Terms of service

1. About these terms

These terms govern use of Stally’s mobile app, the websites stallyab.se and www.stallyab.se, and the associated account, administration and payment services. The service is provided by Stally AB, company registration number 559600-9752, Kvänum Smedjegården 5, 535 91 Kvänum, Sweden. You can reach us at support@stallyab.se.

Stally is a digital tool for horse owners, riders, share riders, trainers, stables, riding schools and other equestrian operations. The functions include horse information, a training diary, a calendar, scheduling, division of work, notices, chats and AI-based training planning. Which functions you have access to depends on your subscription and your permissions.

The customer is the contracting party and is responsible for the subscription they order. Every user has a personal account and accepts these terms in the app for their own use. Acceptance is recorded with the account, the time and the document version. Ordering for another person or organisation requires authority to represent that customer. A user’s acceptance does not in itself allow that person to bind another customer to an agreement.

Annex 1, the data processing agreement, forms part of these terms where Stally processes personal data on the customer’s behalf as a processor. The annex is accepted together with the terms and does not need to be signed separately. The customer’s identity follows from the order and the customer details. The annex takes precedence on questions about such processing of personal data.

The privacy policy describes the processing of personal data and the cookie policy describes what the website stores. Accepting these terms, or reading the privacy policy, does not amount to general consent to processing of personal data or to optional storage on your device. Those choices are handled separately where consent is required.

The terms, the privacy policy and the cookie policy can be read and saved at stallyab.se. Mandatory law, including consumer protection, prevails over any conflicting contractual provision.

2. Definitions

The Company or Stally: Stally AB. The Service: Stally’s app, website and the functions the Company provides.

Customer: the private individual, sole trader or legal person who enters into an agreement with Stally and is responsible for the paid services ordered. A stable’s name is not in itself a legal contracting party.

User: the natural person who uses a personal account. A user can be the customer for their own Premium subscription and at the same time a member of a stable whose contracting party is someone else. Being invited to a stable does not create liability for that stable’s subscription.

Representative: a person authorised to act for the customer. Administrator: a user who has been given administrative permissions in a stable or a group. The administrator role does not automatically carry the right to enter into or change agreements for the customer.

Consumer: a natural person acting mainly outside a business. Subscription: an agreement for ongoing access to Premium or stable functions. Content: for example texts, images, video, messages, horse logs, schedules and training plans. AI functions: functions that use artificial intelligence to generate training suggestions.

3. Account and registration

You must be 13 or over to create and use a Stally account. The AI functions are intended only for users aged 18 or over. For users under 18, a guardian is to make the purchase and be the contracting party for the paid private subscription. Holding an account does not carry the right to enter into payment agreements for yourself or anyone else.

You are to give accurate and current information. That applies particularly to your date of birth, which is used to determine access to the AI functions. You must not state the wrong age or attempt to circumvent an age limit. Age is calculated from what you state yourself; registration does not mean Stally has verified your identity or your age. If the date of birth is wrong, contact support for a correction.

The account is personal. Registration and sign-in can use email, or Google or Apple. Protect your sign-in details and tell support without delay if you suspect unauthorised access. You are responsible for how you use the account yourself, but you are not automatically liable for every unauthorised action regardless of the circumstances.

Where a subscription is taken out for an organisation, the organisation that is the customer is to be identified in connection with the order. Whoever accepts on the organisation’s behalf confirms that they are authorised. The customer is to keep their contact and billing details current. Stally may ask for the information needed to clarify the customer’s identity or a representative’s authority.

4. Permitted use

The customer receives a limited, non-exclusive right to use the Service privately or in their operation according to the subscription chosen. A stable subscription may be used by its connected users within the scope of that subscription. Accounts and sign-in details must not be shared.

Use the Service for its intended functions and respect other people’s privacy, intellectual property and security. Only record information you have the right to use. Information about people is to be relevant to the function in question and no more extensive than necessary.

Stally does not replace physical supervision of horses, nor independent checking that stable duties have been carried out. A digital mark, calendar entry or notification is not a guarantee that practical work has been done or that a message has been noticed.

5. Prohibited use

It is prohibited to:

• use the Service for crime, fraud, harassment or any other unlawful purpose;
• knowingly give false information, or circumvent age limits, payment, permissions or security protections;
• sell, rent out or lend a personal account, or create accounts to abuse trial periods;
• attempt to gain unauthorised access, spread malicious code or overload the Service;
• collect other users’ information by automated means, or use bots without permission;
• copy, distribute or recreate Stally’s software beyond what the agreement or mandatory law allows;
• use protected material belonging to Stally or others to develop competing products without the necessary rights;
• manipulate the AI functions for improper purposes, or use them outside their intended scope.

Stally may act against breaches under point 21. These provisions do not limit rights that follow from mandatory law.

6. Community rules

Behave respectfully in chats, groups, notices and comments. Threats, bullying, harassment, discrimination, invasions of privacy, spam, unauthorised advertising, unlawful material and incitement to animal cruelty are not permitted.

You are responsible for content you publish yourself. Do not publish other people’s contact details, private messages or sensitive information without the right to do so. Report inappropriate or unlawful content through the available reporting function or to support@stallyab.se. State which content it concerns and why it should be reviewed.

Stally may review reported content and take proportionate measures, such as removing content or restricting the user concerned. Measures and information about them are handled according to applicable law and point 21. Contact support if you would like a decision about your content or account reconsidered.

7. AI functions and age limit

The active AI function is the training planner, which uses Google’s Gemini Developer API through Firebase AI Logic. A separate AI chat is not part of the active service as at the date of this version.

The AI planner creates suggestions from the horse’s characteristics, the horse’s logs, the user’s free-text goals, available time and training days. On replanning it also uses the week or day in question and any further instruction. The privacy policy has more on what is sent to Google.

You must be 18 or over to use the AI functions, and are to give your real date of birth. For a user who states a lower age, the AI planner is not made available in the app’s interface. You must not attempt to circumvent that restriction or let anyone under 18 use the AI functions through your account.

Do not enter sensitive personal data about people into goals, instructions or horse logs used by the AI. Free text can otherwise travel to Google even where a separate field for a piece of personal data is not sent.

8. Limitations of the AI functions

AI-generated training suggestions can be incorrect, incomplete or unsuitable for the horse and the situation at hand. They are support and inspiration, not binding instructions or guarantees of a particular result.

Check the suggestions before you use them and adapt them to the horse’s condition on the day, age, level of training, health, surface and equipment, and to the rider’s ability. Set a suggestion aside if it is uncertain or unsuitable. Stally describing these limitations does not remove the Company’s obligations under mandatory law.

9. Veterinary matters and professional advice

Stally’s training planning is not veterinary or medical advice and does not replace a vet, trainer, farrier or other relevant professional. The Service is not to be used to diagnose illness, prescribe treatment or assess acute conditions.

In case of illness, injury or any suspicion that a horse’s or a person’s health is affected, contact an appropriate professional. Do not carry out an AI suggestion that conflicts with professional instructions for the horse’s care or rehabilitation.

10. The customer’s and the user’s responsibilities

The customer is responsible for their order, the payment and the administration of the subscription they have taken out. The customer is to appoint suitable administrators, give the right people the right permissions, and take reasonable steps to see that users acting on the customer’s behalf follow these terms.

For a customer who is not a consumer, contractual responsibility also covers acts and omissions of users the customer allows to use the Service on the customer’s behalf, within that use. It does not cover a user’s separate private subscription or their use for another customer. For consumers, liability follows applicable consumer protection legislation.

An administrator can invite and remove members, assign roles and scheduled duties, manage shared content and add guest members without accounts. The customer is responsible for there being a legal basis for information about staff, pupils and guests, and for those people receiving the necessary information.

Stable membership and group chats are handled separately. A person who leaves or is removed from a stable can still be a member of a group chat until the group administrator removes them there. That gives access to that chat, not to the stable’s other protected information. The administrator is responsible for ending group membership too where continued chat access is not intended.

When horses are shared, the horse’s information and earlier history travel with it according to the permissions of the function. Check what you share. If a horse owner deletes their account, the owner’s horses and associated information can disappear for others who had access through sharing.

11. Subscriptions and trial periods

Stally offers separate Premium and stable subscriptions. All subscriptions run monthly with no minimum term and renew automatically one month at a time until cancelled. Access to paid functions requires an active subscription, a valid trial period or specifically granted access.

Premium for private use has a 3-day free trial. Stable subscriptions have a 7-day free trial. The trial period begins at the time stated in the order. If the subscription is not cancelled before the trial period ends, it moves to payment at the price and on the billing date shown at the order. Cancel before the trial period ends to avoid the first charge. A trial period does not replace a consumer’s statutory right of withdrawal.

Premium’s scope and limits, including the number of own horses, follow from the product description at purchase. Stable subscriptions are priced per licensed horse slot with a minimum of ten slots. The number of slots bought, the monthly price and any changes are to be shown before the customer orders or changes the subscription.

Standard prices including VAT:

• Premium: 69 kronor per month.
• Stable: 25 kronor per horse slot per month, minimum 10 slots — that is, at least 250 kronor per month.

Launch campaign for subscriptions taken out by 31 December 2026, that day included:

• Premium: 49 kronor per month through 30 June 2027. The standard price of 69 kronor per month applies thereafter.
• Stable: 20 kronor per horse slot per month through 31 December 2027, minimum 10 slots — that is, at least 200 kronor per month. The standard price of 25 kronor per horse slot per month applies thereafter.

The campaign price applies to the running subscription taken out within the campaign period. Billing periods and the change of price are to be shown in the order. A period already paid for is not charged again merely because the campaign has ended. Once a subscription has ended, the offer available at a new order or reactivation applies.

12. Payment

Purchasing and managing subscriptions happens through the website’s payment flow and Stripe Checkout or Stripe’s customer portal. The customer is responsible for the payment details being correct. Full card details are given to Stripe and are not stored by Stally as part of the app’s own customer data.

All prices above include VAT. The subscription fee is charged according to the billing period stated in the order. A user who joins someone else’s stable subscription does not become liable for that subscription. Customer and payment data are also used for accounting in Fortnox.

If payment fails, access to the paid functions concerned may be locked. That does not in itself affect a separate subscription that is active and paid. The handling of remaining data and any deletion is described in point 22. Validly incurred payment claims do not disappear automatically because an account is deleted.

13. Price changes and changes to the service

An agreed campaign period is honoured. For other future price changes, Stally gives clear information in reasonable time before the renewal at which the new price is to take effect, so that the customer can cancel before the change has effect. Changes do not apply retroactively to periods already paid for.

The Service may be updated for security, legal requirements, technical compatibility and functional improvements. Where a change to an ongoing digital service goes beyond what is needed to keep it in conformity, the conditions, information requirements and rights of termination under the Swedish Consumer Sales Act apply for consumers. A request to accept new terms does not remove those rights.

14. Cancelling a subscription

The customer can cancel their subscription at any time through subscription management on the website, or by contacting support@stallyab.se. A representative is to be authorised to cancel for the customer. State which subscription the cancellation concerns.

The subscription ends at the close of the paid period. Access continues until then, unless there is another ground for restriction under these terms. No new period is charged if the cancellation arrives before renewal. During a free trial period, cancellation is to be made before the trial ends in order to avoid payment.

Uninstalling the app, leaving a stable or simply stopping using the account is not a cancellation. Cancellation, account deletion and deletion of a stable are different actions. For closure and deletion, see point 22.

15. Right of withdrawal, complaints and refunds

Right of withdrawal for consumers

Where you as a consumer take out a subscription at a distance, you have as a general rule 14 days to withdraw, counted from the day the agreement is concluded. A free trial period of 3 or 7 days does not shorten that period. The fact that the ongoing service has begun to be used does not in itself end the right of withdrawal.

Tell Stally clearly before the withdrawal period ends that you wish to withdraw from the agreement — to support@stallyab.se, for example, or by post to Stally AB, Kvänum Smedjegården 5, 535 91 Kvänum, Sweden. You do not have to give a reason. You may use the Swedish Consumer Agency’s standard withdrawal form, but it is not required. State your name, contact details, order date and which subscription you wish to withdraw from. A message sent in time is enough to meet the deadline.

On a valid withdrawal, payments received are refunded without undue delay and at the latest within 14 days of Stally receiving your message. The same means of payment is used unless you expressly agree otherwise, and there is no fee for the refund.

Compensation where the service has begun

If you have expressly asked for the subscription service to begin during the withdrawal period, and before the agreement received the prescribed information about the right of withdrawal and the obligation to pay proportionate compensation, Stally charges on withdrawal a reasonable amount for the chargeable time the service was supplied up to your message of withdrawal. This applies only where the statutory conditions for compensation are met. A general acceptance of these terms does not replace your express request for the service to begin during the withdrawal period.

The compensation is calculated from the agreed price for the relevant subscription’s billing period, including VAT and any applicable discount, divided by the number of days in that period and multiplied by the chargeable time elapsed, expressed in days. Part of a day counts proportionately and is not rounded up to a whole day. Where different prices or billing periods are involved, the calculation is made separately for each part. The amount is rounded to öre and may not exceed the agreed price for the part supplied, or what the law allows.

Free trial days are not charged: Premium’s 3 free days and the stable subscription’s 7 free days are excluded from the calculation. If you withdraw during the free trial period, no subscription fee is charged for that period. No fixed withdrawal fee, no flat deduction of half a month’s fee and no separate charge for AI use included in the subscription is taken on withdrawal.

Example: if a billing period covers 30 days and costs 49 kr, and you withdraw after 3 free trial days and then 10 whole chargeable days, the compensation is 49 / 30 × 10 = 16.33 kr. If 49 kr has already been paid, 32.67 kr is refunded. The example assumes the conditions for compensation above are met; the actual period length and price govern the calculation.

Stally sets out the calculation and deducts any permitted compensation from the refund. Where the conditions for compensation are not met, no such deduction is made. The refund deadline above applies even where a deduction is made. Using the AI function or consuming an included usage allowance does not in itself end the right of withdrawal for the subscription.

Faults in the service and ordinary cancellation

Contact support if the Service does not work as agreed, and describe the fault. Consumers have statutory rights where a digital service is faulty, including the right to have it remedied and, where the conditions are met, a price reduction, termination and damages. Stally’s disclaimers do not limit those rights.

On an ordinary cancellation during a correctly delivered, already paid period, no refund is normally made for the remaining days. That does not apply where a refund or other remedy follows from the right of withdrawal, a complaint or other mandatory law.

16. Stally’s intellectual property

Stally’s software, design, trade marks and other protected material belong to Stally or the respective rights holder. The customer receives the right of use stated in these terms, not ownership of the software or of other protected parts of the Service.

Material must not be copied or exploited commercially beyond that right or what mandatory law allows. This does not mean Stally takes over rights to the customer’s content. AI-generated material may lack copyright protection, and similar suggestions may be given to several users; Stally does not guarantee exclusive rights to such suggestions.

17. User-generated content

Rights to material you upload stay with you or another rights holder. You are to have the right to use the material and to make it available to the people you share it with.

You grant Stally a non-exclusive, royalty-free right to store, process, transmit and display the material to the extent needed to deliver the functions you or the customer request, maintain security and handle support. The right covers the necessary technical steps at the suppliers engaged. It is not a general permission to use personal data for new purposes, nor to train general AI models on your content.

The right lasts as long as the material needs to be handled for those purposes, having regard to deletion, shared content and legal retention requirements. Personal data is always covered by data protection rules and, where Stally is a processor, by annex 1.

18. Liability and limitations

Stally is responsible for providing the Service in accordance with the agreement and applicable law. The Service is digital support, and Stally does not guarantee a particular training result or that user-entered information is accurate. The user is to judge how suggestions and information are used in practice.

For customers who are not consumers, Stally is not liable for indirect loss, such as lost profit or lost production, to the extent such a limitation is permitted. The limitation does not apply in cases of intent or gross negligence and does not restrict liability that may not be limited by law, including applicable rights under the GDPR.

For consumers, the liability rules in law apply. Nothing in these terms means that Stally generally disclaims liability for faults in the Service, for personal injury, or for other obligations following from mandatory law.

19. Availability and disruptions

Temporary interruptions can occur during maintenance, security work, connection problems or technical faults. Stally may restrict functions to the extent needed for necessary maintenance and protection of the Service. Measures are to be proportionate, and Stally is to work to limit the disruption.

The user needs a compatible device, a supported version of the app and an internet connection. Install available security updates. Keep your own copy of information that is particularly important, where possible. This does not transfer Stally’s responsibility for agreed functionality, security or statutory rights to the customer.

20. Events beyond the parties’ control

A party may be relieved of liability for a delay or failure caused by an impediment beyond that party’s control which could not reasonably have been foreseen, avoided or overcome. The assessment is made on the circumstances and applicable law; a disruption or a supplier failure is not automatically such an event.

The affected party is to limit the consequences and inform the other party where relevant. This provision does not give a right to charge contrary to mandatory law, or to keep payment the customer is entitled to have back.

21. Restriction and suspension

Stally may restrict the functions or accounts concerned in the event of missed payment, serious or repeated breaches, unlawful content, unauthorised use or a concrete security risk. The measure is to be matched to the problem and limited, so far as possible, to the users or subscriptions concerned.

A problem with one stable subscription does not in itself end other customers’ subscriptions or a member’s separate Premium subscription. A measure against a user who has themselves misused the Service may, however, extend to that user’s personal account.

Stally gives information about the measure and its basis to the extent the law requires and where it can be done without jeopardising security or a legal investigation. Contact support with questions or for reconsideration. Rights to a price reduction, refund and other remedies under law are unaffected.

22. Closure and deletion

When a paid period expires without renewal, the paid functions concerned are locked. Account and stable information can then remain for reactivation until deletion. You can still reach the account settings to delete the account, and you can contact support. An authorised customer or administrator can handle deletion of a stable.

On an ordinary cancellation, the starting point is that the account or stable concerned is kept for 30 days after the end of the paid period, unless it is reactivated or deleted earlier on request. On missed payment, Stally may delete the account or stable concerned no earlier than 30 days after the missed payment. That deletion is handled manually; the term is not a promise of automatic deletion on a particular day. Personal data may nonetheless not be kept longer than there is a legal basis and a need for the processing.

Deleting a stable does not affect a separate active Premium subscription or private information outside the stable. The stable’s information disappears on deletion. Group chats and messages can, however, remain for the remaining chat participants even where the group or the stable itself has been deleted. When a personal account is deleted, messages sent to others, including the sender’s name, can remain in their chats. This is not unlimited permission to keep personal data; deletion or continued retention is to be assessed under the privacy policy and the law.

Deleting an account can remove your own horses and their history, including for people who had access through sharing. Horses owned by others are not themselves affected by you deleting your account. Deletion does not recall copies others have already made outside Stally.

Cancel any active subscriptions as well when you stop using the Service. If you cannot do that yourself, ask support to help with both cancellation and deletion. One member leaving a stable does not end another customer’s stable subscription.

Accounting records, data needed for legal claims and certain supplier logs can be covered by other retention rules. The details and your rights are in the privacy policy. For data processed on the customer’s behalf, annex 1 also applies, including the customer’s right to choose return or deletion when the processing ends.

23. Changes to these terms

The current version is available at stallyab.se. On updates, the terms are shown in the app for active acceptance, including for existing users, and the version and time are recorded. Material changes affecting an ongoing subscription are to be notified in reasonable time before they take effect, and in the form the law requires.

A user accepts for themselves. Changes for an organisation customer are to be accepted by an authorised representative where the customer’s acceptance is required. The customer can cancel the subscription if the changes are not accepted, without losing rights that follow from mandatory law. A new acceptance does not replace separate consent to new processing of personal data where consent is required.

24. If a provision does not apply

If a provision is invalid or may not be applied, the remaining terms apply to the extent they can stand. Mandatory law and applicable general contract rules then take effect. An invalid provision is not automatically replaced by an equally far-reaching provision to the consumer’s disadvantage.

25. Governing law

Swedish law applies. Where a consumer is entitled to protection under mandatory rules in another applicable country, that protection is not affected by this choice of law.

26. Complaints and disputes

Contact support@stallyab.se first so that we can try to resolve the matter. A consumer can have a dispute examined by the Swedish National Board for Consumer Disputes, ARN, where the board’s conditions are met. Information is at www.arn.se. Postal address: Allmänna reklamationsnämnden, Box 174, 101 23 Stockholm, Sweden.

Disputes can also be examined by a competent general court. These terms do not restrict a consumer’s right to bring proceedings in the court that follows from mandatory rules. For questions about personal data there is also a right to complain to the Swedish Authority for Privacy Protection, as set out in the privacy policy.

27. Annex 1 — Data processing agreement

This annex belongs to Stally’s terms of service, version 2026-10-19. It governs processing under Article 28 of the GDPR where the customer is the controller and Stally AB processes personal data on the customer’s behalf.

B1 Parties, application and conclusion

The controller is the customer stated in the order and the customer details for the subscription concerned. The processor is Stally AB, company registration number 559600-9752, Kvänum Smedjegården 5, 535 91 Kvänum, Sweden. The contact at Stally for data protection matters is Linus, via support@stallyab.se. That contact function does not in itself mean a formal data protection officer has been appointed.

The annex is entered into through the customer’s, or an authorised representative’s, acceptance of the terms of service. The customer’s individual users do not need to enter into separate processor agreements. That every user has their own account does not change the allocation of responsibility for the customer’s operational data.

The annex applies, for example, where the customer uses Stally to administer staff, pupils, guests, stable members, schedules and shared content, and Stally processes the data on the customer’s behalf. It does not apply to processing for which Stally itself determines the purposes, such as its own customer administration, payment handling, accounting or its own legal claims. The actual processing determines the roles, not merely the label in the agreement.

B2 Scope of processing and documented instructions

Subject matter and purpose: to provide, administer, maintain and support the customer’s use of the stable and collaboration functions ordered, with the relevant storage, access and communication.

Nature of the processing: collection through the customer’s and users’ entries, organisation, storage, display to authorised people, search, alteration, transfer, support, export, restriction and deletion.

Categories of data subjects: the customer’s representatives, administrators, staff, contractors, pupils, stable members, guests without accounts and other people the customer lawfully records. Children can appear in the customer’s operational data.

Types of personal data: names, contact details the customer or user makes available, profile pictures, account identifiers, memberships, roles, responsibilities, scheduled duties, messages, notices, comments, shared files, and horse and training information that can be linked to a person. Technical information is processed to the extent needed to provide the functions.

The Service is not intended for the customer’s systematic processing of sensitive personal data about people under Article 9 of the GDPR, or data on criminal offences under Article 10. Such data is not to be entered without the parties first having ensured a legal basis, instructions and adequate safeguards. Horses’ health information is not in itself sensitive health data about human beings.

Duration: for as long as Stally processes data for the customer, including any agreed period for reactivation, export or wind-down after a paid subscription has ended. The annex continues to apply to remaining processor activity until the data has been returned or deleted under B10.

The customer’s instructions consist of this annex, the order, the customer’s choices in the Service and supplementary documented instructions from an authorised representative. Stally may only process the data according to those instructions, including as regards transfers to a third country, unless Union or national law requires otherwise. In that case the customer is informed of the legal requirement before the processing, unless the law prohibits that information on grounds of an important public interest.

Stally is to inform the customer immediately where an instruction, in Stally’s assessment, infringes the GDPR or other applicable data protection rules. An unlawful instruction is not to be carried out. Stally may not use the customer’s data for its own new purposes within the processor engagement.

B3 The customer’s obligations and rights

The customer determines the purposes of its processing and is responsible for the legal basis, for informing data subjects, for the accuracy of the data, for appropriate access and for the lawfulness of its instructions. The customer is to pay particular attention to the protection of children and to record only relevant data.

The customer is to keep the contact details of an authorised representative current and to decide who may administer stables and groups. Removing a person from a stable does not automatically end group membership; the customer is to handle that separately where access is to cease.

The customer may request information, give documented instructions, exercise oversight under B9, and request assistance, export and deletion under this annex. The customer’s responsibilities do not relieve Stally of the obligations Stally has as a processor.

B4 Confidentiality and staff access

Stally is to ensure that people permitted to process the customer’s personal data are bound by a confidentiality undertaking or a statutory duty of confidentiality, and process the data only within their duties and according to instructions. The obligation continues after the employment, engagement or customer agreement has ended.

Administrative access is to be given to authorised people and limited to what their duties require. Privileged accounts are to be protected with two-step verification. Access is to be reviewed and ended when the need ceases.

B5 Security measures

Stally is to take appropriate technical and organisational measures under Article 32 of the GDPR, having regard to the risks, the state of the art, the costs, and the nature and scope of the processing. The measures are to provide appropriate confidentiality, integrity, availability and resilience, and the ability to restore access where needed.

The measures include at least:

• authentication and permission rules that keep private data, stables and groups apart;
• administrator requirements for administrative changes, and server-controlled write permissions for subscription data;
• protected transmission and the suppliers’ applicable encryption protections for storage;
• two-step verification for Stally’s privileged project accounts, and controlled administrative access;
• procedures for incident handling, rectification, secure disclosure and deletion;
• regular risk-based review of access, security settings and the effectiveness of the measures.

This annex is not a promise of a separate customer backup or a particular restoration time. Under the current configuration there is no specifically configured Firestore backup or point-in-time recovery. The supplier’s short-lived version and deletion protections are described in the privacy policy. Stally is to assess whether further restoration protection is needed to meet Article 32, and to inform the customer of material changes to the security protections.

B6 Sub-processors

The customer gives general written prior authorisation for Stally to engage sub-processors for the services in B12, with the limitations stated there. Stally is to ensure that a sub-processor is placed under equivalent data protection obligations by written agreement for the task subcontracted.

Stally is to inform the customer in writing before a planned addition or change of sub-processor and give the customer reasonable time to object on data protection grounds. The information is to state the supplier, the task and the relevant processing locations. The parties are to try to resolve a well-founded objection before the new sub-processor may process the customer’s data. Where no solution is possible, the processing concerned is not to continue with the new sub-processor for that customer; the customer may end the service concerned.

Stally is responsible to the customer for the sub-processor’s performance of the data protection obligations covered by the task. A sub-processor may not be used to circumvent the customer’s instructions or the requirements of this annex.

B7 Processing locations and third-country transfers

The main database is in Firestore eur3 within the EU, files are in Helsinki and server functions in Belgium. Other services, including authentication, push and certain technical diagnostics, may process data globally or in the United States. The customer’s instruction covers the processing needed for the functions chosen, provided applicable data protection requirements are met.

Transfers outside the EU/EEA may only take place with a valid basis under Chapter V of the GDPR. That may be an applicable adequacy decision, including the EU-U.S. Data Privacy Framework for a recipient and processing actually covered by it, or standard contractual clauses together with the necessary transfer assessments and supplementary measures. That a supplier is headquartered in a particular country does not alone determine where each piece of data is processed.

Stally is on request to provide information about the applicable safeguards and the relevant contractual documentation, with the necessary limits for confidentiality and other people’s data. This annex does not replace such a transfer basis.

B8 Assistance and personal data breaches

Stally is, taking into account the nature of the processing, to assist the customer with appropriate measures for handling data subjects’ rights. Requests concerning the customer’s responsibility are to be passed on or directed to the customer without undue delay. Stally does not disclose the customer’s data to unauthorised people and is to verify a recipient’s authority to the extent necessary.

Stally is, taking into account the information available, to assist the customer with the obligations under Articles 32–36 of the GDPR, including security, assessment of incidents, impact assessments and prior consultation.

Stally is to notify the customer without undue delay after becoming aware of a personal data breach affecting the engagement. The information is, so far as available, to state the nature of the breach, the categories and approximate numbers concerned, a contact point, the likely consequences and the measures taken or proposed. Incomplete information is supplemented on a rolling basis without undue delay. Stally is to document the breach and cooperate to limit its consequences.

The customer, as controller, is responsible for its decisions on notification to a supervisory authority and communication to data subjects. That does not affect Stally’s own obligations under law.

B9 Information, audit and supervision

Stally is to give the customer access to the information needed to demonstrate that the obligations under Article 28 have been met. Stally is to allow for and contribute to audits, including inspections, conducted by the customer or an independent auditor appointed by the customer.

The parties are to plan audits so that security, confidentiality, other customers’ data and operations are protected. Documentation and relevant audit reports may be used in the first instance, but may not replace the customer’s right to a necessary inspection. Reasonable prior notice may be requested where possible, but may not prevent an urgent check or a supervisory authority’s powers.

B10 Return and deletion

When the processor activity ends, Stally is, at the customer’s choice, to return or delete the personal data and delete existing copies, unless Union or national law requires continued storage. The customer can give instructions to support@stallyab.se. Export can be carried out manually in a suitable electronic format after an authorisation check.

A period during which a stable is locked for possible reactivation is continued processing under this annex, not an exception to the obligation to delete. The customer’s express request to end the processing is to be handled under this point. Stally’s ability to delete after missed payment follows from point 22 of the main terms.

Deletion is to cover underlying data and files covered by the engagement, not only a visible stable record. That a chat is accessible to others is not in itself an exception to the customer’s instruction. Where a piece of data is also processed independently for another customer or another lawful purpose, Stally is to separate that processing, inform the customer of the reason for retention and limit the data to what is needed. Stally may not unilaterally change role in order to circumvent deletion.

Suppliers’ short-lived version storage and technical deletion processes are to be taken into account. Data awaiting final technical deletion is to be protected and not used for new purposes. Stally is on request to account for how return and deletion were carried out and what exceptions, if any, remain.

B11 Liability, changes and termination

The parties are responsible for their respective obligations under the GDPR and this annex. The liability provisions of the main terms may not limit data subjects’ rights or other liability that may not be limited by law. In the event of conflict on a question of processor activity, this annex prevails.

Changes are to be documented and may not lower the protection contrary to the GDPR. If the customer or Stally can no longer meet the obligations, the parties are without delay to address the shortcoming, restrict the processing concerned where needed and, if necessary, end the service concerned with return or deletion under B10.

B12 Sub-processors and service boundaries

Google, through the applicable contracting party for Firebase and Google Cloud: database, files, server functions, authentication and the relevant communication functions. The data covers the account, stable, horse, file and message content needed for the function. EU regions and global processing follow from B7. The exact legal contracting party and applicable further sub-processors are to be capable of being set out by Stally on request.

Google and Apple for push delivery: where the customer’s messaging function is used, the sender’s name and the message text can be included in push notifications. The parties’ roles and the applicable onward suppliers are to be assessed on the actual contractual flow. Suppliers processing data on Stally’s behalf are covered by the sub-processor requirements; independently responsible recipients are to be treated and notified as such.

Vercel: the website and the web console, together with technical connection data. Processing can take place in a global network. Strato: email handling in Germany, to the extent the customer’s data is sent to support. Only data needed for the respective task may be disclosed.

Stally’s private AI planner, payment handling through Stripe, accounting through Fortnox and processing Stally carries out for its own security purposes are not automatically covered by the customer’s processor engagement. Where the customer’s data is processed in such a function on the customer’s behalf, the applicable instructions, recipients and sub-processor terms are to be clarified before the processing. The current supplier functions are also described in the privacy policy.