Cloud Transparency & Data Portability

This page provides general information on infrastructure location, measures concerning international governmental access to data, and data portability and switching procedures for cloud and managed services supplied by TIBALDI IT & INNOVATION - FZCO (the “FZCO”). It is intended for business customers and does not constitute a description of every technical characteristic of every service.

Service-specific terms may be set out in the relevant Service Document, service sheet, order, accepted proposal, activation document, technical documentation or Data Processing Agreement. Those documents determine the applicable service scope, technical capabilities, locations, export formats, dependencies and retention cycle. If there is a conflict, the contract and the service-specific documents prevail to the extent permitted by applicable law.

The ICT infrastructure currently deployed for the service categories listed below is physically located in Germany and/or Austria. The Member-State jurisdiction associated with those current processing locations is therefore Germany and/or Austria. Other laws may also apply because of the identity of the parties, the nature of the processing or the circumstances of a particular service.

The EU Member State applicable to an individual service is specified in the relevant Service Document, service sheet, order, technical sheet or activation documentation. The table describes the current service arrangement and does not commit the FZCO to use the same location for every future service or deployment. Any different location or material location change will be reflected on this page and addressed in the applicable service documentation and contractual communications where required.

The FZCO uses EU-based infrastructure for the services described above unless otherwise stated in the applicable service documentation. Technical and organisational safeguards are selected for each service according to its nature, risk and documented configuration. They may include role-limited administrative access, authenticated access, access logging where supported, separation of customer environments, encryption in transit using appropriate protocols, confidentiality obligations and restrictions on access by personnel and subcontractors. Encryption at rest applies only where it is supported, configured or expressly included in the relevant service.

If the FZCO receives a governmental request concerning data stored in the European Union, its response process is intended to verify the legal basis, authority, jurisdiction, scope and binding effect of the request. Disclosure is limited to what is legally required; an unlawful or disproportionate request may be challenged where legally and practically possible. The customer will be notified where permitted by law and where notification would not prejudice a lawful investigation or other protected interest. The FZCO does not treat an informal or voluntary request as a sufficient legal basis for disclosure.

These measures reduce risk but do not provide an absolute guarantee against access, disclosure, security incidents or conflicting legal obligations. Service-specific safeguards are described in the applicable technical documentation or Data Processing Agreement.

This online register identifies the data categories, structures, formats and interoperability information generally applicable to each service type. The service-specific export scope depends on the deployed architecture, documented capabilities, third-party rights and the applicable Service Document.

Format and version details that vary by operating system, database engine, application or service release are recorded in the relevant Service Document, technical documentation or export instructions. A listed format applies only where the relevant service is technically capable of producing it.

In the absence of a more specific description in the applicable Service Document, the switching scope may include input data, output data, relevant metadata, files, databases, customer-owned content, transferable customer configuration, customer documentation and digital assets over which the customer has a right of use independent of its relationship with the FZCO.

Exportability is assessed according to technical feasibility, the functions of the service, third-party rights, security requirements and the customer’s entitlement to the relevant data or asset. Data is supplied in a format available for the relevant service and reasonably suitable for retrieval or transfer; this does not necessarily require transformation into a format selected by the customer.

For switching between services of the same service type, where no applicable common specification or harmonised interoperability standard has been published in the central Union repository, the FZCO will, at the customer’s request, provide exportable data in a structured, commonly used and machine-readable format, as required by applicable law.

Up to and including 11 January 2027, any reduced switching charges imposed for the switching process will not exceed the costs incurred by the FZCO that are directly linked to that switching process.

From 12 January 2027, no switching charges will be imposed for mandatory switching activities, including outbound transfer of exportable data and the assistance required as part of the switching process.

The following amounts may remain payable where applicable and permitted by the relevant contract and applicable law:

Following successful switching and expiry of the applicable retrieval period, exportable data and digital assets are deleted from active service environments according to the agreed procedure. The applicable Service Document states the service-specific retention cycle; there is no single retention period for all services.

Where a backup system does not support immediate selective deletion without affecting backup integrity, the relevant copy follows the ordinary retention cycle for that service. Until deletion, such copies remain segregated, protected and unavailable for ordinary use. A disaster recovery restoration must not result in the ordinary reactivation of data already marked for deletion; deletion controls are reapplied as part of the recovery procedure.

Limited retention may continue where required by law or reasonably necessary to establish, exercise or defend legal claims, manage a dispute, preserve evidence or comply with a binding order. Any such retention is limited in purpose and duration according to the applicable requirements.