Duku AI
Legal documentsduku.ai

Duku EU Data Act Addendum

version 2026-09-08 · effective 2026-09-08

This EU Data Act Addendum (“Addendum”) is intended to comply with the obligations set out in Chapter VI of the EU Data Act (Regulation (EU) 2023/2854) as applicable to the Services. This Addendum supplements the Duku Terms and Conditions (“Agreement”) and applies if you are a customer established in the EU/EEA. You acknowledge and agree that this Addendum is accepted and incorporated by reference into your agreement with us if (a) you have acknowledged acceptance of this Addendum (whether by way of a clickwrap or otherwise), or (b) the Agreement expressly refers to this Addendum and specifies that it applies.

Capitalised terms used but not defined in this Addendum shall have the meanings given to them in the Agreement. In this Addendum, “you”, “your”, “yours” means Customer and “we”, “our” and “us” means Duku.

Your Right to Export (Switch) or Delete

  1. Switching Request. At any time during your subscription, you may ask us to export your data (including to a third party authorised by you). We will provide your “Exportable Data” and “Digital Assets” (as defined below) so you can either:

    1. move to another provider offering similar services to us; or

    2. transfer the data to your own systems.

  2. Deletion Request. During your subscription, you may also ask us to delete your data.

We refer to the requests in (a) and (b) as a Switching Request or Deletion Request respectively.

What is Exportable Data and a Digital Asset?

Exportable Data. Your Exportable Data comprises the following, in each case only to the extent held in your account at the time of export and as made available through the Services' standard interfaces and export formats:

  1. account and configuration data you have provided to the Services, being your organisation and user account details, registered applications, target environment settings, and test configurations and schedules;

  2. test results generated by your use of the Services, being test and exploration run records, issues and errors detected in your applications, and generated test definitions and their execution results; and

  3. session media artifacts (test session recordings and screenshots), to the extent still retained under our standard retention periods at the time of export.

Digital Assets. None. The Services are a fully managed software-as-a-service offering: you do not deploy or license applications, machine images, models, containers or other digital assets into our environment. All content you create in the Services is addressed as Exportable Data above.

Excluded Data. Certain data is not covered by your switching and deletion rights, namely:

  • Our trade secrets, for example our AI exploration, test-generation and issue-detection technology, including prompts, agent orchestration and model-routing logic, error fingerprinting and de-duplication algorithms, and state-equivalence and novelty-detection methods;

  • Internal machine-generated working data used to operate the Services, including vector embeddings, state and network signatures and fingerprints, internal model evaluation and resolution records, and job queue and scheduling state;

  • Platform source code, system configurations and infrastructure data;

  • Operational telemetry, including infrastructure and application logs, performance metrics and monitoring data;

  • Anonymised or aggregated usage data generated by us for service operation, benchmarking and service improvement; and

  • Security data, including API key secrets and stored credential values (which are securely deleted on exit rather than exported), encryption keys and abuse-prevention data.

How to Submit a Request

To make a Switching Request or Deletion Request, please inform us in writing at least two (2) months before the date you want to start the export or deletion process (the “Switching Date”).

Before the Switching Date, you must tell us the following information:

  1. the date you want the switch to take effect;

  2. the services you want to move away from; and

  3. whether you want to: (i) switch to another provider (and the details of the relevant provider), (ii) transfer your Exportable Data and Digital Assets to your own systems, or (iii) delete your Exportable Data and Digital Assets.

You may request a one-time extension of the Switching Date if you need more time to prepare for the switch. Please notify us at least 14 days before the Switching Date if you would like an extension.

If You Request Deletion

If you make a Deletion Request, we will delete your Exportable Data and Digital Assets by the Switching Date, in line with our standard deletion procedures and applicable law. We may retain aggregated or anonymised data that no longer identifies you.

If You Request Export (Switching)

We will use reasonable efforts to make your Exportable Data and Digital Assets available to you in raw form within thirty (30) calendar days after the Switching Date. You are responsible for carrying out the export. If making the data available is technically unfeasible within that period, we may extend it. If we do, we will notify you and explain why and how long we need.

During the export process, we will:

  1. continue providing the Services (unless otherwise agreed);

  2. inform you of any known risks to the continuity of the Services;

  3. maintain appropriate security during the transfer; and

  4. provide reasonable technical information to support your transition.

Following the completion of the export process, we will make your Exportable Data and Digital Assets available for retrieval for thirty (30) days. You are responsible for retrieving your Exportable Data and Digital Assets within this period.

After the export is completed (unless otherwise agreed), we will delete your data in accordance with our standard procedures and applicable law.

Effect on Your Subscription

When your Switching Request or Deletion Request is completed, your access to the Services will automatically end. We will confirm the date of termination to you once the switch or deletion has been successfully completed.

Ending your agreement does not remove your obligation to pay fees owed for the period before termination. Within ten (10) days after termination, you must pay any outstanding fees due for your use of the Services.

Fees

We do not charge fees for standard export or deletion requests. However, if your export request requires significant manual work or customisation, we may charge reasonable fees, provided that we give you advance notice and receive your prior agreement.

Your Responsibilities

You are responsible for ensuring that you have the right and authority to make the Switching Request or Deletion Request, and for securely transferring and storing your data after we have exported it to you or your alternative third party provider.

Infrastructure Information

Information about where our infrastructure is located, the switching and porting methods and formats as well as restrictions and technical limitations which are known to us, and the safeguards we use to prevent unlawful access to non-personal data is available at https://duku.ai/legal/infrastructure.