Login
sparkleAI

Data protection

Privacy Policy

This privacy policy informs you about the nature, scope and purpose of the processing of personal data within our online offering and the websites, functions and content associated with it, as well as external online presences such as our social media profiles. With regard to the terms used, such as "processing" or "controller", we refer to the definitions in Art. 4 of the General Data Protection Regulation (GDPR).

1. Name and contact details of the controller and of the data protection officer

This data protection information applies to data processing by the controller:

plastship GmbH
Auf der Lind 10
65529 Waldems, Germany

Represented by: Andreas Bastian and Markus Dambeck
Phone: +49 6126 5898010
E-mail: info@plastship.com

Contact for data protection matters:
datenschutz@plastship.com

plastship has currently not appointed a data protection officer. For all questions relating to data protection, please use the address given above.

2. Definitions

The terms used in this privacy policy correspond to the definitions in Art. 4 GDPR (e.g. "processing", "personal data", "controller").

3. Collection and storage of personal data and the nature and purpose of their use

a) When visiting the website

When you access the website www.plastship.com, the browser used on your device automatically sends information to the server of our website. This information is temporarily stored in a so-called log file. The following information is recorded without any action on your part and stored until it is automatically deleted:

  • IP address of the requesting computer,
  • date and time of access,
  • name and URL of the file retrieved,
  • website from which access is made (referrer URL),
  • browser used and, where applicable, the operating system of your computer.

We process the data mentioned for the following purposes:

  • ensuring a smooth connection to the websites,
  • ensuring convenient use of the websites,
  • evaluating system security and stability, and
  • for other administrative purposes.

The legal basis for the data processing is Art. 6(1)(f) GDPR. Our legitimate interest follows from the purposes of data collection listed above. Under no circumstances do we use the data collected for the purpose of drawing conclusions about you personally. In addition, when you visit our websites we use technically necessary cookies and, only with your consent, anonymous reach measurement. Further details can be found in Sections 7 and 8 of this privacy policy. Log files are stored for 90 days for security reasons and then deleted automatically.

b) Newsletter

We do not currently send a newsletter. The following information applies in the event that we offer a newsletter in the future. If you have given your express consent in accordance with Art. 6(1)(a) GDPR, we use your e-mail address to send you our company newsletter on a regular basis. An e-mail address is sufficient to receive the newsletter. In addition to your e-mail address, we store your first and last name in order to personalise the newsletter. We use the double opt-in procedure to ensure that the registration is made by the owner of the e-mail address. We pass on the data required for sending the newsletter and for unsubscribing to an external service provider with whom a data processing agreement is in place. You can unsubscribe from the newsletter at any time, for example via a link at the end of each newsletter. Alternatively, you can send your request to unsubscribe at any time by e-mail to info@plastship.com.

c) Use of the customer portal (plastship.com)

Our customer portal serves to provide and manage the contractually agreed services. To use our customer portal, you need to provide the following personal data when registering:

  • form of address
  • first name
  • last name
  • company name and company address
  • business e-mail address
  • business telephone number for any queries

After completing registration, you can log in to the customer portal with your e-mail address and your password.

We process the data mentioned for the following purposes:

  • provision of contract-specific data and information
  • viewing of data and information specific to the contracting party
  • handling of enquiries, quotations, orders and invoices

Data processing for the purpose of providing and using the customer portal is carried out in accordance with Art. 6(1)(b) GDPR on the basis of the performance of a contract.

For hosting our customer portal, for backup services and for the technical development of the customer portal, we use external service providers who may gain insight into sample data in the course of processing on our behalf. A data processing agreement on the basis of Art. 28 GDPR is in place with these processors.

The personal data collected for the use of the customer portal are processed and stored for the term of the contract up to the final settlement of contractual services. In addition, we store your personal data to fulfil statutory documentation and retention obligations arising, among other things, from the German Commercial Code (Handelsgesetzbuch), the German Fiscal Code (Abgabenordnung) and the German Money Laundering Act (Geldwäschegesetz).

d) Contacting us

If you contact us via the contact form, by e-mail or by telephone, we process your details and your message in order to deal with your request. The legal basis is Art. 6(1)(b) GDPR insofar as your enquiry is aimed at a contract or its initiation, otherwise Art. 6(1)(f) GDPR (legitimate interest in answering enquiries). We store your enquiry for as long as this is necessary for processing it and for any resulting business relationship, and delete it afterwards unless statutory retention obligations prevent this.

e) Communication, customer management and business processes

To process enquiries efficiently, to manage our customer relationships (CRM) and to handle our internal business processes and accounting, we use specialised software solutions from external service providers. We have concluded data processing agreements in accordance with Art. 28 GDPR with all the providers named below in order to ensure a high level of protection for your data.

aa) Customer management and back-end system (Salesforce)

We use the CRM system of Salesforce (salesforce.com Germany GmbH, Erika-Mann-Straße 31-37, 80636 Munich, Germany). It is used to manage customer and prospect data and to carry out pre-contractual and contractual measures.

  • Legal basis: Processing is carried out for the performance of a contract or to take pre-contractual steps (Art. 6(1)(b) GDPR) and on the basis of our legitimate interest in efficient customer service (Art. 6(1)(f) GDPR).
  • Third-country transfer: Salesforce.com Inc. is certified under the EU-U.S. Data Privacy Framework. This ensures an adequate level of data protection for transfers to the USA. In addition, we use the EU standard contractual clauses as a further safeguard.
  • Further information: Salesforce privacy statement.

bb) Invoicing and accounting (Fastbill)

For our accounting and for creating invoices we use the Fastbill service (FastBill GmbH, Wildunger Str. 6, 60487 Frankfurt am Main, Germany).

  • Legal basis: Processing is necessary for the performance of the contract concluded with you (Art. 6(1)(b) GDPR). In addition, we are subject to statutory retention obligations under the German Commercial Code (HGB) and the German Fiscal Code (AO), which oblige us to store and process certain data (Art. 6(1)(c) GDPR).
  • Further information: Fastbill privacy policy (in German).

cc) E-mail communication and organisation (Microsoft 365)

For all our e-mail correspondence, scheduling and internal organisation we use the cloud solution Microsoft 365 (Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland).

  • Legal basis: It is used to carry out our business communication and to perform contracts (Art. 6(1)(b) GDPR) and on the basis of our legitimate interest in secure and efficient collaboration (Art. 6(1)(f) GDPR).
  • Third-country transfer: Microsoft is certified under the EU-U.S. Data Privacy Framework. Insofar as data are processed in the USA, this adequacy decision ensures a legally secure level of data protection.
  • Further information: Microsoft privacy statement.

f) Logs and usage evaluation in the customer portal

When you use the customer portal, we log logins and security-related events (with IP address and browser), active sessions, records viewed and edited, and the use of the individual areas. The purpose is to protect your account, detect misuse, make changes traceable, enable support by your contact persons and develop the customer portal further. We evaluate the use of the areas only in aggregated form and not to assess individual persons. The legal basis is Art. 6(1)(f) GDPR. Depending on their purpose, the logs are deleted after 30 days to 12 months; records of changes to business data are kept for as long as the respective record exists. You can object to the evaluation of usage at any time (Art. 21 GDPR), in your profile in the customer portal or by e-mail.

g) Technical error analysis

To detect and fix technical errors, we use a specialised service provider as a processor (based in the USA, data stored in the EU). If an error occurs, technical details of the error, the address accessed, browser and operating system as well as a pseudonymous user identifier and your role are transmitted, but not your name, e-mail address or IP address. The data are deleted after 90 days. The legal basis is Art. 6(1)(f) GDPR (stability and security of the website and the customer portal). For transfers to third countries, see Section 4.

h) AI-supported functions

To support our employees in handling business transactions, and for translations and the evaluation of material photos, we use AI-supported functions. In doing so, information about customers, contact persons and transactions may also be processed on our behalf by Microsoft (see letter e). Decisions about individuals are not made by automated means. AI translations and AI evaluations are labelled as such wherever they are displayed. We delete histories and logs of these functions after 180 days at the latest. The legal basis is Art. 6(1)(b) and (f) GDPR (efficient handling of transactions). For transfers to third countries, see Section 4.

i) Verification of business partners

Before we approve companies as business partners, we check their details against publicly accessible sources (such as commercial and company registers, the EU VAT Information Exchange System and sanctions lists) and with services for checking domains and e-mail addresses. The name and e-mail address of a contact person may also be processed in the process. The purpose is protection against fraud and sanctions violations; the legal basis is Art. 6(1)(f) GDPR and, where sanctions law applies, Art. 6(1)(c) GDPR. Approval is decided by our employees, not by an automated procedure.

4. Disclosure of data

Your personal data will not be transferred to third parties for purposes other than those listed below.

We only pass on your personal data to third parties if:

  • you have given your express consent to this in accordance with Art. 6(1)(a) GDPR,
  • there is a legitimate interest in the disclosure in accordance with Art. 6(1)(f) GDPR and there is no reason to assume that you have an overriding legitimate interest in your data not being disclosed,
  • there is a legal obligation to disclose the data in accordance with Art. 6(1)(c) GDPR, and
  • this is legally permissible and necessary in accordance with Art. 6(1)(b) GDPR for the initiation and performance of contractual relationships with you.

To operate the website and the customer portal, we use service providers who process data on our behalf and in accordance with our instructions (processors, Art. 28 GDPR). In addition to the providers named in Section 3, these are service providers for hosting and data backup with data centres in Germany and the EU and for technical error analysis.

Transatlantic data transfers: Where we use service providers in the USA (e.g. Microsoft 365, Salesforce), this is done on the basis of the EU-U.S. Data Privacy Framework or the EU standard contractual clauses. You can obtain a copy of the safeguards on request using the contact details given in Section 1.

5. Legal basis for the processing of personal data

Insofar as we obtain your consent for processing operations involving personal data, Art. 6(1)(a) GDPR serves as the legal basis.

For the processing of personal data that is necessary for the performance of a contract or for pre-contractual measures, Art. 6(1)(b) GDPR serves as the legal basis.

Insofar as the processing of personal data is necessary to comply with a legal obligation to which we are subject, Art. 6(1)(c) GDPR serves as the legal basis.

If the processing is necessary to safeguard a legitimate interest of ours or of a third party and your interests, fundamental rights and freedoms do not override that interest, Art. 6(1)(f) GDPR serves as the legal basis for the processing.

6. Data erasure and storage period

Your personal data will be erased or blocked as soon as the purpose of storage ceases to apply. Data may be stored beyond that if this has been provided for by the European or national legislator in Union regulations, laws or other provisions to which the controller is subject. The data will also be blocked or erased when a storage period prescribed by the aforementioned provisions expires, unless further storage of the data is necessary for the conclusion or performance of a contract.

7. Cookies

We use cookies on our website. These are small files that your browser creates automatically and that are stored on your device (laptop, tablet, smartphone or similar) when you visit our website. Cookies do not cause any damage to your device and do not contain viruses, Trojans or other malware.

Information is stored in the cookie that arises in connection with the specific device used. However, this does not mean that we thereby gain direct knowledge of your identity.

We only use cookies that are strictly necessary for us to provide the website and the customer portal (Section 25(2) no. 2 TDDDG): for logging in, for protection against attacks, for the selected language and for your decision in the cookie notice. The login cookie is valid for up to 30 days and is deleted when you log out; the other cookies are valid for the duration of the session or for one year at most. We do not use cookies for advertising or analysis purposes or third-party cookies.

On your first visit, a cookie notice asks whether you additionally agree to anonymous reach measurement (Section 8).

Processing takes place insofar as it is covered by your voluntarily given consent (Art. 6(1)(a) GDPR) or is necessary to safeguard our legitimate interests or those of a third party (Art. 6(1)(f) GDPR). You can withdraw your consent at any time with effect for the future via the "Cookie settings" (at the bottom of the website).

Most browsers accept cookies automatically. However, you can configure your browser so that no cookies are stored on your computer or so that a notice always appears before a new cookie is created. Completely deactivating cookies may, however, mean that you cannot use all the functions of our website.

8. Analysis and tracking tools

We do not use any analysis, tracking or advertising services from third-party providers on our website.

Only if you have agreed in the cookie notice do we count visits to public pages anonymously, without IP address, without user identifier and without a separate identification cookie, and record measurements of page loading times via the service provider named in Section 3 g). The purpose is to improve the website. The legal basis is your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR), which you can withdraw at any time (Section 7). The individual counts are deleted after 90 days.

9. Social media links and plug-ins

On the basis of Art. 6(1)(a), (f) GDPR, we use links to the social network LinkedIn on the website. The underlying advertising purpose is to be regarded as a legitimate interest within the meaning of the GDPR. Responsibility for operation in compliance with data protection law lies with the respective provider. We do not use plug-ins, buttons or embedded videos from social networks or video platforms; when you merely access our pages, no data are transmitted to such providers. Where individual articles link to other websites, your browser only accesses them when you click on the link; from that point on, the privacy notices of the respective provider apply.

a) LinkedIn

The website provides a link to the LinkedIn network. The provider is LinkedIn Corporation, 2029 Stierlin Court, Mountain View, CA 94043, USA.

When you follow the link to LinkedIn, a connection to LinkedIn's servers is established. LinkedIn is informed that you have visited our website with your IP address. If you click the LinkedIn link while logged in to your LinkedIn account, LinkedIn is able to associate your visit to our website with your user account.

Further information on the collection of data and on your legal options and settings can be found in LinkedIn's privacy policy at: https://www.linkedin.com/legal/privacy-policy.

10. Rights of data subjects

You have the right:

  • in accordance with Art. 15 GDPR, to request information about your personal data processed by us. In particular, you can request information about the purposes of processing, the category of personal data, the categories of recipients to whom your data have been or will be disclosed, the planned storage period, the existence of a right to rectification, erasure, restriction of processing or objection, the existence of a right to lodge a complaint, the source of your data if they were not collected by us, and the existence of automated decision-making including profiling and, where applicable, meaningful information about its details;
  • in accordance with Art. 16 GDPR, to request without undue delay the rectification of inaccurate personal data or the completion of your personal data stored by us;
  • in accordance with Art. 17 GDPR, to request the erasure of your personal data stored by us, unless the processing is necessary for exercising the right of freedom of expression and information, for compliance with a legal obligation, for reasons of public interest or for the establishment, exercise or defence of legal claims;
  • in accordance with Art. 18 GDPR, to request the restriction of processing of your personal data if you contest the accuracy of the data, if the processing is unlawful but you oppose erasure, if we no longer need the data but you require them for the establishment, exercise or defence of legal claims, or if you have objected to the processing in accordance with Art. 21 GDPR;
  • in accordance with Art. 20 GDPR, to receive the personal data you have provided to us in a structured, commonly used and machine-readable format or to request their transfer to another controller;
  • in accordance with Art. 7(3) GDPR, to withdraw your consent, once given, at any time. As a result, we may no longer continue the data processing based on this consent in the future;
  • in accordance with Art. 21 GDPR, to object to the processing insofar as it is based on legitimate interests (Art. 6(1)(f) GDPR);
  • in accordance with Art. 77 GDPR, to lodge a complaint with a supervisory authority. As a rule, you can contact the supervisory authority of your habitual residence or place of work or of our registered office.

11. Right to object

If your personal data are processed on the basis of legitimate interests in accordance with Art. 6(1)(f) GDPR, you have the right under Art. 21 GDPR to object to the processing of your personal data, provided there are grounds arising from your particular situation or the objection is directed against direct marketing. In the latter case, you have a general right to object, which we will implement without you having to state a particular situation.

If you wish to exercise your right of withdrawal or objection, an e-mail to datenschutz@plastship.com is sufficient.

12. Data security

The connection to our website and to the customer portal is encrypted with TLS throughout (recognisable by "https://" and the lock symbol in your browser).

In addition, we use suitable technical and organisational security measures to protect your data against accidental or intentional manipulation, partial or complete loss, destruction or unauthorised access by third parties. Our security measures are continuously improved in line with technological developments.

13. Currency of and changes to this privacy policy

This privacy policy is currently valid and was last updated in November 2026.
It may become necessary to amend this privacy policy as a result of the further development of our website and the services offered via it, or due to changes in legal or regulatory requirements. You can access and print out the current privacy policy at any time on the website at https://plastship.com/privacy. The German version of this privacy policy is authoritative; the English version is a non-binding translation.

Only the German version of this page is legally binding. The English version is a non-binding courtesy translation; it is translated by hand, never by machine.