Data Portability and Switching Providers

1. The Customer's options

When the Service changes or ends, the Customer may request, in particular:

1. switching to another provider of data processing services;
2. transfer of exportable data and digital assets to its own infrastructure;
3. a stand-alone export without an immediate switch;
4. erasure of exportable data and digital assets.

The request must be submitted from a verified administrator contact to [email protected] or through a feature made available in the Hub. It must sufficiently identify the Workspace and the procedure requested.

2. Initiating a switch

2.1. The maximum notice period for initiating a switch will not exceed two months from verification of a complete request, unless the parties agree on a shorter period or mandatory law requires otherwise.

2.2. KIVEX will confirm receipt of the request without undue delay and provide reasonably available information needed to carry out the switch, including the expected procedure, the cooperation required and known risks to continuity.

2.3. The Customer will provide in good time the details, authorisations and a secure destination needed for the transfer. A delay caused by a failure to provide necessary cooperation may affect the completion date accordingly.

3. Transitional period

3.1. The standard transitional period will not exceed 30 calendar days after the end of the notice period. During this period, to the extent required by law, KIVEX will:

• provide reasonable assistance to the Customer and to a third party authorised by it;
• maintain continuity of the Service concerned;
• disclose known risks of the switch;
• maintain an appropriate level of security during the transfer.

3.2. If the 30-day transitional period is technically unfeasible, KIVEX will notify this without undue delay, explain the reasons and set an alternative transitional period within the limits permitted by the Data Act.

3.3. The Customer may exercise the right to extend the transitional period to the extent granted to it by the Data Act.

4. Exportable data and digital assets

The following list is the contractual list of categories of data and digital assets that KIVEX considers exportable, provided that they have actually been created for the specific Customer and KIVEX lawfully retains them at the time of the request:

1. configuration of the Workspace and Agents, including names, custom instructions, permitted languages, permitted domains and user settings;
2. configuration of the widget and other customer settings that can be technically separated from KIVEX's internal software;
3. the list of the Customer's knowledge sources, their URLs, metadata and exportable content that the Customer has inserted or that KIVEX retains as processed source content and is entitled to release to the Customer;
4. conversations, messages and text transcripts of voice interactions within the current retention period;
5. leads, contact details voluntarily provided by End Users and requests for hand-off to staff;
6. topics, summaries, ratings and analytical outputs relating directly to the specific Customer or its Agents, where they are retained in the Service in an exportable form;
7. available usage events that relate directly to the specific Customer, its website or Agents and are not merely KIVEX's internal security or operational logs;
8. the list of Workspace members, roles and permissions, to the extent that their transfer is lawful;
9. exportable integration configuration data, excluding passwords, tokens, secret keys and other authentication secrets;
10. other customer digital items expressly created or uploaded through KIVEX features, where the feature concerned supports this.

KIVEX is not obliged to create data that did not arise in the Service or that has already been erased in accordance with the Contract and the law.

5. Categories excluded from export

The following categories in particular are excluded from export, unless mandatory law requires them to be made available:

1. KIVEX source code, model weights and non-public internal orchestration;
2. KIVEX internal system instructions, security rules, detection mechanisms and safeguards;
3. internal assessments of misuse, fraud, attacks and vulnerabilities, where disclosing them would compromise security;
4. internal operational logs that are not customer exportable data or that contain data of other customers;
5. global aggregated or anonymised statistics that do not relate directly to the specific Customer;
6. passwords, private keys, authentication tokens and other security secrets;
7. data and digital assets of third parties that KIVEX has no right to transfer;
8. internal derived parameters, embeddings and similar technical representations whose export is not necessary for an effective switch and whose disclosure would reveal protected technology or trade secrets.

Custom instructions, customer sources and customer configuration are not considered KIVEX internal system instructions.

6. Data structures, formats and interfaces

6.1. KIVEX provides the export in a commonly used, machine-readable format appropriate to the nature of the data. Structured customer data is by default intended to be delivered in a structured format such as JSON, JSONL or CSV; original customer files, where the feature concerned supports this and KIVEX lawfully retains them, may be delivered in their original format or another commonly usable format.

6.2. Each export package must contain or be accompanied by a description of the files, fields and formats used, to the extent necessary for their interpretation and transfer. KIVEX must not deliberately use a proprietary obstacle that would unjustifiably hinder an effective switch.

6.3. KIVEX will make available to the Customer, and to the destination provider authorised by it, a standard export or switching interface and the information needed to use it, to the extent required by the Data Act. The current technical means of access may be described in the Hub or in the technical documentation and may change, provided that this does not materially impede the statutory switch.

6.4. Where KIVEX supports a relevant open standard or open interoperability specification, it will state this in the technical documentation. Where no harmonised or open standard is generally applicable to a given type of data, KIVEX will provide sufficient documentation of its own export format.

7. Switching charges

7.1. Until 12 January 2027, KIVEX may charge only such switching charges as are permitted by the Data Act and do not exceed the costs directly linked to the switch concerned. If KIVEX requires such a charge, it will inform the Customer of it in advance.

7.2. From 12 January 2027, KIVEX will not charge switching charges to the extent that the Data Act prohibits them.

7.3. Additional professional services that are not a necessary condition for a standard export or switch, such as development of a custom connector, project management of a migration or customer-specific data transformation, may be ordered separately at a price agreed in advance.

8. Retrieval period

After the end of the transitional period, exportable data will remain available for download for at least 30 calendar days, unless mandatory law requires a longer period or the parties agree otherwise. The Customer is responsible for retrieving the data in good time and securely.

9. Termination and erasure

9.1. On successful completion of a switch, the Service concerned ends in the manner and at the time laid down by the Contract and applicable law.

9.2. If the Customer opts only for termination and erasure, the Contract ends on expiry of the applicable notice period or at another agreed time.

9.3. After the retrieval period has expired, KIVEX will delete exportable customer data from active systems, unless further retention is required by law or by a valid documented instruction. Backup copies are handled in accordance with the DPA and KIVEX's actual technical procedures.

10. Infrastructure jurisdiction and protection of non-personal data

10.1. KIVEX's primary production application, databases and storage are operated in Germany and are subject to the law of the European Union and the relevant law of the Member State. Supporting features may use other providers and jurisdictions depending on the specific feature enabled.

10.2. KIVEX takes appropriate technical, organisational and contractual measures to protect customer non-personal data held in the Union against unlawful access by third-country authorities, in particular access management, restriction of permissions, secure transfer, contractual management of suppliers and assessment of the legal basis of binding requests for access to data.

10.3. If KIVEX receives a binding request from a third-country public authority for access to non-personal data in the Union, it will act in accordance with applicable law and, to the extent legally possible, protect customer data against a request that conflicts with Union or Member State law.

11. Personal data protection

If an export contains personal data, KIVEX will provide it only to an authorised person and in accordance with the Customer's documented instructions. The Customer is responsible for the legal basis and security of any onward transfer to the new provider. The provisions of the DPA remain unaffected.