Privacy policy

The controller for the processing of personal data is: SH Digital GmbH, Sülzer Burg 4, 51503 Rösrath, Germany.

Represented by its Managing Director Nils Küsgen. Email: shpbgmbh@gmail.com.

Our website is provided via Lovable. The provider is Lovable Labs Incorporated, 1 Lincoln St, Boston, MA 02111, USA. Infrastructure and delivery providers engaged by Lovable may process personal data for the technical provision of the site.

When you access the website, your IP address in particular is processed so that the requested content can be transmitted to your browser. In addition, technical access information such as the time of access, the address requested and browser and operating system details is processed. Access and error logs may arise as part of technical operations.

The processing serves to provide and secure the website and to detect and remedy technical faults. The legal basis is Art. 6 (1) (f) GDPR. Our legitimate interest lies in a reliable and secure online presence.

In its general privacy notices, Lovable states a retention period of up to 90 days for log data and one year for centralised security logs. Statutory retention requirements may go beyond this. A separate retention period specific to our website has not been confirmed to us at present.

Processing in the USA and other countries outside the European Economic Area is possible. For international transfers, Lovable refers in particular to the European Commission's standard contractual clauses.

Further information on processing, transfer mechanisms and the providers used: lovable.dev/privacy, lovable.dev/data-processing-agreement, lovable.dev/subprocessors.

The language of the website is determined by the address you visit, in particular the language paths /de and /en. No cookies, local storage or session storage are used for the language selection.

If the local storage entry “sh-digital-language” from an earlier version of the website is still present, it is removed when the site is opened. Its stored value is neither read nor transmitted to us.

We do not use any analytics or marketing cookies of our own on this website, nor any tracking or advertising services of our own.

Fonts and images are delivered together with the website via its hosting infrastructure. No fonts are loaded from external font providers. Maps, videos and social media widgets are not embedded.

The website contains links to external offerings. Opening such a link establishes a connection to the respective provider. That provider's own privacy notices apply to its data processing.

The message field serves to prepare an email. It processes the details you enter — name, email address, optionally company and location, and your message — initially locally in your browser.

When you press the button, your email programme opens with the recipient, subject and message text pre-filled. The website itself does not send any email and does not store the entries in a database of its own. Your email programme may save a draft according to its settings.

Only when you send the message from your email programme is it transmitted via your email provider to our mailbox. We then process your contact details, message and any attachments in order to handle your enquiry.

We use Gmail for our mailbox. For Google services in the European Economic Area, Google Ireland Limited, Ireland, is generally responsible. Google processes in particular communication content as well as sender, recipient and technical connection data.

Processing outside the European Economic Area, in particular in the USA, is possible. For this, Google describes among other things the use of the EU-US Data Privacy Framework for covered transfers to certified companies as well as standard contractual clauses.

Further information: policies.google.com/privacy and policies.google.com/privacy/frameworks.

Our website contains a link to WhatsApp. No WhatsApp scripts or widgets are integrated. Merely displaying the link does not cause our website to transmit any data to WhatsApp.

If you open the link, the WhatsApp service is called up. The provider in the European Economic Area is WhatsApp Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland.

If you contact us there, we process your telephone number, where applicable your profile name, and the messages transmitted in order to handle your enquiry.

WhatsApp also processes data to operate its service, in particular account, usage, device and connection information. Data may be processed outside the European Economic Area. For this, WhatsApp refers in particular to adequacy decisions, the EU-US Data Privacy Framework for covered transfers, and standard contractual clauses.

Using WhatsApp is voluntary. You can contact us by email instead.

Further information on recipients, retention practices and transfer mechanisms can be found in the WhatsApp privacy notices: whatsapp.com/legal/privacy-policy-eea.

Where an enquiry is aimed at concluding or performing a contract with the enquiring person, the processing is based on Art. 6 (1) (b) GDPR.

Other enquiries, in particular from contacts at companies, municipalities and other organisations, are handled on the basis of Art. 6 (1) (f) GDPR. Our legitimate interest lies in properly handling business matters and communicating with prospective clients and business partners.

Where data is processed to comply with statutory retention obligations, Art. 6 (1) (c) GDPR is the legal basis.

Providing your details for contacting us is voluntary and generally neither legally nor contractually required. Without sufficient information about your matter and a means of replying, we may be unable to process or answer your enquiry.

We retain enquiries received for as long as their handling and any subsequent business relationship require. Enquiries that do not lead to a business relationship are generally deleted no later than six months after the last correspondence, unless statutory retention obligations or necessary evidentiary purposes apply.

Documents subject to commercial or tax retention obligations are kept for the applicable period, which is generally six or ten years from the end of the relevant calendar year. Where further storage is necessary to assert, exercise or defend legal claims, the duration follows the applicable limitation periods — generally three years from the end of the year in which the claim arose — and, where applicable, the duration of proceedings.

In addition to the technical and communication providers named, legal or tax advisers bound by professional confidentiality, as well as authorities on the basis of legal obligations, may receive data in individual cases where necessary.

Subject to the statutory requirements, you have the right of access to the processing of your personal data, rectification of inaccurate and completion of incomplete data, erasure of your data, restriction of processing, and data portability.

Right to object: where processing is based on Art. 6 (1) (f) GDPR, you may object at any time on grounds relating to your particular situation. We will then no longer process the data concerned unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves to assert, exercise or defend legal claims.

Where processing is based on your consent, you may withdraw it at any time with effect for the future. The lawfulness of processing prior to withdrawal remains unaffected.

To exercise your rights, you can reach us at shpbgmbh@gmail.com.

You may lodge a complaint with a data protection supervisory authority, in particular in the Member State of your habitual residence, place of work or the place of the alleged infringement.

The authority responsible for our company is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia: www.ldi.nrw.de.

In connection with this website and the handling of your enquiries, we do not take any decisions based solely on automated processing with legal or similarly significant effect within the meaning of Art. 22 GDPR.

Last updated: September 2026