Privacy policy

Preamble

deuter Sport GmbH is pleased that you are visiting our website. Data protection and data security when using our website are very important to us. Below, we inform you which personal data we process when you visit our website and use our services, for what purposes we do so, the legal basis for this processing, and your rights. As changes in legislation or in our internal processes may require this privacy policy to be amended, we ask you to read this privacy policy regularly.

This privacy policy applies to the online offering of deuter Sport GmbH, available at https://www.deuter.com.

1. Name of the controller

The controller and service provider is deuter Sport GmbH, Daimlerstraße 23, 86368 Gersthofen, Germany (hereinafter referred to as “deuter”, “we” or “us”).

2. Name and address of the data protection officer

Our data protection officer is Sebastian Meyer, Schwanweg 1, 90562 Heroldsberg, Germany. You may contact our data protection officer at any time with questions relating to data protection. The best way to contact him is by email at Datenschutz@schwan-stabilo.com.

3. General information on data processing

As a general rule, we collect and use our users’ personal data only to the extent necessary to provide a functioning website and our content and services.

3.1 Personal data

Personal data means any information relating to an identified or identifiable natural person. This includes, for example, a name, age, address, telephone number, date of birth, email address, IP address or information about user behaviour. Information where no link to you can be established, or where this would require disproportionate effort, in particular anonymised information, is not considered personal data.

3.2 Processing of personal data

Processing means any operation performed on personal data, whether or not by automated means, including in particular the collection, recording, organisation, structuring, storage, adaptation, alteration, retrieval, consultation, use, disclosure, transmission, dissemination, alignment, restriction, erasure or destruction.

3.3 Legal bases for processing personal data

Where we obtain consent for processing personal data, the legal basis is Article 6(1)(a) GDPR. Where processing is necessary for the performance of a contract to which you are a party or for taking steps at your request before entering into a contract, the legal basis is Article 6(1)(b) GDPR.

Where processing is necessary for compliance with a legal obligation to which we are subject, the legal basis is Article 6(1)(c) GDPR. Where processing is necessary for the purposes of our legitimate interests or those of a third party, and your interests, fundamental rights and freedoms do not override those interests, the legal basis is Article 6(1)(f) GDPR.

4. Data processing operations

Personal data is collected via this website when you provide it to us voluntarily, for example by completing forms, creating a customer account, placing an order or sending an email. We use this data for the purposes stated in each case or resulting from your enquiry.

4.1 Informational use of the website

You can visit our website without providing information about yourself. If you use our website for informational purposes only, we process in particular the data transmitted by your browser for the technical provision of the website. This information is automatically collected each time our website is accessed and stored in server log files. This may include:

  • Host and IP address of the accessing device
  • Date and time of access
  • Access method, for example GET or POST
  • Requested resource or request
  • Protocol, for example HTTPS
  • Status and error messages
  • Amount of data transferred
  • Referrer URL
  • Browser type, browser version and operating system

The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is the secure, stable and technically proper provision of our online offering.

The data is deleted as soon as it is no longer required to display and operate the website. Further storage may take place if required by law or if necessary for the establishment, exercise or defence of legal claims.

4.2 Active use of the website – contact form

If you use our contact form, we process the data you enter, in particular your first name, surname and email address. You may voluntarily provide your address and telephone number. We also process the content of your message.

Processing takes place to handle your enquiry. The legal basis is Article 6(1)(f) GDPR. If your enquiry is aimed at concluding a contract, the legal basis is Article 6(1)(b) GDPR. The data required for communication is deleted once your enquiry has been finally dealt with, unless statutory retention obligations or legitimate interests require further storage.

If you have consented to your enquiry being forwarded to a responsible country representative or partner company, we may transmit the information required to handle it, in particular your name, email address and request, to that company. As a rule, no such disclosure takes place without your consent.

4.3 Registration for a customer account

You can create a customer account on our website. We process the data marked as mandatory in the input form, in particular your form of address, first and last name, address, email address and a password chosen by you. Providing a telephone number is voluntary. In addition, your IP address and the date and time of registration may be processed.

We process this data to set up and administer your customer account, enable orders and send you new access details if required. The legal basis is Article 6(1)(b) GDPR.

You can have your customer account deleted at any time. To do so, send an email to privacy@deuter.com. Statutory retention obligations remain unaffected.

4.4 Dealer search

a) OUTTRA component

We use the OUTTRA component provided by 81 MEDIA GmbH, Ziegelbrennerstraße 5, 73074 Stuttgart, Germany, for the dealer search. Processing the IP address is necessary to display the dealer search. OUTTRA anonymises the IP address on its own server and uses the anonymised part for approximate localisation so that local dealers can be displayed.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is providing and promoting our products and the dealer search. If checking product availability serves to initiate a contract, the legal basis is Article 6(1)(b) GDPR. After the browser session ends, the component generally does not store personal data with OUTTRA, 81 MEDIA GmbH or deuter, unless otherwise stated in an individual case.

b) Google Maps

To display maps within the dealer search, we use Google Maps, a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google may process your IP address for this purpose. Activation takes place only after you have given your consent. The legal basis is Article 6(1)(a) GDPR in conjunction with Section 25(1), sentence 1 TDDDG.

You can withdraw your consent at any time with effect for the future via the dealer-search settings or our consent manager. The transfer of personal data to countries outside the EU or EEA, in particular the USA, cannot be ruled out. Further information is available in Google’s privacy policy.

4.5 Ordering process in the deuter online shop and payment processing

To process orders, we process in particular your first and last name, billing and delivery address, email address, telephone number, order and payment data, and the information required for the order concerning the items ordered, quantities, prices, discounts and taxes. Where required for a specific payment method and legally permissible, your date of birth and data for fraud and risk prevention may also be processed.

Payment service provider Unzer

We use Unzer as our payment service provider. Payment processing takes place in particular via Unzer E-Com GmbH, Vangerowstraße 18, 69115 Heidelberg, Germany. Depending on the payment method selected, the data required for payment is transmitted to Unzer and, where applicable, to other companies, credit institutions or payment service providers involved in payment processing.

The data transmitted may include, in particular, the name and address of the billing recipient, delivery address, email address, telephone number, order number, order amount, currency, order contents and transaction information. For card payments, the card and transaction data required for payment processing is processed. We generally do not see complete card details where payment processing takes place directly via Unzer.

Processing takes place to perform the purchase contract and process payments on the basis of Article 6(1)(b) GDPR. Where processing serves to prevent fraud, prevent abusive payments or secure our claims, the legal basis is Article 6(1)(f) GDPR. Where statutory obligations, in particular under payment and tax law, must be fulfilled, the legal basis is Article 6(1)(c) GDPR.

Further information is available in Unzer’s privacy policy.

Purchase on invoice in Germany

For deliveries to Germany, we offer purchase on invoice as a payment method. If you select this payment method, the data required for payment processing may be transmitted to Unzer and to the company within the Unzer Group responsible for purchase on invoice, in particular Payolution GmbH, Columbusplatz 7–8, Stiege 1/5, 1100 Vienna, Austria. The relevant company processes the data as controller for checking, performing and settling the purchase on invoice.

To decide whether purchase on invoice can be offered, identity, address, contact, order and payment information and, where applicable, information about previous payment processing may be processed and information from credit agencies may be included where necessary. Processing serves identity and credit checks, fraud prevention, risk management and the settlement of the purchase on invoice. Processing may be based on Article 6(1)(b) GDPR and, insofar as it concerns fraud and risk prevention, Article 6(1)(f) GDPR. The separate privacy notices of Unzer and Payolution also apply to processing by Unzer or Payolution.

Further information about purchase on invoice and your rights is available in Unzer’s or Payolution’s privacy information for consumers.

If the selected payment method cannot be offered, you can choose another available payment method. After the contract has been fully processed, the data is blocked from further use and deleted after the expiry of the tax and commercial-law retention periods, unless another legal basis permits longer storage.

4.6 Shipping

To perform the contract, we provide the data required for delivery to the commissioned shipping company, in particular DHL Paket GmbH, Sträßchensweg 10, 53113 Bonn, Germany, and, where applicable, to local delivery partners. We use PAQATO GmbH, Johann-Krane-Weg 6, 48149 Münster, Germany, for shipment tracking.

The legal basis for transferring delivery data is Article 6(1)(b) GDPR. If you have consented to delivery notification or coordination by email or telephone, Article 6(1)(a) GDPR is the legal basis for transferring the email address and telephone number required for this purpose. You may withdraw your consent at any time with effect for the future.

4.7 Applicant management

If you apply for a vacancy advertised by us, we process the application data you provide to conduct the application process. You can send your application by email to ichwill@deuter.com or by post to deuter Sport GmbH, Daimlerstraße 23, 86368 Gersthofen, Germany.

The legal basis is Article 6(1), sentence 1(b) GDPR in conjunction with Section 26(1) BDSG. As a rule, we store application data for six months after the application process has ended, unless longer storage is required due to legal proceedings or your consent. We require your separate consent under Article 6(1)(a) GDPR to include you in an applicant database. You can withdraw this consent at any time.

4.8 Newsletter

We require your email address to send the newsletter. The newsletter is sent via Inxmail GmbH, Wentzingerstraße 17, 79106 Freiburg, Germany, which processes your data on our behalf. We use the double opt-in procedure. The legal basis is Article 6(1)(a) GDPR. You can withdraw your consent at any time via the unsubscribe link in the newsletter or by email to privacy@deuter.com.

To improve our newsletter, we may analyse opens, clicks and other reactions if you have given separate consent for this. Newsletter data is deleted as soon as you unsubscribe, unless statutory retention obligations prevent this.

4.9 Competitions

If you participate in a competition, we process the information required to conduct it, in particular your name and email address and, depending on the competition, your address, telephone number and other data specified in the terms of participation. The legal basis is Article 6(1)(b) GDPR. After the competition has ended and the winners have been notified, the data is deleted unless statutory retention obligations or legitimate interests prevent this.

4.10 Microsoft Clarity

We use Microsoft Clarity, a service for analysing user behaviour and user experience on our website. The provider is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland.

Depending on your consent and the technical configuration, Microsoft Clarity may collect information about your use of our website, in particular pages viewed, navigation, clicks, scrolling, mouse movements, interactions with elements, technical device and browser data and session data. Clarity may use this information to create heat maps and session recordings. We mask input fields and sensitive content as far as technically possible. We do not transmit content through Clarity that is not required for the analysis.

Clarity is activated only after you have given consent via our consent manager. The legal basis for storing and accessing information on your device is Section 25(1), sentence 1 TDDDG. The subsequent processing of personal data is based on your consent under Article 6(1)(a) GDPR. You can withdraw your consent at any time with effect for the future via our consent manager. After withdrawal, Clarity is no longer loaded or further collection is stopped.

Microsoft describes Clarity as a privacy-compliant service and as an independent controller for certain processing activities. According to Microsoft, session data is generally retained for up to 30 days for use by the website operator; the actual retention period depends on the configuration of the Clarity project. A transfer to countries outside the EU or EEA, in particular the USA, may take place as part of Microsoft’s internal data processing and support or infrastructure services. For such transfers, Microsoft uses the applicable transfer mechanisms, in particular standard contractual clauses where required.

Further information is available in Microsoft Clarity’s privacy information, the Microsoft Clarity FAQ and Microsoft’s privacy statement.

4.11 OpenAI Ads

We place advertising through OpenAI’s advertising services, in particular OpenAI Ads or the Advertising Services provided by OpenAI. For users in the European Economic Area, the provider may be OpenAI Ireland Limited, 1st Floor, The Liffey Trust Centre, 117–126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland.

For planning, serving and measuring the success of our campaigns, OpenAI or service providers engaged by OpenAI may process campaign and advertising materials, technical information, interactions with advertisements and, where activated by us, conversion or audience data. We use OpenAI Ads as an advertiser and do not integrate an OpenAI API function into this website.

Processing our campaign and billing data takes place to perform the business relationship and protect our legitimate interests in promoting our products and measuring advertising effectiveness, on the basis of Article 6(1)(b) or (f) GDPR. If we use conversion, remarketing or comparable technologies on our website that store or access information on your device, we do so only after your consent under Section 25(1), sentence 1 TDDDG; the subsequent processing of personal data is then based on Article 6(1)(a) GDPR.

Depending on the specific OpenAI advertising tool used and the type of processing, OpenAI may act as a processor or as an independent controller. If we transmit audience or conversion data to OpenAI, we comply with the applicable contractual and data protection requirements. A transfer to countries outside the EU or EEA, in particular the USA, may take place. In the applicable contractual and privacy documents, OpenAI describes the transfer mechanisms used, in particular standard contractual clauses where required.

Further information is available in OpenAI’s Advertising Terms, the Ad Tools Terms, the Ad Tools Data Processing Addendum and OpenAI’s Europe Privacy Policy.

5. Disclosure of personal data to third parties

We disclose personal data only where this is necessary to perform a contract, take steps before entering into a contract, comply with a legal obligation, protect legitimate interests or based on your consent. Recipients may include payment service providers, shipping and logistics companies, IT and hosting providers, analytics and marketing providers, customer service and applicant-management providers and affiliated companies.

Disclosure may also take place if we are obliged to do so by an official or court order or if this is necessary for the establishment, exercise or defence of legal claims.

6. Cookies and external services

Cookies and comparable technologies are small files or technical storage mechanisms that may store or access information on your device. Some functions of our website cannot be provided without technically necessary cookies. We use non-essential analytics, marketing and personalisation technologies only after you have given your consent.

Further information about the cookies used, the relevant providers, retention periods and your settings options is available in our Cookie Policy and in the consent manager.

7. Social plugins

Our websites may contain social plugins or embedded content from the social networks Facebook, Instagram, Pinterest, X, YouTube and LinkedIn. Such content is generally activated only after you have given your consent. When activated, a connection to the servers of the relevant provider may be established. In particular, the IP address, device information and information about accessing the relevant page may be processed.

The legal basis for storing and accessing information on your device is Section 25(1), sentence 1 TDDDG. The subsequent processing of personal data is based on your consent under Article 6(1)(a) GDPR. You can withdraw your consent at any time via our consent manager.

For further information, please refer to the privacy notices of the relevant providers:

8. Pages on social networks

We operate our own presences on the social networks Facebook, Instagram, YouTube, LinkedIn, XING, Pinterest, X and TikTok.

When you visit one of our presences, the relevant platform operator may process personal data. We are joint controllers with, or controllers alongside, the operators of the social networks for certain processing activities where this is provided for by the relevant agreements and legal requirements. The platform operators may provide us with aggregated statistics about the use of our presences.

We link to our TikTok channel from our website. When you open the TikTok link, you leave our website and TikTok’s privacy provisions apply. In this context, we do not embed a TikTok pixel or TikTok content on deuter.com. Merely displaying the link generally does not cause TikTok content to be loaded by TikTok. Further information is available in TikTok’s privacy policy.

Further information about data processing by the other platforms is available in their respective privacy policies:

9. Security measures to protect the data stored by us

We implement technical and organisational security measures to protect your personal data against loss, destruction, unauthorised access, alteration or disclosure. The measures are reviewed regularly and adapted to technological developments. Please note that data transmission over the internet may nevertheless have security vulnerabilities despite these measures.

10. Hyperlinks

Our website contains hyperlinks to websites operated by other providers. When you activate a hyperlink, you leave our offering. The respective operator is solely responsible for the processing of personal data on the linked websites. Please observe the privacy notices of the relevant provider.

11. Eye-Able®

We use Eye-Able® from Web Inclusion GmbH to enable more accessible access to information on the internet. The required files are loaded via a content delivery network operated by BunnyWay d.o.o., Cesta komandanta Staneta 4A, 1215 Medvode, Slovenia. When functions are activated, Eye-Able® uses the browser’s local storage to save settings locally. According to the information available to us, these settings are not transmitted to us. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is providing our online offering in a more accessible, secure and efficient manner.

Further information is available at https://eye-able.com/datenschutz-eye-able/ and https://bunny.net/privacy.

12. External service providers

We use service providers that process data on our behalf. These service providers are carefully selected, contractually obligated and receive only the access required. Where service providers act as processors, we conclude agreements in accordance with Article 28 GDPR.

Personal data may be transferred to countries outside the EU or EEA. In these cases, we ensure that the requirements of Articles 44 et seq. GDPR are met, in particular through an adequacy decision, standard contractual clauses and, where applicable, additional safeguards.

13. Retention period

We delete personal data as soon as the purpose of processing has been achieved or no longer applies, unless statutory retention obligations or legitimate interests require further storage.

Contract and invoice data is retained in accordance with commercial and tax law requirements. Depending on the category of data, retention periods of six or ten years may apply. Data required for the establishment, exercise or defence of legal claims is stored until the expiry of the applicable limitation or procedural periods.

14. Data subject rights

14.1 Right of access, Article 15 GDPR

You have the right to request information about the personal data stored about you and its origin, recipients, purposes and retention period.

14.2 Right to withdraw consent, Article 7(3) GDPR

You may withdraw consent you have given at any time with effect for the future. The lawfulness of processing carried out before withdrawal remains unaffected. To do so, contact privacy@deuter.com or deuter Sport GmbH, Daimlerstraße 23, 86368 Gersthofen, Germany.

14.3 Right to rectification, Article 16 GDPR

You may request the rectification of inaccurate personal data or the completion of incomplete personal data.

14.4 Right to erasure and restriction of processing, Articles 17 and 18 GDPR

Under the statutory conditions, you may request the erasure or restriction of processing of your personal data. Statutory retention obligations may prevent erasure.

14.5 Right to data portability, Article 20 GDPR

Under the statutory conditions, you have the right to receive the personal data you have provided in a structured, commonly used and machine-readable format or to request that it be transmitted to another controller.

14.6 Right to object, Article 21 GDPR

You have the right to object, on grounds relating to your particular situation, to processing based on Article 6(1)(e) or (f) GDPR. You may object at any time to processing for direct marketing purposes.

14.7 Contact for exercising your rights

To exercise your rights, contact privacy@deuter.com or deuter Sport GmbH, Daimlerstraße 23, 86368 Gersthofen, Germany. When you contact us, we process the data you provide to handle your request. The data is deleted as soon as it is no longer required for this purpose, unless retention obligations apply.

15. Right to lodge a complaint with a supervisory authority, Article 77 GDPR

You have the right to lodge a complaint with a data protection supervisory authority about the processing of your personal data, in particular with the supervisory authority responsible for your habitual residence, place of work or the place of the alleged infringement.

16. Transfer of data to affiliated companies

For operational reasons and to ensure IT operations and IT security, personal data may be transferred to affiliated companies of the Schwan-STABILO Group. Transfers take place only where there is a legal basis and the data protection requirements are met.

17. Automated decision-making and profiling

We ourselves do not use automated decision-making or profiling on deuter.com that produces legal effects concerning you or similarly significantly affects you.

When selecting and processing certain payment methods, in particular purchase on invoice, Unzer or Payolution may carry out automated checks for identity, creditworthiness, fraud and risk assessment. This may result in a particular payment method not being offered. The decision is made by the relevant payment service provider under its own responsibility and is based on the procedures and information it applies.

Under Article 22 GDPR, you generally have the right not to be subject to a decision based solely on automated processing that produces legal effects concerning you or similarly significantly affects you, where the statutory conditions are met. In particular, you may request human intervention, express your point of view and contest the decision. For these rights and further information, please contact the relevant payment service provider, in particular info@unzer.com or the contact points specified in Unzer’s and Payolution’s privacy information.

Version: September 2026