(including for backup, business continuity purposes and transit) as well as locations from where remote operations are performed. Any plans for change of location shall be provided by the Contractor to the ECDC before data are processed in the new location with a pre-notice necessary for the ECDC to check in particular if this change complies with the Contract and the applicable law. The ECDC shall have the right to object to the change. 

## D – Certification 

In case of hosting through cloud services, the Contractor and its sub-contractors shall ensure that only cloud service providers are selected which are certified in accordance with a recognised certification scheme included in the Cloud Certification Schemes List, as published by ENISA at: https://resilience.enisa.europa.eu/cloud-computing-certification (or as published via a updated web link on ENISA’s website.) 

## E - Obligation after the termination of personal data processing services 

On the termination of the provision of data processing services , the Contractor and the sub- processors shall, at the choice of the ECDC: 

- without any delay, in a commonly agreed format, either return all the personal data and the copies thereof to the ECDC or transfer them to a destination designated by the ECDC itself, or 

- effectively delete all the personal data and certify to the ECDC that it has done so , if applicable this should be done once it has been verified and confirmed that the data have been successfully and completely transferred to the new processor or the ECDC. 

## F – ‘Portability’ of the data transferred to the Contractor (as a right for the ECDC to receive and transmit these data to another Contractor and to provide the data to a data subject) 

The Contractor shall ensure and be able to demonstrate the ‘ portability’ of the ECDC’s data from its systems, and any sub-processor system, to other providers of ECDC’s choice, within 2 days after having been notified in writing by the ECDC. The Contractor must ensure that the ECDC is provided fully with the service and access to the data during this period. 

The Contractor and any sub-processor shall keep the ECDC’s data safe and secure until transferred to another site under the control of the ECDC. 

The Contractor shall ensure the possibility to extract in a structured, commonly used and machine-readable format the personal data referring to a specific data subject. 

## G - Use and storage limitation 

The Contractor shall ensure that any personal data is processed only in order to execute tasks within the scope  of the contract. 

Personal data shall be retained for no longer than is necessary in order to execute tasks within the scope of the contract. Thereafter it shall be deleted. Indefinite retention of personal data is explicitly prohibited. 

