What happens to the data at the end of the contract?

This should be decided beforehand, not at expiration: normally, the data is returned in a readable format and then deleted from the vendor's systems, within an agreed timeframe and with written confirmation. Backups and third-party services must also be considered, since they have their own deletion cycles. This is the point most often overlooked, and it's what makes switching vendors difficult.