Privacy Policy

Steel International Trading Company LLC ("SITC", "we"), 150 D. Agmashenebeli Avenue, Tbilisi, Georgia, decides how the personal data described here is used. For anything about this policy, or to exercise the rights in section 9, write to kyc@sitc.ge.

If you only browse sitc.ge: anonymised analytics through Google Analytics 4, and only after you accept cookies. If you write to us through the contact form: your name, company, e-mail and message. If you complete the Know Your Client questionnaire, we collect considerably more, because the law requires us to identify the companies we trade with: • about the company — name, legal form, identification and tax numbers, registered address, date and country of incorporation, activity, contact details, countries of operation; • about its directors, representatives and beneficial owners — full name, citizenship, date of birth, personal number, identity-document number, home and registered address, position and shareholding; • the sanctions declaration you make about OFAC, UN and EU lists; • the signed copy of the questionnaire you upload; • technical records — the IP address and time of submission, kept to show when and from where a declaration was made.

Questionnaire data is collected to meet our obligations under Georgian anti-money-laundering law and international sanctions rules, and to enter into and perform a contract with your company. Providing it is not optional: without it we cannot begin a business relationship. Analytics are collected only with your consent, which you may withdraw at any time. Contact-form messages are processed to answer you.

One essential cookie remembers your cookie choice. If you accept analytics, Google Analytics adds _ga, _ga_* and _gid to count unique visitors. Nothing else. You can change your choice at any time through "Cookie preferences" in the footer.

Analytics: 2 months. Contact-form messages: until we have answered you, then deleted. Questionnaire data and the signed copy: for the length of our business relationship and then for the period Georgian anti-money-laundering law requires records to be kept — 5 years after the relationship ends — after which they are deleted. We keep them for that period even if you ask us to delete them sooner, because the law obliges us to.

Microsoft Ireland Operations Ltd hosts the mailbox that receives questionnaires. Hetzner Online GmbH (Germany) hosts the website, the database and the encrypted backups. Google LLC processes analytics, and Web3Forms relays contact-form messages. We disclose questionnaire data to the Financial Monitoring Service of Georgia, tax authorities, banks or auditors where the law requires or permits it. We never sell or rent personal data, and we do not use it for advertising.

The website, the database and the backups are in Germany. E-mail is in the European Union. Our staff access the data from Georgia, which is outside the European Economic Area. Where that involves personal data of people in the EEA, the transfer is necessary for entering into or performing our contract with your company.

The site is served only over an encrypted connection. Personal numbers, identity-document numbers and dates of birth are additionally encrypted in the database, so they are unreadable in a stolen copy of it. Signed documents are stored privately and are never publicly reachable. Only authorised SITC staff can open the review panel, and only with a password and a one-time code from their phone. Every time an application is viewed, exported or a signed document downloaded, we record who did it and when. Backups are encrypted before they leave our server.

You may ask us for a copy of the data we hold about you, to correct it if it is wrong, to delete it, to restrict or object to its use, or to receive it in a portable form. Where you gave consent — for analytics — you can withdraw it at any time. Deletion is limited by section 5: while the anti-money-laundering retention period runs, we must keep questionnaire data even if you ask us to erase it. We answer requests within one month. Write to kyc@sitc.ge. If you believe we have handled your data wrongly, you can complain to the Personal Data Protection Service of Georgia (personaldata.ge), or to the data-protection authority where you live.

We do not make any decision about you by automated means alone, and we do not profile you. A person at SITC reviews every questionnaire.

If we change how we handle personal data we will update this page and the date above. If the change is significant and affects people who have already submitted a questionnaire, we will tell them by e-mail.