Privacy
What we collect, why, and how long we keep it.
ESM is established in Tunisia and works for European customers, so two regimes apply at once: Tunisian Organic Law No. 2004-63 on the protection of personal data and, because we address the European market, the EU General Data Protection Regulation (GDPR). Neither exempts us from the other. This page covers both.
Controller
ESM — Engineering Solution and Machining, Industrial Building No. 4, Cité El Mzoughi, ZI Bir El Kassaâ, 2059 Ben Arous, Tunisia.
Contact
contact@esm.com.tn, +216 70 168 600, or by post to our registered office.
Authority
In Tunisia, the INPDP (Instance Nationale de Protection des Données Personnelles). In the European Union, the supervisory authority of your country.
What we collect
One purpose per form, nothing else
| Form | Data | Purpose and legal basis | Retention |
|---|---|---|---|
| Request for quotation | Company, country, name, function, professional e-mail, phone, part and project data, technical files, comments. | Answering your enquiry and preparing a possible contract. Law 2004-63: your consent, given by ticking the box in the form. GDPR: pre-contractual measures (Art. 6(1)(b)) and legitimate interest in business correspondence (Art. 6(1)(f)). | 3 years after the last contact, then deletion. If an order follows: the duration of the contract, then the legal archiving periods. |
| Contact | Name, company, professional e-mail, phone, subject, message. | Routing your request to the right department and answering it. Law 2004-63: your consent, given in the form. GDPR: legitimate interest (Art. 6(1)(f)). | 2 years after the last exchange. |
| Job application | Name, e-mail, phone, function and position sought, qualification, experience, availability, current situation, city of residence, LinkedIn profile if you give it, CV, message. | Handling your application and, if it matches a need, arranging interviews. Law 2004-63: your consent, given in the form. GDPR: steps taken at your request before a contract (Art. 6(1)(b)). | 2 years after the last contact, deleted earlier on request. If you are hired, the file moves to your personnel record. |
| Internship and placement | Name, e-mail, phone, school, type of placement, hosting function, diploma, year and specialisation, period sought, city of residence, CV, proposed subject. | Handling your request with the tutoring functions. Same legal bases as a job application. | 2 years after the last contact, deleted earlier on request. |
| Supplier application | Company, country, name, professional e-mail, phone, what you supply, certifications, capabilities, documents you attach. | Assessing your company as a potential supplier. Law 2004-63: your consent, given in the form. GDPR: legitimate interest (Art. 6(1)(f)). | 3 years after the last contact, or the duration of the business relationship. |
| Supplier invoice submission | Company, e-mail, purchase order and invoice numbers, invoice. | Receiving, checking and paying your invoice. Performance of the purchase contract and our accounting obligations (GDPR Art. 6(1)(b) and (c)). | The periods set by Tunisian accounting and tax law. |
| Appointment booking | Name, e-mail, phone, company, subject or purpose of the meeting, number of participants, chosen time slot. | Organising and preparing the call or visit you booked. Law 2004-63: your request and consent, given when you book. GDPR: pre-contractual measures (Art. 6(1)(b)). | 3 years after the last contact. |
| Customer portal | Name, professional e-mail, company, connection history. | Giving named users of a customer under contract access to their quotations, orders and documents. Performance of the contract (GDPR Art. 6(1)(b)). | Duration of the contract; the account is closed when it ends. |
Fields marked with an asterisk are required to handle your request: without them we cannot answer it. All other fields are optional. We never ask for sensitive data — health, religion, opinions, criminal record — so please leave it out of free-text fields and CVs. Our forms are intended for adults: if you are under 18, ask a parent or guardian to contact us first.
Technical files attached to a quotation request are treated as customer confidential from the moment they arrive: stored in the quotation file, accessible only to the people handling it, never forwarded to a partner without your written agreement, and returned or destroyed at your request. If your own policy forbids transfer through a web form, tick the NDA box and send nothing — we will agree a channel with you first.
Browsing the site
Statistics, cookies and technical logs
Audience measurement. We count visits, pages viewed, referring sites, countries and device types with the cookieless tool built into Odoo (Plausible Analytics technology, operated by Odoo S.A.). It sets no cookie, stores no IP address and uses no persistent identifier: it produces aggregate statistics only, used to improve the site.
Cookies. Only the cookies strictly necessary for the site to work are set without your consent: session, language, time zone and the record of your cookie choice. Campaign cookies are set only if you choose “Allow all cookies”. The list, purposes and durations are in our cookie policy, and the “Cookies” link at the bottom of every page lets you change your choice at any time.
Technical logs. Like any web server, our host records technical logs — IP address, date and time, page requested — to secure and operate the service. They are kept for a limited period and used for no other purpose.
Where the data goes
Recipients and transfers
Form submissions land in our ERP and CRM, provided and hosted by Odoo S.A. (Belgium), which processes them on our behalf. Access is limited to the ESM staff whose job requires it: sales administration, engineering, quality, purchasing, finance or human resources, depending on the form.
We do not sell, rent or share personal data with third parties for marketing, and we use no advertising tracker and no social-network pixel. Personal data is disclosed to a third party only with your consent or when the law requires it.
Transfers. Our ERP is hosted in Odoo S.A. data centres outside Tunisia. Transfers of personal data out of Tunisia are subject to the prior authorisation of the INPDP under Articles 50 to 52 of Law 2004-63. Tunisia does not benefit from a European adequacy decision: any flow of personal data from the European Union to ESM therefore requires appropriate safeguards, such as the European Commission’s standard contractual clauses.
Security
How the data is protected
Forms are sent over HTTPS only. In the ERP, access rights follow each user’s function, and quotation files and applications are visible only to the people handling them. Our host applies its own security measures to the infrastructure. A security incident affecting personal data is handled under our information security process and, where the law requires it, notified to the competent authority and to the people concerned.
The organisational and technical measures, including those protecting customer technical data, are described on our information security page.
Your rights
And how to exercise them
Under Tunisian Law 2004-63: access to your data (Art. 32); rectification, completion, update or deletion of inaccurate data (Art. 40); objection at any time on legitimate grounds, and objection to any disclosure for promotional purposes (Art. 42); withdrawal of your consent.
Under the GDPR, where it applies: access, rectification, erasure, restriction, portability, objection, and withdrawal of consent at any time without affecting what was done before. We take no decision based solely on automated processing and do no profiling.
Write to contact@esm.com.tn stating your request; we may ask you to prove your identity. We answer within one month. You may also lodge a complaint with the INPDP in Tunisia or, if you are in the European Union, with your national supervisory authority.
Document control
Version and review
| Version | Date | Change |
|---|---|---|
| 1.1 | 7 October 2026 | Cookies and audience measurement aligned with the cookie policy; job application, supplier, invoice, appointment and customer portal processing added; legal bases under Law 2004-63; security section; mandatory fields. |
| 1.0 | 19 September 2026 | First issue. |
Owner: ESM management. Reviewed at least once a year and before any new form or processing is put online. The French version prevails in case of discrepancy.
