EU Data Act: Switching and Data Export

This document is published in several languages. In the event of any discrepancy between the language versions, the Polish version is binding.

Version 1.0 · Last updated: 16 October 2026

What Regulation (EU) 2023/2854 (the “Data Act”) means for formexposed, how you leave the service and take your data with you, in which formats this is possible and which law our infrastructure is subject to. Insofar as this page grants you rights in connection with switching and export, it forms part of your contract under the Terms of Service (Art. 25(1)). If it conflicts with the Terms of Service, the rule more favourable to you applies. Otherwise, it is for information.

1. Is formexposed a data processing service?

The Data Act has applied since 12 September 2025. Its rules on switching providers (Chapter VI, Art. 23 to 31) apply only to “data processing services” within the meaning of Art. 2(8): digital services that give a customer on-demand network access to a shared pool of configurable, scalable and elastic computing resources that can be rapidly provisioned and released with minimal management effort. Recital 81 expressly also mentions software as a service (SaaS).

We have examined this honestly, and the answer is not clear-cut:

• For: formexposed is software as a service. Customers set up domains, check intervals, alerts and form monitoring themselves, change, remove or (in the case of form monitoring) switch them off at any time without our involvement, and the service runs for all Customers on the same servers.
• Against: Customers do not outsource any of their own data sets or their own data processing to us. The service produces check results about third-party websites; the “computing resources” are our checks, not a storage or computing offering that Customers configure for their own purposes.

Because the distinction is open and the obligations of Chapter VI correspond in any case to how we want to run the service, we treat formexposed as if it were a data processing service and follow the rules below.

Exceptions under Art. 31 do not apply: formexposed is not a service custom-built for a single customer (paragraph 1) but a standard offering with public plans. The 14-day trial of a paid plan is the real service and not a separate testing version within the meaning of paragraph 2. The free check without an account does not create a contract for a data processing service; there is nothing to switch there, and the report expires after 30 days.

Other parts of the Data Act: Chapters II and III (data from connected products and related services) do not concern us; formexposed is not a connected product. Our contract terms do not prevent you from obtaining and using your own data, and do not exclude liability for intent and gross negligence (cf. Art. 13). For requests by public sector bodies under Chapter V, small and micro enterprises are obliged only in the event of a public emergency (Art. 15(2)); in any case, we hand over data only on a lawful, specific request and inform the Customer concerned to the extent the law permits.

Personal data first. The Data Act is without prejudice to the GDPR. Where we process third-party data on your behalf – for example subscribers of a client portal or copies of form e-mails in the delivery check – the Data Processing Agreement applies. Everything on this page applies within these limits.

2. Termination and switching (Art. 23 to 25)

• Taking your data with you: at any time, without notice and without an application. All export routes in section 4 except the export on request are available to you yourself during the term of the contract; there is no “switching procedure” that we would first have to approve.
• Switching or deletion with a maximum period (Art. 23 et seq., Art. 25(2)(c) and (d), Art. 25(3)): If you declare to us in text form, for example by e-mail or via the support window, that you are switching to another provider or to your own infrastructure, or that you want your exportable data to be deleted, a paid subscription ends no later than two months after receipt of this declaration (notice period), even if the paid period runs longer, for example on the annual plan. If you name an earlier date, it ends on that date. We refund fees paid in advance for the time after that on a pro rata basis. Until the subscription ends, the plan remains usable with all functions and export routes; what happens after that is set out in the following points. We confirm the end of the subscription to you in text form. You do not have to give a reason. For switching and deletion, this is also set out in the Terms of Service.
• Transitional period (Art. 25(2)(a), Art. 25(4) and (5)): In the case of a switch, the end of the notice period is followed by a transitional period of up to 30 calendar days during which the plan continues with all functions and export routes; we charge nothing for this. It ends earlier as soon as you inform us that the switch is complete. During this time, we assist you and third parties engaged by you with the switch, continue the service with due care, inform you of risks to its continuity known to us and maintain the level of security of the Technical and Organisational Measures, including for your data during the transfer. You can extend the transitional period once by a period that you consider more appropriate; for the period of the extension, you pay the ordinary fee for your plan on a pro rata basis for the actual duration. If it is technically not feasible, we will inform you of this, with reasons, within 14 working days of your declaration and name an alternative transitional period of no more than seven months; until then, the service continues free of charge.
• Ordinary termination of a paid plan: at any time in the Billing area, effective at the end of the current billing period (month or year). Until then the plan remains usable with all functions. On the annual plan, the price for twelve months is paid in advance; ordinary termination ends the renewal, not the paid term. If you want to switch or delete and leave earlier, use the declaration described in the point “Switching or deletion with a maximum period”.
• After the end of the paid period and of any transitional period, your account continues on the free plan, unless you have chosen deletion or requested that your account end (point “Deletion”). We delete nothing because of the change of plan; only the ordinary retention periods continue to run, for example for checks after 13 months, with the last result for each domain being kept. The data export under Settings and the export on request remain available without time limit until you delete the account. The period for retrieving your data is therefore longer than the 30 calendar days that Art. 25(2)(g) requires as a minimum. The API and the portfolio export belong to the Business plan; they end with it (section 4).
• Free plan: You end it by deleting your account. We may terminate it with 30 days’ notice; during this time the export remains available.
• Assistance and exit planning (Art. 25(2)(b)): We answer questions about switching and export via the support window, the contact page or by e-mail. On request, we give you the information you need to plan your exit, for example which data each export route contains and how it is structured.
• Deletion (Art. 25(2)(h)): If you have chosen deletion in your declaration, we delete your account with all exportable data at the end of the notice period. If, in the case of a switch, you have requested that your account also end, we delete it with all exportable data when the retrieval period of at least 30 calendar days after the transitional period expires, or earlier as soon as you confirm to us that the switch is complete; you can also delete the account yourself. Deletion is carried out in full in accordance with the rules described under Access, Erasure and Your Other Rights; that page also sets out what has to remain for a certain time for legal reasons. If you delete the account yourself, this takes effect immediately and cannot be undone. A running subscription then ends immediately and, as a rule, without a refund. If you have previously declared a switch or deletion, we refund on a pro rata basis for the time after the date on which the subscription would have ended under your declaration; the Terms of Service set out further exceptions. So export beforehand, and if you are switching, delete the account only after the subscription has ended following your switching declaration; if you only want to delete, choose deletion in the declaration described in the point “Switching or deletion with a maximum period”.

No obstacles. When switching, at most two months’ notice period, even on the annual plan, no proprietary data format, no penalty for leaving, no obligation to give reasons for the switch (Art. 23).

3. No switching charges (Art. 29)

We charge nothing for termination, export or switching – no charge for the data export, none for data egress, none for assistance with switching. From 12 January 2027, Art. 29(1) prohibits switching charges altogether; from 11 January 2024 to 12 January 2027, under Art. 29(2) and (3), providers may impose reduced switching charges that do not exceed the costs they incur that are directly linked to the switching. We do not make use of this transitional rule. If a paid subscription ends after a switching or deletion declaration before the end of the paid period, we refund the amount paid in advance for the time after that on a pro rata basis; we keep only the fee up to the end of the subscription. We do not charge for the transitional period; only for an extension that you request yourself do you pay the ordinary fee for your plan on a pro rata basis. This is a fee for the continued use of the plan, not a switching charge.

Information under Art. 29(4) and (6): Our ordinary fees are listed on the pricing page. We do not impose switching charges. Nor do we charge a contractual penalty or a separate fee for early termination; anyone who terminates without a switching or deletion declaration pays for the current billing period, as provided in the Terms of Service.

4. What you can export and in which format (Art. 25, 26 and 30)

All formats are open, structured and machine-readable; no tool of ours is needed to read them. The table lists all categories of exportable data (Art. 25(2)(e)); what is excluded from them is set out exhaustively in the next paragraph. It is also our overview of export routes and formats under Art. 26; we keep it up to date. The structure of the files is shown by the field names in the files themselves; on request, we will send a description to you and to the provider you are switching to. Examples for the API are in the agency area under API.

Not exportable is data that serves only the internal operation of the service and whose disclosure would endanger our trade secrets or the security of the service (Art. 2(38), Art. 25(2)(f)); its absence does not hinder or delay switching: password hashes, two-factor login secrets, tokens and signing keys, the encrypted credentials of test accounts (you created them yourself and know them), the weighting of our score, our detection rules and the abuse flags of our abuse prevention. Your right of access under Art. 15 GDPR remains unaffected.

Functional equivalence when switching (Art. 23(d), Art. 30(1)) is owed only by providers of infrastructure services; it does not apply to formexposed. For other services, Art. 30(2) requires open interfaces to be made available to all customers and the destination providers they choose, to the same extent and free of charge, to facilitate switching. For switching, all Customers on every plan therefore have the same free routes: the data export, the report links and the export on request, which, on your instructions, we also transmit directly to the provider you are switching to. The API is a function of the Business plan for ongoing operation.

5. Jurisdiction of our infrastructure and access by authorities (Art. 28 and 32)

• Location: formexposed runs on our own servers in Poland – a web server with database and a check server with a local language model in the same internal network. There is no cloud provider between you and us. Database backups are currently stored at the same location as the database and are not separately encrypted; an encrypted copy at a second location is planned.
• Service providers outside our servers are listed on the page Sub-processors: Namecheap, Inc. (Private Email), Phoenix, Arizona, USA for sending e-mail, Stripe for payments. We are still verifying where the mail service provider processes the data. Alerts to chat services go to the provider you choose yourself; we send messages to Telegram via our bot.
• Applicable law (Art. 28(1)(a)): Our own servers are subject to Polish law and the law of the European Union. To our knowledge, we ourselves are not subject to any third-country law that would give authorities there access to your data. The service providers outside our servers and the chat services that you choose as alert destinations may be subject to the law of a third country, for example the USA; which data passes through them is set out on the page Sub-processors.
• Requests from third-country authorities: We comply with a decision of a court or authority of a third country requiring the handover of non-personal data only if it is based on an international agreement or the conditions of Art. 32(3) are met. We examine every request, hand over only the minimum necessary and inform the Customer concerned beforehand, where permitted (Art. 32(4) and (5)).
• Safeguards (Art. 28(1)(b)): In contractual and organisational terms, the previous point applies to requests from third-country authorities. Technical safeguards against unlawful access are described in the Technical and Organisational Measures: encrypted external connections, access control, logging, encrypted storage of test accounts.

6. Interoperability (Chapter VIII)

Our interfaces use open, documented standards: JSON over HTTPS with bearer token authentication for the REST API, JSON-RPC 2.0 according to the Model Context Protocol for AI assistants, CSV in UTF-8 for the portfolio. Domains appear in their usual notation, check results with consistent keys per finding. For connecting to your own workflows, we provide templates for GitHub, GitLab and n8n. Harmonised standards and specifications for data processing services under Art. 35 do not yet exist; we will adopt them as soon as they are published and fit a service like ours.

7. Contact

Please send questions about switching and export, and requests for an export, to contact@lukaswojcik.com, via the contact page or the support window, quoting the keyword “Data Act export”. If something goes wrong, the procedure under Complaints applies.

Provider: LW IT Solutions Company Lukas Wójcik, al. Tadeusza Kościuszki 80/82, lok. 301, 90-437 Łódź, Poland, NIP 7252266190.