Data Portability and Switching

Your data is yours. This page explains how to take it with you or move to another provider, as required by Chapter VI of Regulation (EU) 2023/2854 (the Data Act). It forms part of every SupaSailing subscription agreement (General Terms of Service, clause 14).

1. How to switch or export

• Write to [email protected] saying whether you want to switch to another provider, move the data to your own systems, or have it erased.
• The switching process starts at the latest one month after your request.
• We complete the switch within a 30-day transitional period, during which the service keeps running with full security and we help you with the exit. You may extend this period once.
• After that, you can still retrieve your data for at least 30 days. Then we erase it; encrypted backups are overwritten within 90 days.
• Switching and exporting are free of charge. Regular subscription fees until the end of the agreement are not switching charges.

2. What you can export, and in which formats

For every module: your account, users, roles and settings; all records you and your users created; uploaded files in their original format; audit and activity logs about your organisation. Structured data is exported as CSV, XLSX or JSON; files keep their original format (PDF, images, documents); signed documents are exported as PDF with their signature certificate.

Not exported, as they relate only to the internal functioning of the service and would disclose trade secrets: source code, internal system logs and metrics not specific to you, security configurations and keys, fraud-prevention signals, and our own templates and pricing models.

Known limitations: dashboards and reports are exported as the underlying records rather than as images; links between records are kept as identifiers in the export files.

3. Where the infrastructure is

The application servers run in Paris, France (EU). Each module keeps its database in the region below; uploaded files are stored with the database and backed up to encrypted object storage.

The providers of this infrastructure, and all other sub-processors, are listed on the sub-processors page with their jurisdiction.

4. Protection against unlawful access by non-EU authorities

As required by Article 28 of the Data Act, these are the measures we take to prevent international governmental access to, or transfer of, non-personal data held in the EU that would conflict with Union or national law:

• Data is stored in the EU (or the United Kingdom, under an EU adequacy decision) and encrypted in transit and at rest.
• Our providers are bound by contract to process data only on our instructions and to notify and challenge requests from authorities where lawful.
• We assess any request from a non-EU authority under Union law and disclose data only where required by a judgment or decision based on an international agreement, or where the conditions of Article 32 of the Data Act are met, and then only the minimum necessary.
• Unless prohibited, we inform you of any such request before complying.

5. Contact