How we use your data

Who processes the data

The controller of your personal data is GSMvalve OÜ (registry code 11181045, VAT no. EE101037422), Tähetorni tn 23, 11625 Tallinn. For data protection questions, write to info@gsmvalve.ee.

This policy applies to the website valve.ee and to all requests, orders and contracts that reach us through it.

What data we collect and why

We only collect the data we need to answer your request, install the kit and provide the service. The table below shows what, why and on what legal basis.

We don’t collect special categories of personal data, make automated decisions or profile you. The alarm sensors don’t record sound or continuous video; the motion sensor with camera only sends a series of photos when the alarm goes off, and only to your own phone.

Your name, contact details and installation address are needed so we can contact you, fulfil the order and install the system. Without them we cannot answer your request or provide the service. The other fields are optional.

Where the data comes from

The data comes from you: from the website forms (call-back request, order, “Build your own” and the withdrawal form), from e-mails and during the technician’s visit. If you use the app, device events (armed, disarmed, alarm) are created as you use the system.

Who we share data with

Only the GSMvalve staff who handle your request or your system see the data. We also use processors who handle data on our behalf and on our instructions:

• Web hosting and e-mail: the website servers and the e-mail service through which forms reach us.
• Hikvision (Hik-Connect): the alarm hub and app use Hikvision’s cloud service so that alarms reach your phone. Hikvision processes device and app data under its privacy policy.
• Patrol partner: only if you have ordered a call-out service; we pass on the site address and contact person.
• Accounting and payment services: to process invoices and payments.
• Google (reCAPTCHA): spam protection on pages with forms; see “Cookies and website technology”.
• Google (Analytics): visit statistics, only with your consent.
• Google (Maps): the map on the contact page, only after you press “Show map”.
• Spline: the 3D view on the home page loads from Spline’s server, which sees your IP address.
• Maa- ja Ruumiamet (In-ADS): when you type an address in the order form, the site suggests addresses from the Estonian national address register; the service sees the part of the address you typed and your IP address.

If an invoice under the contract is not paid, we may pass your name, personal identification code, the amount of the debt and the start and end dates of the payment default to Creditinfo Eesti AS, which enters them in the payment default register and may use them for credit decisions (creditinfo.ee), and to a debt collection agency to collect the debt. These companies process the data as independent controllers.

We never sell or rent your data to anyone. We only pass data to public authorities where the law requires it.

Youform, e-mail or technician visit

GSMvalveonly those handling your request

Processorshosting and e-mail · Hik-Connect · accounting · Google (reCAPTCHA on forms, Analytics with consent, map on click) · Spline · patrol only if ordered

Advertisersnothing is passed on

Data outside the European Union

Google may also process data outside the European Economic Area, mainly in the USA. Google takes part in the EU–US Data Privacy Framework, which the European Commission has recognised as adequate. Hikvision and Spline may also use servers outside the EEA. In that case the transfer takes place only on the basis of the European Commission’s safeguards (an adequacy decision or standard contractual clauses). For more details, write to info@gsmvalve.ee.

How long we keep data

Server logs30 days

Requests that don’t lead to a contract12 months

System event log12 months

Customer datawhile you are a customer + 3 years

Invoices and accounting7 years (law)

• Requests and call-backs that don’t lead to a contract: up to 12 months from receiving the request, then deleted.
• Customer data: for as long as you are our customer, so we can contact you about faults or errors, and 3 years after the contract ends (limitation period for claims).
• Invoices and accounting records: 7 years under the Accounting Act.
• System event log (arm, disarm, alarms): 12 months, to resolve disputes and find the causes of alarms.

Cookies and website technology

0advertising cookies

1analytics (Google Analytics) only with consent

1third-party script on forms: Google reCAPTCHA

3your own choices: buy or rent, contrast, cookies

valve.ee does not use advertising cookies. Google Analytics cookies start only when you press “Accept” on the cookie bar. If you press “Decline”, Google Analytics does not start. You can change your choice at any time with the “Cookie settings” link in the page footer.

The site also stores your own choices in your browser: whether you want to see prices for buying or renting, whether higher contrast is on and what you chose on the cookie bar. They cannot identify you and are not passed to anyone.

The map on the contact page loads from Google Maps only after you press “Show map”. The 3D view on the home page loads from Spline’s server.

We use two checks against form spam: an invisible honeypot field that collects no data, and a Google reCAPTCHA check (“I’m not a robot”) on pages with forms. reCAPTCHA loads a Google script and may store a Google cookie in your browser; Google then processes your IP address and browser data under its privacy policy . The legal basis is our legitimate interest in protecting the forms from spam.

Your rights

You have the right at any time to:

Accessget a copy of the data we hold about you

Correctwrong or incomplete data

Deleteif the data is no longer needed

Restrictor object

Portin a machine-readable format

Withdraw consentat any time, with one e-mail

• access the data we hold about you and get a copy;
• correct wrong or incomplete data;
• ask for deletion if the data is no longer needed or the processing is unlawful;
• restrict processing or object to processing based on legitimate interest;
• ask for data portability: get the data you provided in a machine-readable format;
• withdraw consent where processing is based on consent; this does not affect the lawfulness of earlier processing.

To use your rights, write to info@gsmvalve.ee. We reply within one month. If you think we have processed your data incorrectly, you have the right to turn to the Data Protection Inspectorate (Tatari 39, 10134 Tallinn, info@aki.ee).

How we protect data

The website runs over an encrypted connection (HTTPS), form contents reach us encrypted, and only staff who need the data for their work can access it. The connection between the alarm hub and the app is encrypted. In case of a data breach we notify you and the Data Protection Inspectorate as the law requires.

Changes to this policy

We may update these terms if the service or the law changes. The current version is always on this page; we tell customers about important changes by e-mail. Last updated: 8 October 2026.