Kitchenflavorhub GDPR Compliance Policy

Introduction

Kitchenflavorhub (“we”, “our”, “us”) is committed to protecting the privacy and personal data of our users in full compliance with the General Data Protection Regulation (GDPR) and related EU data‑protection laws. This policy explains the types of personal data we collect, how we use it, the legal bases for processing, and your rights under the GDPR. For any questions or to exercise your rights, please contact us at [email protected].

Types of Data We Collect

• Email addresses – Collected when you sign up for newsletters, create an account, or place an order. Used for account management, order updates, and marketing communications.
• Cookies and similar technologies – We use first‑party and third‑party cookies to remember your preferences, analyze site usage, and personalize content. Cookies are also used for session management and fraud prevention.
• Analytics data – We employ Google Analytics (or equivalent) to collect anonymized traffic data, including IP addresses (hashed), device information, and browsing patterns, to improve site performance and user experience.
• Optional user‑generated content – Comments, reviews, and recipe submissions are stored with your user profile for display on the site.

How We Protect Your Data

We implement a comprehensive set of technical and organisational measures to safeguard personal data:

• SSL/TLS Encryption – All data transmitted between your browser and our servers is encrypted using industry‑standard SSL/TLS protocols.
• Secure Servers – Our hosting environment is located in EU‑compliant data centres with strict physical security controls, regular penetration testing, and automated threat monitoring.
• Limited Data Retention – Personal data is retained only for as long as necessary to fulfil the purposes for which it was collected. For example, email addresses are kept for the duration of your account or until you request deletion.
Access Controls – Only authorised staff with a legitimate business need can access personal data. All staff undergo regular data‑protection training.
Data Backups – Backups are encrypted and stored in separate, secure locations. They are retained for a maximum of 90 days and then securely destroyed.

Legal Basis for Processing

We process personal data based on the following legal bases, as defined by Article 6 of the GDPR:

• Consent – When you voluntarily provide your email address or opt‑in to marketing communications, we rely on your explicit consent.
• Legitimate Interest – We process data such as analytics and cookie usage to improve our services, detect fraud, and comply with legal obligations. We conduct a balancing test to ensure that our interests do not override your rights.
• Contractual Necessity – Processing of order details and account information is essential for the performance of the contract between us and you.

Your GDPR Rights

The GDPR grants you a range of rights regarding your personal data. Below we explain each right, the conditions that apply, and how you can exercise them.

Right to Access

You have the right to obtain confirmation that we are processing your personal data and, where applicable, to receive a copy of that data. To request access, email us at [email protected]. We will respond within 30 days with the information you requested, free of charge.

Right to Rectification

If any of your personal data is inaccurate or incomplete, you may request that we correct or complete it. Submit a rectification request via the same contact email, and we will rectify the data within 30 days.

Right to Erasure (Right to be Forgotten)

You may ask us to delete your personal data that is no longer necessary for the purposes for which it was collected. Exceptions apply where we must retain data to comply with legal obligations. Please send a deletion request to [email protected]. We will comply within 30 days, unless we have a lawful basis to retain it.

Right to Restrict Processing

You can request that we limit the processing of your data, for example while we investigate its accuracy. During this period, we will store but not process your data further. Contact us to exercise this right, and we will comply within 30 days.

Right to Data Portability

You may receive your personal data in a structured, commonly used, and machine‑readable format, and transfer it to another controller. Submit a portability request, and we will provide the data within 30 days, unless the request is technically infeasible.

Right to Object

You can object to the processing of your data for direct marketing or profiling purposes. If you object, we will stop processing your data for those purposes immediately, except where we can demonstrate compelling legitimate grounds. Notify us via email; we will respond within 30 days.

Right to Withdraw Consent

If you gave us consent to process your data, you may withdraw it at any time. Withdrawal does not affect the lawfulness of any processing carried out before the withdrawal. Send your withdrawal request to [email protected], and we will honour it within 30 days.

How to Exercise Your Rights

To exercise any of the rights listed above, please send a written request to the following email address: [email protected]. Include your full name, contact details, a description of the request, and any supporting documents that help us identify you. We will confirm receipt of your request and provide a reference number for tracking.

All requests will be processed within 30 days, as stipulated by Article 12(3) of the GDPR. If we need additional information to verify your identity or clarify the scope of your request, we will contact you promptly. If we are unable to comply within the statutory period, we will provide a reason for the delay and an estimate of the new completion date.

Data Retention Policy

Personal data is retained only for as long as necessary to fulfil the purposes outlined in this policy or to comply with legal obligations. Typical retention periods are:

• Email addresses – Until account deletion or withdrawal of consent.
• Cookie data – 2 years, after which we delete all identifiers.
• Analytics data – 6 months, after which only aggregated metrics remain.
• User‑generated content – Until the user deletes their account or content.

After the retention period, data is securely deleted or anonymised to prevent re‑identification.

Contact Us

For any questions about this policy, to report a data breach, or to exercise your rights, please contact our Data Protection Officer:

Data Protection Officer (DPO)
Kitchenflavorhub
Email: [email protected]
Phone: +44 20 7946 0958 (UK) – or +1 800 123 4567 (US)
Address: 12 Culinary Lane, London, UK