Privacy Policy

1. Our Role in Data Processing: Data Controller vs. Data Processor

Because we provide a B2B SaaS platform for internal corporate mentoring, we act in two distinct roles depending on how you interact with us:

• Nordic Mentor as a Data Processor (the SaaS mentoring platform): When you use the Nordic Mentor platform as an internal mentoring tool provided by your employer or organization, your organization is the Data Controller and Nordic Mentor is the Data Processor. We process data only in accordance with the client organization's instructions and our mutual Data Processing Agreement (DPA).
• Nordic Mentor as a Data Controller (website, sales and marketing): When you visit our public website, book a demo, download materials, or contact us as a representative of a client or partner, Nordic Mentor is the Data Controller of your personal data.

Data Controller contact details:

Company: Nordic Platforms Oy
Business ID: 3619198-8
Address: Kasarmikatu 8, 00140 Helsinki, Finland
Data protection contact: Kalle Koivuniemi (info@nordicmentor.com)

2. What Personal Data We Collect and Why

A. Mentoring platform users (Processor role)

To carry out the automated mentoring process, the platform processes the following data:

• Basic and profile information: Name, work email address, job title, unit/department, years of work experience, language choices, and preferred role (mentor, mentee or both).
• Skills and development data (matching data): Strengths and development areas chosen by the user, communication style and preferred meeting frequency.
• Mentoring process data: AI-generated match recommendations, goals set, meeting agendas, calendar bookings and feedback survey responses.
• Reporting for management and HR: In the client organization's dashboard, data is viewed primarily at an aggregate and statistical level (e.g. active pairs, skills gaps and engagement). The confidentiality of individual mentoring conversations is protected, and the platform is not used to eavesdrop on employees' conversations.

B. Website visitors and B2B client representatives (Controller role)

• Contact details and communication: Name, organization, job title, email address, phone number, and information provided through contact forms or meetings.
• Website analytics: IP address (anonymized), browser type, visit duration and page loads on our public website, if you have consented to statistical cookies.

3. Legal Bases for Processing (GDPR Art. 6)

• Contract (Art. 6.1 b): Providing the service, managing user accounts and performing client agreements.
• Legitimate interest (Art. 6.1 f): B2B customer acquisition, managing customer relationships, ensuring the technical functionality and security of the service, and developing the service.
• Consent (Art. 6.1 a): Non-essential analytics cookies on the public website and direct marketing permissions. You can withdraw your consent at any time.
• Legal obligation (Art. 6.1 c): Meeting accounting and regulatory obligations.

4. Responsible AI and Automated Decision-Making

Nordic Mentor uses AI to match mentoring pairs (AI matchmaking), create development goals and facilitate meeting agendas:

• No training use: Employees' personal data, skill profiles or mentoring conversations are never used to teach or train general or third-party AI models.
• Local and certified processing: Intelligent matching (AI matchmaking) runs in a Nebius data center located in Finland, which is ISO 27001/27701 and SOC 2 Type II certified.
• Human oversight: The AI does not make automated decisions that have legal or similarly significant effects on data subjects (GDPR Art. 22). It works as an intelligent recommendation and facilitation tool for participants and the organization's HR.

5. Data Location, Sovereignty and Sub-processors

All user data and databases are located and remain within the EU/EEA (in Finland and Germany). We use only carefully selected sub-processors that meet enterprise-level security requirements.

Third-party integrations: At the client organization's choice, the platform can connect to the organization's own tools, such as Microsoft Teams, Slack, Outlook Calendar, Google Calendar, Workday or SAP SuccessFactors. Data is always transferred to these systems through secure interfaces with the client organization's authorization.

6. Cookies and Analytics

We keep the tracking of our public marketing website and of the mentoring platform strictly separate:

• Clean platform environment (SaaS application): The mentoring platform itself does not use external marketing or analytics tools, such as Google Analytics. All tracking on the platform is minimized and serves only the technical functionality and security of the service.
• Public website: On our public website we use strictly necessary cookies to keep the site working and Google Analytics 4 to measure visitor traffic. Analytics cookies are loaded only if you give your consent in our cookie banner. You can change your choice at any time from the "Cookie settings" link at the bottom of the website.

7. Data Retention

• Mentoring platform data: We retain data for the duration of the agreement with the client organization. After the agreement ends, personal data is deleted or anonymized within the period defined in the Data Processing Agreement (DPA), typically 30–90 days, unless the client organization requests earlier deletion.
• Marketing and customer records: B2B contacts and customer relationship data are retained for as long as there is a business reason or until the person requests deletion of their data. Accounting records are retained for six (6) years in accordance with the Finnish Accounting Act.

8. Your Rights as a Data Subject

Under the GDPR, you have the right to:

• Access your data: Check what personal data about you we process.
• Rectify data: Request correction of incorrect or incomplete data.
• Erase data ("right to be forgotten"): Request deletion of your data when there is no longer a legal basis for processing.
• Restrict or object to processing: Object to the processing of your data for direct marketing or on the basis of legitimate interest.
• Transfer data from one system to another: Receive the data you have provided in a machine-readable format.

Note for platform end users: If you use Nordic Mentor through your employer, please direct requests concerning your data subject rights primarily to your own organization (its HR or data protection officer), which is the Data Controller of your data. We assist our client organizations in fulfilling all requests without delay.

If you believe your personal data has been processed in breach of data protection law, you have the right to lodge a complaint with a supervisory authority (in Finland, the Office of the Data Protection Ombudsman, tietosuoja.fi).