Export and Deletion

Version 2026-09-26.3 | 26 September 2026 | CBX Media LLC

1. Export and switching

Customer may export data and digital assets it supplied or generated through contractual use. Covered categories, to the extent booked, include lead/consent data, survey answers, campaign/reporting data, calibration, proposals, approved actions, chat and project content. Formats are commonly used machine-readable formats, including CSV/JSON and original file formats. CBX supplies the necessary structure/interface information and any legally required open switching interfaces without charge. Unprotected platform tokens are not exported; establishing a newly authorised connection is supported.

Excluded only to the extent legally permitted are CBX software, model weights, internal system prompts and CBX trade secrets. Customer inputs/outputs and necessary metadata are not generally excluded. These categories apply according to booked modules; particular formats and lawful exceptions are stated additionally in the service order.

Where Data Act Chapter VI applies, switching may be requested in text form. No additional notice beyond reasonably necessary coordination is required. Transition begins promptly at the coordinated time and normally lasts no more than 30 calendar days. CBX provides reasonable assistance, information, continuity and security. If this period is technically infeasible, CBX gives a reasoned notice within 14 working days of the request and specifies an alternative period no longer than seven months; Customer’s statutory extension rights remain.

Data remain available for retrieval for at least 30 calendar days after transition ends. Service termination and deletion start following successful switching or the selected termination are clearly confirmed. No automatic deletion shortens this retrieval period. Customer may instead choose lawful complete deletion. Legally required switching/export assistance incurs no additional switching charge under this agreement. Regular charges for continuing service and expressly ordered additional services are distinguished.

The annual model excludes ordinary early termination but cannot block mandatory switching or termination rights. Export alone does not terminate the agreement. No additional goodwill early-exit right is created. Financial settlement after a legally effective early termination follows applicable law; mandatory repayment rights are not excluded. No hidden switching charge or undisclosed early-termination penalty applies. Mandatory Data Act rights prevail.

2. Retention

These are contractual maximum periods. Different necessary customer periods must be expressly and justifiably agreed before processing and reflected in notices. Earlier loss of purpose, valid deletion requests and withdrawal are addressed separately.

Data	Period / trigger
Raw lead/attribution data	maximum 90 days after event; longer attribution only expressly and justifiably agreed
Raw survey answers/order linkage	maximum 90 days after answer, then delete or irreversibly aggregate
Campaign reports/necessary action logs	rolling maximum 12 months; necessary legal-defence preservation separated and justified
AI chat/prompts/outputs	normally maximum 90 days; explicitly saved projects according to documented purpose
Audio at CBX	transient transcription only; no permanent audio storage; provider retention separately secured
Tokens	revoke/delete promptly on disconnect or expiry of authorisation
Routine operational/error logs	maximum 30 days without raw payloads; security cases separately time-limited
Consent/contract evidence	normally three years after the relevant operation/agreement ends; longer only for a specific legal duty or necessary legal defence, separate from marketing data
Accounting records	applicable statutory retention period, separated; no continued tracking permission

On termination, active data are deleted after the lawful export/retrieval window or earlier on lawful instruction. Payment suspension creates no automatic additional 90-day retention right. Backups rotate within 30 days; existing copies of deleted active data expire no later than 30 days after active deletion. Necessary immutable copies remain access-restricted and are not routinely used; deletion markers are reapplied after restoration. Processor copies, exports, queues and logs are included. Complete deletion is confirmed only after residual copies expire; before that any remaining scope is disclosed.

3. Rights requests and incidents

Privacy and incident contact: privacy@marketing-aigency.com, handled by Christian Bozic and Georg of Dis-Connect. General support: hello@marketing-aigency.com. Management is involved where escalation is needed. Receipt, responsible controller and deadline are recorded. Identity checks are proportionate and no other tenant’s data are disclosed. Searches may use hash, account, order or response identifiers. Handling and recipient forwarding are documented.

Incidents are contained and evidence preserved. Affected customers, data and times are identified, with prompt preliminary notification under the DPA and continuing updates. Authority/data-subject notifications depend on actual role and legal conditions. Completion reports and remediation/deletion/recovery evidence are retained as necessary.

4. Third-country authority requests

CBX examines the legal basis, jurisdiction, scope and available remedies. Where legally permitted, it informs Customer before disclosure and seeks relief from any prohibition. Disclosure is limited to the lawful necessary minimum, documented, and unlawful demands challenged using appropriate available remedies. A foreign authority order alone does not replace a required European transfer basis. Where Data Act Article 32 applies to non-personal data held in the Union, its additional safeguards are implemented.