MessengerPrivacy Policy
Effective from 10 November 2026
1. Controller
The controller of personal data is OÜ CSC Telecom Estonia (registry code 14422354, Väike-Paala tn 1, 11415 Tallinn, Estonia). For any privacy matters, contact info@csc.ee.
This policy describes how we process personal data of visitors to messenger.ee, CSC Messenger customers and their contact persons. Data of recipients of messages sent by customers through the Service is processed on the customer’s behalf as a processor – see the Data Processing Terms.
2. Data we process
| Category | Examples |
|---|---|
| Account and contact data | name, company name and registry code, e-mail, phone, address |
| Billing data | invoices, payments, account balance, VAT number; payment status from the payment provider (we never see card details) |
| Service usage data | sender name, recipient numbers, message content and status, time of sending, API requests |
| Technical data | IP address, browser, login time, cookies (see Cookies) |
| Enquiries | content of contact form submissions and e-mails |
3. Purposes and legal bases
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Creating the account, providing the Service, customer support | performance of contract (1)(b) |
| Invoicing and accounting | legal obligation (1)(c) |
| Preventing fraud, spam and misuse; information security | legitimate interest (1)(f) |
| Answering contact form enquiries | pre-contractual steps / legitimate interest |
| Service news to existing customers | legitimate interest; you can opt out at any time |
4. Recipients
We share data only to the extent necessary to provide the Service:
- mobile operators and SMS carriers, to deliver messages;
- payment service providers (Montonio Finance OÜ, PayPal (Europe) S.à r.l. et Cie, S.C.A.), to process payments;
- server, hosting and e-mail service providers;
- accounting and legal advisers;
- public authorities where required by law.
When a message is sent abroad, the recipient number and the message are necessarily transferred to the operator in that country, including outside the European Economic Area. In other cases, transfers outside the EEA are protected by the safeguards in Chapter V of the GDPR (e.g. the European Commission’s Standard Contractual Clauses).
5. Retention
- Account data – for the term of the agreement and up to 3 years after it ends (limitation period for claims).
- Accounting documents – 7 years (Accounting Act).
- Message content – up to 12 months; sending metadata (number, time, status, price) up to 3 years for billing.
- Security logs – up to 12 months.
- Contact form enquiries – up to 2 years.
6. Your rights
You have the right to request access to, rectification, erasure, restriction of processing and portability of your data, and to object to processing based on legitimate interest. Send requests to info@csc.ee; we respond within one month.
If you believe your rights have been infringed, you may lodge a complaint with the Estonian Data Protection Inspectorate (www.aki.ee, info@aki.ee) or apply to a court.
7. Security
We protect data with technical and organisational measures: encrypted connections (HTTPS), access restrictions and logging, firewalls, backups and staff confidentiality obligations.
8. Changes
This policy may be updated. The current version is always published on messenger.ee; customers are notified of material changes by e-mail.