Privacy policy

1. Data controller

StigomBoard is a service shared by many customers. For the personal data stored in the service for each customer company, that company is itself the data controller. StigomBoard acts as a data processor on the company's behalf.

2. Data processed

• Administrators' identifying data: name, email, role, last login.
• Board members' data: name, email (if chair/secretary or report recipient), role.
• Survey participants' data: name and email (for sending invitations).
• Answers: anonymous – cannot be linked to the respondent in the database.
• Audit log: logins, survey lifecycle events.
• Per-person evaluations: the annual survey may collect an NPS score and free-text feedback about a named individual (a board member, the managing director, or the secretary). The person giving the rating stays anonymous; the person being rated is identifiable.

3. Purpose and basis of processing

The purpose of processing the data is to organize the board's self-assessment. Processing is based either on the controller company's legitimate interest (evaluation per the governance code) or on the data subject's consent (voluntary respondents).

4. Anonymity

Answers cannot be linked to the respondent at the database level. Only the information about who has responded is kept (to calculate the response rate) – not what each person answered. Per-member NPS results are subject to k-anonymity protection (default n < 3 → the result is not shown).

Per-person evaluation: this section has two data subjects — the person rating and the person rated. The rater cannot be linked to the rating in the database, and free-text feedback is rewritten by AI into a uniform style so the writer cannot be identified from their writing style. For the person rated, results and feedback are released only when the number of ratings meets the k-anonymity threshold (default 3) — otherwise they are hidden entirely. The person rated has the right to know what data is stored about them.

5. Retention period

The active phase of the survey (invitations, response window): until the response time ends. Response data: a retention period set by the controller company, by default 7 years from the end of the evaluation year. Participants' personal data can be requested for deletion at any time.

6. Data transfers and sub-processors

• Anthropic (Claude API): PDF extraction and generation of AI report text. Per the agreement, data is not used to train the model. Submitted data is processed for the task.
• Email service: sending invitations and reports (e.g. AWS SES, Postmark).
• Hosting: EU-region cloud.
• Google (Analytics): visitor statistics with consent only. An IP address and a browser-specific identifier are sent to Google. Not used if you decline analytics.

7. Rights of the data subject

• The right to be informed about the processing (this policy).
• The right to access one's own data.
• The right to rectify incorrect data.
• The right to erase data (the right to be forgotten).
• The right to restrict and object to processing.
• The right to lodge a complaint with the supervisory authority (Data Protection Ombudsman, tietosuoja.fi).

Requests go to the controller company's contact person. The StigomBoard owner can, on request, export the company's data out of the system (GDPR export) or delete it entirely.

8. Sample report requests and marketing

This section concerns people who requested the sample reports on the website. Note the different controller: unlike customer companies' survey data, for this data the controller is Aukia-yhtiöt, because these are our own contacts.

• Data collected: name, email address, organization (optional), language, the form's location on the site, and the consent record (wording, version, timestamp, IP).
• Basis: sending the sample reports rests on your own request. Marketing messages rest on your separate consent — it is voluntary and receiving the reports does not require it.
• Withdrawal: you can withdraw marketing consent at any time via the link at the end of every message, or by replying to any of our messages.
• Retention: the data is deleted no later than 24 months after the last contact, or immediately upon withdrawal.

8. Cookies

We use necessary session cookies and, with your consent, Google Analytics cookies for visitor statistics. Analytics does not start before you agree, and you can withdraw that agreement at any time. More information on the cookie page.