Privacy policy

1 - Introduction
This privacy notice explains how SH Group A/S ("we", "us", "our") processes personal data in various situations.

We process personal data in accordance with the General Data Protection Regulation (EU) 2016/679 ("GDPR") and applicable national data protection legislation.

This Privacy Notice describes how we process personal data in connection with:

• Business relationships and communications

• Website operations

• Video surveillance (CCTV)

• Marketing and events

• AI-assisted content creation

2 - Data Controller
SH Group A/S is the data controller for the processing of personal data described in this Privacy Notice. Contact details can be found in section 9.

3 - Retention of data
SH Group is required to retain data for up to 50 years, considering our deliveries in sectors such as defence industry, ship contracts, and maritime rescue equipment. Examples within these sectors require data to remain accessible throughout the ship's lifespan. Data is retained to comply with regulatory and contractual obligations, as well as to support future needs for monitoring, maintenance, and analysis of the deliveries.

4 - Description of the processing
Below, please find the specific purposes for our data processing, the categories of personal data that we process, the legal basis for such processing, and the retention periods that we have decided (in specific situations, we may defer from our general retention periods in case of e.g., complaints, objections, or other specific situations).

Business purposes
Purpose:
Communicating with you when you represent a customer, partner, supplier, or another third party.

Categories:
Name and contact information, title, and position. The relationship to the business that you represent.

Legal Basis:
Article 6(1)(f) of the GDPR, as we are pursuing our legitimate interests in managing business contacts and fulfilling any agreement, we may have concluded with the company you represent.

Retention:
Please Refer to section 3.
__________________________________

Purpose:
Managing and answering general inquiries.

Catergories:
Name and contact information, title, and position. The subject of your inquiry.

Legal Basis:
Article 6(1)(f) of the GDPR, as we are pursuing our legitimate interests in managing general inquiries.

Retention:
Please refer to section 3.
__________________________________

Purpose:
Bookkeeping purposes.

Categories:
Information stated on invoices etc.

Legal basis:
Article 6(1)(c) of the GDPR. For the Danish entities, the legal obligations derive from the bookkeeping legislation.

Retention:
Up to 5 years after the end of the financial year in which the customer or supplier relationship has ended.

Website operations
Purpose:
We use cookies and analytics technologies to operate, maintain and improve our website and user experience.

Categories:

• IP address

• Browser type

• Operating system

• Device information

• Website usage information

• Pages visited

• Time spent on the website

Legal basis:
Article 6(1)(a) GDPR Consent provided through our cookie banner.

Retention:
SH Group uses:

• Cookie Information for consent management

• Google Analytics for website analytics and performance measurement

Further information can be found in our Cookie Policy.

Video surveillance (CCTV)
Purpose:
To prevent and solve criminal offences at the Danish entities. We have put up signage in the places where we have installed CCTV cameras.

Categories etc.:
Time and place/location, actions recorded by the CCTV cameras.

Legal basis:
Article 6(1)(f) of the GDPR, as we are pursuing our legitimate interests related to prevent and solve criminal offences. If the recordings show criminal offences, the legal basis is section 8 of the Danish Data Protection Act.

Retention:
Please refer to section 3.

Marketing activities:
Purpose:
SH Group participates in:

• Trade fairs

• Conferences

• Customer events

• Webinars

• Networking activities

• Marketing campaigns

Categories:

• Name

• Company

• Job title

• Conctact information

• Event participation information

Legal basis:
Article 6(1)(f) GDPR Our legitimate interest in maintaining and developing business relationships and promoting our products and services.

Retention:
Please refer to section 3.

AI-assisted content creation:
Purpose:
SH Group may use AI-supported tools as part of internal business processes, including communication, marketing and content development.

Such tools are used under human supervision and do not make decisions on behalf of SH Group.

Categories:
Personal data may be processed where included in material being drafted, reviewed or translated.

Legal basis:
Article 6(1)(f) GDPR Our legitimate interest in improving efficiency and supporting communication and content creation activities.

Retention:
Please refer to the relevant retention periods described in this Privacy Notice

5 - Categories of recipients
We disclose your personal data to our relevant business partners, including external advisors. Further, we share your personal data within the group of companies, if relevant in connection with your request or relation to us.

Also, we make your personal data available to our processors who for example, host, develop, and support our IT systems. Further, CCTV video recordings may if relevant be shared with the police.

Moreover, please refer to our cookie policy in relation to third party providers and recipients.

6 - Transfer to third countries
We transfer your personal data to a processor located in third countries. This includes United States

The legal basis for our transfer is the Commission Decision of 4 June 2021 on standard contrac-tual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council.

If you want additional information about our transfer of personal data to third countries, includ-ing a copy of the above-mentioned standard contractual clauses, you may make a request for such additional information by contacting us (see section 8 below).

7 - Your rights
You have the following rights:

• Right to withdraw consent: Where you have given your consent for our processing of your personal data, you have the right to withdraw your consent at any time. You can withdraw your consent by contacting us (see contact details below). If you withdraw your consent, the withdrawal will not affect the lawfulness of processing that has already been carried out based on your consent.

• Right of access: You have the right to have confirmed whether collection or processing your personal data has taken place, and, if so, you have the right to request a copy of your personal data in a digital format.

• Right of rectification: You have the right to require that we correct any inaccurate personal data, and that we complete incomplete personal data.

• Right of erasure: In certain circumstances, you have the right to request that we erase personal data concerning you; for example, if it is no longer necessary for the purposes in which it was originally collected.

• Right to restrict processing: In certain circumstances, you have the right to request that we restrict the processing of your personal data, for example, if you believe that the personal data is not accurate or lawfully processed.

• Right to object to the processing: In certain circumstances, you have the right to request that we stop processing your personal data.

• Right to data portability: In certain circumstances, you have the right to receive the personal data you have provided us with in a structured, commonly used, machine readable format, and the right to have us transmit the data to another entity, where technically fea-sible.

You can read more about your rights in the Danish Data Protection Agency's guidelines on data subjects' rights, which is available at datatilsynet.dk (in Danish) and at datatilsynet.dk (in Eng-lish). Please contact us if you wish to exercise any of your rights. The relevant contact details are stated below. 

There may be conditions or limitations on these rights. It is therefore not certain for example you have the right of data portability in the specific case; this depends on the specific circumstances of the processing activity. 

8 - Complaint to a supervisory authority
If you believe that SH Group's processing of personal data violates applicable data protection legislation, you have the right to lodge a complaint with the Danish Data Protection Agency (Datatilsynet). For more information, please visit: Datatilsynet

9 - Contact information etc.
SH Group A/S,
CVR No.: 1276 2704,
Kuopiovej 20, 5700 Svendborg, Denmark
Tel +45 6221 7810,
sh@shgroup.dk