SESCO Steel Privacy Policy

1. Who We Are

The controller responsible for personal data collected through this website is SESCO Steel, operating as SESCO Steel ("SESCO Steel", "we", "us", or "our"). A controller decides why and how personal data is processed.

• Website: https://sescosteel.com
• Registered address: Building 32, Lotus 8, 5th Settlement, New Cairo, Cairo, Egypt
• Privacy email: admin@sescosteel.com
• Data Protection Officer: Ahmed Samir

If a different SESCO Steel entity is responsible for a particular activity, we will identify that entity and provide the relevant privacy information when the data is collected.

2. Scope of This Policy

This policy covers personal data processed in connection with:

• visits to our website and use of its forms;
• requests for quotations (RFQs), requests for proposals (RFPs), tenders, and project enquiries;
• LinkedIn Lead Gen Forms and similar enquiry forms on advertising platforms;
• communications by email, telephone, WhatsApp, social media, meetings, and exhibitions;
• customer, supplier, contractor, consultant, and partner relationships; and
• job applications and recruitment enquiries.

It covers individuals acting on their own behalf or representing an organization. Separate employee or activity-specific notices may apply where provided.

3. Personal Data We Collect

The information we process depends on your interaction with us and may include:

• Contact details: name, business email, telephone number, country, location, and preferred contact method.
• Professional details: employer, job title, department, industry, business address, professional profile, and relationship with SESCO Steel.
• Enquiry and project details: products or services of interest, project name and location, requirements, quantities, timelines, specifications, and personal data within submitted documents.
• Communications: correspondence, enquiry records, meeting details, and information you provide during business discussions.
• Recruitment details: CV, qualifications, employment history, experience, and other relevant application information.
• Website and device information: IP address, browser and device details, operating system, referring pages, website activity, approximate location, and cookie or similar identifiers, where collected.
• Marketing preferences: campaign source, form submissions, communication preferences, and consent or withdrawal records.

Please provide only information necessary for your enquiry. Do not submit identity documents, health information, financial information about individuals, or other sensitive personal data through general enquiry forms unless we specifically request it through an appropriate channel for a lawful purpose.

Where information is needed to respond to your request, assess an application, or meet a legal requirement, we will explain this when requesting it. Without that information, we may be unable to complete the relevant action. Optional marketing consent is separate from these requirements.

4. Sensitive Industrial and Project Information

Project enquiries may include drawings, engineering specifications, bills of quantities, tender documents, schedules, pricing, equipment details, supply-chain information, photographs, and project locations.

Do not send classified, restricted, export-controlled, or national-security-sensitive information through general website forms, advertising forms, or social media. Do not send third-party confidential material unless you are authorized to do so and an appropriate transfer method has been agreed.

For confidential technical or commercial documents, contact our relevant team first to arrange suitable access, transfer, and confidentiality terms. You should also have authority to provide any personal data about other individuals included in your submission.

Submitting an enquiry does not by itself establish a new non-disclosure agreement, exclusivity arrangement, or commercial contract. This does not limit any existing confidentiality agreement, intellectual property right, data protection obligation, or other duty imposed by law. Separate written agreements may provide additional protection.

5. Sources of Personal Data

We may collect information directly from you through forms, applications, business communications, meetings, and events; from your organization or an authorized representative; and from platforms through which you submit an enquiry, such as LinkedIn.

We may also receive business contact information from publicly available company websites, professional directories, industry platforms, or professional networking services, where lawful. Website information may be collected automatically through server logs, cookies, analytics tools, and similar technologies as described in Section 10.

Where data is obtained indirectly, we will provide the privacy information required by applicable law. Public availability of contact details does not itself constitute consent to promotional communications.

6. How We Use Personal Data

We use personal data, as relevant, to:

• respond to enquiries, assess project requirements, and prepare or follow up quotations and proposals;
• manage contracts, tendering, procurement, deliveries, and business relationships;
• communicate requested technical or commercial information and arrange meetings;
• operate, secure, maintain, and improve our website and communications;
• measure website and campaign performance and manage lead generation, subject to applicable consent requirements;
• send permitted marketing communications and manage communication preferences;
• assess job applications and administer recruitment;
• prevent fraud, unauthorized access, and misuse; and
• meet legal obligations, maintain necessary records, and establish, exercise, or defend legal rights.

We will not use personal data for an incompatible new purpose unless applicable law permits it. Where necessary, we will provide an additional notice and obtain the required consent before the new use.

7. Legal Bases for Processing

We process personal data only where a lawful basis applies. The basis depends on the purpose and the applicable law:

• Consent: for electronic direct marketing and optional tracking where required, and for other activities that require your specific consent.
• Contractual necessity: where processing is necessary for a contract with you or steps you request before entering into that contract, where recognized by applicable law. A contract with your employer does not automatically make this basis applicable to your personal data.
• Legitimate interests: where permitted, for handling business enquiries, coordinating relationships through organizational contacts, administering recruitment, improving services, and protecting our systems. We must assess necessity and balance those interests against your rights and freedoms. This basis does not replace consent where consent is required.
• Legal obligations and legal rights: where necessary to meet applicable legal duties, comply with lawful orders, or establish, exercise, or defend a legal right.

Where we rely on consent, you may withdraw it using the contact details in Section 22. Withdrawal does not affect processing lawfully carried out before it was withdrawn. We will explain if a separate legal obligation requires us to retain particular records.

8. LinkedIn and Other Lead Forms

When you submit an enquiry through LinkedIn or another advertising platform, we may receive the contact, professional, geographic, and project information shown in that form. We use it to respond to your request, assess requirements, provide relevant information, and follow up the enquiry.

Submitting a lead form or acknowledging this privacy policy does not automatically subscribe you to newsletters or ongoing promotional messages. Where required, we obtain separate consent for those communications. The platform also processes information under its own privacy notice.

9. Direct Marketing and Your Choices

Where we undertake electronic direct marketing, we obtain prior valid consent when required by applicable law. Communications may concern SESCO Steel products, capabilities, technical content, projects, company developments, or events. An enquiry or quotation request is not, by itself, consent to ongoing marketing.

You can opt out at any time, free of charge, using the unsubscribe or opt-out method in the message or by contacting our privacy email. Marketing messages will identify their promotional purpose and the sender, and provide contact and opt-out details. We will stop the relevant marketing when you withdraw consent or object, as required by law.

We may retain the minimum information needed to record your preference and prevent further unwanted marketing. An opt-out does not prevent necessary, non-promotional communications about an active enquiry, contract, or legal matter.

10. Cookies and Similar Technologies

Cookies are small files stored on your device. Cookies, pixels, and similar technologies may be used for website functionality and security, preferences, usage analytics, and advertising or conversion measurement. The tools used determine what information is collected and which providers receive it.

Where consent is required, optional analytics or advertising technologies must remain disabled until that consent is given. Continuing to browse does not by itself provide that consent. If optional tracking is used, information about its providers, purposes, duration, and available consent controls will be provided when you make your choice.

You can change or withdraw optional tracking consent through the controls provided with the relevant consent request, or contact us for help. You can also manage or delete cookies through your browser settings. Blocking essential cookies may affect website functions. Browser settings may not control every type of tracking.

11. Who May Receive Personal Data

We may disclose relevant personal data where necessary and lawful to:

• authorized SESCO Steel personnel and relevant affiliated entities;
• providers of hosting, IT, cloud storage, CRM, website support, communications, analytics, marketing, and security services;
• legal, accounting, audit, insurance, and other professional advisers;
• logistics, engineering, commercial, or project partners where needed to handle an enquiry or deliver an agreed activity;
• competent authorities where disclosure is legally required or otherwise lawfully permitted; and
• parties involved in a proposed or completed business restructuring or transaction, subject to appropriate confidentiality and data protection safeguards.

We limit disclosures to information needed for the relevant purpose. Providers processing data on our behalf must act under appropriate instructions and contractual obligations. Some recipients, including certain platforms and professional advisers, may act as independent controllers for their own lawful purposes.

12. International Data Transfers

Use of overseas providers or international business partners may involve processing, storage, or access outside the country in which information was collected. A provider's location and the places from which its staff access data may both be relevant.

We will make transfers subject to the legal requirements that apply to the data, including any required authorization and safeguards. For personal data covered by Egyptian transfer restrictions, this means the applicable PDPC licence or permit, or a legally available exception. A supplier contract alone does not replace a required regulatory authorization.

Transfer destinations and legal mechanisms: SESCO Steel does not transfer personal data internationally.

You may contact our privacy team for information about the safeguards applicable to your personal data, subject to lawful confidentiality restrictions.

13. Information Security

We seek to protect personal data through technical and organizational measures appropriate to the information and the risks involved. Depending on the system and activity, measures may include access restrictions, authentication controls, secure communications, encryption where appropriate, backups, monitoring, supplier requirements, and incident response procedures.

Access must be limited to authorized people who need the information for their work. No website, electronic transmission, or storage system can be guaranteed completely secure. Please use the agreed secure channel for sensitive submissions and avoid sending unnecessary personal data.

14. Confidentiality of Project Information

Customer, supplier, tender, and engineering information must be handled according to business need, applicable law, and any relevant confidentiality or project agreement. Critical infrastructure, controlled locations, and other sensitive projects may require additional access or transfer controls.

This privacy policy explains the handling of personal data. Project-specific security requirements, NDAs, and commercial terms may impose additional obligations for both personal data and other confidential information. Nothing in this policy reduces those protections.

15. How Long We Retain Data

We retain personal data only for as long as needed for its stated purpose and any applicable legal or record-keeping requirement. Retention is assessed by category rather than applying one period to all information:

• Enquiries and unsuccessful opportunities: time needed to respond, complete relevant follow-up, and address any associated claim or record requirement.
• Customer, supplier, and project records: the relationship and project duration, together with applicable warranty, accounting, audit, regulatory, and claim periods.
• Recruitment records: time needed to complete the process and meet related legal requirements; future-opportunity retention requires the applicable notice and consent where required.
• Marketing records: the permitted marketing purpose, consent and withdrawal evidence, and the minimum suppression record needed to respect an opt-out.
• Website and security records: the period justified by their operational, measurement, or security purpose and relevant legal requirements.

Relevant records may be retained longer where a legal obligation or a specific dispute requires it. When the purpose and any required retention period end, data must be securely deleted or irreversibly anonymized. Where backup copies cannot be removed immediately, they must remain protected and excluded from routine use until removed through the applicable backup cycle.

16. Your Data Protection Rights

Depending on applicable law and your circumstances, you may have rights to receive information about processing, access your data, correct or complete inaccurate or incomplete data, request deletion, withdraw consent, object to processing, or request restriction where available. You may also request information about recipients or transfers and lodge a complaint with the competent authority.

To make a request, contact the privacy email in Section 22 and describe the right you wish to exercise and the interaction concerned. We may request proportionate information to verify your identity or authority to act for someone else. Please do not send identity documents unless requested through an appropriate channel.

We will respond within the period required by applicable law. If a lawful exception limits a request, we will explain the reason and the available complaint route where required. Contacting us first does not prevent you from complaining directly to the competent authority.

17. Recruitment

We use recruitment information to assess applications, communicate with candidates, manage the selection process, and meet related legal requirements. Applicants should supply relevant professional information and avoid unnecessary sensitive personal data.

If information is needed for an additional check, we will explain the purpose and applicable requirements before collecting it. Retaining an application for future vacancies is subject to the required notice and any necessary consent. A separate employee notice may apply after appointment.

18. Privacy of Children

Our general website, project enquiry forms, and marketing communications are intended for business and professional users and are not directed at children. Please do not provide children's personal data through these channels.

If you believe a child has provided personal data inappropriately, contact us so we can assess the matter and take the steps required by applicable law.

19. Third Party Websites and Platforms

Links, embedded services, social networks, maps, and communication platforms may involve third parties processing information under their own privacy notices. Please review those notices before using the service or providing information.

We do not control an independent third party's privacy practices. This does not remove our responsibilities for personal data we collect, disclose, or otherwise process through those services.

20. Security Incidents

If a personal data breach or security incident occurs, we will take appropriate steps to assess it, contain its effects, and address the risks. Where required, we will notify the competent authority and affected individuals within the applicable legal time limits.

Please report a suspected compromise involving information provided to SESCO Steel using the contact details in Section 22. Do not include further sensitive material unless a suitable channel has been agreed.

21. Changes to This Policy

We may update this policy to reflect changes in our activities, technologies, or legal requirements. We will publish the revised policy with its last updated date and provide additional notice or obtain further consent where required. An update does not retrospectively authorize a new use of data that requires separate consent.

22. Contact and Complaints

For privacy questions, rights requests, or concerns, contact:

You may also lodge a complaint with the competent data protection authority. In Egypt, this is the Personal Data Protection Center (PDPC). Its official website is https://www.pdpc.gov.eg/.