INFORMATION ON DATA EXPORT OPTIONS AND THE PROVIDER SWITCHING PROCESS (DATA ACT)

This page provides the information required under Regulation (EU) 2023/2854 of the European Parliament and of the Council on harmonised rules on fair access to and use of data (the “Data Act”) concerning:

• a detailed specification of all categories of data and digital assets that can be transferred during the provider-switching process, including all exportable data,
• an exhaustive specification of the categories of data specific to the internal functioning of the Service that are excluded from exportable data,
• information on the available procedures for switching providers of data processing services and transferring data, including available switching methods, transfer formats, and technical or other limitations known to wflow,
• data structures and formats, as well as relevant standards and open interoperability specifications, in which exportable data referred to in Article 25(2)(e) of the Data Act is available,
• information on the jurisdiction to which the information and communication technology infrastructure used for processing data is subject,
• a general description of the technical, organisational, and contractual measures implemented by wflow to prevent international governmental access to or transfer of non-personal data held in the European Union where such access or transfer could conflict with Union law or the national law of the relevant Member State.

The rights described on this page apply if and to the extent that the Service is provided as a data processing service within the meaning of the Data Act. To the extent that the Service does not meet the definition of a data processing service under the Data Act, these rights do not arise for the Customer.

1. AVAILABLE METHODS FOR PROVIDER SWITCHING AND DATA TRANSFER

Customers may switch to another provider of data processing services or migrate to their own on-premise infrastructure. The following methods are available for this purpose.

Export via API

Customers may use the wflow API interface. Documentation is available online.

Assisted Export and Migration Support

Upon request, wflow may provide migration assistance to the extent described in this document.

2. TECHNICAL AND OTHER KNOWN LIMITATIONS

Although wflow strives to make provider switching and data portability as smooth as possible, the following limitations may apply.

Dependencies on Third-Party Services

If the Customer uses integrations with third-party tools, data stored in those tools may be subject to their own limitations regarding export options, formats, or API availability. wflow cannot guarantee the portability of data that is processed exclusively within such third-party environments.

Performance and Capacity Limits

High-volume or frequent bulk exports may be subject to limitations (rate limits), scheduling, or batch processing in order to maintain the stability and performance of the Service for all customers.

Customer Configuration and Target Environment

Successful import into the target environment (another provider or an on-premise system) depends on the technical capabilities, configuration, and data model of that environment. wflow does not control and is not responsible for limitations on the side of the target system.

3. CATEGORIES OF EXPORTABLE DATA AND DIGITAL ASSETS, DATA STRUCTURES AND FORMATS

3.1 Categories of Exportable Data and Digital Assets

The Customer may obtain its data from the Service through a public API that is available online and fully documented. This interface enables secure and systematic downloading of data from the wflow Service without requiring individual cooperation from wflow.

In simple terms, the API acts as a standardised method for requesting data from the Service and using it elsewhere—for example, when switching to another provider or migrating to an on-premise solution.

How Data Export Works

The export process can be described as follows:

1. The Customer obtains access to the API (typically using an access key).
2. The Customer selects which data to download (e.g., documents or information about their processing).
3. The data is gradually downloaded from the Service and stored for further use.
4. The data can then be imported into another system or provided to a new service provider.

The entire process can run automatically, for example through a script or integration tool.

What Data Can Be Exported

Using the API, Customers can obtain in particular:

• documents stored in the Service,
• information about those documents (e.g., type, status, or identifiers),
• data extracted from documents,
• document attachment files,
• information about the progress of document processing.

The exact list of available data is provided in the API documentation.

Data Formats

Most data is provided in structured JSON or XML formats, which are commonly used and easily portable to other systems.

Exports may also include document attachment files (such as PDFs or images). These are provided through separate API calls as binary data (i.e., the original file content) and can be stored without further conversion.

Key Characteristics

• No dependency on wflow – Customers can export their data independently.
• Incremental export – Data can be downloaded continuously, including large volumes.
• Automation support – Export processes can be automated.

Additional Information

Detailed information about available data and export procedures is provided in the documentation:

• https://api.wflow.com/index.html
• https://developers.wflow.com/docs/wflowapidoc

3.2 Categories of Data That Cannot Be Exported

Bank Account Connection Configuration

These are specific parameters that present a security risk and are directly tied to technical system integrations. They are not the property of the Customer.

ERP System Connection Configuration

This data does not belong to the Customer.

BI Data

Protected to safeguard the intellectual property of wflow.

Automation Workflow Configuration

Protected to safeguard the intellectual property of wflow.

Collection Email Settings

This data does not belong to the Customer.

User Passwords and API Client Authentication Keys

Excluded for security reasons affecting both the Customer and wflow.

Please note that Customers are not entitled to receive data or digital assets protected by the intellectual property rights of wflow or constituting trade secrets of wflow or third parties, including, in particular, source code, machine code, or related documentation, unless otherwise stated in this document.

4. ICT INFRASTRUCTURE AND RELEVANT JURISDICTIONS

Data is stored in a database hosted within the Microsoft Azure cloud infrastructure in the European Union (Microsoft Azure North Europe – Ireland), including ongoing backups.

Backups are also automatically stored in a redundant data centre located in Microsoft Azure West Europe – Netherlands.

The relevant jurisdiction applicable to the primary cloud infrastructure is the Republic of Ireland.

5. MEASURES AGAINST UNLAWFUL INTERNATIONAL ACCESS BY PUBLIC AUTHORITIES

wflow is committed to ensuring that any international access by public authorities to non-personal data stored in the EU takes place in accordance with applicable EU and Member State law.

wflow has implemented a combination of technical, organisational, and contractual measures intended to prevent such access or challenge requests that would conflict with EU law or applicable national law.

Technical Measures

Logical and Physical Separation of Environments

Data stored within the EU is hosted in EU-based data centres and is logically separated from other environments.

Access Control and the Principle of Least Privilege

Access to production systems is strictly controlled, logged, and limited to authorised personnel based on role and business necessity.

Encryption

Data is protected both in transit and at rest using industry-standard encryption mechanisms, to the extent supported by the infrastructure and services used.

These measures reduce the risk that foreign public authorities gain direct access to data through infrastructure providers without following appropriate legal procedures.

Organisational and Contractual Measures

Contractual Commitments of Providers

wflow requires its cloud and infrastructure providers to comply with applicable EU law and, where legally permitted, to inform wflow of any legally binding requests from public authorities for access to data.

Where relevant, Standard Contractual Clauses (SCCs) are also agreed between wflow and the infrastructure provider.

Internal Procedures for Handling Requests

If wflow receives a request from a public authority outside the EU/EEA seeking access to data stored in the EU, it will:

• carefully assess the legal basis of the request,
• verify whether the request is compatible with EU law and applicable national law,
• challenge or oppose the request where there is a reasonable belief that it conflicts with such laws or exceeds the authority of the requesting body.

Transparency Toward Customers

Unless prohibited by law, wflow will inform affected Customers without undue delay of such requests and of the data concerned, enabling them to take appropriate measures to protect their interests.

‍