content_image/480540.jpg
<img src='content_image/480540.jpg'>

measures having regard to the risks inherent in the processing and to the nature of the personal data concerned in order to: 

a) prevent any unauthorised person from having access to computer systems processing personal data, and especially: 

(i) unauthorised reading, copying, alteration or removal of storage media, 

(ii) unauthorised data input as well as any unauthorised disclosure, alteration or erasure of stored personal data, 

(iii) unauthorised persons from using data-processing systems by means of data transmission facilities, 

b) ensure that authorised users of a data-processing system can access only the personal data to which their access right refers, 

c) record which personal data have been communicated, when and to whom, 

d) ensure that personal data being processed on behalf of third parties can be processed only in the manner prescribed by the Agency, 

e) ensure that, during communication of personal data and transport of storage media, the data cannot be read, copied or erased without authorisation, and 

f) design its organisational structure in such a way that it meets data protection requirements. 

## 9.7. Audit 

ECHA is entitled to conduct audits to verify the continuous compliance of the contractor to the requirements of this Framework Contract and when necessary, at the contractor ’s site. The contractor shall in a timely manner address the findings of the audit in proportion to the severity of the findings and within the timeframe agreed between the parties (Ref. in particular to sections 4.1.3, 4.1.8 and Annex 16 –  Service Level Agreement). 

## 9.8. Working schedule and working days 

A Full Time Equivalent  day (FTE) is 8 hours. 

One full year corresponds normally to an effective workload of 220 days. 

Normal working days  are Monday to Friday. These exclude  so-called ECHA holidays . ECHA holiday schedules become available in the preceding year. There are around 15-19 ECHA holidays per year. 

Any work at ECHA premises  is subject to the access and opening hours rules of ECHA. Any exceptions to these shall be agreed in advance with ECHA contract manager for the particular specific contract. 

For Recurrent Services  (e.g. Application Management) ECHA can request up to 24 hours per day, 7 days per week (see also Annex 10 for the applicable service bands). 

Basic Run Services  (e.g. corrective maintenance and service support) are normally to be provided throughout ECHA’s normal working days, between 8:00 and 18:00. 

Work outside of normal working days and/or hours  can be requested by ECHA in some circumstances. Such circumstances may include: 

1. For on-premise Times and Means work  outside of normal working hours, the following surcharges may apply: 

▪ On normal working days before 7 a.m. and after 8:30 p.m.: 50% of the corresponding person-day price for normal working hours, pro rata. 

