Privacy policy

Valve Branding Oy (trading as Valve One), Business ID: 1884268-7

Last updated: June 15, 2026, Version: 2.0

This privacy policy explains how Valve Branding Oy, operating the Valve One business and website at valveone.com ("Valve One", "Valve", "we", "us"), processes personal data relating to website visitors, customers, potential customers, business partners, event participants, newsletter subscribers, job applicants, freelancers and other persons who interact with us.

We process personal data in accordance with the EU General Data Protection Regulation ("GDPR"), applicable Finnish data protection legislation, the Finnish Act on Electronic Communications Services, and applicable rules on cookies and electronic communications.

Our website and services are intended for business users and are not directed at children.

1. Who this policy applies to

This policy applies to personal data relating to:

• visitors to valveone.com and our other digital channels;
• representatives and contact persons of our customers, potential customers, suppliers and business partners;
• people who contact us, book meetings, request proposals or otherwise communicate with us;
• newsletter subscribers and recipients of marketing communications;
• participants in events, webinars, campaigns or similar activities;
• job applicants, freelance applicants and other recruitment-related contacts;
• users of our services, platforms, forms, and other digital tools.

Where we process personal data on behalf of our customers as a processor, the customer's own privacy notice normally applies. In those cases, we process personal data under the relevant customer agreement and data processing agreement.

2. What personal data we collect

2.1. Contact and identification data

• first and last name;
• email address;
• phone number;
• company or organisation;
• job title or role;
• business address or other professional contact details;
• social media profile or username where relevant, such as LinkedIn or X/Twitter profile information.

2.2. Customer, prospect and business relationship data

• information about your employer, organisation or business area;
• information about your interests in our services;
• meeting, sales, proposal and contract-related information;
• customer relationship history;
• event, webinar or campaign participation;
• marketing preferences, consents and opt-outs;
• feedback, survey responses, and similar business interaction data.

2.3. Communication data

• messages you send to us;
• records of communications with you;
• metadata such as time, channel and recipient of communications;
• information about whether marketing emails have been delivered, opened, or clicked.

2.4. Website, device and online behaviour data

• IP address;
• device and browser information;
• approximate location derived from technical identifiers;
• website usage data, such as pages visited, time spent, links clicked and referral source;
• cookie identifiers and similar online identifiers;
• information collected through analytics, marketing automation, and similar technologies (see Section 6).

2.5. Recruitment and freelance application data

Where you apply for a role, freelance collaboration or open position, we may process:

• contact details;
• CV, portfolio, LinkedIn profile or other application materials;
• work history, education, skills and experience;
• salary expectations or availability where provided;
• interview notes and recruitment communications;
• references, where you provide them or authorise us to contact them.

Please do not provide sensitive personal data, such as health data, political opinions, religious beliefs or national identification numbers, unless specifically requested and necessary for the relevant process.

Where required, we process recruitment-related personal data in accordance with the Act on the Protection of Privacy in Working Life (759/2004) in addition to GDPR obligations.

3. Where we collect personal data from

We collect personal data from:

• you directly, for example when you contact us, complete a form, subscribe to a newsletter, book a meeting or apply for a position;
• your employer, colleagues or other business contacts;
• our customers, partners and event organisers;
• public sources, such as company websites, business registers, LinkedIn and other professional sources;
• website and marketing technologies, including cookies and analytics tools (see Section 6);
• CRM, marketing automation, and communication systems used by us.

4. Why we process personal data and our legal bases

Legitimate interests: Our legitimate interests include developing and marketing our services, managing customer and business relationships, maintaining secure and effective systems, understanding business customer needs, and protecting our legal rights. We balance these interests against the rights and freedoms of the individuals concerned. You can object to processing based on legitimate interests at any time, as described in Section 14.

Where we rely on legitimate interests, we assess and document the relevant interest, its necessity, and the balancing of our interests against your rights and freedoms. You may contact us at privacy@valve.fi for more information about the balancing assessment relevant to your situation.

5. Direct marketing

We may send direct marketing to business contacts where communication is relevant to the person's professional role or organisation. We may also send newsletters, event invitations, and updates where you have subscribed or where otherwise permitted by law.

The Finnish Act on Electronic Communications Services, which implements the EU ePrivacy framework in Finland, applies to direct electronic marketing. For existing customers, we may rely on a soft opt-in with a clear opt-out where permitted. For new contacts with no prior relationship, we require opt-in consent before sending direct email marketing.

You can opt out of marketing communications at any time by using the unsubscribe link in our emails or by contacting us at privacy@valve.fi. We may retain limited information about your opt-out to ensure that we respect your choice.

We may use CRM and marketing automation tools to understand which topics, services, or events may be relevant to you. See Section 8 for information about profiling. We do not use this information to make decisions about you that produce legal or similarly significant effects.

6. Cookies and similar technologies

Our website uses cookies and similar technologies, deployed via Google Tag Manager. Cookies are small files or identifiers stored on or accessed from your device.

The table below summarises the main categories of cookies and similar technologies we use. The exact cookies, providers, and retention periods may change depending on our website configuration. The current cookie banner and Cookie Settings tool provide the most up-to-date cookie-level information.

Where available and appropriate, we configure EU hosting, EU data-region or EU data-boundary settings for relevant systems. Some support, security, telemetry, or routing operations may still involve processing outside the EU/EEA, subject to appropriate safeguards.

Analytics, marketing, and functional cookies are used only with your consent unless they are strictly necessary for the service you have requested. You can accept, reject or manage cookie categories through the cookie banner or the Cookie Settings link on our website. You can also manage cookies through your browser settings.

Essential cookies cannot be disabled through the cookie banner where they are required for the website to function and are not subject to the consent requirement. Analytics, marketing, and functional cookies require your consent. You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

For an up-to-date cookie-level declaration, including individual cookie names, providers, purposes and validity periods, see the cookie banner or Cookie Settings link on our website, or contact us at privacy@valve.fi.

7. AI-enabled tools

We may use AI-enabled tools to support marketing, sales operations, content production, analytics, customer relationship management, and internal productivity. These tools may help us draft content, classify information, summarise communications, analyse campaign performance, or support service delivery. The AI service providers we currently use are listed in Section 10.

Where AI-enabled tools process personal data, we apply a risk-based AI governance framework that helps us classify data and AI services. We also apply appropriate operational safeguards including access controls, vendor review, contractual protections, and data minimisation. We do not use AI tools to make decisions about individuals that produce legal or similarly significant effects without appropriate human involvement. AI services are used primarily as tools supporting human decision-making and content creation. Valve One personnel remain responsible for reviewing outputs before they are used in business activities.

We instruct our personnel not to enter unnecessary personal data, confidential customer data, special-category data or sensitive business information into AI tools unless the tool has been approved for that purpose and appropriate contractual, security and access safeguards are in place.

EU AI Act — transparency obligations (Article 50, applying from 2 August 2026):

• Interaction disclosure: Where any AI system deployed by Valve One interacts directly with you, we will inform you at the point of interaction that you are engaging with an AI system, unless this is obvious from the context.
• AI-generated content: Where AI-generated content is required to be labelled or marked under applicable law, we will apply the required labelling.

8. Profiling and automated processing

We use CRM and analytics tools, including HubSpot, to understand how you interact with our website, emails and content — for example, which pages you visit, which emails you open or click, and which content you engage with. Where we combine and analyse this information to evaluate your likely professional interests or to tailor marketing, this may constitute profiling under GDPR Art. 4(4).

We may use such profiling to personalise marketing communications, to make content and communications more relevant to your professional role and organisation, and to support Account-Based Marketing (ABM) activities directed at relevant business decision-makers. Where we carry out profiling for these purposes, we rely on our legitimate interests (GDPR Art. 6(1)(f)) and balance those interests against your rights and freedoms.

Right to object to profiling for direct marketing: You have the right to object to profiling carried out for direct marketing purposes at any time. Where you object, we will stop such profiling. To object, contact privacy@valve.fi or use the unsubscribe link in any of our communications.

We do not use solely automated decision-making that produces legal or similarly significant effects on you (GDPR Art. 22).

9. Recipients of personal data

We may share personal data with:

• companies within the Valve Group, where necessary for the purposes described in this policy;
• IT, hosting, CRM, marketing automation, analytics, security, communications and business-system providers;
• event partners, webinar platforms or campaign partners where you participate in a joint activity;
• professional advisers, such as auditors, legal advisers and consultants;
• public authorities, courts or regulators where required by law or necessary to protect our legal rights;
• transaction parties where necessary in connection with a merger, acquisition, restructuring or similar business transaction.

We do not sell personal data.

Where service providers process personal data on our behalf, we use written agreements requiring them to process personal data only according to our instructions and to apply appropriate security measures.

10. Service providers, processors and other recipients

The table below lists the material service providers, processors and sub-processors we currently use for the processing activities described in this privacy policy. Some providers process personal data on our behalf as processors. Others may act as independent controllers or joint controllers for specific services, depending on their terms and how the service is used — this is often the case for advertising platforms such as Google Ads, LinkedIn and Meta.

This list may change as our systems, services and customer needs develop. See Section 17 for how we handle material changes to this list.

For further information about service-provider safeguards or to request information about relevant SCCs, contact privacy@valve.fi.

11. International transfers

Some of our service providers may process personal data outside the EU or EEA, including in the United States. Where personal data is transferred outside the EU or EEA, we rely on one or more of the following safeguards:

• Adequacy decision: an adequacy decision adopted by the European Commission for the recipient country.
• EU–U.S. Data Privacy Framework (DPF): where the US recipient is self-certified under the EU–U.S. DPF (adequacy decision of 10 July 2023).
• Standard Contractual Clauses (SCCs): the European Commission's SCCs (Commission Implementing Decision 2021/914), supplemented where required by a transfer impact assessment.
• Supplementary measures: additional technical, contractual, or organisational measures where the transfer assessment identifies residual risk.

For the following systems we have configured EU data residency, EU hosting or EU data-region settings so that primary storage and processing take place within the EU/EEA: HubSpot, Supermetrics, Microsoft 365/Azure, Miro, monday.com, Make, Kinsta, Atlassian Confluence & Jira Cloud, ChatGPT Enterprise, and Google Workspace (including Gemini for Google Workspace and NotebookLM). These settings are intended to limit the primary storage or processing location; limited extra-EEA access or processing may still occur, for example for support, security, telemetry, routing or provider operations, subject to appropriate transfer safeguards.

Other systems, including certain advertising, analytics, and AI services, may process personal data outside the EU/EEA under the safeguards described above. You may contact us at privacy@valve.fi for further information about the transfer safeguards applicable to specific providers.

12. Retention of personal data

We keep personal data only for as long as necessary for the purposes described in this policy, unless a shorter or longer period is required or permitted by law, contract, accounting obligations, dispute handling or other legitimate necessity.

General rule: We retain personal data for up to five years from the last meaningful interaction with you, the end of the relevant customer or business relationship, or the end of the applicable process — unless a shorter retention period applies under the table below, or a longer period is required by law or to establish, exercise or defend legal claims.

Meaningful interaction: A meaningful interaction means an intentional or business-relevant engagement with us, such as a direct communication, meeting, proposal request, event registration, form submission, newsletter subscription, customer project interaction or similar active engagement. A passive website visit, an automatic email open event or an isolated analytics signal does not by itself restart the general retention period.

When personal data is no longer needed, we delete it or anonymise it so that it can no longer be attributed to an identified or identifiable person.

13. Security

We apply technical and organisational measures to protect personal data against unauthorised access, loss, misuse, alteration, or disclosure. These measures may include:

• access controls and role-based permissions;
• personal user accounts and passwords;
• multi-factor authentication where appropriate;
• encryption in transit and, where applicable, at rest;
• secure hosting and system configuration;
• logging and monitoring;
• backup and recovery processes;
• vendor and service-provider review;
• personnel confidentiality obligations;
• internal data protection and information security procedures;
• incident response processes.

We assess security measures based on the nature of the processing, the risks to individuals, and the confidentiality, integrity, availability, and resilience of the systems involved. In the event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify the Finnish Data Protection Ombudsman within 72 hours in accordance with GDPR Article 33 and will inform affected individuals where required under GDPR Article 34.

14. Your rights

You have the following rights under applicable data protection law:

• Right of access: you may request confirmation of whether we process your personal data and receive a copy of the data.
• Right to rectification: you may request correction of inaccurate or incomplete data.
• Right to erasure: you may request deletion of your personal data in certain circumstances.
• Right to restriction: you may request restriction of processing in certain circumstances.
• Right to data portability: where processing is based on consent or contract and carried out by automated means, you may request your data in a structured, commonly used and machine-readable format.
• Right to object: you may object to processing based on legitimate interests at any time.
• Right to object to direct marketing: you may object to direct marketing at any time. This right is absolute — we will cease processing for direct marketing without requiring justification.
• Right to object to profiling for direct marketing: you may object to profiling carried out for direct marketing purposes at any time. See Section 8.
• Right to withdraw consent: where processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of prior processing.
• Rights relating to automated decision-making: you have the right not to be subject to a decision based solely on automated processing, including profiling, where it produces legal or similarly significant effects, unless permitted by law.

To exercise your rights, you may contact us at privacy@valve.fi. We may ask for information necessary to confirm your identity or clarify your request. We will respond within one calendar month as required by GDPR Article 12(3).

15. Right to lodge a complaint

You have the right to lodge a complaint with a supervisory authority if you consider that our processing of your personal data infringes data protection law. In Finland, the supervisory authority is:

Office of the Data Protection Ombudsman (Tietosuojavaltuutettu)

Website: tietosuoja.fi

Email: tietosuoja@om.fi

PO Box 800, FI-00531 Helsinki, Finland

We encourage you to contact us first at privacy@valve.fi so that we can try to resolve the matter directly.

16. Providing personal data

Providing personal data may be necessary for us to respond to your enquiry, provide services, enter into or perform a contract, send requested communications, process an application, or comply with legal obligations. If you do not provide necessary personal data, we may not be able to respond to your request, provide services, process your application, or maintain the relevant business relationship.

17. Changes to this privacy policy

We may update this privacy policy from time to time to reflect changes in our processing activities, legal requirements, supervisory guidance, or service-provider arrangements. The latest version will always be available on our website at valveone.com/privacy-policy with a revised Last Updated date.

Material changes: Where we make a material change — such as a new processing purpose, a new category of personal data, a significant change to our service-provider list, or a change to how we handle your rights — we will notify registered contacts by email where we hold a valid address and have a lawful basis to use it. We will provide reasonable advance notice before material changes take effect where appropriate.

Service-provider changes: We may update our service-provider list as systems and services change. Where required by applicable data protection law or our customer agreements, we will provide notice of material additions or replacements and allow customers to raise reasonable data protection objections within the period specified in the applicable data processing agreement.

Controller: Valve Branding Oy
Business ID: 1884268-7
Address: Sturenkatu 16, 00510 Helsinki, Finland
Privacy contact: privacy@valve.fi