Privacy notice

We process the following personal data in connection with managing memberships, providing services, invoicing, enquiries and meeting legal obligations:

Basic details

• Name
• Date of birth or age group (for junior and senior memberships)
• Email address
• Phone number
• Postal address

Membership and usage data

• Type of membership, start and end date
• Access right data (check-in times and counts in the Enkora system)
• Payment history and invoicing details

Financial administration data

• Invoicing and payment records (Ropo One system)
• Possible debt collection records

Communication data

• Emails sent or received at toimisto@nostelema.fi that relate to memberships, enquiries or service requests
• Data sent through the contact form on the site: name, email address, optional phone number, topic and the content of the message. The form message reaches us as an email to toimisto@nostelema.fi.

Technical data (website visitors)

• Your cookie choice. It is stored only in your own browser, not with us.
• Visitor data (Google Analytics 4) and advertising measurement data (Google Ads) only if you accept cookies. See the section Cookies and browser storage.
• Server log data, such as IP address, the page requested and the time, for security and for investigating disruptions. Log data is stored on the servers of our hosting provider Zoner Oy, which keeps it under its own practices only for as long as necessary. We do not combine log data with other data.
• Spam protection of the contact form: a hash calculated from the IP address and the timestamps of submissions. The data is deleted automatically after one day at the latest.

We do not process special categories of personal data (e.g. health data) unless a member provides them voluntarily, for example in connection with a training programme request. Do not write your health data or other sensitive data in the contact form message unless it is necessary for your matter.

Additional note on marketing communication: We rely on the legitimate interest based on membership to send notices, renewal reminders and campaign notices to current and former members. Every message gives you the option to opt out of further messages, and we respect an opt-out immediately. If you want to prohibit marketing communication, send an email to toimisto@nostelema.fi or use the unsubscribe link at the end of the email.

The data comes mainly from you yourself:

• When you join as a member (Nostelema’s online shop and the Enkora member portal at oma.enkora.fi/nostelema)
• When you contact us (email toimisto@nostelema.fi, phone or the contact form on the site)
• When you request a training programme (the AI-PT Google form)
• When you visit (checking in to the door system; OnTheMove app or access tag)
• Through payment services (exercise benefit systems, an employee benefit that many Finnish employers offer: ePassi, Smartum, Edenred and other partners)

We do not collect data from public authority registers or other external sources.

We use the following data processors to provide our services. The processors process data only on our behalf and under the service providers’ own contract terms.

Enkora Oy (Finland)

Task: Membership management, access control and the online shop (oma.enkora.fi/nostelema). Enkora processes members’ basic details, membership details and visit records. Memberships and other products are bought in Enkora’s online shop service, and use of the service is subject to Enkora’s terms. The site nostelema.fi does not process your payment or purchase data. Data location: EU/EEA.

Ropo Capital Oy / Ropo One (Finland)

Task: Invoicing, management of payments and debt collection. Ropo processes the personal data and payment records needed for invoicing. Data location: EU/EEA.

Zoner Oy (Finland): email and web services

Task: Maintenance of the email server (toimisto@nostelema.fi) and the server of the nostelema.fi site. Zoner processes messages that arrive in and are sent from the toimisto@ mailbox, including messages sent through the contact form, which reach the mailbox as email. Data location: EU/EEA.

Google Ireland Limited / Google LLC: Google Tag Manager, Google Analytics 4 and Google Ads (only with consent)

Task: Website visitor statistics (Google Analytics 4) and measurement of advertising results (Google Ads), which are started through Google Tag Manager. The site loads Google Tag Manager and the services started through it only once you accept cookies in the site’s cookie banner. If you choose “Essential only”, the site does not load Google’s services at all. This is how we see which pages are read and how many people go from the site to Nostelema’s online shop. Transfer of data outside the EU/EEA: data may be transferred to the United States. Google has committed to the EU–US Data Privacy Framework. The retention period of Google Analytics data is 14 months.

OnTheMove (access control / door system)

Task: Access control of members to the gym (mobile app and access tags). The OnTheMove app processes the member’s identification and visit data in order to open the door. Data location: EU/EEA.

Exercise benefit providers (ePassi, Smartum, Edenred etc.)

Task: Passing on payments when a member pays for their membership with an employer’s exercise benefit. The data needed for the payment transaction is passed on through these providers. Data location: EU/EEA.

Google Forms: the AI-PT form

Task: The form that opens from the AI-PT page is Google’s Forms service, which operates outside the site. The details you give in the form (for example goals, available time and possible limitations) are stored in Google’s service, and Nostelema staff prepare a training programme for you based on them with the help of artificial intelligence. The finished programme is sent to you by email. Use of the form is subject to Google’s terms. Form answers are kept for 20 years, like other customer messages, after which staff delete them. Your name and contact details are not entered into the AI service.

Email marketing: Marketing and customer messages are sent from our own email system (Zoner). We do not use a separate external email marketing service (e.g. Mailchimp / MailerLite).

Disclosure of data to authorities: We disclose personal data to authorities only on the basis of a legal obligation.

We do not sell or disclose your data to third parties for commercial purposes.

When the retention period ends, the data is deleted or anonymised systematically.

You have rights concerning your personal data under the EU General Data Protection Regulation (GDPR). You can send all requests relating to your rights to toimisto@nostelema.fi or through the contact form on the site. We reply to requests within 30 days at the latest. Your identity may be verified before the data is handed over if necessary.

Right of access (art. 15) You have the right to know which of your personal data we process and to receive a copy of it.

Right to rectification (art. 16) You can ask us to correct inaccurate or incomplete data.

Right to erasure (art. 17) You can ask us to delete your personal data. Please note that we cannot delete data covered by the Accounting Act during the retention period required by law.

Right to restriction of processing (art. 18) You can ask for the processing to be restricted, for example when the accuracy of the data is contested or the processing is unlawful but you do not want the data to be deleted.

Right to data portability (art. 20) You have the right to receive your data that is based on consent or on a contract in a machine-readable format and to transfer it to another controller.

Right to object (art. 21) You can object to the processing of your personal data where the legal basis is legitimate interest (e.g. marketing communication). Tell us by email and we will remove you from our marketing lists without delay.

Withdrawal of consent If processing is based on consent (e.g. analytics and advertising cookies), you can withdraw your consent at any time from the Cookie settings link at the bottom of the page or by contacting us. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

Right to lodge a complaint with the Data Protection Ombudsman If you consider that the processing of your personal data infringes data protection legislation, you have the right to lodge a complaint with the Finnish Data Protection Ombudsman:

Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto)
Lintulahdenkuja 4, 00530 Helsinki
Phone: 029 566 6700
Email: tietosuoja@om.fi
Website: https://tietosuoja.fi

The site has its own cookie banner. Your choice decides whether Google’s services are loaded.

• Before you choose, the site does not load Google’s services and does not set tracking or advertising cookies.
• Essential only: Google’s services are not loaded at all.
• Accept all: the site loads Google Tag Manager, which starts visitor tracking (Google Analytics 4) and measurement of advertising results (Google Ads).

For its own use, the site stores two pieces of data in your browser’s local storage. They do not leave your browser for us or for anyone else:

• Your cookie choice (key nl-consent), so that we do not ask the same question every time.
• Your Quiet times selections (key nl_tk_ajat). Quiet times is the site’s gym activity chart, where you can select up to five of your own training times. The selections are stored in your browser and in the # part of the page address, so that you can share a link. If you share the link, you also share your selection. You can delete the selections with the Clear choices button.

You can change your cookie choice at any time from the Cookie settings link at the bottom of the page. If you withdraw your consent, you can delete cookies that have already been set in your browser settings.

You can find more detail about cookies and how long they last in our cookie policy: Cookie policy.

We protect your personal data with appropriate technical and organisational measures against unauthorised processing, loss and alteration. The measures we use include, among others:

• The member data system (Enkora) is protected with password and access rights management.
• The invoicing system (Ropo) is limited to the staff who handle invoicing.
• HTTPS protection (TLS) of the website, which also means that the contact form data travels encrypted.
• The site does not store form messages in a database or in files. The message is sent as an email to toimisto@nostelema.fi.
• Access to personal data is limited to the people who need it in their work.

In the event of a data breach we act in accordance with the requirements of the data protection regulation and, where necessary, notify the Data Protection Ombudsman within 72 hours and the data subjects if the breach is likely to cause a high risk to their rights and freedoms.

We update this privacy notice when necessary, for example when our operations or legislation change. The updated notice is available at https://nostelema.fi/en/privacy-notice/, marked with the date. We will tell members about significant changes by email.

This notice was updated on 18.10.2026.