Privacy Policy

1. Overview of the Privacy Policy

General Information

The information below provides a general overview of what happens to your personal data when you visit this website . Personal data is any data that can be used to identify you. Detailed information on data protection can be found in our Privacy Policy, which is available below this text.

Data collection on this website

Who is responsible for data collection on this website?

Data processing on this website is carried out by the website operator. The operator’s contact details can be found in the ‘Information on the Data Controller’ section of this Privacy Policy.

How do we collect your data?

Your data is collected, in particular, through the voluntary provision of information to us — for example, by entering data into the contact form.

Other data is collected automatically or with your consent by our IT systems when you visit the website. This primarily concerns technical data (such as the type of web browser, operating system or the time the page was viewed). This data is collected automatically when you access this website.

What do we use your data for?

Some data is collected to ensure the website functions properly. Other data may be used to analyse user behaviour.

What rights do you have regarding your data?

You have the right at any time to obtain, free of charge, information about the origin, recipients and purpose of the storage of your personal data. You also have the right to request the rectification or erasure of this data. If you have given your consent to the processing of data, you may withdraw it at any time, with effect for the future. Furthermore, you have the right to request that the processing of your personal data be restricted in certain circumstances. You also have the right to lodge a complaint with the relevant supervisory authority.

If you have any further questions regarding data protection or wish to exercise your rights, please contact us.

Analytics tools and third-party tools

When you visit this website, your online behaviour may be subject to statistical analysis — primarily using so-called analytics tools.

Further details regarding these analytics tools are provided later in this Privacy Policy.

2. General information and mandatory information

Data protection

The operators of this website take the protection of your personal data very seriously. Your personal data is processed confidentially and in accordance with applicable data protection legislation, as well as the provisions of this Privacy Policy.

Various types of personal data are collected when you use this website. Personal data is information that allows you to be personally identified. This Privacy Policy explains what data we collect, for what purpose we use it, and how and on what legal basis it is processed.

Please note that the transmission of data via the Internet (for example, when communicating by email) may be subject to security vulnerabilities. It is not possible to guarantee complete protection of data against access by third parties.

Information on the data controller

The data controller for this website is:

SHP Steriltechnik Polska Sp. z o.o.
ul. Witolinska 6/70
04-185 Warsaw
Email: This email address is being protected from spambots. You need JavaScript enabled to view it.

The data controller is a natural or legal person who, alone or jointly with others, determines the purposes and means of the processing of personal data (e.g. names, email addresses, etc.).

Data retention period

Unless a specific retention period is specified in this Privacy Policy, your personal data will be retained by us until the purpose for which it is processed no longer applies. If you submit a justified request for the erasure of your data or withdraw your consent to its processing, the data will be erased – provided there are no other legal grounds for its retention (for example, tax or commercial regulations regarding the retention of documents); in such cases, the data will be deleted once these grounds cease to apply.

General information on the legal grounds for data processing on this website

If you have given your consent to data processing, we process your data on the basis of Article 6( 1(a) of the GDPR or Article 9(2)(a) of the GDPR, if special categories of data are processed in accordance with Article 9(1) of the GDPR. Where explicit consent has been given for the transfer of personal data to third countries, processing is also carried out on the basis of Article 49(1)(a) of the GDPR. If you have consented to the storage of cookies or to access to information on your device (for example, by identifying the device via a fingerprint), the data will also be processed on the basis of Section 25( 1 of the TDDG. Consent may be withdrawn at any time. Where data is necessary for the performance of a contract or for steps taken prior to entering into a contract, we process it on the basis of Article 6(1)(b) of the General Data Protection Regulation (GDPR). Furthermore, where processing is necessary for compliance with a legal obligation, it is carried out on the basis of Article 6(1)(c) of the GDPR. Data processing may also be carried out on the basis of our legitimate interests in accordance with Article 6(1)(f) of the GDPR. We provide details of the specific legal bases for processing in individual cases later in this Privacy Policy.

Data Protection Officer

We have appointed a Data Protection Officer:

Thomas Dey, Chartered Engineer
SHP Steriltechnik AG
Schloss Detzel 1
D-39345 Detzel Schloss
Telephone: +49 (0) 39058/9762-0
Email: This email address is being protected from spambots. You need JavaScript enabled to view it.

Information on the transfer of data to third countries that do not provide an adequate level of data protection, as well as to US companies that are not certified under the EU-US Data Privacy Framework

We use, amongst other things, tools provided by companies based in third countries that do not provide adequate data protection, as well as US tools, whose providers are not certified under the EU-US Data Privacy Framework (DPF). If these tools are active, your personal data may be transferred to these countries and processed there. Please note that in third countries which do not guarantee an adequate level of data protection, it is not possible to ensure a level of protection comparable to that of the European Union.

We would like to emphasise that the USA, as a country considered to be safe, generally has a level of data protection comparable to that of the EU. Data transfers to the USA are permissible if the recipient is certified under the ‘EU-US Data Privacy Framework’ (DPF) or provides appropriate additional safeguards. Information on data transfers to third countries, in particular regarding data recipients, is set out in this Privacy Policy.

Recipients of personal data

As part of our activities, we cooperate with various external parties. In some cases, it is necessary to transfer personal data to these parties. We transfer personal data only where this is necessary for the performance of a contract, where required by law (for example, the transfer of data to tax authorities), where we have a legitimate interest pursuant to Article 6(1)(f) of the General Data Protection Regulation (GDPR), or where another legal basis permits such a transfer. Where subcontractors are involved, we transfer our clients’ personal data exclusively on the basis of a valid data processing agreement. In the case of joint processing, we enter into a joint processing agreement.

Withdrawal of consent to data processing

Many data processing operations are only possible on the basis of explicit consent. You may withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of data processing that took place prior to its withdrawal.

Right to object to data collection in specific cases and to direct marketing (Article 21 of the GDPR)

IF DATA PROCESSING IS CARRIED OUT ON THE BASIS OF ARTICLE 6(1), POINT (e) OR (f) OF THE GDPR, YOU HAVE THE RIGHT AT ANY TIME TO OBJECT to the processing of your personal data on grounds relating to your particular situation. This also applies to profiling based on these provisions. The legal grounds for data processing are set out in this Privacy Policy. If you object, we will not process your data, unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or where the processing is necessary for the establishment, exercise or defence of legal claims (objection under Article 21(1) of the GDPR).

IF YOUR PERSONAL DATA IS PROCESSED FOR DIRECT MARKETING PURPOSES, YOU HAVE THE RIGHT TO OBJECT to the processing of your data for this purpose; THIS ALSO APPLIES TO PROFILING IF IT IS RELATED TO SUCH ADVERTISING. IF YOU OBJECT, YOUR DATA WILL NOT BE USED FOR DIRECT ADVERTISING (OBJECTION PURSUANT TO ARTICLE 21(2) OF THE GDPR).

Right to lodge a complaint with the relevant supervisory authority

In the event of a breach of the provisions of the GDPR, data subjects have the right to lodge a complaint with the relevant supervisory authority, in particular in the Member State where they have their habitual residence, where they work, or where the alleged breach occurred. The right to lodge a complaint exists independently of other remedies available through administrative or judicial proceedings.

Right to data portability

You have the right to receive from us the data we process on the basis of your consent or for the performance of a contract, in an automated form in a commonly used, machine-readable format. If you wish for the data to be transferred directly to another controller, the transfer will take place within the limits of our technical capabilities.

Right to access, rectify and erase data

In accordance with applicable legislation, you have the right at any time and free of charge to obtain information about the personal data held, its origin, the recipients and the purpose of processing, as well as the right to have it rectified or erased. If you have any questions regarding your personal data or the exercise of your rights, please contact us.

Right to restriction of processing

You have the right to request the restriction of the processing of your personal data. To do so, you may contact us. The right to restriction of processing applies in the following cases:

• If you dispute the accuracy of the personal data stored, which usually requires time to verify. During the verification period, you have the right to request that the processing of your data be restricted.
• If the processing of your data has taken place in breach of the law, you may request that processing be restricted rather than your data being erased.
• If we no longer require your personal data, but it is necessary for the establishment, exercise or defence of legal claims, you have the right to request that the processing be restricted rather than deleted.
• In the event of an objection being lodged in accordance with Article 21(1) of the GDPR, your interests and ours must be weighed up. Until it has been determined which interests prevail, you have the right to request that the processing of your data be restricted.
• If you have restricted the processing of your data, such data — with the exception of its storage — may only be processed with your consent or for the purposes of establishing, exercising or defending legal claims, protecting the rights of another natural or legal person, or for reasons of substantial public interest of the European Union or a Member State.

SSL/TLS encryption

For security reasons and to protect the confidentiality of transmitted data, such as orders or enquiries, this website uses SSL/TLS encryption. An encrypted connection can be recognised by the fact that the website address changes from ‘http://’ to ‘https://’, as well as by the padlock icon displayed in the browser address bar.

Active SSL/TLS encryption ensures that data sent to us cannot be intercepted by third parties.

Opting out of promotional emails

We hereby declare that we will not use the contact details published in the website footer to send advertising or information material that you have not expressly requested. The operators of this website reserve the right to take legal action in the event of unsolicited advertising, for example in the form of spam emails.

3. Data collection on this website

Cookies

Our website uses so-called ‘cookies’. Cookies are small data packets that do not cause any harm to your device. They may be stored temporarily for the duration of a session (session cookies) or permanently (persistent cookies) on your device. Session cookies are automatically deleted once you leave the website, whilst persistent cookies remain stored until they are manually deleted or automatically cleared by your browser.

Cookies may originate from us (first-party cookies) or from third-party companies (so-called third-party cookies). Third-party cookies enable us to integrate certain services provided by external companies (for example, cookies required for processing payments).

Cookies perform various functions. Many cookies are technically necessary, as without them certain website functions (such as the shopping basket or video playback) would not be possible. Other cookies may be used to analyse user behaviour or for advertising purposes.

Essential cookies, which are used to facilitate electronic communication, to provide specific functions you have requested (such as the shopping basket function), or to optimise the website (for example, cookies used to measure website traffic), are stored on the basis of Article 6(1)(f) of the General Data Protection Regulation (GDPR), unless another legal basis is specified. The website operator has a legitimate interest in storing the necessary cookies to ensure the proper and optimised functioning of its services. Where consent has been obtained for the storage of cookies and similar tracking technologies, processing is carried out exclusively on the basis of this consent (Article 6(1)(f) a) of the General Data Protection Regulation (GDPR) and Section 25(1) of the Telecommunications Act (TDDG)); consent may be withdrawn at any time.

You can configure your browser so that it notifies you when cookies are set and allows their use only in specific cases, blocks cookies in certain situations, or automatically deletes cookies when you close your browser. If you disable cookies, some website functions may be restricted.

Information on which cookies and services are used on this website can be found in this Privacy Policy.

Consent management via Usercentrics

This website uses Usercentrics consent technology to obtain your consent to the storage of certain cookies on your device or the use of certain technologies, and to document the consents given in accordance with legal requirements. The provider of this technology is Usercentrics GmbH, Sendlinger Straße 7, 80331 Munich, website: https://usercentrics.com/pl/ (hereinafter ‘Usercentrics’).

When you visit our website, the following personal data is transmitted to Usercentrics:

• Your consents and, where applicable, the withdrawal of consent
• IP addresses
• Browser information
• Information about your device
• Date and time of your visit to the website
• Geolocation data

In addition, Usercentrics stores cookies in your browser to enable it to associate the consents you have given or any withdrawals thereof. The data collected is stored until you request its deletion, delete the Usercentrics cookies yourself, or until the purpose of the data processing no longer applies. The statutory retention periods remain unaffected.

The Usercentrics banner on this page is configured using the eRecht24 service. This can be identified by the eRecht24 logo that appears on the banner. To display the eRecht24 logo on the banner, a connection is established with the eRecht24 image server. During this process, the IP address is also transmitted; however, it is stored exclusively in anonymised form in the server logs. The eRecht24 image server is located in Germany with a German provider, and the banner itself is provided exclusively by Usercentrics.

Usercentrics is used to obtain the consents required by law for the use of certain technologies. The legal basis for this data processing is Article 6(1)(c) of the General Data Protection Regulation (GDPR).

Contact form

If you send us enquiries via the contact form, the data entered into the form, including the contact details provided, will be stored by us for the purpose of processing your enquiry and any follow-up questions. This data will not be passed on to third parties without your express consent.

The processing of this data is carried out on the basis of Article 6(1), (b) of the General Data Protection Regulation (GDPR), provided your enquiry relates to the performance of a contract or is necessary for taking steps prior to entering into a contract. In other cases, processing is carried out on the basis of our legitimate interest in the effective handling of enquiries (Article 6, (1)(f) of the General Data Protection Regulation) or on the basis of your consent (Article 6(1)(a) of the General Data Protection Regulation), provided such consent has been given; you may withdraw your consent at any time.

Data submitted by you via the contact form is retained for as long as the purpose of its processing remains valid, or until you request its deletion or withdraw your consent. Mandatory provisions, such as statutory retention periods, remain unaffected.

Enquiries sent by email, telephone or fax

If you contact us by email, telephone or fax, your enquiry, together with all associated personal data (e.g. your and the content of the enquiry) will be stored and processed by us for the purpose of dealing with your enquiry. This data will not be passed on to third parties without your consent.

The processing of this data is carried out on the basis of Article 6(1)(b) of the General Data Protection Regulation (GDPR), provided your enquiry is relates to the performance of a contract or to steps taken prior to entering into a contract. In all other cases, processing is carried out on the basis of our legitimate interest in the efficient handling of enquiries (Article 6(1)(f) of the General Data Protection Regulation) or on the basis of your consent (Article 6(1)(a) a of the General Data Protection Regulation), provided such consent has been given; consent may be withdrawn at any time.

Data sent to us in enquiries is retained by us for as long as the purpose of its processing exists, or until you request its deletion or withdraw your consent. Mandatory legal provisions, in particular statutory retention periods, remain unaffected.

4. Social media

eRecht24 Safe Sharing Tool

The content of this page may, in accordance with data protection regulations, be shared on social media platforms such as Facebook, X and others. To this end, the website uses the eRecht24 Safe Sharing Tool. This tool establishes a direct connection between social media platforms and users only after the user clicks the relevant button. Clicking the button constitutes consent within the meaning of Article 6(1)(a) of the General Data Protection Regulation (GDPR) and Section 25(1) of the Telecommunications and Digital Services Act (TDDG). This consent may be withdrawn at any time with future effect.

Thanks to this tool, there is no automatic transfer of user data to the operators of these platforms. If the user is logged into a particular social network, an information window will appear when using social features from Facebook, X, etc., in which the user can confirm the transfer of data.

Users of our website may share its content on social media in accordance with data protection regulations, without the operators of these networks creating comprehensive browsing profiles.

This tool is used to obtain the necessary consents for the use of certain technologies. The legal basis for this processing is Article 6(1)(c) of the General Data Protection Regulation (GDPR).

5. Analytics tools and advertising

Google Tag Manager

On this website, we use the Google Tag Manager service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Google Tag Manager is a tool that allows us to integrate tracking tools, analytics and other technologies into our website. Google Tag Manager itself does not create user profiles, store cookies or carry out any analyses of its own. Its sole purpose is to manage and activate the tools it integrates. However, Google Tag Manager stores your IP address, which may be transferred to Google’s parent company in the United States.

The use of Google Tag Manager is based on Article 6(1)(f) of the GDPR. The website operator has a legitimate interest in the rapid and efficient implementation and management of various tools on its website. Where relevant consent has been given, processing is carried out exclusively on the basis of Article 6, (1)(a) of the General Data Protection Regulation (GDPR) and Section 25(1) of the Telecommunications Act (TDDG), provided that the consent covers the storage of cookies or access to information on the user’s device (e.g. via a device fingerprint); this consent may be withdrawn at any time.

The company is certified under the ‘EU-US Data Privacy Framework’ (DPF). The DPF is an agreement between the European Union and the United States aimed at ensuring compliance with European data protection standards when processing data in the United States. Every company certified under the DPF undertakes to comply with these standards. Further information is available at: https://www.dataprivacyframework.gov/participant/5780.

Data is transferred to the USA on the basis of the European Commission’s Standard Contractual Clauses. Further information can be found at: https://privacy.google.com/businesses/controllerterms/mccs/.

The company holds a certificate of compliance with the ‘EU-US Data Privacy Framework’ (DPF). Further information: https://www.dataprivacyframework.gov/participant/5780.

IP address anonymisation
The IP address anonymisation feature in Google Analytics is enabled. This means that IP addresses are truncated in EU member states or in other countries party to the Agreement on the European Economic Area before being transmitted to the USA. The full IP address may only be transmitted to a Google server in the USA in exceptional cases where truncation has not taken place. On behalf of the operator of this website, Google uses this data to analyse website usage, compile activity reports and provide services relating to internet usage. The IP address transmitted by your browser as part of Google Analytics will not be merged with other Google data.

Browser plug-in
You can prevent Google from collecting and processing your data by installing the plug-in available at: https://tools.google.com/dlpage/gaoptout?hl=pl.

Further information on data processing in Google Analytics can be found in Google’s Privacy Policy: https://support.google.com/analytics/answer/6004245?hl=pl.

Data transfers to the USA are based on the European Commission’s standard contractual clauses. Further information is available at: https://policies.google.com/privacy/frameworks and https://business.safety.google/controllerterms/.

The company holds a certificate of compliance with the ‘EU-US Data Privacy Framework’ (DPF). Further information: https://www.dataprivacyframework.gov/participant/5780.

Google Conversion Tracking

This website uses the Google Conversion Tracking service provided by Google Ireland Limited (‘Google’), Gordon House, Barrow Street, Dublin 4, Ireland.

Thanks to Google Conversion Tracking, we and Google can determine whether a user has carried out certain actions. On this basis, we can analyse which buttons were clicked most frequently or which products were most frequently viewed or purchased. This information is used to generate conversion statistics. We do not receive any data that would allow us to identify the user personally. However, Google uses cookies or similar user recognition technologies.

The use of this service is based on your consent in accordance with Article 6(1)(a) of the General Data Protection Regulation (GDPR) and Section 25(1) of the Telecommunications Act (TDDG); you may withdraw your consent at any time.

Further information on Google Conversion Tracking can be found in Google’s Privacy Policy: https://policies.google.com/privacy?hl=pl.

The company is certified under the ‘EU-US Data Privacy Framework’ (DPF). Further information: https://www.dataprivacyframework.gov/participant/5780.

6. Plugins and tools

Font Awesome

This website uses Font Awesome to ensure consistent display of fonts and icons. The service provider is Fonticons, Inc., 6 Porter Road Apartment 3R, Cambridge, Massachusetts, USA.

When a page is loaded, the browser caches the necessary fonts to ensure that text, fonts and icons are displayed correctly. To this end, the browser establishes a connection to the Font Awesome server, which allows Font Awesome to obtain information that the page has been visited via your IP address. The use of Font Awesome is based on Article 6(1)(f) of the GDPR. We have a legitimate interest in ensuring consistent font display on our website. Where consent has been obtained, data processing is carried out exclusively on the basis of Article 6(1)( (a) of the General Data Protection Regulation (GDPR) and Section 25(1) of the Telecommunications Act (TDDG), provided that the consent covers the storage of cookies or access to information on the device (e.g. device fingerprints); consent may be withdrawn at any time.

If your browser does not support Font Awesome, your computer’s default font will be used.

Further information about Font Awesome and its privacy policy can be found at: https://fontawesome.com/privacy.

Google Maps

This website uses the Google Maps mapping service provided by Google Ireland Limited (‘Google’), Gordon House, Barrow Street, Dublin 4, Ireland. This tool enables us to embed maps on our website.

To use the functions of Google Maps, your IP address must be stored. This information is usually transmitted to a Google server in the USA and stored there. The operator of this website has no influence over this data transfer. If Google Maps is activated, Google may use Google Fonts to ensure a consistent display of fonts. When Google Maps is loaded, the browser downloads the relevant fonts into the cache to ensure that text and fonts are displayed correctly.

Google Maps is used to present our online offerings in an attractive manner and to make it easier to find the locations we specify. This constitutes a legitimate interest pursuant to Article 6(1)(f) of the GDPR. Where consent is given, data processing is carried out exclusively on the basis of Article 6(1)(a) a of the General Data Protection Regulation (GDPR) and Section 25(1) of the Telecommunications Act (TDDG), provided that the consent covers the storage of cookies or access to information on the user’s device (e.g. device fingerprints); consent may be withdrawn at any time.

Data transfers to the USA are carried out on the basis of the European Commission’s standard contractual clauses. Further information is available at: https://privacy.google.com/businesses/gdprcontrollerterms/ and https://privacy.google.com/businesses/gdprcontrollerterms/sccs/.

Further information on Google’s data processing can be found in Google’s Privacy Policy: https://policies.google.com/privacy?hl=pl.

The company holds a certificate of compliance with the ‘EU-US Data Privacy Framework’ (DPF). Further information: https://www.dataprivacyframework.gov/participant/5780.

Google reCAPTCHA

On this website, we use Google reCAPTCHA (‘reCAPTCHA’), provided by Google Ireland Limited (‘Google’), Gordon House, Barrow Street, Dublin 4, Ireland.

The purpose of reCAPTCHA is to verify that the data entered (for example, in a contact form) originates from a human rather than an automated programme. To this end, reCAPTCHA analyses the user’s behaviour based on various indicators. The analysis begins automatically as soon as the user accesses the page. reCAPTCHA collects, in particular, information such as the IP address, the duration of the user’s visit to the page and mouse movements. The data collected is transmitted to Google.

The reCAPTCHA analysis takes place in the background — the user is not informed of its progress.

The storage and analysis of data are carried out on the basis of Article 6, (1)(f) of the General Data Protection Regulation (GDPR), as the website operator has a legitimate interest in protecting its services against misuse, spam and automated data collection. Where consent has been obtained, processing is carried out exclusively on the basis of Article 6(1)(a) of the General Data Protection Regulation (GDPR) and Section 25, (1) of the Telecommunications Act (TDDG), provided that the consent covers the storage of cookies or access to information on the user’s device (e.g. device fingerprints); consent may be withdrawn at any time.

Further information about Google reCAPTCHA can be found in Google’s Privacy Policy (https://policies.google.com/privacy? hl=pl) and in Google’s Terms of Service (https://policies.google.com/terms?hl=pl).

The company holds a certificate of compliance with the ‘EU-US Data Privacy Framework’ (DPF). Further information: https://www.dataprivacyframework.gov/participant/5780.

Cloudflare Turnstile

On this website, we use Cloudflare Turnstile (hereinafter ‘Turnstile’). The provider is Cloudflare Inc., 101 Townsend St., San Francisco, CA 94107, USA (hereinafter ‘Cloudflare’).

Turnstile is designed to verify whether data entered on this website (for example, in a contact form) is entered by a human or an automated programme. To this end, Turnstile analyses the behaviour of website visitors based on various indicators.

The analysis begins automatically as soon as a user visits a website on which Turnstile is activated. To carry out the analysis, Turnstile evaluates various pieces of information (for example, the IP address, the time spent by the user on the website, or the user’s mouse movements). The data collected during the analysis is transmitted to Cloudflare.

Data storage and analysis are carried out on the basis of Article 6(1)(f) of the General Data Protection Regulation (GDPR). The website operator has a legitimate interest in protecting its online offerings from abuse in the form of automated spying and spam. If the relevant consent has been obtained, processing is carried out exclusively on the basis of Article 6(1)(a) of the GDPR and Section 25(1) of the TDDDG, provided that the consent covers the storage of cookies or access to information on the user’s end device (e.g. device identification) within the meaning of the TDDDG. Consent may be withdrawn at any time.

Data processing is based on standard contractual clauses, which can be viewed here: https://www.cloudflare.com/cloudflare-customer-scc/.

Further information about Cloudflare Turnstile can be found in the privacy policy at https://www.cloudflare.com/cloudflare-customer-dpa/ .

The company holds a certificate of compliance with the ‘EU-US Data Privacy Framework’ (DPF). The DPF is an agreement between the European Union and the United States designed to ensure compliance with European data protection standards when data is processed in the United States. Every company holding a DPF certificate undertakes to comply with these data protection standards. Further information on this matter can be obtained from the provider by following the link below: https://www.dataprivacyframework.gov/participant/5666.