions referenced in this Agreement and as otherwise mutually agreed . [COMPANY] shall have appropriate technical and organizational measures in place to protect the Personal Data against accidental or unlawful destrucllon or accidental loss, alterallon, unauthorized disclosure or access, and against all other unlawful forms of Processing, [COMPANY] shall be authorized to make use of subcontractors for the Processing of Personal Data which may be located outside of the European Economic Area and SWitzerland in countries not providing an adequate level of protection in the meaning of the Data Protection Directive