Contract number: [ complete ]  Contract conditions of December 2015  II.9.3 The contractor has right of recourse at any time to the European Data Protection  Supervisor.  II.9.4 If the contract requires the contractor to process any personal data, the contractor  may act only under the supervision of the data controller, in particular with regard  to the purposes of the processing, the categories of data that may be processed, the  recipients of the data and the means by which the data subject may exercise its  rights.  II.9.5 The contractor must grant  personnel access to the data to the extent strictly  necessary for the performance, management and monitoring of the contract.  II.9.6 The contractor must adopt appropriate technical and organisational security  measures giving due regard to the risks inherent in the processing and to the nature  of the personal data concerned in order to:  (a) prevent any unauthorised person from gaining access to computer systems  processing personal data, and especially:  (i)  unauthorised reading, copying, alteration or removal of storage media;  (ii)  unauthorised data inputting, as well as any unauthorised disclosure,  alteration or erasure of stored personal data;  (iii)  unauthorised use of data-processing systems by means of data transmission  facilities;  (b) ensure that authorised users of a data-processing system can access only the  personal data to which their access right refers;  (c) record which personal data have been communicated, when and to whom;  (d) ensure that personal data being processed on behalf of third parties can be  processed only in the manner prescribed by the contracting authority;  (e) ensure that, during communication of personal data and transport of storage media,  the data cannot be read, copied or erased without authorisation;  (f) design its organisational structure in such a way that it meets data protection  requirements.  II.10. SUBCONTRACTING  II.10.1  The contractor must not subcontract and have the contract performed by third  parties beyond the third parties already mentioned in its tender without prior  written authorisation from the contracting authority.  II.10.2  Even if the contracting authority authorises subcontracting, the contractor remains  bound by its contractual obligations and is solely responsible for the  performance  of this contract. 21 