Privacy Policy
Your & Our privacy matters!
We protect it like Finland protects its forests
1. Introduction
Nordaurai Oy Ltd ('Nordaurai', 'we', 'us', or 'our') is a Finnish gamified wellbeing company that develops and delivers science-based wellbeing board games, and game-based organisational wellbeing programs grounded in the science of positive psychology.
This Privacy Policy explains how Nordaurai Oy collects, uses, stores, and protects personal data in connection with our website (nordaurai.com) and our gamified wellbeing programs and services delivered to organisations.
We are committed to protecting your privacy and complying with:
• The General Data Protection Regulation (EU) 2016/679 (GDPR)
• The Finnish Data Protection Act (Tietosuojalaki, 1050/2018)
• The Act on the Protection of Privacy in Working Life (759/2004)
• The Act on Electronic Communications Services (917/2014) regarding cookies
2. Data Controller
The data controller responsible for your personal data is:
Nordaurai Oy.
Business ID: 3528707-2
Helsinki, Finland
Email: info@nordaurai.com
Website: www.nordaurai.com
3. Website Data Collection
Nordaurai does not actively collect personal data through its website. We do not use tracking pixels, advertising cookies, or behavioural profiling tools.
Our website uses essential cookies only, which are necessary for the website to function correctly. These may include session cookies and security cookies. By continuing to use our website, you consent to the use of these essential cookies.
If you choose to contact us via our contact form, we collect only the information you provide: your name, company name, email address, and message. This data is used solely to respond to your enquiry and is not shared with third parties.
4. About Our Science-Based Methodology
Nordaurai's programs are grounded in Positive Psychology, specifically the PERMA framework developed by Professor Martin Seligman. PERMA stands for:
• P — Positive Emotions: building emotional resilience and reducing burnout
• E — Engagement: increasing focus, flow, and meaningful participation at work
• R — Relationships: building psychological safety and team connection
• M — Meaning: connecting individuals to purpose and organisational values
• A — Accomplishment: recognising strengths and celebrating progress
Our 14 original wellbeing board and card games are designed around these five pillars, transforming passive workshops into active, embodied experiences. Each game is developed to facilitate real conversation, self-awareness, and measurable behaviour change not simply data collection.
Nordaurai does not use participant data for academic research purposes. All data collected during programs is used exclusively to measure and report the outcomes of the specific engagement for the contracting organisation.
5. Data Collected Before Sessions (Pre-Survey)
Before any gamified wellbeing program begins, Nordaurai administers a pre-session wellbeing and engagement survey to participants. This survey is:
• Developed by qualified psychology professionals
• Grounded in the PERMA framework of positive psychology
• Designed to measure baseline levels of wellbeing, engagement, and burnout
• Completed voluntarily by each participant with informed consent
The pre-survey data collected may include:
• Self-reported wellbeing levels
• Engagement and motivation indicators
• Burnout risk indicators
• Organisational culture perceptions
This data is collected directly from participants and is used solely to personalise and measure the impact of the program.
6. Data Collected During Sessions
During our gamified wellbeing sessions, Nordaurai may collect:
• Behavioural observations at the group level
• Organisational culture and team dynamics data
• Participation and engagement observations
All data collected during sessions is gathered at the group or team level. Individual responses shared during game play are treated as confidential and are not recorded or attributed to specific individuals without explicit consent.
Each participant is informed of data collection practices before the session begins and is asked to provide their individual consent.
7. Third-Party Wearable Technology
In select programs, Nordaurai may use third-party wearable technology tools (such as biometric or physiological monitoring devices) to provide measurable data on participant wellbeing and engagement levels.
The use of wearable tools is:
• Always optional and never mandatory
• Subject to the explicit written consent of each individual participant
• Disclosed in advance to both the contracting organisation and participants
• Conducted in compliance with applicable Finnish and EU data protection law
Biometric and physiological data constitutes special category data under Article 9 of the GDPR. Nordaurai processes such data only with explicit consent and takes all necessary technical and organisational measures to protect it.
8. Data Collected After Sessions (Post-Survey)
Following each program, Nordaurai administers a post-session survey to measure the impact and outcomes of the gamified wellbeing intervention. This survey mirrors the pre-session instrument and measures changes in:
• Wellbeing and engagement levels
• Burnout indicators
• Behavioural intentions and insights gained
Pre and post survey results are compared to provide the contracting organisation with a clear picture of the program's impact.
9. Reporting to Organisations
All results and data are presented to the contracting organisation's HR Director or equivalent representative in anonymised, aggregated form.
This means:
• Results are presented as percentages, not as individual figures
• No individual participant is identified in any report
• Reports reflect group-level trends and outcomes only
• Individual responses shared during sessions remain confidential
Nordaurai will never share individual participant data with the contracting organisation or any third party without the explicit consent of the individual concerned.
10. Confidentiality and Non-Disclosure Agreements
In cases where Nordaurai collaborates with partner organisations, co-developers, technology providers, or research collaborators, a Non-Disclosure Agreement (NDA) may be required and signed before any program delivery or data sharing takes place.
NDAs ensure that all sensitive organisational and participant data shared in the context of the collaboration remains strictly confidential and is not used for any purpose beyond the agreed scope of work.
11. Data Retention
Nordaurai retains personal data collected during programs for a maximum period of 2 years from the date of collection.
After this period, all personal data is securely deleted or anonymised. Anonymised, aggregated data may be retained for longer periods for internal quality improvement purposes only.
Data collected through our website contact form is retained for as long as necessary to respond to your enquiry and for a reasonable period thereafter, not exceeding 12 months.
12. Data Security
Nordaurai implements appropriate technical and organisational measures to protect personal data against unauthorised access, loss, destruction, or disclosure. These measures include:
• Secure, encrypted storage of all digital data
• Access controls limiting data access to authorised personnel only
• Regular review of data protection practices
• Secure deletion of data upon expiry of the retention period
13. Your Rights
Under the GDPR and Finnish data protection law, you have the following rights regarding your personal data:
• Right of access — you may request a copy of the personal data we hold about you
• Right to rectification — you may request correction of inaccurate data
• Right to erasure — you may request deletion of your personal data
• Right to restriction — you may request that we restrict processing of your data
• Right to data portability — you may request your data in a structured, machine-readable format
• Right to object — you may object to certain types of processing
• Right to withdraw consent — where processing is based on consent, you may withdraw it at any time
To exercise any of these rights, please contact us at: info@nordaurai.com
If you believe your data protection rights have been violated, you have the right to lodge a complaint with the Finnish Data Protection Ombudsman (Tietosuojavaltuutettu) at tietosuoja.fi.
14. Third-Party Services
Nordaurai does not sell, rent, or trade personal data to third parties.
We may use trusted third-party service providers to support our operations, including:
• Website hosting (Squarespace)
• Email services (Google Workspace)
• Scheduling tools (Calendly)
These providers process data only as instructed by Nordaurai and in accordance with applicable data protection law. Where required, data processing agreements are in place with these providers.
Nordaurai does not transfer personal data outside the European Economic Area (EEA) except where adequate safeguards are in place in accordance with GDPR Chapter V.'
15. Cookie Policy
Our website uses the following types of cookies:
• Essential cookies — required for the website to function. These cannot be disabled.
• Analytics cookies — used to understand how visitors use our site (only with your consent)
You can manage your cookie preferences through your browser settings at any time. Disabling certain cookies may affect the functionality of the website.
16. Changes to This Policy
Nordaurai reserves the right to update this Privacy Policy at any time. Any changes will be published on this page with an updated date. We encourage you to review this policy periodically.
17. Contact Us
For any questions, concerns, or requests regarding this Privacy Policy or the processing of your personal data, please contact us:
Nordaurai Oy
Business ID: 3528707-2
Helsinki, Finland
Email: info@nordaurai.com
Website: www.nordaurai.com