How Menimo uses your data

In force from 4 October 2026.

Who is responsible. Doju Ltd (Business ID 2708306-1, Finland; privacy@doju.org) runs Menimo and is the controller of the data described here. A provider you book with is a separate controller of what it keeps about you from the moment your request is confirmed or your booking is made; its own privacy notice applies to that, and your questions about it go to the provider.

What we use your data for, and why.

• Searching. Where you search from (a place you type or, if you allow it, your device's location), what you search for and when. The location is used for that search and is not kept; the search itself is kept without your name for 90 days to improve results. Basis: our legitimate interest in running the search (Article 6(1)(f)).
• No Menimo account. Menimo has no consumer accounts and nothing on Menimo to sign in to. When you book directly with a studio or trainer, the booking creates your client record with them, in their own booking system (at <studio>.menimo.fi, where you can see and cancel your bookings). The studio or trainer is the controller of that record, and its own privacy notice applies to it.
• Bookings and booking requests. You first confirm your e-mail address with the link we send you; only then does your booking or request go ahead. Your name, e-mail address, the class and anything you write go to the provider: with a direct booking straight away; with a request the provider first sees your name, the time, the number of people and your message, and your contact details are passed on when it confirms. We keep the booking or request and its answer for two years so that you and the provider can see what happened; after that we close it and delete your name and contact details. Basis: the contract (Article 6(1)(b)).
• People you book for. If you book places for others, you give each person's name and, if you like, their e-mail address. We send them to the provider with the booking, and where an address was given we send that person one message saying who booked a place for them. We delete them from Menimo when the booking is confirmed or declined or the link expires; the provider keeps what it needs as its own controller. Basis: legitimate interest in booking for a group (Article 6(1)(f)).
• Links to a provider's site. When you follow a link we record the click with a code that changes every day and does not identify you, and the link carries a one-off reference number for that click (menimo_ref), so the provider can see the visit came from Menimo. Clicks are kept for 13 months. Basis: legitimate interest (Article 6(1)(f)).
• Reviews. If you tick the box on the booking page (it is never ticked in advance), we keep the e-mail address you just confirmed, encrypted, and send you one e-mail asking for a review 2 to 48 hours after your visit. We delete the address when you send a review, when you press "No thanks", or 30 days after that e-mail (90 days after you ticked the box if no e-mail was due). Basis for the invitation: your consent (Article 6(1)(a)); pressing "No thanks" withdraws it. A review is made of your stars, text and display name and the booking it belongs to; it is published with "Verified visit" 24 hours after you send it. The link in the e-mail lets you edit, withdraw or delete the review at any time; keep that e-mail, because it is the only way to reach the review. Your text is checked when you send it; if a sentence seems to name someone or include health information, we show it to you to change. Basis for the review: the contract (Article 6(1)(b)). If a provider leaves Menimo, its reviews are hidden at once and deleted 24 months later.
• Businesses without a page of their own on Menimo. We compile a service's name, address and line of business from public registers (the PRH business information system, and Lipas, the sports-facility database of the University of Jyväskylä; both under the CC BY 4.0 licence) so that consumers can find local exercise services; the page has no timetable and no booking, and names its source. If the data concerns you as a sole trader you can object to its use (Article 21): the "Remove my business" button on the page hides it at once and it is not created again, or write to privacy@doju.org. A hidden page's name and address are kept out of sight for 30 days, so that a wrongful removal can be undone; after that they are deleted and only the register number is kept so the page is not created again. Basis: our legitimate interest (Article 6(1)(f)).
• Reports and decisions. If you report content, or content of yours is reported, we keep the report and our decision for two years. Basis: our legal duties under the Digital Services Act (Article 6(1)(c)).
• Cookies. We use two technical cookies only: one protects our forms against misuse, and when you book directly, one lets the confirmation link confirm the booking at once in the browser you booked in (it lasts 45 minutes). No tracking or advertising cookies, so we do not ask for cookie consent.

We do no advertising profiling and sell nothing about you. Sponsored results are chosen by the provider's subscription, never by your data.

Who sees it. The provider you book with (your name, contact details and the booking); the people you book for (that you booked them a place); our hosting and e-mail providers in the EU; an encrypted backup copy in the United States under the EU standard contractual clauses (the key never leaves us); authorities where the law requires. The map link opens an OpenStreetMap page only when you click it; OpenStreetMap then learns which address you looked up.

How long we keep it. Searches: 90 days, without your name. Clicks: 13 months. Bookings and requests: two years, then closed and your name and contact details deleted. Names and addresses of people you book for: until the booking is confirmed or declined or the link expires. Reviews: while the provider is on Menimo, unless you delete them first; 24 months after a provider leaves. The address used for a review invitation: as described above. Deleted data may remain in encrypted backups for up to about 400 days.

Your rights. Access, rectification, erasure, restriction, objection and portability (Articles 15–21). You edit, withdraw or delete a review through the link in the invitation e-mail; for anything else write to privacy@doju.org and we answer within a month. Objecting to the search or click records stops them for you. You may complain to the Data Protection Ombudsman (tietosuoja.fi). No decision about you is made automatically (Article 22).