Security, Support and Data Access

3. Our rules for reporting vulnerabilities (CVD policy)

"Coordinated Vulnerability Disclosure" means: you first report a vulnerability to us, we fix it, and we agree on publication together.

What you can expect from us if you provide an email address:

• We will confirm receipt of your report within 2 working days.
• We will provide you with an initial assessment within 10 working days.
• Afterwards we will keep you updated on the status until the vulnerability has been fixed.
• We will inform you when an update is available.

What we ask of you:

• Please coordinate the timing of any publication with us.
• Only test with your own accounts and devices.
• Do not access other users' data.
• Do not impair the operation of our services.

Our commitment: If you investigate and report a security vulnerability in good faith and in accordance with these rules, we will not assert any claims solely because of this investigation and report. This does not apply to access to third-party data or accounts, impairment of our systems, or other unlawful conduct.

Reports to authorities: Since 11 September 2026, the following applies: we report actively exploited vulnerabilities and serious security incidents to the competent CSIRT and to the European Union Agency for Cybersecurity (ENISA) pursuant to Article 14 of the Cyber Resilience Act and inform affected users.

4. Security notices

Here we publish notices on fixed security vulnerabilities in our products.

Currently there are no security notices.

5. Support and security updates

We provide security updates for our digital products until at least 12/2032. As long as a product is being sold, we review this date annually and extend it if necessary; an end date already stated will not be shortened. For the apps, this applies to the respective current app version. Each security update remains available for at least 10 years after its release or for the remainder of the support period, whichever is longer.

• You receive app updates via the Apple App Store or Google Play. We recommend enabling automatic updates.
• The connected app offers firmware updates for the pens; they are installed wirelessly after your confirmation.
• We roll out updates to our servers centrally; you do not need to do anything for this.

Which product versions are supported, which requirements apply, and how to use the products safely and decommission them again is described in the document for your product (sections 2 and 5).

6. Information per product

Each document contains: product and manufacturer, support period and type of security updates, contact for vulnerabilities, notes on safe use, EU declaration of conformity and – for the connected pens – the information pursuant to the EU Data Act.

EU declarations of conformity for the pens: https://www.stabilo.com/com/declaration-of-conformity/

7. Access to product data (EU Data Act)

Our connected pens generate data. Under Regulation (EU) 2023/2854, you have the right to access this data and, upon request, to have it shared with third parties.

Data holder: STABILO International GmbH, Schwanweg 1, 90562 Heroldsberg, Germany.

How to submit a request: via the form on this page, selecting "Request access to or disclosure of product data". There, choose whether the data should be sent to you or to a named third party, and enter the identifier stated in the document for your product (e.g. user or backup ID for ErgoPen Neo and EduPen Neo, partner app and serial number of the pen for LUNIS Ink).

What you will receive: the data that can be made available, free of charge, in a structured, commonly used and machine-readable format. Which data this is, what format it has and what volume of data to expect is described in the document for your product.

Disclosure to third parties: At your request, we will pass the data on to a third party, insofar as this is legally permissible. We will only pass on personal data if a valid legal basis under the GDPR exists.

Which data your product generates, where it is stored, for how long, what we use it for and whether third parties receive it is described in the document for your product (section 8).

Right to lodge a complaint: You may lodge a complaint with the authority competent under Art. 37 Data Act (in Germany presumably the Bundesnetzagentur). Insofar as personal data is affected, you may also contact the competent data protection supervisory authority.

Data protection: How we process personal data is described in our privacy notice, section 7. You can assert your rights under the GDPR, e.g. to access or erasure, via the form or directly at datenschutz@schwan-stabilo.com.

Status: October 2026