Data Act Exit and Switching Policy

Version: 1.0 Effective from: 2026-10-09 Provider: Paul Bengart, Keplerstraße 4A, 39104 Magdeburg, Germany Legal basis: Regulation (EU) 2023/2854 (Data Act), Chapter VI (Articles 23 to 31) and Article 32. Chapter VI has applied since 12 September 2025, including to contracts concluded before that date. Related documents: This Policy forms part of the Terms of Service, in particular Section 8. It applies together with the Retention and Deletion Policy and the Data Processing Agreement. The export formats are described in the register Export Formats and Data Structures.

1. Scope

(1) This Policy governs how the Customer exports its data and digital assets from Choicery, how it switches to another data processing service or to its own infrastructure, and how the Provider deletes data after the end of the contract.

(2) It applies to Customers in the European Union (Article 1(3) Data Act) in all plans, including the Free Trial.

(3) This Policy covers three cases (Article 25(3) Data Act): a) switching to another provider of a data processing service; b) switching to the Customer's own infrastructure, operated by the Customer; c) termination without switching, in which the Customer has its data deleted.

(4) Changing from a paid plan to the Free Trial while the account continues to exist is not switching within the meaning of this Policy. The Terms of Service apply to it.

2. Exportable data and digital assets

(1) Exportable data are all input and output data that the Customer generates in Choicery or that relate directly to the Customer, including the associated metadata (Article 25(2)(e) Data Act). The Customer can download them itself during the term of the contract, during the transitional period and during the data retrieval period.

(2) The following table exhaustively lists the categories, contents, formats and paths. The designations correspond to those in the user interface.

(3) The replication packages are included only in the plans that include them according to the plan overview. The Customer's data contained in them (input data, labels, settings and results of the estimation) are available in all plans through the other exports, in particular through the full project export and the downloads of the analysis. The Provider's scripts in the replication packages do not form part of the exportable data (Article 2(38) Data Act). All other exports under paragraph 2 are available in all plans.

(4) Excluded from export are exclusively data that concern the internal functioning of the service and constitute trade secrets of the Provider (Article 25(2)(f) Data Act): a) the internal parameterisation and implementation of the estimation methods, insofar as it goes beyond the settings chosen by the Customer and documented in the result and replication files; b) the security configuration of the platform; c) the internal logging and operations infrastructure. The estimation settings chosen by the Customer (such as iterations, prior variance, random seed) and all results form part of the exportable data. This exemption does not delay or impede switching.

(5) Data of other Customers are not exported. Personal data of participants are exported only to the extent that they are assigned to the Customer's projects.

3. Switching process

(1) Initiation. The Customer initiates switching by a switching request in text form (for example by e-mail) to info@choicery.ai. The request names the account, the affected projects or all projects, and the case chosen under Section 1(3).

(2) Notice period. The notice period until the start of the transitional period is a maximum of two months (mandatory maximum notice period under Article 25(2)(d) Data Act). If the Customer requests an earlier start, the transitional period begins correspondingly earlier.

(3) Transitional period. The transitional period is 30 calendar days (Article 25(2)(a) Data Act). During this period the contract continues to apply. The Provider a) provides the assistance under Section 4; b) maintains the service with due care; c) informs the Customer of risks known to it for the continuity of provision; d) provides for a high level of security, in particular for the data during their transfer and during the data retrieval period.

(4) Extension by the Customer. The Customer may, once and before its expiry, extend the transitional period by a period that the Customer considers more appropriate for its own purposes (Article 25(5) Data Act). The extension is made by notification in text form. During the transitional period and any extension, the plan booked continues with its standard service fees; no additional charges are incurred.

(5) Technical unfeasibility. If the transitional period of 30 calendar days is technically unfeasible, the Provider notifies the Customer of this in text form within 14 working days of receipt of the switching request, justifies the unfeasibility and indicates an alternative transitional period of no more than seven months (Article 25(4) Data Act). The service continues to be provided during the alternative period as well. The right of extension under paragraph 4 remains unaffected.

(6) Data retrieval period. After the end of the contract under paragraph 7, the Customer has a data retrieval period of at least 30 calendar days (Article 25(2)(g) Data Act). During this period, access to the account remains open for exports and downloads. The data retrieval period serves solely the retrieval of the data. No charge is levied for it. If the Customer deletes its account itself in the account settings, the grace period under Section 8(6)(c) of the Terms of Service applies instead.

(7) End of the contract. The contract ends (Article 25(2)(c) Data Act) a) upon the successful completion of switching; b) in the case of Section 1(3)(c), upon expiry of the notice period. Switching is successfully completed as soon as the exportable data are fully available to the Customer for retrieval and the Customer confirms completion in text form or the transitional period, including any extension or alternative period, expires, whichever occurs first. The Provider notifies the Customer of the termination in text form. The data retrieval period under paragraph 6 follows the end of the contract; the Data Processing Agreement continues to apply until the deletion under Section 7 has been completed.

(8) Cooperation of the Customer. The Customer triggers the exports itself, keeps its access credentials at hand and reports any incompleteness within the data retrieval period.

4. Assistance

(1) The Provider provides reasonable assistance in the switching process to the Customer and to third parties named by the Customer in text form (Article 25(2)(a) Data Act) and provides the information relevant to the Customer's exit strategy (Article 25(2)(b) Data Act). The assistance consists of a) the self-service export functions under Section 2 and the programming interface under Section 8(4); b) the description of the data structures and formats in the register under Section 8(2); c) answering questions about the export files.

(2) The assistance is free of charge. It does not include migrating the data to the destination provider, converting them into target formats of other tools or reconstructing analyses at the destination provider.

(3) The Provider's obligations do not include that other providers produce identical estimation results from the same data.

5. Charges and consequences of termination

(1) Switching charges. The Provider does not impose any switching charges (Article 29 Data Act).

(2) Standard service fees. The standard service fees are the plan prices according to the plan overview at https://choicery.ai. They are billed monthly in advance. The Free Trial is free of charge.

(3) No early termination penalties. There is no minimum term, no contractual penalty and no fee for a remaining term. In the event of switching or termination, the billing month already paid runs out; no pro rata refund is made for the remaining days of that month. No charges are levied for periods after the paid month. The right of withdrawal of consumers and refunds under the terms of Polar remain unaffected.

(4) No particularly complex switching. The Provider does not offer services whose switching would be particularly complex or costly or would be impossible without significant interference with data, digital assets or service architecture (Article 29(5) Data Act).

(5) Publication. The information in this Section is available on this page and is linked from the Terms of Service (Article 29(4) and (6) Data Act).

6. Restrictions for compelling reasons

(1) The Provider may restrict export or deletion insofar as compelling reasons preclude them, in particular a) statutory or official obligations to retain, disclose or preserve data, for example under Section 147 of the German Fiscal Code (AO) or by court or administrative order; b) rights of third parties, in particular where handover to a third party named by the Customer would infringe rights of participants or other third parties; c) the narrowly defined trade secrets under Section 2(4).

(2) A restriction covers only the affected data. A retention obligation of the Provider does not prevent the export of a copy to the Customer.

7. Deletion after the end of the contract

(1) After expiry of the data retrieval period, the Provider fully deletes all exportable data and digital assets of the Customer, at the latest within 30 days, in the database and in the file storage (Article 25(2)(h) Data Act). This covers projects, survey flows, designs, media, responses including their JSON backup, analysis runs, generated download files and the account. The Provider does not delete spreadsheets that it created in the Customer's Google Drive on the Customer's instruction (Section 9(2)); they stay under the Customer's control.

(2) The Customer and the Provider may agree a later deletion date in text form. If the Customer wishes deletion only, the data retrieval period likewise applies; on express instruction in text form, the Provider deletes earlier. For self-deletion of the account in the account settings, Section 3(6) applies instead.

(3) Backups are retained for no longer than 45 days; until then, deleted data may remain in backups. After a restore, documented deletions are carried out again.

(4) Audit events are pseudonymised: direct account identifiers are removed, and the events are retained under the Retention and Deletion Policy for security, evidence and the defence of legal claims. Contract records are retained for the same periods.

(5) On request, the Provider confirms the deletion in text form.

8. Formats and register

(1) The Provider uses open, documented formats: CSV under RFC 4180 in UTF-8, JSON under RFC 8259, Excel workbooks in Office Open XML format (XLSX), SPSS system files (SAV) that can be read by SPSS and open libraries, ZIP archives as well as document and text formats (PDF, DOCX, RTF, TXT). Scripts in replication packages are provided as readable source code.

(2) The data structures, data formats and relevant standards are described in the online register Export Formats and Data Structures (Article 26 Data Act). It describes the current export formats and is updated on an ongoing basis. This Policy and the register are accessible before the contract is concluded.

(3) Known limitations: media are included only in the full project export. The study definition package does not contain responses. The account export does not contain project contents. Replication packages require the open-source runtime environments named in the package.

(4) The export functions under Section 2 are available in all plans free of charge, except for the replication packages (Section 2(3)), and deliver structured, commonly used and machine-readable formats (Article 30 Data Act). For switching, the Provider makes a programming interface available to all Customers free of charge (Article 30(2) Data Act): a personal access key in the profile and endpoints for the project list, the project export as ZIP and the responses as JSON and CSV; documentation in the Export Format Register. The programming interface is open in all plans. The Google Sheets connection is an additional function in the plans that include it; it replaces neither the export functions nor the programming interface. The Provider does not impose any contractual, technical or organisational requirements that impede switching (Article 23 Data Act).

9. Location and jurisdiction of the infrastructure

(1) The infrastructure used for data processing and its jurisdiction (Article 28(1) Data Act):

(2) Services outside the data processing infrastructure (payment processing, sign-in with Google or Microsoft, video embedding after a click by the participant) do not receive any project or response data. They are listed with their role, seat and transfer basis in the register Subprocessors and Recipients. The optional Google Sheets connection is to be distinguished from this: on the Customer's instruction, the Provider writes responses into a spreadsheet in the Customer's Google Drive. This spreadsheet is an external copy held by the Customer; it is not part of the Provider's hosting or backups, and the Provider does not delete it (Section 7).

(3) Measures against access by authorities of third countries that would conflict with Union law or German law (Article 28(1) Data Act): a) technical: encrypted transmission of all connections, encrypted database connection with certificate verification, encryption of data at rest according to the specifications of the respective service provider, access only via authenticated accounts and key-based administrative access; b) organisational: no hosting and no backups outside the European Union (a copy in the Customer's Google Drive made at the Customer's request under paragraph 2 is not a backup of the Provider), administrative access only at the Provider, review of every request under Section 10; c) contractual: data processing agreements with binding instructions, location commitments and notification obligations with every service provider, and for the possible remote support access of the database provider from the USA its intra-group standard contractual clauses. The details are set out in the Technical and Organisational Measures.

(4) The information in this Section is linked from the Terms of Service (Article 28(2) Data Act) and is updated in the event of changes together with the register of sub-processors.

10. Governmental access requests

(1) The Provider reviews requests from courts or authorities of a third country for the transfer of or access to data stored in the European Union, before any response, as to their legal basis, the competence of the requesting body and any conflict with Union law or German law. The Provider may ask the competent national body for an opinion (Article 32(3) Data Act).

(2) Data are transferred only a) where the request is based on an international agreement, such as a mutual legal assistance treaty between the third country and the European Union or Germany (Article 32(2) Data Act), or b) in the absence of such an agreement, only under the conditions of Article 32(3) Data Act: the request states its reasons and proportionality and is sufficiently specific, a reasoned objection by the Provider is subject to review by a competent court of the third country, and that court can take into account the interests protected by Union law or German law.

(3) Where a transfer is permissible, the Provider transfers only the minimum amount of data (Article 32(4) Data Act).

(4) The Provider informs the Customer of the request before complying with it. Excepted are requests for law enforcement purposes for as long as and to the extent that confidentiality is necessary to preserve the effectiveness of the measure (Article 32(5) Data Act).

(5) For personal data, Article 48 GDPR and the provisions of the Data Processing Agreement apply in addition. The procedure is agreed in Section 10(7) of the Terms of Service.

11. Communication

(1) The Customer sends notifications concerning export, switching, termination and deletion in text form to info@choicery.ai or via the contact form of the website. Data protection enquiries go to privacy@choicery.ai, security reports to security@choicery.ai.

(2) The Support and Maintenance Policy applies to responses.