Data protection

Notice Regarding the Processing of Personal Data Collected Through This Website
Last revised: October 1, 2026

1. Introduction and Regulatory References
This notice describes the processing of personal data collected through this website, including data obtained via cookies, tracking technologies, and—where available—contact forms and any other features that may be active on the site.
This notice is intended for anyone who accesses or uses this website, describing how the user’s personal data is collected, used, and protected, as well as the rights granted by law.
These provisions do not apply to other websites, pages, or online services accessible via external links that may be present on the site; for those, you are encouraged to consult the relevant privacy notices.
This notice is provided in compliance with the principal national and international regulations on the protection of personal data, including:

Regulation (EU) 2016/679 (GDPR) and Directive 2002/58/EC, known as the ePrivacy Directive
Other regulations that may apply.

2. Who manages your data and how can you contact us?
Your personal data is processed by:
SH GmbH
Handwerkerzone, 3, I – 39050 Deutschnofen, BZ, Italy
info@sh.bz.it
VAT ID: 03 033 310 214

For any information regarding the processing of personal data or to exercise the rights granted by law, data subjects may contact the Data Controller.

3. On what legal bases do we process your data?
The processing of personal data collected through this site (including data collected via cookies, similar technologies, contact forms, and any other features that may be active on the site) is based on one or more of the following legal bases:

Performance of pre-contractual or contractual obligations: where processing is necessary to respond to user requests, provide requested services, and—where the site offers such features—manage orders, accounts, or contractual relationships.
Compliance with legal obligations: where processing is necessary to comply with tax, accounting, administrative, or security obligations, or with requests from the authorities.

The Data Controller may also process the necessary data on the basis of its own legitimate interests, which include ensuring the security of the site, preventing abuse and fraud, and protecting its rights in legal proceedings. The user may, in any case, object to the processing in accordance with applicable law, in the cases provided for in Article 21 of the GDPR.

For non-essential cookies and tracking tools—such as those used for non-anonymized analytics, profiling, or marketing—processing is based on the user’s consent in jurisdictions where such consent is required by applicable law. The related procedures for providing, managing, and withdrawing consent are described in the Cookie Policy.

Failure to accept or the withdrawal of consent may limit certain features or services on the site.

The provision of data supplied directly by the user is generally optional, except for any data indicated as mandatory in the individual forms or where it is required by a legal or contractual obligation or is necessary to perform a contract or pre-contractual measures requested by the user; in such cases, failure to provide it may make it impossible to process the request or provide the service. Technical navigation data is collected automatically in all cases and is necessary for the website to function.

4. What data do we collect when you visit the site?
While browsing this site, the following data may be collected, including through cookies and similar technologies such as pixel tags, web beacons, local storage, and equivalent technologies, namely:

Navigation and technical data: information such as IP addresses, device identifiers, data relating to the operating system and browser, requested URLs, connection times, technical logs, technical preferences, and usage data collected through cookies tracking technologies (pixel tags, web beacons, local storage, and equivalent tools).
Voluntarily provided personal data: information entered into the digital forms on the website (e.g., first name, last name, email address, phone number) and/or provided by sending emails or through other contact channels, used to respond to requests, provide services, and address any inquiries.

5. How do we process your data, how do we protect it, and how long do we keep it?
The personal data collected through this site is processed primarily by electronic and digital means in accordance with the principles of lawfulness, fairness, data minimization, integrity, and confidentiality.

Appropriate technical and organizational measures are implemented to prevent unauthorized access, loss, alteration, or unauthorized disclosure of data, including:

Encryption of communications (HTTPS): Communications between your browser and the site are protected by HTTPS encryption, a measure designed to reduce the risk of interception or tampering with the data transmitted while browsing;
Restriction of data access to duly authorized persons only: Access to personal data is permitted exclusively to authorized and trained personnel, in accordance with internal security policies.

Data is retained for the following periods:

Cookie preferences and consents: retained for 180 days, as described in the Cookie Policy on this site.
Navigation and technical data: retained for the time strictly necessary for security purposes and, as a rule, for no longer than 12 months, after which it is deleted or anonymized, except for longer periods required by legal obligations or by the need to establish, exercise, or defend a right in legal proceedings.
Data related to any contractual relationships established with the Data Controller: where such relationships exist, the data is retained for the duration of the relationship and, thereafter, for the period required by applicable legal obligations (for example, in accounting and tax matters).
Data entered through forms or specific requests: retained for as long as necessary to respond to the request and fulfill the related purpose, and thereafter for any period required by legal obligations.

Advertising measurement with OpenAI Ads (ChatGPT)
If you have given your consent, we use OpenAI’s Measurement Pixel to track whether our ads in ChatGPT result in inquiries. Page views and—when you submit the contact form—your email address, name, phone number, and location are transmitted to OpenAI in hashed (pseudonymized) form. Data may be transferred to the United States. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time via the cookie settings. More information: https://openai.com/policies/privacy-policy

6. Who can receive your data?
The following parties may access the personal data collected through this site, within the limits of their respective responsibilities and purposes:

Authorized internal personnel designated by the Data Controller, who have received proper training on privacy security matters;
Suppliers and third parties designated as Data Processors (for example: technical providers and IT service providers, website maintenance providers, email providers, and consultants, where applicable);
Third parties that provide services integrated into the site (e.g., fonts, maps, image display), which may process technical data as independent data controllers in accordance with their own privacy notices (in which case, please also consult the individual privacy notices of such third parties);
Competent public authorities and supervisory bodies, within the limits set by law or in order to comply with requests from judicial authorities;

The updated list of external recipients can be provided upon request by writing to the Data Controller at the contact address provided.

7. Where can your data be transferred?
The personal data collected through this site is processed, as a rule, in the country where the Data Controller is established and by the service providers it uses. Where data is transferred or made accessible outside the relevant territory under applicable law, the transfer takes place through one of the mechanisms permitted by such law, including adequacy decisions, appropriate or suitable safeguards, and, where applicable, derogations or other conditions provided for by applicable law. For transfers subject to the GDPR, the relevant territory is the European Union/European Economic Area; in particular, the EU-U.S. Data Privacy s Framework—limited to certified organizations—and the Standard Contractual Clauses adopted by the European Commission are relevant. Information on the applicable mechanism and, where provided, a copy of the relevant safeguards (with confidential portions redacted, if necessary) may be requested using the Data Controller’s contact information.

8. What are your rights regarding the data collected?
Under applicable law, the user has the right to:

Obtain confirmation as to whether or not personal data concerning them is being processed and, if so, obtain access to that data and the related information (right of access).
Request the correction, updating, or deletion of data that is inaccurate or no longer necessary (right to correction and deletion).
Request the restriction of processing or object, for reasons related to your particular situation, to processing based on the Data Controller’s legitimate interest, provided that the conditions set forth in Article 21 of the GDPR are met.
To receive, in the cases and under the conditions provided for by applicable law, the personal data concerning you in the format required by that law, and to have that data transmitted to another controller or provider; for the EU/EEA and the UK, this right applies to the data you have provided, the format is structured, commonly used, and machine-readable, and direct transmission is carried out where technically feasible (right to data portability).
You may withdraw any consent you have given at any time, without affecting the lawfulness of processing based on consent that took place prior to the withdrawal (for example, for the sending of commercial communications or newsletters, where applicable).
Withdraw your consent to the use of non-essential cookies and to the processing of data collected through tracking tools.
Report any irregularities or abuses to the competent supervisory authorities.

In Italy, the rights concerning the personal data of deceased persons may be exercised, within the limits set forth in Article 2-terdecies of the Code of Privacy , by anyone who has a personal interest, acts to protect the data subject as an agent, or invokes family reasons worthy of protection.

To exercise these rights, simply send a request to the Data Controller using the contact information provided. The Data Controller will respond without undue delay and within the time limits provided for by applicable law. For requests subject to the GDPR or the UK GDPR, a response is provided within the standard period of one month, calculated in accordance with applicable law; that period may be extended by an additional two months, taking into account the complexity and number of requests, and the data subject is informed of the extension and the reasons for it within the standard period.

9. How is minors’ data processed?
The protection of minors is a fundamental priority.

This site is not intended for minors and does not intentionally collect their data through its forms. If, in the context of a request or inquiry, the user provides personal data relating to third parties—including any minors—they must ensure that they are authorized to do so; such data will be processed within the limits and for the purposes of the request, in compliance with applicable law. For requests regarding rectification, restriction, or erasure, you may contact the Data Controller using the contact information provided.

10. How can you file reports or complaints with the authorities?
If you believe that the processing of your personal data through this site does not comply with applicable law, you may file a complaint free of charge, pursuant to Article 77 of the GDPR, with the competent authorities listed below, in accordance with applicable law:

11. How do we notify you of changes to this notice?
This notice is subject to periodic revision to reflect regulatory changes or modifications to the services offered through the site. Any significant change will be communicated on this page.
Last revised: October 1, 2026