Contract number: ECHA/2020/724  Restricted  Service contract conditions of December 2018  (d) carry out data protection impact assessments and prior consultations as necessary.  II.10.1  The contractor must not subcontract and have the contract performed by third  parties beyond the third parties already mentioned in its tender without prior written  authorisation from the contracting authority.  II.10.2  Even if the contracting authority authorises subcontracting, the contractor remains  bound by its contractual obligations and is solely responsible for the  performance of this  contract .  II.10.3  The contractor must ensure that the subcontract does not affect the rights of the  contracting authority under this contract, particularly those under Articles II.8, II.13 and  II.24.  II.10.4  The contracting authority may request the contractor to replace a subcontractor found  to be in a situation provided for in points (d) and (e) of Article II.18.1. II.11.1 Any amendment to the contract must be made in writing before all contractual  obligations have been fulfilled. II.11.2 Any amendment must not make changes to the contract that might alter the initial  conditions of the procurement procedure or result in unequal treatment of tenderers.  II.12.1  The contractor must not assign the rights and obligations arising from the contract,  including claims for payments or factoring, without prior written authorisation from the  contracting authority. In such cases, the contractor must provide the contracting  authority with the identity of the intended assignee.  The contractor shall maintain a record of all data processing operations carried on behalf of the  controller, transfers of personal data, security breaches, responses to requests for exercising  rights of people whose personal data is processed and requests for access to personal data by  third parties.  The contracting authority is subject to Protocol 7 of the Treaty on the Functioning of the European  Union on the privileges and immunities of the European Union, particularly as regards the  inviolability of archives (including the physical location of data and services as set out in Article  I.9.2) and data security, which includes personal data held on behalf of the contracting authority  in the premises of the contractor or subcontractor.  The contractor shall notify the contracting authority without delay of any legally binding request  for disclosure of the personal data processed on behalf of the contracting authority made by any  national public authority, including an authority from a third country. The contractor may not  give such access without the prior written authorisation of the contracting authority.  The duration of processing of personal data by the contractor will not exceed the period referred  to in Article II.24.2. Upon expiry of this period, the contractor shall, at the choice of the  controller, return, without any undue delay in a commonly agreed format, all personal data  processed on behalf of the controller and the copies thereof or shall effectively delete all personal  data unless Union or national law requires a longer storage of personal data. For the purpose of Article II.10, if part or all of the processing of personal data is subcontracted  to a third party, the contractor shall pass on the obligations referred to in Articles I.9.2 and  II.9.2 in writing to those parties, including subcontractors. At the request of the contracting  authority, the contractor shall provide a document providing evidence of this commitment. II.10. SUBCONTRACTING  II.11. AMENDMENTS  II.12. ASSIGNMENT 19 