PRIVACY POLICY

Last updated: August 2026

This privacy notice explains how we process the personal data of visitors to www.cesarmour.co.uk and of the individuals who contact us. We process personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025. The controller of your personal data is:

Controller	:	C.E.S. İleri Kompozit ve Savunma Teknolojileri Sanayi ve Ticaret A.Ş. ("CES Advanced Composites & Defence Technologies Inc.")
Address	:	Malıköy Anadolu OSB 12. Cadde No:20, 06909 Sincan – Ankara / Türkiye
Phone	:	+90 312 384 8000
E-mail	:	info@ces.com.tr
Registered Electronic Mail (KEP)	:	cesilerikompozit@hs03.kep.tr
UK Representative (Article 27 UK GDPR)	:	Onur Gürsoy — contact via info@ces.com.tr (please mark your message "FAO UK Representative")

The controller is established in Türkiye. As a Turkish company, we are also subject to the Turkish Law on the Protection of Personal Data No. 6698 (KVKK, as amended by Law No. 7499) in respect of our processing activities carried out in Türkiye.

What personal data we collect

Depending on how you interact with us, we may collect:

Identity and contact data: name, surname, job title, company, postal address, telephone number and e-mail address, for example when you contact us through the website or by e-mail.

Business and transaction data: correspondence, enquiry and order details, invoicing and delivery information relating to our commercial relationship with you or your organisation.

Technical and website usage data: IP address, browser and device information, pages visited and similar log data generated when you use our website, and — only with your consent — analytics data collected through cookies (see our Cookie Policy).

Recruitment data: information you provide when you apply for a position with us (see our Clarification Text for Job Candidates).

We do not knowingly collect special category data through this website and ask you not to submit such data to us unless we request it.

Purposes of processing and lawful bases

We process your personal data for the following purposes, relying on the lawful bases set out in Article 6(1) UK GDPR:

Responding to enquiries and managing pre-contractual steps and contracts with you or your organisation — Article 6(1)(b) (performance of a contract) and Article 6(1)(f) (our legitimate interest in running our business and communicating with business contacts);

Operating, securing and improving our website and IT systems, and preventing fraud and security threats — Article 6(1)(f) (legitimate interests);

Placing non-essential cookies and measuring website audience through analytics — Article 6(1)(a) (your consent), which you may withdraw at any time;

Complying with legal obligations that apply to us, including export-control, accounting, tax and record-keeping requirements — Article 6(1)(c) (legal obligation);

Establishing, exercising or defending legal claims — Article 6(1)(f) (legitimate interests).

Where we rely on legitimate interests, we have balanced those interests against your rights and freedoms and concluded that they are not overridden; you may object at any time (see "Your rights" below).

Recipients of your personal data

We do not sell your personal data. We share personal data only where necessary with: service providers acting on our instructions (such as IT, hosting, e-mail and website analytics providers); professional advisers (lawyers, auditors, consultants); banks and insurers; logistics providers; other companies of our group for internal administrative purposes; and courts, regulators and public authorities where the law requires or permits it. Our service providers are bound by contract to protect the personal data they receive from us and may not use it for their own purposes.

International transfers

Personal data collected through this website is processed by the controller in Türkiye. Türkiye is not covered by UK adequacy regulations, so transfers of your personal data from the United Kingdom to Türkiye are made subject to appropriate safeguards: the ICO's International Data Transfer Agreement (IDTA), or the EU Standard Contractual Clauses together with the UK International Data Transfer Addendum, supported by the statutory "data protection test" transfer risk assessment required under the Data (Use and Access) Act 2025 (in force 5 February 2026). Within Türkiye, your data is additionally protected under the Turkish Law on the Protection of Personal Data No. 6698, as amended by Law No. 7499. You may contact us using the details above for further information on the safeguards applied.

Retention

We keep personal data only for as long as necessary for the purposes described above: correspondence and enquiry data for the duration of our exchange and a reasonable period thereafter; contractual and invoicing records for the retention periods required by the commercial and tax legislation applicable to us; website log data for a short security-retention period; and analytics cookie data for the lifetimes stated in our Cookie Policy. When the applicable period expires, the data is deleted, destroyed or anonymised.

Security

We apply appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse, disclosure or alteration, including access controls, encryption in transit, network security measures and staff confidentiality obligations, in line with recognised information-security standards.

Your rights and complaints

Under the UK GDPR you have the right to:
• access the personal data we hold about you;
• have inaccurate data rectified and incomplete data completed;
• have your data erased in the circumstances provided by law;
• restrict the processing of your data;
• object to processing based on our legitimate interests;
• receive the data you provided to us in a portable format (data portability);
• withdraw your consent at any time where processing is based on consent, without affecting the lawfulness of processing before withdrawal.

To exercise any of these rights, contact us at info@ces.com.tr or by post at the address above. We will respond within one month of receiving your request; this period may be extended by two further months for complex or numerous requests, in which case we will inform you.

If you are dissatisfied with how we have handled your personal data, you may complain directly to us using the contact details above. In line with section 164A of the Data Protection Act 2018 (in force 19 June 2026), we will acknowledge your complaint within 30 days and inform you of the outcome without undue delay. You also have the right to lodge a complaint at any time with the UK supervisory authority, the Information Commissioner's Office (ICO): ico.org.uk.

How to contact us

For any question about this privacy notice or about how we process your personal data, you can reach us:
• by e-mail: info@ces.com.tr
• by post: C.E.S. İleri Kompozit ve Savunma Teknolojileri Sanayi ve Ticaret A.Ş., Malıköy Anadolu OSB 12. Cadde No:20, 06909 Sincan – Ankara / Türkiye
• by phone: +90 312 384 8000
• by registered electronic mail (KEP): cesilerikompozit@hs03.kep.tr
• our UK representative under Article 27 UK GDPR, Onur Gürsoy, can be reached via info@ces.com.tr (mark your message "FAO UK Representative")

We may update this notice from time to time; the "Last updated" date at the top shows when it was last revised.