Contract number: NP/653/2019/AG Service contract conditions of December 2018

Il. GENERAL CONDITIONS FOR THE SERVICE CONTRACT

1.1. DEFINITIONS

For the purpose of this contract, the following definitions (indicated in italics in the text)
apply:

‘Back office’: the internal system(s) used by the parties to process electronic invoices;

‘Breach of obligations’: failure by the contractor to fulfil one or more of its contractual
obligations.

‘Confidential information or document’: any information or document received by either
party from the other or accessed by either party in the context of the performance of the
contract, that any of the parties has identified in writing as confidential. It may not include
information that is publicly available;

‘Conflict of interest’: a situation where the impartial and objective performance of the
contract by the contractor is compromised for reasons involving family, emotional life,
political or national affinity, economic interest, any other direct or indirect personal
interest, or any other shared interest with the contracting authority or any third party
related to the subject matter of the contract;

‘Creator’: means any natural person who contributes to the production of the result;

*EDI message’ (electronic data interchange): a message created and exchanged through the
electronic transfer, from computer to computer, of commercial and administrative data
using an agreed standard;

‘e-PRIOR’: the service-oriented communication platform that provides a series of web
services and allows the exchange of standardised electronic messages and documents
between the parties. This is done either through web services, with a machine-to-machine
connection between the parties’ back office systems (EDI messages), or through a web
application (the supplier portal). The Platform may be used to exchange electronic
documents (e-documents) such as electronic requests for services, electronic specific
contracts, and electronic acceptance of services or electronic invoices between the parties.

‘Force majeure’: any unforeseeable, exceptional situation or event beyond the control of
the parties that prevents either of them from fulfilling any of their obligations under the
contract. The situation or event must not be attributable to error or negligence on the part
of the parties or on the part of the subcontractors and must prove to be inevitable despite
their exercising due diligence. Defaults of service, defects in equipment or material or delays
in making them available, labour disputes, strikes and financial difficulties may not be
invoked as force majeure, unless they stem directly from a relevant case of force majeure;

‘Formal notification’ (or ‘formally notify’): form of communication between the parties
made in writing by mail or email, which provides the sender with compelling evidence that
the message was delivered to the specified recipient;

‘Fraud’: an act or omission committed in order to make an unlawful gain for the perpetrator
or another by causing a loss to the Union's financial interests, and relating to: i) the use or
presentation of false, incorrect or incomplete statements or documents, which has as its
effect the misappropriation or wrongful retention of funds or assets from the Union budget,
ii) the non-disclosure of information in violation of a specific obligation, with the same effect
or iii) the misapplication of such funds or assets for purposes other than those for which they
were originally granted, which damages the Union's financial interests;

Contract number: [complete] Service contract conditions of December 2018

'Grave professional misconduct': a violation of applicable laws or regulations or ethical
standards of the profession to which a contractor or a related person belongs, including any
conduct leading to sexual or other exploitation or abuse, or any wrongful conduct of the
contractor or a related person which has an impact on its professional credibility where such
conduct denotes wrongful intent or gross negligence.

“Interface control document’: the guideline document which lays down the technical
specifications, message standards, security standards, checks of syntax and semantics, etc.
to facilitate machine-to-machine connection. This document is updated on a regular basis;

“Irregularity’: any infringement of a provision of Union law resulting from an act or omission
by an economic operator, which has, or would have, the effect of prejudicing the Union’s
budget.

‘“Notification’ (or ‘notify’): form of communication between the parties made in writing
including by electronic means;

‘Performance of the contract’: the execution of tasks and delivery of the purchased
services by the contractor to the contracting authority;

‘Personnel’: persons employed directly or indirectly or contracted by the contractor to
perform the contract;

‘Pre-existing material’: any material, document, technology or know-how which exists prior
to the contractor using it for the production of a result in the performance of the contract;

‘Pre-existing right’: any industrial and intellectual property right on pre-existing material;
it may consist in a right of ownership, a licence right and/or right of use belonging to the
contractor, the creator, the contracting authority as well as to any other third parties;

‘Professional conflicting interest’: a situation in which the contractor’s previous or ongoing
professional activities affect its capacity to perform the contract to an appropriate quality
standard.

‘Related person’: any natural or legal person who is a member of the administrative,
management or supervisory body of the contractor, or who has powers of representation,
decision or control with regard to the contractor;

‘Result’: any intended outcome of the performance of the contract, whatever its form or
nature. A result may be further defined in this contract as a deliverable. A result may, in
addition to newly created materials produced specifically for the contracting authority by
the contractor or at its request, also include pre-existing materials;

‘Supplier portal’: the e-PRIOR portal, which allows the contractor to exchange electronic
business documents, such as invoices, through a graphical user interface.

Il.2. ROLES AND RESPONSIBILITIES IN THE EVENT OF A JOINT TENDER

In the event of a joint tender submitted by a group of economic operators and where the
group does not have legal personality or legal capacity, one member of the group is
appointed as leader of the group.

11.3. SEVERABILITY

Each provision of this contract is severable and distinct from the others. If a provision is or
becomes illegal, invalid or unenforceable to any extent, it must be severed from the
remainder of the contract. This does not affect the legality, validity or enforceability of any
other provisions of the contract, which continue in full force and effect. The illegal, invalid
or unenforceable provision must be replaced by a legal, valid and enforceable substitute

1A

Contract number: [complete] Service contract conditions of December 2018

provision which corresponds as closely as possible with the actual intent of the parties under
the illegal, invalid or unenforceable provision. The replacement of such a provision must be
made in accordance with Article II.11. The contract must be interpreted as if it had
contained the substitute provision as from its entry into force.

11.4. PERFORMANCE OF THE CONTRACT

11.4.1 The contractor must provide services of high quality standards, in accordance with
the state of the art in the industry and the provisions of this contract, in particular
the tender specifications and the terms of its tender. Where the Union has the right
to make modifications to the results, they must be delivered in a format and with
the necessary information which effectively allow such modifications to be made in
a convenient manner.

11.4.2 The contractor must comply with the minimum requirements provided for in the
tender specifications. This includes compliance with applicable obligations under
environmental, social and labour law established by Union law, national law and
collective agreements or by the international environmental, social and labour law
provisions listed in Annex X to Directive 2014/24/EU? and compliance with data
protection obligations resulting from Regulation (EU) 2016/679° and Regulation (EU)
2018/1725%.

11.4.3 The contractor must obtain any permit or licence required in the State where the
services are to be provided.

11.4.4 All periods specified in the contract are calculated in calendar days, unless otherwise
specified.

11.4.5 The contractor must not present itself as a representative of the contracting
authority and must inform third parties that it is not part of the European public
service.

11.4.6 The contractor is responsible for the personnel who carry out the services and
exercises its authority over its personnel without interference by the contracting
authority. The contractor must inform its personnel that:

(a) they may not accept any direct instructions from the contracting authority; and

(b) their participation in providing the services does not result in any employment or
contractual relationship with the contracting authority.

11.4.7 The contractor must ensure that the personnel performing the contract and any
future replacement personnel possess the professional qualifications and experience

 

m

OJ L 94 of 28.03.2014, p. 65

* Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016
on the protection of natural persons with regard to the processing of personal data and on
the free movement of such data, and repealing Directive 95/46/EC, OJ L 119, 4.5.2016, p.
# https://eur-lex.europa.eu/legal-
content/EN/TXT/?uri=uriserv:OJ.L_.2016.119.01.0001.01.ENG

* Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October

2018 on the protection of individuals with regard to the processing of personal data by the

Union institutions, bodies, offices and agencies and on the free movement of such data and

repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC, OJ L 295/39

21.11.2018, https://eur-lex.europa.eu/legal-

content/’EN/TXT/PDF/?uri=CELEX:32018R1725&from=EN

   

iı®

Contract number: [complete] Service contract conditions of December 2018

required to provide the services, as the case may be on the basis of the selection
criteria set out in the tender specifications.

11.4.8 At the contracting authority’s reasoned request, the contractor must replace any
member of personnel who:

(a) does not have the expertise required to provide the services; or
(b) has caused disruption at the premises of the contracting authority.

The contractor bears the cost of replacing its personnel and is responsible for any
delay in providing the services resulting from the replacement of personnel.

11.4.9 The contractor must record and report to the contracting authority any problem that
affects its ability to provide the services. The report must describe the problem,
state when it started and what action the contractor is taking to resolve it.

11.4.10 The contractor must immediately inform the Contracting authority of any changes in
the exclusion situations as declared, according to Article 137 (1) of Regulation (EU)
2018/1046.

11.5. COMMUNICATION BETWEEN THE PARTIES
11.5.1 Form and means of communication
Any communication of information, notices or documents under the contract must:
(a) be made in writing in paper or electronic format in the language of the contract;
(b) bear the contract number;
(c) be made using the relevant communication details set out in Article 1.8; and

(d) be sent by mail, email or, for the documents specified in the special conditions,

If a party requests written confirmation of an e-mail within a reasonable time, the other
party must provide an original signed paper version of the communication as soon as possible,

The parties agree that any communication made by email has full legal effect and is
admissible as evidence in judicial proceedings.

11.5.2 Date of communications by mail and email

Any communication is deemed to have been made when the receiving party receives it,
unless this contract refers to the date when the communication was sent.

E-mail is deemed to have been received by the receiving party on the day of dispatch of that
e-mail, provided that it is sent to the e-mail address indicated in Article 1.8. The sending
party must be able to prove the date of dispatch. In the event that the sending party receives
a non-delivery report, it must make every effort to ensure that the other party actually
receives the communication by email or mail. In such a case, the sending party is not held
in breach of its obligation to send such communication within a specified deadline.

Mail sent to the contracting authority is deemed to have been received by the contracting
authority on the date on which the department responsible referred to in Article 1.8 registers
it.

Contract number: [complete] Service contract conditions of December 2018

Formal notifications are considered to have been received by the receiving party on the
date of receipt indicated in the proof received by the sending party that the message was
delivered to the specified recipient.

11.5.3 Submission of e-documents via e-PRIOR

If provided for in the special conditions, the exchange of electronic documents (e-
documents) such as invoices between the parties is automated through the use of the e-
PRIOR platform. This platform provides two possibilities for such exchanges: either through
web services (machine-to-machine connection) or through a web application (the supplier
portal).

The contracting authority takes the necessary measures to implement and maintain
electronic systems that enable the supplier portal to be used effectively.

In the case of machine-to-machine connection, a direct connection is established between
the parties’ back offices. In this case, the parties take the measures necessary on their side
to implement and maintain electronic systems that enable the machine-to-machine
connection to be used effectively. The electronic systems are specified in the interface
control document. The contractor (or leader in the case of a joint tender) must take the
necessary technical measures to set up a machine-to-machine connection and at its own
cost.

If communication via the supplier portal or via the web services (machine-to-machine
connection) is hindered by factors beyond the control of one party, it must notify the other
immediately and the parties must take the necessary measures to restore this
communication.

If it is impossible to restore the communication within two working days, one party must
notify the other that alternative means of communication specified in Article 11.5.1 will be
used until the supplier portal or the machine-to-machine connection is restored.

When a change in the interface control document requires adaptations, the contractor (or
leader in the case of a joint tender) has up to six months from receipt of the notification to
implement this change. This period can be shortened by mutual agreement of the parties.
This period does not apply to urgent measures required by the security policy of the
contracting authority to ensure integrity, confidentiality and non-repudiation of information
and the availability of e-PRIOR, which must be applied immediately.

11.5.4 Validity and date of e-documents

The parties agree that any e-document, including related attachments exchanged via e-
PRIOR:

(a) is considered as equivalent to a paper document;
(b) is deemed to be the original of the document;

(c) is legally binding on the parties once an e-PRIOR authorised person has performed
the ‘sign’ action in e-PRIOR and has full legal effect; and

(d) constitutes evidence of the information contained in it and is admissible as evidence
in judicial proceedings.

The parties expressiy waive any rights to contest the validity of such a document solely on
the grounds that communications between the parties occurred through e-PRIOR or that the
document has been signed through e-PRIOR. If a direct connection is established between
the parties’ back offices to allow electronic transfer of documents, the parties agree that

Contract number: [complete] Service contract conditions of December 2018

an e-document, sent as mentioned in the interface control document, qualifies as an EDI
message.

If the e-document is dispatched through the supplier portal, it is deemed to have been
legally issued or sent when the contractor (or leader in the case of a joint tender) is able to
successfully submit the e-document without any error messages. The generated PDF and XML
document for the e-document are considered as a proof of receipt by the contracting
authority.

Inthe event that an e-document is dispatched using a direct connection established between
the parties’ back offices, the e-document is deemed to have been legally issued or sent
when its status is ‘received’ as defined in the interface control document.

When using the supplier portal, the contractor (or leader in the case of a joint tender) can
download the PDF or XML message for each e-document for one year after submission. After
this period, copies of the e-documents are no longer available for automatic download from
the supplier portal.

1.5.5 Authorised persons in e-PRIOR

The contractor submits a request for each person who needs to be assigned the role of ‘user’
in e-PRIOR. These persons are identified by means of the European Communication
Authentication Service (ECAS) and authorised to access and perform actions in e-PRIOR
within the permissions of the user roles that the contracting authority has assigned to them.

User roles enabling these e-PRIOR authorised persons to sign legally binding documents such
as specific tenders or specific contracts are granted only upon submission of supporting
documents proving that the authorised person is empowered to act as a legal representative
of the contractor.

11.6. LIABILITY

11.6.1 The contracting authority is not liable for any damage or loss caused by the
contractor, including any damage or loss to third parties during or as a consequence
of performance of the contract.

11.6.2 If required by the relevant applicable legislation, the contractor must take out an
insurance policy against risks and damage or loss relating to the performance of the
contract. It must also take out supplementary insurance as reasonably required by
standard practice in the industry. Upon request, the contractor must provide
evidence of insurance coverage to the contracting authority.

11.6.3 The contractor is liable for any loss or damage caused to the contracting authority
during or as a consequence of performance of the contract, including in the event of
subcontracting, but only up to an amount not exceeding three times the total amount
of the contract. However, if the damage or loss is caused by the gross negligence or
wilful misconduct of the contractor or of its personnel or subcontractors, as well as
in the case of an action brought against the contracting authority by a third party for
breach of its intellectual property rights, the contractor is liable for the whole
amount of the damage or loss.

11.6.4 If a third party brings any action against the contracting authority in connection with
the performance of the contract, including any action for alleged breach of
intellectual property rights, the contractor must assist the contracting authority in
the legal proceedings, including by intervening in support of the contracting authority
upon request.
If the contracting authority’s liability towards the third party is established and that

Contract number: [complete] Service contract conditions of December 2018

11.6.5

11.6.6

1.7.1

11.7.2

such liability is caused by the contractor during or as a consequence of the
performance of the contract, Article II.6.3 applies.

If the contractor is composed of two or more economic operators (i.e. who submitted
a joint tender), they are all jointly and severally liable to the contracting authority
for the performance of the contract.

The contracting authority is not liable for any loss or damage caused to the contractor
during or as a consequence of performance of the contract, unless the loss or damage
was caused by wilful misconduct or gross negligence of the contracting authority.

11.7. CONFLICT OF INTEREST AND PROFESSIONAL CONFLICTING INTERESTS

The contractor must take all the necessary measures to prevent any situation of
conflict of interest or professional conflicting interest.

The contractor must notify the contracting authority in writing as soon as possible of
any situation that could constitute a conflict of interest or a professional conflicting
interest during the performance of the contract. The contractor must immediately
take action to rectify the situation.

The contracting authority may do any of the following:

(a) verify that the contractor’s action is appropriate;

(b) require the contractor to take further action within a specified deadline;

11.7.3

The contractor must pass on all the relevant obligations in writing to:

(a) its personnel;

(b) any natural person with the power to represent it or take decisions on its behalf;

(c) third parties involved in the performance of the contract, including subcontractors.

11.8.1

11.8.2

The contractor must also ensure that the persons referred to above are not placed in
a situation which could give rise to conflicts of interest.

11.8. CONFIDENTIALITY
The contracting authority and the contractor must treat with confidentiality any
information or documents, in any format, disclosed in writing or orally relating to the
performance of the contract and identified in writing as confidential.

Each party must:

(a) not use confidential information or documents for any purpose other than to perform
its obligations under the contract without the prior written agreement of the other
party;

(b) ensure the protection of such confidential information or documents with the same
level of protection as its own confidential information and in any case with due
diligence;

(c) not disclose, directly or indirectly, confidential information or documents to third
parties without the prior written agreement of the other party.

1.8.3

The confidentiality obligations set out in this Article are binding on the contracting
authority and the contractor during the performance of the contract and for as long
as the information or documents remain confidential unless:

Contract number: [complete] Service contract conditions of December 2018

(a) the disclosing party agrees to release the receiving party from the confidentiality
obligation earlier;

(b) the confidential information or documents become public through other means than a
breach of the confidentiality obligation;

(c) the applicable law requires the disclosure of the confidential information or documents.

1.8.4 The contractor must obtain from any natural person with the power to represent it
or take decisions on its behalf, as well as from third parties involved in the
performance of the contract, a commitment that they will comply with this Article.
At the request of the contracting authority, the contractor must provide a document
providing evidence of this commitment.

11.9. PROCESSING OF PERSONAL DATA

11.9.1 Processing of personal data by the contracting authority

Any personal data included in or relating to the contract, including its implementation, shall
be processed in accordance with Regulation (EU) 2018/1725. Such data shall be processed
solely for the purposes of the implementation, management and monitoring of the contract
by the data controller.

The contractor or any other person whose personal data is processed by the data controller
in relation to this contract has specific rights as a data subject under Chapter Ill (Articles
14-25) of Regulation (EU) 2018/1725, in particular the right to access, rectify or erase their
personal data and the right to restrict or, where applicable, the right to object to processing
or the right to data portability.

Should the contractor or any other person whose personal data is processed in relation to
this contract have any queries concerning the processing of its personal data, it shall address
itself to the data controller. They may also address themselves to the Data Protection Officer
of the data controller. They have the right to lodge a complaint at any time to the European
Data Protection Supervisor.

Details concerning the processing of personal data are available in the data protection notice
referred to in Article 1.9.

11.9.2 Processing of personal data by the contractor

The processing of personal data by the contractor shall meet the requirements of Regulation
(EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the
protection of natural persons with regard to the processing of personal data and on the free
movement of such data, and repealing Directive 95/46/EC (General Data Protection
Regulation) and be processed solely for the purposes set out by the controller.

The contractor shall assist the controller for the fulfilment of the controller’s obligation to
respond to requests for exercising rights of person whose personal data is processed in
relation to this contract as laid down in Chapter Ill (Articles 14-25) of Regulation (EU)
2018/1725. The contractor shall inform without delay the controller about such requests.

The contractor may act only on documented written instructions and under the supervision
of the controller, in particular with regard to the purposes of the processing, the categories
of data that may be processed, the recipients of the data and the means by which the data
subject may exercise its rights.

The contractor shall grant personnel access to the data to the extent strictly necessary for
the implementation, management and monitoring of the contract. The contractor must
ensure that personnel authorised to process personal data has committed itself to

Contract number: [complete] Service contract conditions of December 2018

confidentiality or is under appropriate statutory obligation of confidentiality in accordance
with the provisions of Article 11.8.

The contractor shall adopt appropriate technical and organisational security measures,
giving due regard to the risks inherent in the processing and to the nature, scope, context
and purposes of processing, in order to ensure, in particular, as appropriate:

(a) the pseudonymisation and encryption of personal data;

(b) the ability to ensure the ongoing confidentiality, integrity, availability and resilience
of processing systems and services;

(c) the ability to restore the availability and access to personal data in a timely manner
in the event of a physical or technical incident;

(d) a process for regularly testing, assessing and evaluating the effectiveness of technical
and organisational measures for ensuring the security of the processing;

(e) measures to protect personal data from accidental or unlawful destruction, loss,
alteration, unauthorised disclosure of or access to personal data transmitted, stored
or otherwise processed.

The contractor shall notify relevant personal data breaches to the controller without undue
delay and at the latest within 48 hours after the contractor becomes aware of the breach.
In such cases, the contractor shall provide the controller with at least the following
information:

(a) nature of the personal data breach including where possible, the categories and
approximate number of data subjects concerned and the categories and approximate
number of personal data records concerned;

(b) likely consequences of the breach;

(c) measures taken or proposed to be taken to address the breach, including, where
appropriate, measures to mitigate its possible adverse effects.

The contractor shall immediately inform the data controller if, in its opinion, an instruction
infringes Regulation (EU) 2018/1725, Regulation (EU) 2016/679, or other Union or Member
State data protection provisions as referred to in the tender specifications.

The contractor shall assist the controller for the fulfilment of its obligations pursuant to
Article 33 to 41 under Regulation (EU) 2018/1725 to:

(a) ensure compliance with its data protection obligations regarding the security of the
processing, and the confidentiality of electronic communications and directories of
users;

(b) notify a personal data breach to the European Data Protection Supervisor;

(c) communicate a personal data breach without undue delay to the data subject, where
applicable;

(d) carry out data protection impact assessments and prior consultations as necessary.
The contractor shall maintain a record of all data processing operations carried on behalf of
the controller, transfers of personal data, security breaches, responses to requests for
exercising rights of people whose personal data is processed and requests for access to
personal data by third parties.

The contracting authority is subject to Protocol 7 of the Treaty on the Functioning of the
European Union on the privileges and immunities of the European Union, particularly as
regards the inviolability of archives (including the physical location of data and services as
set out in Article 1.9.2) and data security, which includes personal data held on behalf of the
contracting authority in the premises of the contractor or subcontractor.

The contractor shall notify the contracting authority without delay of any legally binding
request for disclosure of the personal data processed on behalf of the contracting authority
made by any national public authority, including an authority from a third country. The
contractor may not give such access without the prior written authorisation of the
contracting authority.

Contract number: [complete] Service contract conditions of December 2018

The duration of processing of personal data by the contractor will not exceed the period
referred to in Article 11.24.2. Upon expiry of this period, the contractor shall, at the choice
of the controller, return, without any undue delay in acommonly agreed format, all personal
data processed on behalf of the controller and the copies thereof or shall effectively delete
all personal data unless Union or national law requires a longer storage of personal data.

For the purpose of Article 11.10, if part or all of the processing of personal data is
subcontracted to a third party, the contractor shall pass on the obligations referred to in
Articles 1.9.2 and Il.9.2 in writing to those parties, including subcontractors. At the request
of the contracting authority, the contractor shall provide a document providing evidence of
this commitment.

11.10. SUBCONTRACTING

11.10.1 The contractor must not subcontract and have the contract performed by third
parties beyond the third parties already mentioned in its tender without prior written
authorisation from the contracting authority.

11.10.2 Even if the contracting authority authorises subcontracting, the contractor remains
bound by its contractual obligations and is solely responsible for the performance of
this contract.

11.10.3 The contractor must ensure that the subcontract does not affect the rights of the
contracting authority under this contract, particularly those under Articles 11.8, 11.13
and 11.24.

11.10.4 The contracting authority may request the contractor to replace a subcontractor
found to be in a situation provided for in points (d) and (e) of Article 11.18.1.

11.11. AMENDMENTS

11.11.1 Any amendment to the contract must be made in writing before all contractual
obligations have been fulfilled.

11.11.2 Any amendment must not make changes to the contract that might alter the initial
conditions of the procurement procedure or result in unequal treatment of tenderers.

11.12. ASSIGNMENT

11.12.1 The contractor must not assign the rights and obligations arising from the contract,
including claims for payments or factoring, without prior written authorisation from
the contracting authority. In such cases, the contractor must provide the contracting
authority with the identity of the intended assignee.

11.12.2 Any right or obligation assigned by the contractor without authorisation is not
enforceable against the contracting authority.

11.13. INTELLECTUAL PROPERTY RIGHTS
11.13.1. Ownership of the rights in the results
The Union acquires irrevocably worldwide ownership of the results and of all intellectual
property rights on the newly created materials produced specifically for the Union under the

contract and incorporated in the results, without prejudice however to the rules applying
to pre-existing rights on pre-existing materials, as per Article 11.13.2.

Ir