Data export and switching

Effective date and last updated: 17 October 2026

This Register is the online information that Regulation (EU) 2023/2854 (the Data Act) requires a provider of data processing services to keep available, and it forms part of the Harmoniq Terms of Service (https://harmoniq.ro/en/legal/terms). It describes how a Customer moves its data out of Harmoniq — on its own, at any time, or as part of switching to another provider —, what can be exported and in what shape, what is not exported and why, how the account ends and the data is deleted, and what safeguards apply to governmental access requests concerning non-personal data held in the Union. For personal data, the Data Processing Agreement (https://harmoniq.ro/en/legal/dpa) also applies.

Provider: SYNCDEV S.R.L., Romanian Trade Register no. J2014000164361, EUID ROONRC.J2014000164361, CUI 33129339, Str. Fetițelor nr. 4, camera nr. 1, 820035 Tulcea, Tulcea County, Romania. General contact and support: hello@harmoniq.ro; data protection: dpa@harmoniq.ro.

1. Starting an export, a switch or a deletion#

• Export, at any time: the company's account owner (the Owner role) opens Company → Company data and account and chooses "Prepare the export". No notice, no request and no approval from us are needed, and nothing has to be terminated first. To protect the data, the page asks for the password again and is available only to the Owner in person (not to someone signed in on their behalf).
• Switching to another provider or to an in-house solution: write to hello@harmoniq.ro stating the intended switch and the target date. We acknowledge in writing and confirm the transitional period. The account remains active until you decide to close it.
• Closing and deletion: the account owner closes the account from the same page, confirming by typing the company's name. Closing cancels the subscription and opens the retrieval period described in section 2, at the end of which the data is deleted automatically. Moving to a lower plan, non-payment or the end of the trial does not delete anything.

2. Notice, transitional and retrieval periods#

• Notice period: a maximum of two months, as permitted by Article 25(2)(a) of the Data Act. A shorter notice is accepted at the Customer's choice.
• Transitional period: 30 calendar days, running from the end of the notice period. Where switching within that period is technically unfeasible, we will say so in writing within 14 working days of the request, give reasons, and propose an extended period, which cannot exceed seven months. During the notice and transitional periods the account works in full: the complete export, reports and the API remain available.
• Retrieval period: 30 calendar days from the closing of the account. We recommend closing the account at the end of the transitional period. During this period the company's users no longer have access to the application, and the account owner sees only the Company data and account page, from which they can prepare and download the complete export or reopen the account, with all its data. Seven days before the deletion date, the account owners receive a notice.
• Erasure: at the end of the retrieval period, the company's data is permanently deleted. See section 7.

The service continues in full during the notice and transitional periods, at the agreed plan and price, and the technical and organisational security measures in the Data Processing Agreement continue to apply. We do not degrade, throttle or restrict a Customer because it has announced a switch.

3. Assistance during switching#

Included in the subscription: the self-service exports below, written answers about structure, formats and the meaning of fields, and reasonable co-operation with the Customer's chosen destination provider. Substantial bespoke work — writing a transformation into another vendor's schema, or operating the import at the destination — is professional-services work, quoted in advance, and is never a condition of getting the data out.

Where the export cannot be obtained from the application — for example during a suspension of the account, when the application allows only billing and account security —, we prepare it on the written request of the account owner, sent to hello@harmoniq.ro.

4. Register of exportable data, structures and formats#

a) Complete company data export — ZIP of CSV files#

Company → Company data and account → Prepare the export. The archive is built in the background; the Owner who asked for it is notified when it is ready and can download it for 7 days, after which the archive is deleted from the server. A new export can be prepared at any time. The archive's structure:

• data/<table>.csv — one file for each database table that holds the company's data. The list of tables is taken from the database schema at the time of the export, so any new module is included automatically. The first line holds the database column names, followed by one row per record.
• files/<path> — every file the company uploaded (documents, photos, attachments, certificates, profile photos and so on), at their original relative paths. The file data/media.csv shows which record each file belongs to (the record's type and identifier, the file name).
• CITIȚI-MĂ.txt and README.txt — an explanation of the contents, in Romanian and in English.

Format: UTF-8 CSV files with a byte-order mark (so that spreadsheet programs show diacritics correctly), comma-separated, with double quotes. Identifiers are exported exactly as stored, so relationships survive: primary keys keep their values and the *_id columns continue to point at them. Numeric values, including amounts and scores, are exported as exact decimals, with no rounding or conversion; timestamps include their offset from UTC; boolean values appear as true / false, and a missing value as an empty cell. Structured fields (for example texts translated into several languages, or KPI formulas stored as a calculation tree alongside their text) are exported as JSON text in the cell. A text cell beginning with =, +, - or @ is given a leading apostrophe, so that a spreadsheet program does not run it as a formula.

CNPs (Romanian personal identification numbers) and the values of custom fields marked as sensitive, stored encrypted in the application, appear in the archive in plain text, because they are the company's data. The archive must be kept secure.

b) Reports — Excel (.xlsx)#

People with the right to export reports can generate, on demand or on a schedule (weekly or monthly), .xlsx files for the data sets available in the company's plan and modules: employees, placements, leave requests, leave balances, KPI results, objectives, evaluations, course enrolments, certificates, documents, occupational health and safety (SSM) records, audits, action plans, service requests, material requests, answers to named surveys, survey totals and, in the CRM, customers, deals, activities and feedback. Each file holds the chosen columns, with human-readable headers and real calendar dates, plus a second sheet describing the report, its filters, who asked for it and when it was generated. A report covers only the data that person can see in the application, and the generated file is kept for one day. Reports are intended for review and for loading into general-purpose tools; they are not the complete record.

c) Company API — JSON (Enterprise plan)#

A REST API over HTTPS, at the company's address (https://<company>.harmoniq.ro/api/v1), authenticated with API keys created by the company, with separate read and write permissions for each resource, an optional list of allowed IP addresses and a log of calls. Responses are UTF-8 JSON, with dates in ISO 8601 format (UTC); lists are paginated (at most 100 records per page) and can be filtered by the time of the last change (updated_since), which allows a gradual synchronisation into another system. The limit is 120 requests per minute per key. The public reference is at https://harmoniq.ro/api, and the complete description, in OpenAPI 3.1 format, at https://harmoniq.ro/api/openapi.json.

d) Exports for a single person — JSON#

• Employees: a ZIP archive with everything the company holds about one person, one JSON file for each kind of record, together with the attached files, prepared at the request of the person or of the company (Articles 15 and 20 GDPR).
• CRM customers: everything the company holds about a CRM contact, as a downloadable JSON file (Article 15 GDPR).

e) What each area covers#

f) What is not exported, and why#

• Authentication secrets: passwords (stored only as a hash), two-factor authentication secrets and recovery codes, access and reset tokens, API key hashes, the keys and addresses of web push subscriptions, calendar subscription tokens, sessions. They are of no use outside Harmoniq and would allow access on someone else's behalf.
• The CNP search index: a technical hash derived from the CNP, which is exported in plain text anyway.
• Integration credentials: the password of the company's smslink.ro account and the company's own AI provider key. They are re-entered at the destination.
• Temporary files: Excel imports in progress (deleted in any case within one day), earlier exports and single-person exports.
• Sealed answers of anonymous surveys still open: they are not yet in the database and nobody can see them until the survey closes; after closing, they are included in the export.

5. Known technical limitations#

Stated plainly, because a switching register that lists only what works is not one.

• The complete export is a data export, not a turnkey restore. It is complete and machine-readable, but no importer is supplied for another vendor's platform and none is implied.
• There is no automated push or live migration to a destination provider. The Customer, or its new provider, performs the import; the API (Enterprise plan) can be used for a gradual synchronisation during the transition.
• The profile of the company itself (its name, identification and billing details, settings and visual identity) is not a table in the archive; it can be consulted in the company's settings and on our invoices.
• KPI scores are calculated by Harmoniq from the company's formulas. The archive contains the formulas (text and calculation tree), the input values and the results, but the calculation engine is not exported; recalculation at the destination depends on the system chosen.
• Data held by the Customer's own providers — messages sent through its smslink.ro account, conversations held through its own account with an AI provider — belongs to relationships the Customer contracts directly, and must be retrieved from them.
• Conversations with the AI assistant are not exported: they are kept for two hours and then disappear.
• The archive includes CNPs in plain text and the contents of every table, including direct messages between users. That is why only the account owner, in person and after confirming the password again, can request and download it.
• Large companies produce large archives. When a single download becomes impractical, we arrange an assisted transfer rather than reduce what is exported.
• After the account is closed, reports and the API are no longer available; the complete export remains available.

6. Costs#

Standard self-service exports are not charged, on any plan. For switching charges, Article 29 of the Data Act applies: until 12 January 2027, any reduced switching charge may not exceed the direct costs we incur and must be communicated in advance; from that date no switching charges are imposed where Article 29 applies. The professional services in section 3 are distinct from switching charges and are agreed in advance. The API is part of the Enterprise plan.

7. Deletion at the end#

Closing the account is confirmed explicitly, by typing the company's name, and can be undone by reopening the account at any time during the 30 days of the retrieval period. At the end of that period all of the company's data in Harmoniq is permanently deleted: the database records, every file and the custom domains configured. Only the invoices we issued remain (with the Customer's billing details, kept for as long as accounting law requires) and a deletion record that holds only the company's name and Harmoniq address, the dates of closing and deletion and the number of records deleted, without their content.

Data in backups is not brought back into use: backups expire with their cycle, within approximately 90 days at most, and the deletions of closed accounts are re-applied after any restore. On request, we provide a confirmation that the deletion has been completed.

Deleting the data of a single person — anonymising a former employee, or erasing a CRM customer while keeping the figures — is done from the application, on the company's instruction, under the Data Processing Agreement.

8. Support, contact and escalation#

• Questions about export and switching: hello@harmoniq.ro.
• Questions about personal data and data subjects: dpa@harmoniq.ro.
• If a request is not handled properly, the free complaints procedure in the Terms applies. Nothing in it prevents the Customer from bringing legal proceedings or turning to a competent authority.

9. Governmental access to non-personal data (Article 28 of the Data Act)#

Where a third-country authority requests or seeks the transfer of non-personal data held in the Union through Harmoniq, the following applies.

• Where the data is: the application, database, file storage and backups are hosted by Hetzner Online GmbH in Germany, and the off-site backups are also in the European Economic Area. The service is provided from the European Union by a Romanian company, subject to Romanian and Union law.
• Which jurisdictions can reach it: Romania and Germany, both Member States. No third-country provider holds the data of the core service. The AI assistant, optional and switched on only by the company, may involve recipients outside the EEA; they are listed, with location and transfer basis, in the subprocessor register (https://harmoniq.ro/en/legal/subprocessors).
• Safeguards: we transfer non-personal data, or give access to it, in response to a third-country authority only where the request is based on an international agreement in force between that country and the Union or a Member State or, failing such an agreement, only after assessing whether the request is specific, reasoned, proportionate and subject to review, and whether complying with it would conflict with Union or Romanian law.
• Challenge: where a request conflicts with Union or Member State law, we do not comply on the strength of the request alone. Where the law allows, we seek the opinion of the competent national body, ask the requesting authority to use mutual legal assistance or the applicable international agreement, and challenge the request before the competent court.
• Minimisation: if disclosure ultimately becomes lawful and unavoidable, we disclose the minimum permitted and record what was disclosed, to whom and on what basis.
• Information: the affected Customer is informed before disclosure whenever the law allows it and, otherwise, as soon as the law allows it, so that it can exercise its own rights.
• Keeping this information current: this page is where the relevant information on jurisdiction and safeguards is kept up to date. It is reviewed whenever the hosting, the subprocessor register or the applicable law changes, and the version is updated accordingly.

10. Changes#

Material changes to this Register are notified under the Terms, and the effective date and version are updated. Earlier versions are available on request at hello@harmoniq.ro.