Skip to main content
Lietuvių Eesti Latviešu Polski English ✓
Create Memorial

GDPR Compliance

Last updated: March 1, 2026

1. Our Commitment to GDPR

memento.uno is operated by MB Eskama, a company registered in Lithuania, an EU member state. We process personal data in accordance with the General Data Protection Regulation (EU) 2016/679 (the "GDPR"), the EU Charter of Fundamental Rights, the Lithuanian Law on Legal Protection of Personal Data, and applicable guidance from the European Data Protection Board (EDPB) and the Lithuanian State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija — VDAI).

This page summarises how the platform is designed for GDPR compliance from the ground up. It complements our Privacy Policy (what we collect and why) and Cookie Policy (which cookies we set and how to manage them).

2. Lawful Bases We Rely On

Article 6(1) GDPR requires every processing operation to be supported by at least one of six lawful bases. For each category of processing we run, we identify which basis applies:

  • Contract performance (Art. 6(1)(b)) — creating, storing, and serving the memorial page for a registered account; handling subscription billing.
  • Consent (Art. 6(1)(a)) — non-essential cookies (analytics, optional embeds); marketing emails. Always withdrawable.
  • Legitimate interests (Art. 6(1)(f)) — preventing fraud and abuse, keeping the service secure, basic web-server logging. We carry out a balancing test for each operation that relies on this basis; documentation is available on request.
  • Legal obligation (Art. 6(1)(c)) — accounting and tax record-keeping under Lithuanian law, responding to lawful authority requests.

3. Your Rights as a Data Subject

Articles 15–22 of the GDPR give you a comprehensive set of rights over the personal data we hold about you. You can exercise any of these rights at no cost by emailing pagalba@memento.uno from the address on file, or by writing to our postal address below.

  • Right of access (Art. 15) — we provide a copy of your data within one month, free of charge for the first request.
  • Right to rectification (Art. 16) — most account fields can be edited in the dashboard; for the rest, contact us.
  • Right to erasure (Art. 17, "right to be forgotten") — we delete your account and memorial content within thirty days, except where retention is required by law (e.g. accounting records).
  • Right to restriction (Art. 18) — you can ask us to pause processing while a dispute is resolved.
  • Right to data portability (Art. 20) — export your account data in a structured, machine-readable JSON format.
  • Right to object (Art. 21) — withdraw marketing consent or object to legitimate-interest processing.
  • Rights related to automated decision-making (Art. 22) — we do not make automated decisions that produce legal effects about you.

4. Children's Data

Our service is not directed at children under the age of sixteen. We do not knowingly process the personal data of children. If you believe we hold data about a child, please contact us and we will delete it without undue delay.

5. International Transfers

memento.uno is hosted entirely within the European Union, primarily in Lithuania. Personal data does not leave the EU/EEA in the normal course of operating the platform.

Where we use third-party sub-processors located outside the EU/EEA (for example, a transactional email provider), we ensure transfers are covered by an EU adequacy decision or by the European Commission's Standard Contractual Clauses (SCCs), and we conduct a transfer-impact assessment in line with the Schrems II ruling.

6. Data-Protection by Design and by Default

Article 25 of the GDPR requires us to bake data-protection into the platform's architecture. Concretely, we:

  • Collect the minimum data needed to operate each feature (data minimisation).
  • Default every new memorial to a private setting until the owner publishes it.
  • Encrypt data in transit (TLS 1.2+) and at rest (server-side disk encryption).
  • Limit administrative access on a need-to-know basis with audit logging.
  • Run an annual penetration test and quarterly dependency security review.
  • Maintain a Record of Processing Activities (Art. 30) and a data-breach response runbook.

7. Sub-Processors

We work with a small number of sub-processors to operate the platform. Each is bound by a Data Processing Agreement (Art. 28) that includes confidentiality, security, sub-processing controls, and end-of-contract data deletion. A current list of sub-processors — including the category of service, the country of processing, and the safeguard relied on — is published in our Privacy Policy and updated whenever we make a change.

8. Breach Notification

In the event of a personal-data breach that is likely to result in a risk to your rights and freedoms, we will notify the Lithuanian State Data Protection Inspectorate within 72 hours of becoming aware of it (Art. 33). If the breach is likely to result in a high risk, we will also notify affected users without undue delay (Art. 34), with clear information about what happened and what steps you can take to protect yourself.

9. Data Protection Officer

We have appointed a Data Protection Officer (DPO) who oversees compliance with this page and with the GDPR. You can reach the DPO directly:

Data Protection Officer — MB Eskama
Email: pagalba@memento.uno
Postal: Vilnius, Lithuania, European Union

10. Lodging a Complaint

If you believe we have processed your personal data unlawfully, you have the right to lodge a complaint with a supervisory authority, in particular in the EU member state of your habitual residence, place of work, or place of the alleged infringement (Art. 77).

The Lithuanian authority is the State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija): vdai.lrv.lt.

11. Changes to This Page

We will update this page when our processing activities or sub-processor list changes materially. The "Last updated" date at the top reflects the most recent revision. For substantial changes, we will additionally email registered users with a summary of what's changing and when it takes effect.

12. Contact

For any GDPR-related question, including exercising your rights, you can reach us at:

MB Eskama
Registration code: 305118137
Gedimino pr. 64A-8, LT-01111 Vilnius, Lithuania
European Union
Phone: +370 622 07555

Email: pagalba@memento.uno