GDPR Policy - flavormealpress

1. Introduction

FlavorMealPress (the “Website”) is committed to protecting your privacy and ensuring that your personal data is processed in accordance with the European Union’s General Data Protection Regulation (GDPR) and related data‑protection legislation. This policy explains how we collect, use, store, and safeguard your personal information, as well as your rights as a data subject. If you have any questions or concerns, please contact us at [email protected].

2. Types of Personal Data We Collect

Email addresses – collected when you sign up for newsletters, request recipes, or contact us through the website.
Cookies and similar tracking technologies – used to remember your preferences, analyze traffic, and personalize content.
Analytics data – including IP addresses, device type, and page views, collected via Google Analytics and other third‑party services.

We do not collect sensitive personal data (e.g., race, health information) unless explicitly provided by you for specific services (such as dietary consultations) and only after obtaining explicit consent.

3. Legal Basis for Processing

Our processing activities are based on the following lawful bases:

Consent: For newsletters, marketing emails, and optional personalization features you must actively opt‑in. Consent must be freely given, specific, informed, and unambiguous.
Legitimate Interest: For essential website operations, security, and analytics that help us improve user experience. We conduct a balancing test to ensure that our interests do not override your fundamental rights.

4. How We Protect Your Personal Data

SSL/TLS Encryption: All data transmitted between your browser and our servers is encrypted via HTTPS.
Secure Servers: We host data on encrypted, access‑controlled servers in compliance with ISO/IEC 27001.
Limited Retention: Personal data is retained only for as long as necessary to fulfil the purpose for which it was collected, or as required by law. Email addresses are automatically deleted after 12 months of inactivity, cookies are cleared after 30 days, and analytics logs are retained for 90 days.
Access Controls: Only authorised staff with a legitimate need can access personal data. All staff receive GDPR training annually.

5. Your GDPR Rights

Right to Access

You have the right to request a copy of the personal data we hold about you, along with information on how we use it. Submit a request via email to [email protected].

Right to Rectification

If any of your personal data is inaccurate or incomplete, you can ask us to correct it. Provide the specific information that needs updating and we will rectify it promptly.

Right to Erasure

Under certain circumstances, you may request the deletion of your personal data. This includes data that is no longer necessary, or if you withdraw consent for processing. We will delete or anonymise the data unless a legal obligation requires us to retain it.

Right to Restrict Processing

You can request that we temporarily stop processing your data, for example while we verify its accuracy. During this period, we will retain the data but will not use it for any purpose beyond the restriction.

Right to Data Portability

You may obtain your personal data in a structured, commonly used, and machine‑readable format. We will provide the data in a CSV or JSON file, unless it is impractical or would compromise the security of other parties.

Right to Object

You can object to the processing of your data for direct marketing or profiling. If you do so, we will stop using your data for those purposes and will provide you with an alternative service if possible.

Right to Withdraw Consent

You may withdraw consent at any time. This does not affect the lawfulness of any processing carried out before withdrawal. To withdraw, simply unsubscribe from newsletters or send an email to [email protected].

6. How to Exercise Your Rights

To exercise any of the rights listed above, please send a clear, written request to [email protected]. Include the following details to help us identify you and process your request efficiently:

Your full name
Email address or phone number we have on file
Specific request (e.g., “I wish to delete all personal data stored about me”)
Any supporting documentation (e.g., proof of identity) if necessary

We will respond to your request within 30 days of receipt. If we need more time to verify your identity or assess the request, we will inform you and provide a new deadline.

7. Data Retention and Deletion

We retain personal data only for as long as necessary to fulfill the purpose for which it was collected or to comply with legal obligations. Our retention periods are:

Email addresses: 12 months of inactivity
Cookies: 30 days (unless you manually delete them)
Analytics logs: 90 days

After these periods, we securely delete the data. If you request deletion before the end of the retention period, we will comply within the 30‑day response window.

8. Changes to This Policy

We may update this policy from time to time. Any changes will be posted on this page with a new “Last Updated” date. We encourage you to review the policy periodically to stay informed about how we handle your personal data.

9. Contact Us

For any questions, concerns, or to exercise your rights, please contact our Data Protection Officer at [email protected]. We will respond within 30 days.

GDPR Compliance Policy – FlavorMealPress