EU Data Act — Switching & Data Portability

This page explains, in plain terms, how to export your data from PageShield or switch to another provider under the EU Data Act. It describes the practical process and current technical details. The EU Data Act Addendum is the binding contractual document; if anything here conflicts with it, the Addendum controls.

What data can I export?

Where the Addendum applies, the following categories are exportable ("Exportable Data" and "Portable Digital Assets"), to the extent they are still retained under the normal retention rules when you request a switch:

• your Account and organisation information;
• your Protected Domains, Protected Pages, protected URLs, Redirect Destinations, authorised-domain lists and exclusions;
• your protection profiles, including redirect modes, triggers, percentages, schedules and alert settings, even if inactive because they exceed your current Plan's limit;
• webhook and integration destination settings (excluding passwords, private keys or other secrets that cannot be exported securely);
• your Detection Event records, Heartbeat records, reports and other output records still retained at the time of export; and
• export files and configuration assets you have a right to use independently of your continuing PageShield relationship.

Some internal categories are not exportable because they would disclose PageShield's own intellectual property, trade secrets or security-sensitive information, for example: source code and internal technical documentation; detection algorithms, scoring methods and abuse-prevention logic; infrastructure credentials and security configuration; internal operational and debugging logs; and aggregated or irreversibly anonymised statistics that are not specific to your Account. The full, exhaustive lists are in Sections 6 and 7 of the EU Data Act Addendum.

Export formats and interfaces

Two export methods are available, at no charge:

• A secure ZIP archive containing UTF-8 CSV files for tabular records (such as Detection Events and Heartbeats) and JSON files for Account, organisation, protection-profile and configuration data. It is delivered through an authenticated dashboard flow or an access-controlled encrypted link. Each download link expires after seven (7) days and can be regenerated for as long as your retrieval period is open.
• A documented, authenticated export API (or equivalent open machine-to-machine interface), available on an equal basis to you and to any destination provider you authorise, subject to identity and security verification. No separate fee applies for using it, including on the free Starter Plan.

How to request a switch or export

Email support@pageshield.io with the subject line "EU Data Act Switching Request". In the request, identify your Account and state which of the following you want:

• switch all or part of the Service to another provider offering the same type of service;
• port your Exportable Data and Portable Digital Assets to your own on-premises infrastructure; or
• terminate the Service and have your Exportable Data and Portable Digital Assets erased, without switching to another provider.

If you're switching to another provider or using an authorised representative, include their details and any access permissions or security instructions we'll need to transfer data to them safely. We'll acknowledge your request and let you know without undue delay if anything material is missing before we can begin.

Timelines

These periods run from the date we receive a complete request identifying your Account and intended action:

• Notice period: up to two (2) months before the switching process begins.
• Transitional period: up to thirty (30) calendar days after the notice period, during which the switch is carried out. If that's technically unfeasible, we'll notify you within fourteen (14) working days of your request, explain why, and set an alternative period of up to seven (7) months. You can also extend the transitional period once yourself, for as long as you consider appropriate.
• Retrieval period: after the transitional period ends, your Exportable Data and Portable Digital Assets remain available for retrieval for at least thirty (30) calendar days.
• Erasure: once the switch is successfully completed and the retrieval period has passed, we erase the Exportable Data and Portable Digital Assets tied to your Account, except where the law requires us to keep something longer. You can request confirmation of deletion.

The full mechanics, including how "successful completion" is established and what happens if the process stalls, are in Sections 3 and 9 of the EU Data Act Addendum.

Charges

We don't charge for standard switching assistance, the export interfaces described above, or the assistance required by law. Additional bespoke assistance beyond that is only ever charged if you specifically request it and agree to the scope and price in advance. Any related payment, credit or refund is processed through Lemon Squeezy.

International access and infrastructure

Our main application environment, active database and database backups are hosted with Hetzner in Germany. Cloudflare provides authoritative DNS and basic DNS-layer protection only; it is not configured as an application proxy and does not receive application, API, Protection Snippet, detection or switching payloads. See the Subprocessor Register for the full current list of providers and their roles.

Data protection

A switching or export request is a separate process from a GDPR data-subject request, and one does not automatically trigger the other. Where an export includes personal data, the GDPR, the Data Processing Addendum and applicable international-transfer rules continue to apply, and we may verify your request or pause a transfer where reasonably necessary to prevent unauthorised disclosure or address a security concern.

Questions

For anything not covered here, email support@pageshield.io or read the full EU Data Act Addendum.