Sign in to the member portalSign in Join as a memberJoin
Mementomori ry

Privacy notice

This notice explains what personal data Mementomori ry collects on this site, why, and what rights you have. The member register is a personal data file under the EU General Data Protection Regulation.

Controller

Mementomori ry, business ID 3637371-4, domiciled in Jyväskylä, Finland. Questions about your data: ry@mementomori.social

What we collect

  • Member register: full name, home municipality, email address, member class, billing interval, membership status, and the dates an application was made and decided.
  • Optional details you choose to give: your mementomori.social account and its avatar, your Matrix user id, and your consent to appear on the member list shown to other members.
  • Payments: your personal reference number, amounts, payment dates and periods, the payment method, the Stripe customer and subscription identifiers, and who recorded a manual bank transfer.
  • Technical: sign-in sessions with IP address and browser user agent, sign-in link tokens, and the access token from linking a Mastodon account. Board approval decisions are recorded with the approver and their role.

Why we process it, and on what basis

  • Keeping the member register is a legal obligation: the Finnish Associations Act (yhdistyslaki 11 §) requires the full name and home municipality of every member.
  • Running the membership, collecting fees and communicating with members is based on the membership relationship itself.
  • Payment records are kept to satisfy accounting law.
  • Appearing on the member list, and giving a Matrix user id, are based on your consent. You can withdraw either at any time.
  • Session data is processed on the basis of legitimate interest, to keep accounts secure.

Who processes the data

  • Cloudflare: hosting and database (Cloudflare, Inc., San Francisco, USA; traffic is served from EU data centres)
  • Stripe: card payments (Stripe Payments Europe Ltd, Dublin, Ireland)
  • Mailgun: email delivery, EU region (Sinch, EU data centres)
  • Hetzner: the mementomori.social service itself and all backups (Helsinki, Finland); Nextcloud: second backup copy on the association's own instance, also on Hetzner in Europe
  • GitHub: source code hosting (Microsoft, USA); the code contains no personal data

These providers process data on our behalf and only for these purposes, in accordance with the EU GDPR and Finnish law.

Data is not sold, and it is not disclosed to anyone else except where the law requires it.

How long we keep it

Register data is kept while the membership lasts. Payment records and other accounting material are kept for at least six years from the end of the year in which the accounting period ended, as accounting law requires. Sessions expire on their own, and sign-in link tokens are single use.

Your rights

You have the right to:

  • ask what data we hold about you and get a copy of it
  • have inaccurate data corrected
  • have data erased, where we are not required by law to keep it
  • object to or restrict processing
  • withdraw consent you have given, such as appearing on the member list
  • lodge a complaint with the Finnish Data Protection Ombudsman

Send requests to ry@mementomori.social. You can correct most of your own details on your member page.

Security

There are no passwords to steal: sign-in uses one-time links or Mastodon. All traffic is encrypted, the application sets strict browser protections (Content Security Policy and related headers), and Cloudflare's platform provides infrastructure-level hardening and DDoS protection. The register is visible only to the board, and the member list only to signed-in, approved members who opted in. The entire source code is open for anyone to inspect at GitHub. The members' Matrix chat room is end-to-end encrypted.

The site has a public member list. A member appears on it only after ticking a separate consent for public listing; the members-only list has its own consent. Both can be withdrawn on your member page at any time, and withdrawal removes you from the list immediately.

Changes

If this notice changes, the updated version is published on this page. Last updated 19.8.2026.