Dawiso s.r.o. publishes this page under Articles 26, 28 and 29 of Regulation (EU) 2023/2854, the Data Act. It states the jurisdiction to which the ICT infrastructure of the Dawiso cloud service is subject. It also describes the measures that protect customer data held in the European Union against unlawful international government access to it or transfer of it, the fees that apply when a customer switches to another provider, and how the customer exports its data when it switches. Dawiso contracts for the Dawiso cloud service refer to this page.
Last updated: 6 November 2026
Jurisdiction of the ICT infrastructure
The Dawiso cloud service runs on infrastructure that Dawiso contracts from the companies below.
| Company | Role | Established in | Where it processes the data |
|---|---|---|---|
| Dawiso s.r.o. | Provider of the Dawiso cloud service | Czech Republic | — |
| Microsoft Ireland Operations Limited | Cloud platform that runs the service, including Azure AI Foundry | Ireland | Default: Microsoft Azure regions in the European Union. The standard AI functions use an Azure AI Foundry deployment in the EU Data Zone. Other location at the customer’s request, as agreed in the customer’s contract. |
| Amazon Web Services EMEA SARL | Cloud storage | Luxembourg, acting through its Czech branch | Default: data centers in the European Union. Other location at the customer’s request, as agreed in the customer’s contract. |
| Slack Technologies Limited | Messaging, for a customer that agrees to Slack as a communication channel | Ireland | United States |
Dawiso s.r.o. is a Czech company and is subject to Czech law and to EU law.
By default, the ICT infrastructure that runs the Dawiso cloud service is located in the European Union. Dawiso contracts for that infrastructure with companies established in the European Union. The infrastructure is therefore subject to EU law and to the law of the Member State concerned. Where a customer’s contract agrees another location, the infrastructure for that customer is also subject to the law of that location.
Slack processes data in the United States. The transfer to the United States happens only for a customer that agrees with Dawiso to use Slack as a communication channel.
Microsoft, Amazon Web Services, and Slack belong to groups whose parent companies are established in the United States. An authority outside the European Union can address a request to a parent or group company instead of the company established in the European Union. The measures under Measures against unlawful international government access and transfer address that risk.
Measures against unlawful international government access and transfer
Article 28 of the Data Act concerns non-personal data. Dawiso applies the measures below to all customer data held in the European Union. Personal data carries the additional protection described under Personal data.
Technical measures
- By default, the Dawiso cloud service, the support ticket system, and the standard AI functions run in Microsoft Azure regions in the European Union. The standard AI functions use an Azure AI Foundry deployment in the EU Data Zone.
- By default, backups of customer data are stored in data centers in the European Union.
- At the customer’s request, the Dawiso cloud service can run in another location, as agreed in the customer’s contract. Backups of that customer’s data are then stored in the same location.
- The application audit log of system and user activity is append-only. No user and no tenant administrator can change or delete an entry, through the interface or through the API.
Organizational measures
- Dawiso holds ISO/IEC 27001:2022 and ISO/IEC 27018:2019 certification for the information security management system that covers the development, operation, and delivery of the Dawiso platform.
- Dawiso also holds a SOC 2 Type 2 report and a CyberVadis rating for its security practices.
- Dawiso has appointed a data protection officer, reachable at dpo@dawiso.com.
- Dawiso staff and contractors work under the direct authority of Dawiso as persons acting under Article 29 of Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR). Each one signs a confidentiality undertaking.
Contractual measures
- Each sub-processor is bound by a written contract to the same data protection obligations that apply to Dawiso.
- Microsoft commits to challenge every government request for enterprise or public sector customer data where there is a lawful basis to do so. Microsoft also compensates the users of those customers if it discloses their data in response to a government request in breach of the GDPR.
- Amazon Web Services reviews every order it receives and objects to an order that is overbroad or otherwise inappropriate. It gives its customer, Dawiso, reasonable notice of a compelled disclosure, unless the law prohibits the notice.
- Slack participates in the EU-U.S. Data Privacy Framework through Salesforce. The Slack Data Processing Addendum also includes the EU standard contractual clauses.
- Where a sub-processor transfers personal data outside the European Economic Area, the Dawiso data processing terms require an adequacy decision first, and the EU standard contractual clauses as the fallback, with additional technical and organizational measures where they are needed.
Personal data
Article 28 of the Data Act concerns non-personal data. The GDPR and the Dawiso data processing terms govern personal data. The sub-processor list states the transfer safeguard that applies to each sub-processor.
For more information, see Sub-processors.
Switching fees and early termination
Article 29 of the Data Act requires a provider of data processing services to inform its customers of its standard service fees, early termination penalties, and switching charges.
- Standard service fees. The prices of the Dawiso cloud service are those agreed in the customer’s contract and its price list.
- Switching charges. Dawiso charges nothing for switching to another provider, for porting the customer’s data to the customer’s own infrastructure, or for erasing the data. The export interfaces and functions needed for switching are free of charge. From 12 January 2027 the Data Act prohibits switching charges.
- Early termination. The customer can start switching, porting, or erasure at any time, with a notice period of up to two months. The contract then ends when switching is complete, or at the end of the notice period where the customer asks only for erasure. Dawiso does not refund the price already paid, and the price for the remainder of the ongoing term remains payable as agreed in the contract. This is not a switching charge. The same applies when Dawiso withdraws from the contract because of the customer’s material breach. Dawiso imposes no other early termination penalty.
- Complex switching. No Dawiso cloud service is one where switching is highly complex or costly, or impossible without significant interference with the data, the digital assets, or the service architecture.
A proof-of-concept contract, under which the service is provided for testing and evaluation, follows its own terms (Article 31(2) of the Data Act).
Switching and data export
Article 26 of the Data Act requires a provider of data processing services to inform its customers how they can switch to another provider or port their data to their own infrastructure.
Start switching
The customer starts switching, porting, or erasure by written notice under its contract. After the notice, Dawiso gives the customer a switching plan for its instance. The plan states the steps, the timeline, and the export methods that suit the customer’s data.
Export methods
The customer can export its data itself, at any time during the contract and during the retrieval period after it ends.
| Method | What it exports | Format | Availability |
|---|---|---|---|
| Export object data | The objects of one application in one space, written into a data package | JSON data package; Download all packs the data packages as a zip | Administrator account |
| Working with packages | The configuration of the instance, held in packages | One JSON file per package, packed as a zip by Download all | Administrator account |
| REST API | The data of the instance, through the API endpoints | HTTPS, described by an OpenAPI (Swagger) specification | Every license |
| Database API and SQL API | The data of the instance, through read-only database views, for analytics and bulk extraction | SQL views | Only where the customer’s license includes the SQL API module |
Where a category of data listed in the customer’s contract cannot be exported with the methods available under its license, Dawiso exports it for the customer free of charge, in a structured, commonly used and machine-readable format.
Data structures and formats
The Dawiso API documentation describes the data structures and formats in which the data is available. The REST API of each instance publishes its OpenAPI (Swagger) specification at {yourdomain}/swagger/index.html. Database API views lists the views and what each one holds. Dawiso keeps this documentation up to date with each release.
Known restrictions
- The exported data follows the Dawiso data structures. Another provider’s service may need to map it to its own data model. Packages install directly into another Dawiso instance.
- Export object data writes one application in one space per export. It carries only root-level, active spaces. It drops reference-typed attribute values and relations that point outside the exported set, and reports each case as a warning.
- Dawiso’s source code, internal platform configuration, and the operational and security telemetry of Dawiso’s infrastructure are not exported, as the customer’s contract states.
Changes to this page
Dawiso keeps this page updated, as Articles 26, 28 and 29 of the Data Act require. The “Last updated” date changes with every change to the page. Advance notice of a new sub-processor follows the customer’s data processing terms.
Contact
Send questions about this page to the Dawiso data protection officer at dpo@dawiso.com.