Privacy policy.
SH Group UAB (SUPER HOW? Group) is committed to protecting your personal data. This policy sets out how we collect, use, and safeguard it in accordance with the GDPR.
Last updated: 8 October 2026
Who we are
SH Group UAB is a group holding company incorporated in Lithuania (UAB SH Group), company code 306645701, registered office J. Jasinskio str. 14B, Vilnius, Lithuania. Your privacy matters to us. This policy explains how we collect, use, disclose, transfer, and otherwise process personal data in accordance with the General Data Protection Regulation (GDPR).
Depending on the context, SH Group UAB may act as a data controller and, in some engagements, as a data processor. “Personal data” means any information that identifies you directly or indirectly — including names, email addresses, phone numbers, location data, postal addresses, and online identifiers.
Where necessary, personal data may be shared within the SUPER HOW? Group entities on a strict need-to-know basis, governed by GDPR-compliant agreements and Standard Contractual Clauses.
To exercise any of your rights, or for any privacy enquiry, contact us at info@superhow.com, or by mail: Data Protection Officer, SH Group UAB, J. Jasinskio str. 14B, Vilnius, Lithuania.
What we collect & why
Contact form
We collect your full name, company name, email, phone, and project details to answer your enquiry. Legal basis: consent.
Newsletter
We collect your name and email to send newsletters and event invitations. Legal basis: consent.
Website maintenance
Using Hotjar, Google Analytics, MS Dynamics, and Cloudflare Web Analytics, we collect feedback, device data, usage metrics, and behavioural data to maintain and improve the website. Legal basis: legitimate interests.
Job applicants
We collect your name and CV — which may include address, date of birth, telephone number, email address, references, and certificates — to assess your application. Legal basis: steps prior to entering a contract.
Employees and former employees
We process name, address, contact details, date and place of birth, nationality, national register number, gender, language, qualifications, and related details for purposes such as salary, registration, mobility, and insurance. Legal basis: contract execution.
Business connections & AI sales assistant
We process company information, contact details, job title, meeting notes, and contract/billing information. For AI assistant interactions we may process conversation history, technical information, usage data, preferences, and location data. Legal basis: legitimate interests.
Cookies
We use cookies for the functioning of the website. Legal basis: legitimate interest.
Training (SuperHow.Academy)
We collect name, email, and bank data; feedback is collected anonymously. Legal basis: contract execution.
Sharing & third parties
We rely on the following service providers to operate our business and website. For each, we have a data processing agreement governing their use and protection of your personal data:
- —Robolabs
- —Eventbrite
- —MS Office 365
- —MS Dynamics
- —Omnisend
- —MailChimp
- —Microsoft Office Lens
- —Wix
- —Google Analytics
- —MS Teams
The contact form on this site uses two further service providers. Cloudflare Email Service delivers the message you send us and receives the name, email address, company name and message you enter for that purpose. If we have to stop using Cloudflare Email Service, Mailgun delivers the message instead and receives the same data. Cloudflare Turnstile checks that the form is sent by a person and not by a program, and for that purpose receives your IP address. The site also uses Cloudflare Web Analytics to measure traffic and performance in aggregate. Its script collects page-load timing through your browser's Performance API, and Cloudflare records page views, referrers, country, browser and operating system, with their versions, and device type, and page-load performance. Cloudflare also receives your IP address when your browser reports these measurements. Cloudflare states on its Web Analytics page that it does not use any client-side state, such as cookies or localStorage, to collect usage metrics, and that it does not fingerprint individuals via their IP address, User Agent string or any other data for the purpose of displaying analytics. Our legal basis is legitimate interest, in measuring and improving our own site. The script stores nothing on your device and reads only the measurements described above, so we do not ask for your consent for it. Cloudflare, Inc. acts as our processor for this, under the Data Processing Addendum that is part of our agreement with Cloudflare, and keeps the data for the period stated in Cloudflare's own documentation.
We maintain a presence on social media — Facebook, LinkedIn, Twitter (X), and Telegram — without disclosing your personal data to those platforms.
How we protect your data
Technical measures
- —Anti-virus, firewalls, and similar protections
- —Authentication
- —Encrypted hard disks
- —Access restriction
- —Encryption of data
- —Secure backup
Organisational measures
- —Access limited to specific persons
- —Internal privacy policy for employees
- —Employee training
- —Confidentiality clauses
- —Incident & data-breach management
International transfers
Where data is transferred outside the EEA, we rely on adequacy decisions, Standard Contractual Clauses, or equivalent safeguards to protect it.
Retention
We keep personal data only as long as necessary for the purpose it was collected, or as required by law:
- —CV from external recruiters — 2 years
- —CV uploaded via website — 1 year
- —Employee data — 5 years, or as legally required
- —Mobile phone registration — 5 years, or as legally required
- —Insurance data — 5 years, or as legally required
- —Accounting — 5 years, or as legally required
Your rights
We will respond to your request without undue delay and, in any event, within one month of receipt. Under the GDPR you have the following rights:
Right to be informed
To receive concise, transparent information in clear language about how your data is processed.
Right of access
To ask whether we process personal data concerning you, and to obtain a copy of it.
Right to rectification
To have inaccurate or incomplete data corrected.
Right to erasure
To request deletion where data is no longer necessary, consent is withdrawn, processing is unlawful, or other GDPR conditions apply — subject to exceptions such as freedom of expression and legal-compliance obligations.
Right to restrict processing
To have data stored but used only for limited purposes where its accuracy is contested, processing is unlawful, or an objection is pending.
Right to data portability
To receive your personal data in an understandable, readable, and portable format.
Right to object
To object to processing within the limitations of Article 21 GDPR.
Automated decision-making
Not to be subject to decisions based solely on automated processing, subject to the exceptions set out in the GDPR.
Right to lodge a complaint
You may lodge a complaint with the State Data Protection Inspectorate of Lithuania (VDAI): https://vdai.lrv.lt/ · ada@ada.lt · A. Juozapavičiaus str. 6, LT-09310 Vilnius, Lithuania.
Changes to this policy
In a world of continuous technological change, we will update this privacy statement on a regular basis. Please check back periodically for the latest version.