Privacy Policy

Tosyali Sulb Steel Industries Joint Company ("Tosyali Sulb", "we", "us" or "our") is a Libyan company developing an iron and steel complex at Al-Lithama, Benghazi, Libya.

We operate the website at www.tosyalisulb.ly and are responsible for the personal data processed through and in connection with the website as described in this Privacy Policy.

This Policy explains:

·  what personal data we collect;

·  why and on what basis we process it;

·  how we use it;

·  who may process it on our behalf;

·  how long we retain it;

·  how we protect it;

·  international handling of personal data; and

·  the rights and choices available to individuals.

This Policy applies to the whole of www.tosyalisulb.ly, including its English and Arabic pages, contact facilities and correspondence sent to the contact details published on the website.

Tosyali Sulb is established in Libya. Our business is internationally oriented and a substantial part of our intended production is directed toward export markets, including European markets.

Accordingly, we seek to operate the website in accordance with appropriate international standards of privacy and data protection. Where the European Union General Data Protection Regulation, the United Kingdom General Data Protection Regulation or another data protection law applies to a particular processing activity, we will comply with the obligations applicable to us under that law.

Where applicable law requires Tosyali Sulb to designate a representative in a particular jurisdiction, the relevant representative's details will be published in this Policy following the required legal appointment.

The contact details for privacy matters are set out in Section 14.

1.1 In Short

·  The website is primarily an informational corporate website.

·  There are no visitor accounts, no online payments and no facility for visitors to publish content.

·  The principal place where a visitor voluntarily provides personal data through the website is the Contact Us form.

·  We do not use contact-form information for advertising or marketing.

·  We do not sell or rent personal data.

·  Analytics operates only after affirmative consent.

·  Visitors can withdraw analytics consent at any time through the Cookie Preferences control available on the website.

·  Analytics records are automatically deleted after 90 days.

·  Contact-form submissions and related correspondence are normally retained for 24 months from the last related correspondence.

·  We do not carry out advertising profiling or automated decision-making about website visitors.

2.1 Information You Provide Through the Contact Form

The Contact Us form currently requests:

·  Name;

·  Email address;

·  Subject; and

·  Message.

The current technical limits are:

·  Name: up to 100 characters;

·  Email: up to 320 characters;

·  Subject: up to 200 characters; and

·  Message: between 10 and 5,000 characters.

These fields are required in order to submit the online form.

You are not legally or contractually required to use the contact form or provide this information. However, if you choose to use the form and do not complete the required fields, the website will not be able to submit your enquiry to us.

The message field is free text. Please provide only information reasonably necessary for us to understand and deal with your enquiry.

2.2 Sensitive Information

The general contact form is not intended for highly sensitive personal information.

Please do not use it to send copies of passports, identity cards, bank cards, passwords, medical records or other documents containing information that we do not reasonably need to answer a general enquiry.

We also do not intentionally request through the general contact form information concerning matters such as health, religious or political beliefs, criminal allegations or other particularly sensitive personal circumstances.

If such information is nevertheless provided to us without being requested, we will restrict its use and access and will process it only to the extent reasonably necessary and permitted by applicable law, including where necessary to address the matter raised, comply with a legal obligation, protect a person's vital interests, or establish, exercise or defend legal rights. Information that is not reasonably required will be deleted or appropriately restricted.

2.3 Information Recorded When a Contact Form Is Submitted

When a contact-form submission is made, the website also records:

·  the Internet Protocol address from which the submission originated; and

·  the date and time of the submission.

This information is used for website security, protection against automated abuse and maintaining an accurate record of when the enquiry was received.

The contact form currently uses technical anti-abuse controls including rate limiting, automated submission detection, link-count checks and minimum-message requirements.

We apply data-minimisation principles to this information and do not use the Internet Protocol address for advertising or profiling.

2.4 Employment Enquiries

The website does not currently operate an online recruitment or applicant-tracking system.

If you contact us through the general contact form or general email address about employment, we treat that communication as an enquiry under this Policy.

Please do not submit passports, identity documents or other unnecessary sensitive documents through the general contact form.

If Tosyali Sulb introduces an online recruitment or application system in the future, an appropriate Applicant and Recruitment Privacy Notice will be provided before that system is used to collect applicant information.

Please also see our Recruitment and Fraud Warning.

2.5 Email and Telephone Correspondence

If you contact us through an email address or telephone number published on the website, we may retain a record of that correspondence, including:

·  your name;

·  your email address or telephone number;

·  the information you provide to us; and

·  our communications with you.

We use this information to deal with the matter you have raised and maintain an appropriate record of the correspondence.

2.6 Information Collected When You Browse

If you give consent to analytics, we collect the limited analytics information described in Section 4.

If you do not give consent, or if you withdraw it, optional analytics does not operate.

Separately, website hosting and infrastructure systems may generate technical server and security logs, which can include Internet Protocol addresses and other technical request information necessary for security, service delivery and system operation.

Depending on the circumstances and applicable law, we process website personal data for the following purposes.

Responding to Enquiries

We use contact details and correspondence to receive, assess and answer communications sent to us.

Where applicable data protection law requires a legal basis, this will generally be our legitimate interests in operating our business and responding to communications directed to us.

Where a person asks us to take specific steps with a view to entering into a contract, the processing may instead be necessary to take steps at that person's request before entering into a contract.

Record Keeping and Legal Protection

We may retain appropriate records of correspondence to administer our business, demonstrate what communications occurred, comply with legal obligations and establish, exercise or defend legal rights.

Website Security and Abuse Prevention

We process limited technical information where reasonably necessary to protect the website, prevent spam and automated abuse, enforce rate limits, investigate security incidents and maintain the security and availability of our systems.

Analytics

Optional analytics is used to understand how the website is used and how it performs so that we can improve it.

Analytics operates only on the basis of the visitor's consent.

Compliance With Law

We may process or disclose personal data where necessary to comply with a legal obligation, binding regulatory requirement, court order or other lawful requirement applicable to us.

No Marketing or Profiling

Personal data collected through the website contact form is not used to place visitors on a marketing mailing list.

We do not sell or rent personal data.

We do not use website personal data for behavioural advertising.

We do not make decisions producing legal or similarly significant effects about website visitors solely by automated means.

Our use of cookies and similar browser-storage technologies is explained in detail in the Cookie Policy.

The website uses strictly necessary technologies required for website functionality and consent management. Optional analytics-related technologies operate only after a visitor provides affirmative consent.

The consent banner provides a genuine choice between accepting and rejecting optional analytics.

Before a visitor provides consent, optional analytics does not operate.

4.1 Analytics Information

Subject to final technical confirmation, the limited analytics system records information such as:

·  page-view or website-performance event type;

·  the path of the page viewed, without a query string;

·  referring website, where available;

·  a temporary session identifier;

·  country at a broad two-letter country-code level;

·  device category;

·  browser family;

·  date and time; and

·  website-performance measurements.

Analytics does not intentionally store:

·  your name;

·  your email address;

·  your Internet Protocol address;

·  precise geographical location;

·  advertising identifiers;

·  cross-site identifiers;

·  device fingerprints; or

·  information for behavioural advertising.

Analytics records are automatically deleted after 90 days.

4.2 Withdrawing or Changing Analytics Consent

You may change or withdraw analytics consent at any time by selecting Cookie Preferences from the website footer.

It must be as straightforward to withdraw optional analytics consent as it is to provide it.

Once consent is withdrawn:

·  optional analytics stops for future activity unless consent is subsequently provided again;

·  no new optional analytics information will be recorded for that visitor while consent remains withdrawn; and

·  withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

Existing analytics records remain subject to the 90-day automatic deletion period unless earlier deletion is required by applicable law.

Where technically supported as stated in our Cookie Policy, browser privacy signals such as Global Privacy Control and Do Not Track may also prevent optional analytics from operating.

We do not sell, rent or trade personal data.

We do not currently use advertising partners or third-party behavioural advertising services on the website.

We use specialist technology providers to operate the website and related communications.

The current website architecture includes services provided by:

·  Vercel – website hosting and content delivery;

·  Supabase – database and related backend services; and

·  Resend – delivery of contact-form notification emails.

The exact legal contracting entities, processing locations, sub-processors and contractual safeguards applicable to these services are maintained and reviewed by Tosyali Sulb and are subject to Legal Department approval.

We require service providers processing personal data on our behalf to process it only for authorised purposes and subject to appropriate contractual, confidentiality and security obligations.

We may also disclose personal data:

·  where required by applicable law;

·  pursuant to a binding order of a competent court or authority;

·  where reasonably necessary to establish, exercise or defend legal rights;

·  in connection with investigating fraud, cyber incidents or unlawful activity; or

·  where otherwise permitted or required by applicable law.

Except for disclosures of this nature, we do not intentionally disclose website personal data to unrelated third parties for their own marketing or advertising purposes.

Tosyali Sulb is established in Libya and uses service providers that operate international infrastructure.

As a result, personal data connected with the website may be processed or stored in countries other than the country in which the visitor is located.

Where applicable data protection law imposes requirements on an international transfer of personal data, we will use an appropriate lawful transfer mechanism and safeguards as required by that law.

Depending on the relevant provider, jurisdiction and applicable law, safeguards may include contractual protections, approved standard contractual clauses or another legally recognised transfer mechanism.

The precise transfer mechanism relied upon for each provider will be maintained under legal review.

You may contact privacy@tosyalisulb.ly if you would like further information concerning the safeguards applicable to an international transfer of your personal data and, where applicable, information about how to obtain a copy of those safeguards.

7.1 Contact Enquiries

Contact-form submissions and related correspondence are normally retained for 24 months from the date of the last related correspondence.

This period applies, so far as reasonably practicable, to copies retained in:

·  the website database;

·  associated contact-form notification emails; and

·  related correspondence concerning the same enquiry.

Information may be retained for longer where reasonably necessary or required:

·  to comply with a legal obligation;

·  for litigation or anticipated litigation;

·  for an investigation;

·  to establish, exercise or defend legal rights;

·  pursuant to a lawful regulatory or governmental requirement; or

·  where another applicable retention obligation requires it.

Where such a reason applies, deletion will take place when that reason no longer requires continued retention.

7.2 Analytics

Analytics records are automatically deleted after 90 days.

7.3 Storage-Limitation Principle

We periodically review retention arrangements and seek not to retain identifiable personal data for longer than reasonably necessary for the purposes for which it is processed, subject to applicable legal requirements.

We use technical and organisational measures designed to protect personal data against unauthorised or unlawful access, disclosure, alteration, loss or destruction.

Subject to final technical confirmation of the production environment, these measures include:

·  encrypted HTTPS connections;

·  authentication and restricted access to website administration systems;

·  access controls for systems containing personal data;

·  rate limiting and anti-abuse measures;

·  website security headers and content-security controls;

·  appropriate service-provider security arrangements; and

·  retention and deletion controls.

Access to personal data should be limited to personnel and service providers who reasonably require access for an authorised purpose.

No internet transmission or electronic-storage method can be guaranteed to be completely secure. Users should therefore avoid sending unnecessary sensitive information through general website forms or ordinary email.

8.1 Security Incidents

If a personal-data security incident occurs, we will investigate it, take appropriate steps to contain and remediate it, and make any notifications to affected individuals or competent authorities required by applicable law within the applicable legal time limits.

If you believe you have identified a security issue affecting the website, please contact us using the details in Section 14.

As a matter of company policy, and subject to applicable legal limitations and exemptions, Tosyali Sulb permits individuals to contact us concerning personal data we hold about them.

Depending on the circumstances and the law that applies, your rights may include:

·  access to personal data we hold about you;

·  correction of inaccurate or incomplete personal data;

·  deletion of personal data;

·  restriction of processing;

·  objection to processing;

·  withdrawal of consent;

·  data portability where applicable; and

·  the right to complain to a competent supervisory authority or court where applicable law provides that right.

Important – Right to Object

Where we rely on legitimate interests to process your personal data, you may have the right to object to that processing. You may submit an objection by writing to privacy@tosyalisulb.ly

Withdrawal of Consent

Where processing is based on consent, you may withdraw that consent at any time.

For optional website analytics, consent can be withdrawn through Cookie Preferences in the website footer.

Withdrawal does not affect the lawfulness of processing that took place before consent was withdrawn.

Exercising Your Rights

To exercise a privacy right or make a privacy enquiry, contact:

privacy@tosyalisulb.ly

We aim to respond within 30 days.

We may ask for information reasonably necessary to verify your identity before releasing, deleting or changing personal data. This is intended to prevent information being disclosed or changed at the request of an unauthorised person.

Some rights are subject to legal conditions and exceptions. For example, we may be required to retain particular information despite a deletion request where retention is necessary to comply with law or establish, exercise or defend legal rights.

If the European Union General Data Protection Regulation or another applicable law gives you a right to complain to a supervisory authority, nothing in this Policy limits that right.

The website is intended primarily for adults, businesses, professionals, authorities, jobseekers and members of the public interested in Tosyali Sulb and its project.

It is not designed or directed specifically at children.

Persons under 18 should not submit personal data through the contact form without the involvement of a parent or guardian.

We do not knowingly seek personal information from children through the website.

If a parent or guardian believes that a child has submitted unnecessary personal information to us, they may contact privacy@tosyalisulb.ly and we will review the matter and take appropriate action.

The general contact form is not intended to operate as a formal recruitment or whistleblowing platform.

Employment enquiries submitted through the general website are handled as correspondence under this Policy.

Suspected fraud or misconduct should be reported through the contact channel identified in our Recruitment and Fraud Warning.

Where a report includes personal data relating to the reporter or another individual, we will restrict access to the information and use it only as reasonably necessary to receive, assess, investigate, escalate or otherwise appropriately address the matter, subject to applicable law.

If Tosyali Sulb introduces a dedicated recruitment platform, whistleblowing platform or other system involving materially different processing, an appropriate additional privacy notice will be provided.

Our website may contain links to websites operated by third parties.

We are not responsible for the privacy practices of an independent third-party website merely because we link to it. Visitors should review the privacy information published by the relevant third party.

If Tosyali Sulb introduces new functionality involving additional processing of personal data – including third-party analytics, advertising technologies, newsletter subscriptions, social-media plug-ins, embedded maps, embedded videos or recruitment functionality – we will assess the privacy implications and update the relevant privacy and cookie information before activating the service where required.

We may update this Privacy Policy where necessary, including where:

·  website functionality changes;

·  processing purposes change;

·  service providers change;

·  legal or regulatory requirements change; or

·  additional privacy safeguards or user controls are introduced.

The version number and effective date at the top of this Policy identify the version currently in force.

Where a proposed change materially affects how personal data is processed, we will take any additional transparency or consent steps required by applicable law before the relevant change takes effect.

For questions about this Privacy Policy or the processing of personal data connected with the website, please contact:

Tosyali Sulb Steel Industries Joint Company
Al-Lithama, Benghazi, Libya

Telephone: +218 93 000 5002
General enquiries: info@tosyalisulb.ly
Privacy and data protection: privacy@tosyalisulb.ly
Website: www.tosyalisulb.ly

Where applicable law requires the appointment of a representative or other designated privacy contact in another jurisdiction, the relevant details will be added to this section following formal appointment.

This Policy is published in English and Arabic.

The two versions should be maintained so that they communicate the same substantive privacy terms.

Where a legally binding prevailing-language rule is required, it will be determined in accordance with the applicable law and the company's approved legal position.

Related Website Documents

This Privacy Policy should be read together with:

·  Cookie Policy;

·  Terms of Use;

·  Legal Notice;

·  Disclaimer and Forward-Looking Statements;

·  Accessibility Statement; and

·  Recruitment and Fraud Warning.