Data Export Formats

Article 26 of the EU Data Act requires Druma to make available, for each category of data it processes on a customer's behalf, the structure, format, and interface in which that data can be exported. This page is that register. It documents an existing capability — nothing here is aspirational, and nothing on this page changes what data Druma processes; see our Privacy Notice for that, and our Terms of Service section 17 for the switching and portability rights this register supports.

The table in the next section is generated from the same table manifest the tenant export actually reads (COMPANY_SCOPED_TABLES in process-gdpr-export/gdpr-export-core.ts), so it cannot drift from what the export code does: a table added to the export appears here automatically, and one removed disappears.

An administrator or company administrator can request a full export of the company's operational data from Settings → GDPR & Privacy → Data Export. Druma builds a ZIP archive within 15 minutes and emails a signed download link (valid 24 hours) to the requester. The ZIP contains one CSV file per entity below, plus the underlying document files (PDF/image) referenced by the documents and ecmr_sealed_documents entities, up to a 20 MB / 300-file budget — anything beyond that budget is still listed in the CSV with its storage path, so it can be requested individually.

23 entities as of this page's version. CSV files follow RFC 4180 with a UTF-8 byte-order mark for spreadsheet compatibility. Cells that would otherwise be interpreted by a spreadsheet application as a formula (a leading =, +, -, or @) are prefixed with an apostrophe — the underlying data is not altered, only how a spreadsheet reads it.

Any signed-in user — including a driver, who cannot reach Settings — can export the personal data held about themselves, without contacting Druma, through the database function export_my_personal_data. It returns a single JSON document scoped to that person only: profile and driver-qualification records, company memberships, GPS and status-tap history, tachograph and driving-hours data, orders they drove or created, waiting logs, delay reports, pre-trip checklists, incident reports, toll receipts, payroll and eco-score records, messages they sent or received, AI assistant threads, support chat sessions, eCMR signatures, uploaded-document metadata, and their own 12-month audit trail. Storage objects are referenced by path and filename rather than embedded — the file itself is available on request via the tenant export above.

This is a narrower, person-scoped view of many of the same categories listed above — the two exports do not share table names one-for-one, because one is scoped to a company and the other to a person. The authoritative field list is in migration 0588_export_my_personal_data_rpc.sql.

Beyond the two purpose-built exports above, every entity a customer is entitled to see in the Druma application is also available live, as structured JSON, through Druma's REST Data API — the same interface the Druma web app and driver PWA themselves call. It requires no special access tier, no separate contract, and no charge: a customer's own account credentials are sufficient, and row-level security scopes every request to that customer's own company exactly as it does inside the app. This satisfies Article 30(2) (open interfaces, "equally available… free of charge") and Article 30(5) (structured, commonly used, machine-readable format) independently of the two managed exports above, which exist for convenience and completeness rather than because the API is otherwise closed.