Data export and switching (EU Data Act)

1. Subject and scope

QORLYNT is a tenant-specific SaaS service. These notes concern the exportable data and digital assets attributable to a customer and present in the subscribed service. Unused or unpurchased functions do not generate corresponding operational data. Applicable rules in Chapter VI of Regulation (EU) 2023/2854 (the Data Act), including switching, assistance, information and return of data, govern.

A business customer's Data Act export differs from an individual's GDPR rights of access and data portability. Where personal data is transferred, instructions, data-subject rights, the DPA and technical safeguards continue to apply.

2. Data areas and currently evidenced access routes

Depending on setup and use, customer-side areas may include business profiles, locations and booking settings; contacts and custom fields; services, staff profiles, workplaces, qualifications, shifts, availability, absences, and time and vacation balances; bookings, waiting lists, offers, approvals and tasks; messages, templates, campaigns, media and files; connected calendar events and mappings; rules and automations with revisions and runs; customer-configured external integrations and settings; and attributable usage and operational records, including push delivery receipts. If a QORLYNT sending address is enabled, the assigned sender address, verified reply address, dispatch and delivery records, and suppressions following bounces or complaints may also arise. Data generated through use of the service is included to the extent it is exportable under the Data Act.

Staff records may also contain information about sickness or other sensitive absence reasons. The QORLYNT customer determines lawful processing and instructions; disclosure and transfer also remain subject to the GDPR, the DPA and appropriate safeguards. The public contact CSV does not include these team records.

A contact CSV export is available in the customer workspace. It contains active contacts with identifier, name, e-mail address, phone number, custom fields, notification preference, WhatsApp/Telegram consent entries and tags. The export is provided in pages of up to 250 contacts with a continuation identifier; the web app assembles the pages into one file. In particular, it does not contain all bookings, messages, media, calendars, automations or integration data.

The currently evidenced file structure of the contact export is UTF-8 with a byte-order mark, semicolon separators and CRLF line endings. The header is, in this order: id;name;email;phone;fields;notifications_allowed;consent_whatsapp;consent_telegram;tags;field_types. The field_types column contains their declared types as a JSON object. The fields column contains a JSON object for custom fields; tags contains a comma-separated list inside a CSV cell. Every data cell is double-quoted, and embedded quotation marks are doubled. A leading apostrophe is added to cell content that a spreadsheet might interpret as a formula. For each page the API returns csv and next; the web app adds the header and UTF-8 marker and downloads the assembled file as qorlynt-kunden.csv. This documents only the evidenced contact export, not formats for other data areas.

A complete export is available in workspace Settings to owners and administrators with unrestricted company access. It includes retained business data for all locations, associated original files and DPA acceptance evidence. The public register at https://www.qorlynt.com/api/catalog/data-export describes every exported dataset, field, type and exclusion for the format version. The download also embeds this register.

3. Interfaces, portability and boundaries

Connected Google, Microsoft, Meta, Telegram, mail and other providers manage their own accounts and data under their terms. Disconnecting or exporting from QORLYNT does not automatically delete their data. Other tenants' data, our protected software and lawfully excluded trade secrets are not disclosed; applicable rights to exportable customer data remain. Secrets and credentials generally need to be set up again in the destination service.

The complete export uses UTF-8, newline-delimited JSON objects (NDJSON) and version qorlynt-export-1. A manifest is followed by records and files with Base64 content, size and SHA-256 checksum, then a completion record with counts and an overall checksum. Without a valid completion record the download is incomplete. Timestamps use UTC; exact decimal values are strings. Identifiers and relationships are retained; dynamic customer fields remain JSON. The free verification and extraction tool https://www.qorlynt.com/downloads/unpack-data-export.py produces JSONL datasets and original files without a QORLYNT installation. The destination needs to map these data; this does not promise automatic execution or complete functional equivalence.

4. Procedure, time limits, charges and deletion

An authorized customer may request a switch to another provider of the same service type, an on-premises ICT environment or erasure under the applicable Data Act rules. Section 14 of the terms specifies notice, transitional, retrieval and deletion periods and assistance duties. Send the affected company, requested data areas, destination and a reachable contact to support@qorlynt.com; necessary verification protects against unauthorized disclosure.

Charges for an applicable statutory switch follow section 14 of the terms, which also distinguishes ordinary service fees from switching charges. After switching and any applicable retrieval period, data subject to erasure is removed in accordance with the DPA and applicable law; legally required residual records and backups require separate handling.

5. Location of QORLYNT AWS infrastructure

According to the operator, QORLYNT's regional application resources are located in the AWS Europe (Stockholm) region, eu-north-1, Sweden. The operator identifies EC2/EBS, S3, Cognito, DynamoDB and Secrets Manager in particular; which data categories are held in each service depends on the actual configuration. This location does not mean all management and provider operations take place in Sweden. AWS describes, for example, one IAM control plane for commercial Regions in the USA and regional authorization data planes (https://docs.aws.amazon.com/IAM/latest/UserGuide/disaster-recovery-resiliency.html). These details concern QORLYNT's AWS infrastructure; they do not describe accounts and infrastructure independently operated by connected providers such as Google, Microsoft, Meta or Telegram.

A location in Sweden alone does not rule out access from other countries or international government disclosure requests. The specific technical, organisational and contractual measures against unlawful international government access to non-personal data held in the EU must still be verified against the actual operating environment and applicable provider agreements and will be added here after that review. Until then, this section is not a complete description under Article 28 of the Data Act.