GDPR Compliance Policy – recipesbymums

1. Introduction

recipesbymums (the “Website”, “we”, “our”, or “us”) is committed to protecting the privacy and personal data of our visitors, subscribers, and users in accordance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”). This policy explains what personal data we collect, why we collect it, how we safeguard it, and the rights you enjoy under the GDPR. By accessing or using the Website, you acknowledge that you have read and understood the information set out below.

2. Data We Collect

We only process personal data that is necessary for the legitimate purposes described in this policy. The categories of data we collect include:

• Email address – collected when you sign up for our newsletter, submit a comment, or request a recipe.
• Cookies & similar technologies – used to remember your preferences, analyse site traffic, and improve user experience.
• Analytics data – including IP address, browser type, operating system, and pages visited, gathered through Google Analytics and other similar services.

We do not collect sensitive data such as health information, political opinions, or biometric data.

3. Legal Basis for Processing

Under the GDPR, processing of personal data must be based on a lawful basis. For recipesbymums, the primary legal bases are:

• Consent – when you voluntarily provide your email address to receive newsletters or promotional content, you give explicit consent for us to process that data.
• Legitimate Interests – we process analytics and cookie data to improve the Website’s functionality, security, and overall user experience, which constitutes a legitimate interest that does not override your fundamental rights.

If we ever rely on a different lawful basis (e.g., performance of a contract), we will update this policy accordingly.

4. How We Protect Your Data

Security is a top priority. We employ a combination of technical and organisational measures to keep your personal data safe:

• SSL Encryption – all data transmitted between your browser and our servers is encrypted using HTTPS (TLS 1.2 or higher).
• Secure Servers – our hosting environment is protected by firewalls, intrusion‑detection systems, and regular security patches.
• Limited Retention – email addresses are retained only as long as you remain subscribed or until you request deletion. Analytics data is automatically anonymised after 14 months.
• Access Controls – only authorised personnel with a legitimate need can access personal data, and they are bound by confidentiality obligations.

5. Your GDPR Rights

The GDPR grants you a series of rights regarding your personal data. Each right is listed below with a brief description and an icon for easy reference.

• Right to Access

  You may request a copy of the personal data we hold about you, together with information about how we process it.

• Right to Rectification

  If any of your personal data is inaccurate or incomplete, you have the right to have it corrected without undue delay.

• Right to Erasure (Right to be Forgotten)

  You may ask us to delete your personal data when it is no longer necessary for the purposes for which it was collected, or when you withdraw consent.

• Right to Restrict Processing

  You can request that we limit the way we use your data while we verify the accuracy of the information or while we assess a legal claim.

• Right to Data Portability

  You have the right to receive your personal data in a structured, commonly used format, and to transmit it to another controller where technically feasible.

• Right to Object

  You may object to the processing of your personal data for direct marketing purposes or on grounds relating to your particular situation.

• Right to Withdraw Consent

  If we rely on your consent to process data (e.g., newsletter subscription), you may withdraw that consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

6. How to Exercise Your Rights

To exercise any of the rights listed above, please contact us using the details provided in Section 9. Your request should include:

• Your full name and, if applicable, the email address used on the Website.
• A clear description of the right you wish to invoke.
• Any additional information that will help us verify your identity (e.g., a copy of a government‑issued ID). This step is essential to prevent unauthorised access to your data.

We will acknowledge receipt of your request within 5 business days and will act on it without undue delay. In most cases, we will provide a response within the statutory 30‑day period stipulated by the GDPR. If a request is particularly complex or numerous, we may extend the deadline by a further two months, but we will inform you of the extension and the reasons within the original 30‑day window.

7. Response Time

All requests to exercise your GDPR rights are processed within 30 days of receipt, in line with Article 12 of the GDPR. As noted above, we may extend this period by up to two additional months for particularly complex cases, but you will be notified of any extension before the original deadline expires.

8. Contact Information

If you have any questions about this policy, wish to make a data‑subject request, or need further clarification on how we handle your personal data, please contact our Data Protection Officer at:

9. Updates to This Policy

We review this GDPR Compliance Policy regularly and may update it to reflect changes in legislation, our data‑processing activities, or improvements to our security measures. Any revisions will be posted on this page with a new “Last Updated” date. Continued use of the Website after such updates constitutes acceptance of the revised policy.