Privacy Policy STABILO International GmbH

Preamble

STABILO International GmbH is pleased that you are visiting our website. Data protection and data security when using our website are very important to us. We therefore inform you about which of your personal data we collect when you visit our website and for what purposes it is used.

Since changes in legislation or changes to our internal processes may require an adjustment to this Privacy Policy, we ask you to read this policy regularly. The Privacy Policy applies to the online offering of STABILO International GmbH, available at https://www.stabilo.com including further subdomains.

Website	Country
www.stabilo.com/com/	Global Website
www.stabilo.com/at/	Austria
www.stabilo.com/be-fr/ www.stabilo.com/be-nl/	Belgium
www.stabilo.com/br/	Brazil
www.stabilo.com/ch-de/ www.stabilo.com/ch-fr/	Switzerland
www.stabilo.com/cz/	Czech Republic
www.stabilo.com/de/	Germany
www.stabilo.com/es/	Spain
www.stabilo.com/fr/	France
www.stabilo.com/gr/	Greece
www.stabilo.com/hu/	Hungary
www.stabilo.com/it/	Italy
www.stabilo.com/kr/	South Korea
www.stabilo.com/latam/	Latin America
www.stabilo.com/nl/	Netherlands
www.stabilo.com/pl/	Poland
www.stabilo.com/sk/	Slovakia
www.stabilo.com/tr/	Turkey
www.stabilo.com/uk/	United Kingdom
www.stabilo.com/us/	USA

1. Name and Address of the Controller

The responsible party and service provider is STABILO International GmbH, Schwanweg 1, 90562 Heroldsberg, Germany (hereinafter "STABILO").

2. Name and Address of the Data Protection Officer

Our Data Protection Officer is Mr. Sebastian Meyer, Schwanweg 1, 90562 Heroldsberg, Germany. For all questions regarding data protection, please contact: Datenschutz@schwan-stabilo.com

3. General Information on Data Processing

3.1 Personal Data

Personal data is any information relating to an identified or identifiable natural person (e.g. name, address, telephone number, email, IP address, user behavior). Information without a personal reference, e.g. through anonymization, does not constitute personal data.

3.2 Processing of Personal Data

Processing is any operation carried out in connection with personal data (e.g. collection, recording, organization, storage, adaptation, retrieval, use, transmission, restriction, erasure).

3.3 Legal Bases

We regularly process data on the basis of consent pursuant to Art. 6 para. 1 lit. a GDPR. Processing may also take place for the performance of a contract or for pre-contractual measures (Art. 6 para. 1 lit. b GDPR), for compliance with a legal obligation (Art. 6 para. 1 lit. c GDPR), or for the purposes of the legitimate interests pursued by us (Art. 6 para. 1 lit. f GDPR), provided that no overriding interests of the data subject preclude this.

4. Data Processing Operations

Personal data is collected when you voluntarily provide it to us (e.g. via a form or email). Transmission to third parties only takes place if permitted by law or with your consent.

4.1 Informational Use of the Website

When the website is used purely for informational purposes, we only process the data that your browser transmits for technical provision (server log files): host, IP address, date/time, method (GET/POST), request, protocol, status, volume of data transferred, referrer, browser/OS.

The legal basis is Art. 6 para. 1 lit. f GDPR (legitimate interest in providing the website). The data is deleted as soon as it is no longer required for display purposes; further storage may be required by law.

4.2 Contact Forms

For general inquiries, educator inquiries, sponsoring, etc., we process – depending on the form – email, first/last name, country, message; for complaints additionally address and place of purchase; for teachers, if applicable, further school-related details; for sponsoring, organizational data.

Legal bases: Art. 6 para. 1 lit. b GDPR (contractual/pre-contractual) or Art. 6 para. 1 lit. f GDPR (legitimate interest in efficient processing). Deletion upon completion of the inquiry; longer storage if required by law.

4.3 Processing in the Context of Product Safety

4.3.a Complaints Register

Processing of, among other things, name, telephone number, email, customer number, time/reason of purchase/complaint for traceability and the derivation of measures. Legal basis: Art. 6 para. 1 lit. f GDPR. Storage only for as long as necessary.

4.3.b Contact in Connection with Safety Incidents

Contact, e.g. in the event of recalls; processing of name, telephone number, email, time of purchase. Legal basis: Art. 6 para. 1 lit. f GDPR; from December 13, 2024, additionally Art. 6 para. 1 lit. c GDPR in conjunction with Art. 35 para. 1 Produktsicherheitsverordnung.

4.4 Contests

Required data: name/nickname, email, date of birth, country; if applicable, address in the event of winning. Legal basis: Art. 6 para. 1 lit. b GDPR. Deletion upon completion; statutory retention obligations remain unaffected.

5. Transmission of Personal Data to Third Parties

Personal data is transmitted to third parties in the context of the processing operations described below, in particular to payment service providers, shipping service providers, and IT service providers. Furthermore, your data may be transmitted in the following cases: official/judicial order, authorization for law enforcement/criminal prosecution, or if you have given your consent.

6. Cookies and External Services

6.1 Cookies

Cookies and tracking technologies that are not technically necessary are only set following the user's prior express consent. Consent can be revoked or adjusted at any time via the consent management tool.

Information and individual settings can be found here: Cookie Policy.
Cookie Settings

6.2 Integration of Technical Third-Party Tools

We use technical tools and services from third-party providers that are either technically necessary for the operation and functionality of our website or are based on a legal basis pursuant to Art. 6 para. 1 lit. b GDPR (performance of a contract) or Art. 6 para. 1 lit. f GDPR (legitimate interest in the technical provision of the website, ensuring IT security, and optimizing the user experience).

To the extent that personal data is processed through the use of these tools, this is done exclusively to the extent necessary for the respective purposes. Where third-party providers act as processors, processing is carried out on the basis of agreements pursuant to Art. 28 GDPR.

To the extent that the use of individual services involves the transfer of personal data to countries outside the European Union or the European Economic Area, this only takes place in compliance with the requirements of Art. 44 et seq. GDPR. In these cases, in particular, there may be risks that government authorities access the data or that the enforcement of data subjects' rights is made more difficult. We therefore take appropriate additional measures to ensure an adequate level of data protection.

Where the use of tools is not technically necessary, their use takes place exclusively on the basis of your prior consent pursuant to Art. 6 para. 1 lit. a GDPR. You can revoke or adjust your consent at any time via the consent management tool used.

7. Digital STABILO Products and Associated Digital Services!

The following information supplements the other provisions of this Privacy Notice. It applies to the processing of personal data in connection with digital STABILO products, the associated apps, and the digital services used in each case.

The data processed depends on the product used, the app selected, the features enabled, and the respective user account. Where additional product-specific privacy notices are provided for individual products or services, they apply in addition.

7.1 KATHY (Kinematic Analysis Technology for Handwriting) System – STABILO LUNIS ink with phase6 and cabuu

7.1.1 Scope and Controller

This section applies to the STABILO LUNIS ink digital writing pen and the technical infrastructure operated by STABILO for the KATHY System for handwriting recognition.

The STABILO LUNIS ink can be used in particular with the apps from phase6 and cabuu, as well as with other apps approved by STABILO. STABILO International GmbH is the controller for the processing of writing, sensor, device, and recognition data described in this section within the KATHY infrastructure operated by STABILO.

phase6 and cabuu process personal data within their respective apps, in particular user account data, learning content, learning progress, contract and payment data, and other app-related data, generally under their own responsibility under data protection law. The privacy notices of the respective providers apply to this processing.

7.1.2 Categories of Data Processed

When the STABILO LUNIS ink is used, we may process, in particular, the following data:

Writing and sensor data: acceleration and gyroscope data, pressure values, tilt, orientation, direction and speed of movement, time sequences, pen-down and pen-up information, and other technically necessary measurements of the writing process;
Handwritten input and recognition results: written characters, words, and texts; recognition results derived from them; confidence scores; alternative recognition suggestions; and results confirmed or corrected by the user;
Calibration and configuration data: calibration values, information about left- or right-handedness, pen-holding settings, product-related configurations, and parameters for individual handwriting recognition;
Device and connection data: pseudonymous pen or device identifier, hardware and firmware version, app and operating system version, technical session identifiers, connection status, timestamps, temporarily processed IP address, and error and diagnostic data;
Usage and model data: pseudonymous user or Writer ID, information about model versions, model parameters required for individual handwriting recognition, and technically necessary training and validation data.

Sensor and writing data may be captured at a technically specified sampling rate. Based on the current technical configuration, the sampling rate is up to 100 Hz.

7.1.3 Purposes and Legal Bases

We process the data listed above in order to:

provide handwriting recognition and convert writing movements into digital characters, words, or texts;
set up, calibrate, and technically operate the pen;
transmit recognition results to the compatible app being used in each case;
adapt handwriting recognition to the user’s individual handwriting;
analyze and correct technical errors and ensure the security, stability, and functionality of the systems;
detect and prevent misuse and unauthorized access; and
comply with legal obligations.

The processing of data to provide handwriting recognition, calibration, individual model adaptation, and the adaptation and maintenance of the general handwriting recognition model is based on Art. 6 Abs. 1 lit. b GDPR.

AI-powered handwriting recognition is the core benefit of the digital product and the associated digital service. It includes not only the one-time conversion of individual writing movements into characters, words, or texts, but also the provision of a capable general recognition model and its ongoing adaptation to the handwriting and writing situations encountered during the intended use of the product. The general model provides the technical basis for individual handwriting recognition; individual model adaptation tailors this recognition capability to the personal handwriting of the respective user. Both model components are functionally inseparable parts of the same handwriting recognition function owed under the contract.

Processing is therefore objectively necessary to provide and maintain the agreed product function during the term of the contract. It is not carried out for any independent research, advertising, profiling, or other purpose unrelated to the product. In particular, the data is not used for advertising, advertising profiles, the sale of user data, or the assessment of the user’s personal characteristics.

7.1.4 AI-Powered Handwriting Recognition

Handwriting recognition is based on artificial intelligence methods. The system used analyzes the writing and sensor data captured by the pen to determine the character, word, or text most likely to have been written.

To improve recognition accuracy, an individual handwriting recognition model may be created and adapted during use. This may involve processing, in particular, writing and sensor data, calibration parameters, recognition results confirmed or corrected by the user, and pseudonymous user or Writer IDs.

The AI generates technical recognition results that may be incorrect or incomplete. No decision is made solely by automated means that produces legal effects concerning the user or similarly significantly affects the user.

7.1.5 Data Minimization, Pseudonymization, and Safeguards

We process only data necessary for the respective handwriting recognition and product function. Where technically possible and not necessary for handwriting recognition, directly identifying information is separated from writing and sensor data or removed before the data is used for training, validation, and adaptation processes.

For these processes, datasets may be assigned a pseudonymous user or Writer ID. Pseudonymized data remains personal data as long as it can be linked using additional information that is protected separately.

We implement appropriate technical and organizational measures pursuant to Art. 25 and Art. 32 GDPR. These include, in particular, encrypted data transmission, appropriate measures to encrypt stored data, role-based authorization concepts, access on a need-to-know basis, logging of security-relevant access, and backup, recovery, and deletion procedures. For security reasons, this Privacy Notice does not contain a complete description of all safeguards.

7.1.6 Special Categories of Personal Data and Confidential Content

The STABILO LUNIS ink is not intended to collect special categories of personal data within the meaning of Art. 9 Abs. 1 GDPR. However, because users determine the content they write, it cannot be ruled out that they may voluntarily write information about health, religion, political opinions, or other confidential matters.

Therefore, unless necessary for use, please do not enter special categories of personal data, access credentials, passwords, or other confidential information. STABILO does not use the substantive meaning of handwritten texts to create health, interest, personality, or advertising profiles.

7.1.7 No Automated Decision-Making within the Meaning of Art. 22 GDPR

The handwriting recognition system automatically generates technical recognition results. These results are used exclusively to convert writing movements into digital characters, words, or texts and may be incorrect or incomplete.

No decision is made based solely on automated processing that produces legal effects concerning users or similarly significantly affects them. No automated decision-making, including profiling within the meaning of Art. 22 Abs. 1 GDPR, takes place as part of handwriting recognition.

7.1.8 Recipients and Processing within the European Union

Within STABILO, only employees who need the data for the operation, maintenance, security, or support of the digital product functions have access to it.

In particular, we use the following processors:

Open Telekom Cloud / Deutsche Telekom: provision of server, storage, network, and security infrastructure in Germany;
Kinemic GmbH, Haid-und-Neu-Straße 7, D-76131 Karlsruhe: technical support for providing, maintaining, and adapting the handwriting recognition system and training the general recognition model; Kinemic GmbH receives pseudonymized data exclusively for this purpose.

These service providers process data under data processing agreements pursuant to Art. 28 GDPR and solely in accordance with our documented instructions. The KATHY infrastructure and the core processing for handwriting recognition are located within the European Union. The writing and sensor data described in this section are not intended to be transferred to countries outside the European Union or the European Economic Area for the core function.

7.1.9 Retention Period and Deletion

Operational raw sensor, connection, and operating data is generally stored for no more than 90 days, to the extent necessary to provide handwriting recognition, analyze errors, ensure system security, or select and pseudonymize suitable data. It is then deleted or anonymized, unless further storage is necessary for individual handwriting recognition.

We store data and parameters associated with an individual handwriting recognition model for as long as the product and associated digital service are actively used. They are deleted when the associated user account or pseudonymous Writer ID is deleted, the individual model function is discontinued, or the data is no longer necessary. Deletion from active systems generally takes place within 30 days, unless statutory retention obligations or technically unavoidable temporary backup copies prevent this.

Pseudonymized training and validation data for general handwriting recognition is stored only for as long as necessary to provide and maintain the contractually required handwriting recognition function. Its necessity is reviewed regularly; it is deleted or anonymized after no more than three years, unless a documented review determines that further storage is necessary.

7.1.10 Children and Adolescents

Learning apps associated with the STABILO LUNIS ink may be used by children and adolescents. The personal data of minors is processed solely to provide the respective product, learning, and handwriting recognition functions and is not used for personalized advertising or advertising profiling.

If consent is exceptionally required for processing, we comply with the statutory requirements, in particular Art. 8 GDPR and the applicable national provisions. The core handwriting recognition processing described in this section, including individual and general model adaptation, is not based on consent but, to the extent objectively necessary, on performance of the user agreement pursuant to Art. 6 Abs. 1 lit. b GDPR.

7.2 STABILO LUNIS graph and STABILO BOLLY

7.2.1 Data Processed and Purposes

When STABILO LUNIS graph and STABILO BOLLY are used, we process, in particular, the pen’s writing and movement data, calibration data, exercise and learning progress data, device and connection data, and STABILO user account data, to the extent necessary for the respective function. The pen’s writing and movement data is processed only in real time for immediate feedback in the app and is neither stored nor transmitted to STABILO.

Processing is carried out to provide learning and practice functions, store and display learning progress, synchronize between devices, analyze errors, ensure IT security, and continuously provide and technically improve the agreed functions.

Processing is based on Art. 6 Abs. 1 lit. b GDPR to the extent objectively necessary to provide the user account, synchronization, learning and practice functions, and the functionality and quality of the digital product functions owed during the term of the contract. This also includes processing technical error and security data to the extent necessary for operation in accordance with the contract.

7.2.2 User Account, Recipients, and Retention Period

For authentication, LUNIS graph and BOLLY use the STABILO user account referred to in section 7.4. Processing takes place on servers in Germany within the Open Telekom Cloud. Service providers process data solely on our behalf pursuant to Art. 28 GDPR.

Data is stored for as long as it is actively used. After three years without a sign-in or active use, the user account is classified as inactive. The user is notified by email 30 days before the scheduled deletion. If the account is not reactivated, the user account and associated personal data are deleted, unless statutory retention obligations apply. Users may delete their user account at any time in the account management area. Alternatively, deletion may be requested at any time using the form at https://www.stabilo.com/com/data-act-cra/#nav-formular or the contact details listed in section 7.7.

7.3 STABILO Highlight App

7.3.1 Data Processed and Purposes

The STABILO Highlight App allows users to capture, store, and manage text highlights using image capture, optical character recognition, and optional AI-powered functions, such as summaries, explanations, or translations.

In particular, we may process the following data:

images of highlighted text and other content uploaded or captured by the user;
OCR text extracted from those images;
highlight information and technical characteristics used to identify highlights;
metadata, in particular timestamps, source information, and device information; and
STABILO user account data and technical usage and log data.

Processing is carried out to provide the app functions, in particular to identify and store highlights, display and synchronize stored content, generate AI outputs requested by the user, analyze errors, and ensure technical operation.

Processing is based on Art. 6 Abs. 1 lit. b GDPR to the extent objectively necessary to provide the agreed app functions. This includes storing, displaying, and synchronizing content saved by the user, as well as processing technical error and security data to the extent necessary for operation in accordance with the contract.

7.3.2 Transparency Regarding the Use of Artificial Intelligence

Optical character recognition and the optional functions for generating summaries, explanations, or translations are based on artificial intelligence methods. The AI processes content selected or submitted by the user to generate the requested output. Results may be incomplete or incorrect and are provided solely as assistance; they do not replace professional, educational, scientific, occupational, or other qualified assessment.

The app is designed so that users can tell when they are using an AI-powered function. If the app generates or substantially modifies content, this is identified within the relevant function, to the extent required by Art. 50 of Verordnung (EU) 2024/1689 („EU-KI-Verordnung“). The app does not use emotion recognition systems or biometric categorization systems. No solely automated decision with legal or similarly significant effects within the meaning of Art. 22 GDPR is made.

7.3.3 Recipients, Transfers to Third Countries, and AI Services

The Highlight App data is processed on Amazon Web Services servers in the European Union. Amazon Web Services EMEA SARL processes data as a processor under an agreement pursuant to Art. 28 GDPR.

We also use Google Firebase (including Crashlytics for crash reports) and Neon.tech (database) as processors for operating the app, under agreements pursuant to Art. 28 GDPR. Processing generally takes place within the European Union. If personal data is transferred through Google Firebase to a country outside the European Union or the European Economic Area, this is done only under the conditions set out in Art. 44 ff. GDPR, in particular on the basis of appropriate safeguards under Art. 46 GDPR and, where necessary, additional safeguards. Further information on privacy and data processing by Google Firebase and Neon.tech can be found in their respective privacy notices: Google Firebase (https://firebase.google.com/support/privacy) and Neon.tech (https://neon.tech/privacy-policy).

Google services may be used for optical character recognition and optional generative AI functions. If personal data is transferred in this context to a country outside the European Union or the European Economic Area, this is done only under the conditions set out in Art. 44 ff. GDPR, in particular on the basis of appropriate safeguards under Art. 46 GDPR and, where necessary, additional safeguards.

Fionalila Inc., Republic of Korea, may have access to data for technical development and support services. Such access takes place solely on behalf of STABILO, only to the extent necessary, and under an agreement pursuant to Art. 28 GDPR and appropriate safeguards for transfers to third countries pursuant to Art. 46 GDPR.

The services used for OCR and generative AI are configured so that the submitted content is not used to train the providers’ models, to the extent contractually and technically available.

7.3.4 Retention Period

Images, texts, and highlight data are stored for as long as the user account is actively used because storing them is a core app function. Users may delete stored content in the app at any time. When the user account is deleted, associated content is generally deleted within 30 days, unless statutory retention obligations apply.

Technical server logs are generally deleted after no more than 3 days, unless they are needed to investigate a specific security or error incident. Section 7.4 also applies to deletion of the user account.

7.4 STABILO User Account and Authentication

The STABILO user account is used for authentication with LUNIS graph, BOLLY, and the STABILO Highlight App. In particular, we process email address, password hash, sign-in times, technical session identifiers, and device information.

Processing is carried out to set up and manage the user account, control access, and synchronize data between devices, based on Art. 6 Abs. 1 lit. b GDPR.

The authentication infrastructure is operated on servers within the Open Telekom Cloud in Germany. Account data is stored for as long as the account is actively used. After three years without a sign-in or active use, the account is classified as inactive. The user is notified by email 30 days before the scheduled deletion. If the account is not reactivated, the account and associated personal data are deleted, unless statutory retention obligations apply. Users may delete their account at any time in the account management area; alternatively, deletion may be requested using the form at https://www.stabilo.com/com/data-act-cra/#nav-formular or the contact details listed in section 7.7.

7.5 ErgoPen Neo and EduPen Neo

When ErgoPen Neo and EduPen Neo are used, we process writing, sensor, device, and, where applicable, account data to provide the respective app functions, enable use of the products, analyze technical errors, and ensure secure operation.

Processing is based on Art. 6 Abs. 1 lit. b GDPR to the extent objectively necessary to provide the agreed app function, including secure and functional operation. This includes processing writing, sensor, exercise, and device data, as well as technically necessary error and security data.

Where a pseudonymous account is used, exercising data subject rights may require the user ID or backup ID. We request only the information necessary to identify the dataset and protect against unauthorized requests.

Server-side usage data and backups are processed on Open Telekom Cloud servers in Germany. Service providers process data solely on our behalf pursuant to Art. 28 GDPR.

Retention period and deletion: Data stored only locally in the app on the tablet remains there until it is deleted in the app or the app data is removed from the tablet. We store server-side usage data and backups while the app is actively used. After three years without use, we delete this data unless statutory retention obligations apply. Because no email address is stored for pseudonymous accounts, no prior notification is sent. Deletion of server-side data may be requested by providing the user ID or backup ID, using the form at https://www.stabilo.com/com/data-act-cra/#nav-formular or by emailing datenschutz@schwan-stabilo.com; deletion takes place within 30 days. Deletion of server-side data does not terminate the one-time purchased, perpetual app license.

7.6 Special Categories of Personal Data, Minors, and AI Transparency

Depending on the application, digital STABILO products may involve special categories of personal data within the meaning of Art. 9 Abs. 1 GDPR. Because users may themselves write, photograph, upload, or enter content into AI functions in some products, it cannot be ruled out that such content may voluntarily contain special categories of personal data or other confidential information.

Therefore, unless necessary for use, please do not submit health data, access credentials, passwords, or other confidential information. We do not use such content to create health, interest, personality, or advertising profiles.

Where digital products may be used by children or adolescents, we process their data solely to provide the agreed product, learning, and app functions. The data of minors is not used for personalized advertising or advertising profiling. If consent is exceptionally required, we comply with the statutory requirements, in particular Art. 8 GDPR and the applicable national provisions.

Where we use AI-powered functions, we clearly inform users within the relevant product function about the use of AI and its essential functional limitations. This applies in particular to functions in which users interact with an AI system or in which AI content is generated or substantially modified, to the extent required by Art. 50 of Verordnung (EU) 2024/1689 („EU-KI-Verordnung“). The digital products described do not use emotion recognition systems or biometric categorization systems. Unless expressly stated otherwise, the AI systems do not make decisions with legal or similarly significant effects within the meaning of Art. 22 GDPR.

7.7 GDPR Rights and Contact for Digital Products

With respect to the processing described in this section 7, you may exercise, in particular, your rights of access, rectification, erasure, restriction of processing, and data portability, subject to the statutory requirements.

For inquiries about digital STABILO products, please contact:

STABILO International GmbH
Schwanweg 1
90562 Heroldsberg
Germany
Email: Datenschutz@schwan-stabilo.com

Alternatively, you may submit your inquiry using the form at https://www.stabilo.com/com/data-act-cra/#nav-formular.

To identify an inquiry, you may be required to provide your user, device, backup, or Writer ID. We process only the data necessary to identify the relevant dataset and protect against unauthorized requests.

7.8 Information under the EU Data Act

The rights under Verordnung (EU) 2023/2854 („EU Data Act“) also apply to connected STABILO products. Users may request access to data generated through use of the respective connected product and, to the extent legally permissible, request that it be transferred to a designated third party.

Detailed information about the data categories generated by each product, the estimated data volume, the frequency of data collection, storage locations, access to the data, and data sharing is provided on the product-specific information pages at https://www.stabilo.com/com/data-act-cra/. This information is provided before entering into a contract for the respective connected product or associated service.

Requests under the EU Data Act may be submitted using the form at https://www.stabilo.com/com/data-act-cra/#nav-formular. GDPR rights may also continue to be exercised by emailing datenschutz@schwan-stabilo.com. Provision is generally free of charge and in a structured, commonly used, machine-readable format. If the requesting user is not the data subject, we provide personal data only if there is a valid legal basis under the GDPR.

8. Fan Pages on Facebook, Instagram, TikTok, YouTube, Pinterest

We are joint controllers (Art. 4 No. 7 GDPR) together with the respective operators. Further information:

The essential content of the agreements on joint controllership pursuant to Art. 26 GDPR can be viewed at the respective platform operators.

9. Security Measures

We protect your data through technical and organizational measures, adapt these regularly, and point out that unencrypted communication (e.g. email) can be read by third parties. Please protect your data through appropriate measures (e.g. encryption).

10. Hyperlinks

Our website contains links to other providers. Those providers are responsible for their own data protection. Please inform yourself directly there.

11. External Service Providers

We engage service providers in the context of data processing on our behalf. These are bound by our instructions and are only given the access that is necessary. In this context, data may be transferred to third countries (in particular the USA); standard contractual clauses have been concluded; if applicable, additional measures to protect your data. To the extent that data is transferred to countries outside the EU/EEA, this only takes place in compliance with the requirements of Art. 44 et seq. GDPR.

12. Storage Period

We process and store personal data only for as long as is necessary for the respective purposes or as statutory retention obligations exist.

In detail, the following storage periods or criteria apply:

Data in connection with customer inquiries (e.g. by email or contact form) is generally deleted after final processing, unless statutory retention obligations exist or further storage is necessary for the assertion, exercise, or defense of legal claims.
Applicant data is generally deleted 6 months after the conclusion of the application process, unless consent to longer storage has been given.
Usage and log data (e.g. server log files) is stored for a limited period for security reasons and subsequently deleted, unless further retention for evidentiary purposes is required.

If statutory retention obligations exist or data is needed for the assertion or defense of legal claims, deletion takes place only after the expiry of the respective periods.

13. Rights of Data Subjects

13.1 Right of Access (Art. 15 GDPR)

You have the right to obtain information about the personal data being processed.

13.2 Right of Withdrawal (Art. 7 para. 3 GDPR)

You may withdraw any consent given at any time with effect for the future – by email to Datenschutz@schwan-stabilo.com or by post to STABILO International GmbH, Schwanweg 1, 90562 Heroldsberg, Germany.

13.3 Right to Rectification (Art. 16 GDPR)

You may request the rectification of inaccurate data or the completion of your data.

13.4 Right to Erasure/Restriction (Art. 17/18 GDPR)

You have the right to erasure or restriction, provided no retention obligations preclude this.

13.5 Right to Data Portability (Art. 20 GDPR)

You may request the provision of your data in a commonly used, machine-readable format.

13.6 Right to Object (Art. 21 GDPR)

You may object, on grounds relating to your particular situation, to processing based on Art. 6 para. 1 lit. f GDPR.

13.7 Contact for Data Subject Rights

Email: Datenschutz@schwan-stabilo.com
Post: STABILO International GmbH, Schwanweg 1, 90562 Heroldsberg, Germany

14. Right to Lodge a Complaint with a Supervisory Authority (Art. 77 GDPR)

You have the right to lodge a complaint with the competent lead supervisory authority:

Bayerisches Landesamt für Datenschutzaufsicht

Office address:

Promenade 18
91522 Ansbach
Germany

Postal address:

Postfach 1349
91504 Ansbach
Germany

Phone: +49 (0) 981 180093-0
Fax: +49 (0) 981 180093-800

Email: poststelle@lda.bayern.de (Only PDF files are accepted by email)

Complaint form: https://www.lda.bayern.de/de/beschwerde.html

or also with a local authority.

15. Automated Decision-Making/Profiling

We do not use automated decision-making or profiling.

As of: October 2026