Privacy Policy
NAICC Oy / Challengine
Last updated: 10 September 2026
This Privacy Policy explains what personal data NAICC Oy ("NAICC", "we", "us") collects and processes, for what purposes and on what legal basis, and what rights you have in relation to your data.
1. Scope of this Policy
This Policy applies to you if you
- use the Challengine service at app.challengine.com (the "Service"),
- visit our website at https://challengine.com (the "Website"), or
- otherwise interact with us, for example through sales, support or marketing.
These are together referred to as the "Services" and anyone using them as a "User".
"Customer" means an organisation that has entered into a Challengine agreement with us. A Customer grants access to the Service to its employees and other individuals it designates. These individuals are referred to as "Customer Users".
This Policy does not apply to third-party services linked from the Website or the Service. Those are governed by the terms and privacy policies of the relevant provider.
2. Controller and contact details
Contact person for data protection matters: Mikko Kivistö, CEO
3. Customer Data: who is the controller
This is the most important section for Users and Customer organisations.
"Customer Data" means all content that a Customer or a Customer User enters into or generates within the Service: initiatives, investment and development proposals, business case materials, attachments, dialogue with the Service, and the analyses and documents produced from these.
With respect to Customer Data, the Customer is the controller and NAICC acts as a processor. We process Customer Data only in accordance with the Customer's instructions and the data processing agreement (DPA) entered into with the Customer.
If you are a Customer User and want to know what data about you is held in the Service, or wish to exercise your data protection rights in relation to Customer Data, please contact your employer or organisation first. Where necessary, we will forward the request and assist the Customer in handling it.
Accordingly, this Policy primarily describes processing where NAICC itself acts as the controller: managing the customer relationship, Service accounts and usage data, marketing, and use of the Website.
4. Personal data we process
4.1 Customers and Service users
- User details: name, work email address, job title, organisation, access rights and role in the Service, and password hash or authentication details depending on the sign-in method used.
- Customer relationship details: contact persons, contract content and term, services ordered, billing details and payment history.
- Usage data: when and how the Service is used, for example sign-ins, the number of cases created and processed, features used, and error events.
- Communications: messages, support requests, meeting notes, feedback and feature requests.
4.2 All Website and Service visitors
- Log data: IP address, time of access, browser type and version, operating system, language settings and similar technical information.
- Cookie-based data: see section 12.
4.3 Prospective customers and other business contacts
- Contact and background details: name, work email, phone number, job title, organisation and publicly available professional background.
- Interaction details: dates and content of contacts, meetings, interest status and agreed next steps.
As a rule, we process only data relating to a person's professional role. We do not collect special categories of personal data (Article 9 GDPR), and we do not ask for such data to be entered into the Service.
5. Sources of data
- From you directly, when you register, contact us, subscribe to our newsletter or use the Service.
- From your employer or the organisation you represent, when it grants access to the Service.
- Automatically from the technical logs of the Service and the Website.
- From public sources and business information services, such as company websites, the Finnish Trade Register, LinkedIn and sales intelligence tools, when we identify prospective customers.
6. Purposes and legal bases for processing
| Purpose | Legal basis |
|---|---|
| Providing the Service, managing access rights and support | Contract or steps prior to entering into a contract; legitimate interest in relation to Customer Users with whom we have no direct contract |
| Managing the customer relationship, invoicing and complaints | Contract; legal obligation (accounting) |
| Information security of the Service, prevention of misuse and incident investigation | Legitimate interest |
| Development and quality improvement of the Service | Legitimate interest |
| Direct marketing and sales to representatives of companies | Legitimate interest; electronic direct marketing to consumers is based on consent |
| Compliance with legal obligations and handling of legal claims | Legal obligation; legitimate interest |
Where processing is based on legitimate interest, we have assessed that the processing is necessary for our business and does not unreasonably override the rights of the data subject. You may request information about this assessment using the contact details in section 2.
7. Use of AI and model training
Challengine is an AI-assisted service. Its functionality relies on large language models used to structure the material entered by the user and to conduct the business case dialogue.
- We do not use Customer Data to train or fine-tune general-purpose AI models.
- The language model providers we use process material transmitted through the Service as our sub-processors under our agreements with them. Under those agreements they are not permitted to use the material to train their own models.
- The Service does not carry out automated decision-making that produces legal effects concerning a data subject or similarly significantly affects them. The analyses and recommendations produced by the Service support decision-making, and the final decision is always made by the Customer organisation's own personnel.
8. Recipients and sub-processors
We use trusted service providers that process personal data on our behalf. We currently use the following sub-processors:
| Category of sub-processor | Purpose |
|---|---|
| Cloud infrastructure and database services | Service runtime environment and data storage |
| Language model providers | AI functionality of the Service |
| Communication and document services | Email, calendar and file management |
| Customer relationship management system | Customer and sales data |
| Financial administration services | Invoicing and accounting |
| Analytics and marketing services | Website analytics and communications |
An up-to-date list of named sub-processors is provided to Customers as an annex to the data processing agreement. The list is also available on request using the contact details in section 2. We notify Customers of changes to sub-processors in accordance with the data processing agreement before the change takes effect.
In addition, we may disclose personal data
- to public authorities where required by law,
- to our advisers, such as auditors and legal counsel, and
- to a buyer or its advisers in connection with a corporate transaction.
We do not sell personal data.
9. Transfers outside the EU/EEA
Personal data is stored within the EU or EEA.
Where data is in future transferred outside the EEA, we ensure the lawfulness of the transfer by using the Standard Contractual Clauses approved by the European Commission or another transfer mechanism under Chapter V of the GDPR, together with supplementary measures where necessary. You may obtain a copy of the safeguards used by contacting us using the details in section 2.
10. Retention periods
We retain personal data only for as long as necessary for the purposes described in this Policy.
| Data | Retention period |
|---|---|
| Customer Data | For the term of the customer agreement and 30 days thereafter, after which it is deleted or returned to the Customer in accordance with the agreement |
| User accounts and access rights | For the term of the access right and 30 days after it ends |
| Customer relationship and billing data | For the term of the agreement and thereafter at least 6 years from the end of the financial year, as required by the Finnish Accounting Act |
| Technical logs | 12 months |
| Marketing and prospect data | 2 years from the last contact, or until the person objects to marketing |
11. Your rights
You have the right to
- obtain confirmation as to whether we process personal data concerning you, and to receive a copy of it,
- request rectification of inaccurate data,
- request erasure of data where there is no longer a basis for processing,
- request restriction of processing,
- object to processing based on legitimate interest on grounds relating to your particular situation,
- object to direct marketing at any time and without giving reasons,
- withdraw your consent where processing is based on consent, and
- receive the data you have provided in a portable format where processing is based on a contract or consent.
Requests can be made using the contact details in section 2. We will respond within one month. We may need to verify your identity before acting on a request. Not all data can always be erased, if retaining it is necessary under law or contract.
If you are dissatisfied with how we process your personal data, you may lodge a complaint with a supervisory authority. In Finland, the competent authority is the Office of the Data Protection Ombudsman (tietosuoja.fi). You may also lodge a complaint with the supervisory authority in the EU country where you live or work, or where you believe the alleged infringement took place.
12. Cookies
We use cookies and similar technologies on the Website.
- Necessary cookies are required for the Website and the Service to function, for example to maintain a session and to sign in. Their use does not require consent.
- Analytics and marketing cookies help us understand how the Website is used and target our communications. These are used only with your consent.
You can change or withdraw your consent at any time in the Website's cookie settings, and you can block cookies in your browser settings. Blocking necessary cookies may impair the functioning of the Website.
We use both session cookies, which are removed when you close your browser, and persistent cookies, which remain on your device until they expire, or you delete them. Information collected through persistent cookies is retained for no longer than two years.
Third parties may also place cookies on the Website, currently e.g. LinkedIn, Google Analytics. You can change or withdraw your consent at any time in the Website's cookie settings, and you can block cookies in your browser settings. More detailed information on the cookies used, their purposes and duration is available on request at info@naicc.fi.
13. Security
We protect personal data using technical and organisational measures. These include
- access control and role-based permissions,
- encrypted data transfer (TLS) and encryption of data at rest,
- logging and monitoring of use,
- confidentiality commitments from personnel and sub-processors, and
- regular backups.
We report personal data breaches to the supervisory authority and, where required, to data subjects, in the manner required by the GDPR. We notify the Customer of breaches concerning Customer Data without undue delay.
14. Changes to this Policy
We may update this Policy as our operations or applicable law change. We will notify you of material changes in the Service or by email. The date of the latest update is shown at the top of this Policy.