GDPR Policy - Tastykitchenstudio

1. Introduction

At Tastykitchenstudio (“we”, “us”, “our”), we are committed to protecting the privacy and personal data of all users, visitors, and customers. This GDPR Compliance Policy explains what personal data we collect, why we collect it, how we use it, and the rights you have under the General Data Protection Regulation (EU) 2016/679. If you have any questions or concerns, please contact us at [email protected].

2. Types of Personal Data We Collect

Email addresses – Collected when you sign up for our newsletter, create an account, or contact us through our website.
Cookies and Similar Technologies – We use first‑party and third‑party cookies for authentication, session management, and analytics.
Analytics Data – Information gathered via Google Analytics, Matomo, and other analytics platforms to understand traffic patterns and improve our services.
Contact Information – Name, phone number, and address provided when you place an order or request a quote.

All data are processed in accordance with our legal basis and your rights as outlined below.

3. How We Protect Your Personal Data

SSL Encryption – All data transmitted between your browser and our servers is secured with TLS 1.3.
Secure Servers – Hosted on industry‑standard, ISO 27001‑certified infrastructure with regular penetration testing.
Access Controls – Strict role‑based access, two‑factor authentication, and audit logs limit who can view or modify personal data.
Data Retention – Personal data is retained only for the period necessary to fulfill the purpose for which it was collected (e.g., 12 months after the last interaction unless a longer retention is required by law).
Data Minimisation – We collect only the minimum amount of data needed to deliver our services.

4. Legal Basis for Processing

We process personal data on the following lawful bases:

Consent – For marketing emails, newsletter subscriptions, and optional cookie usage. Consent is freely given, specific, informed, and unambiguous.
Legitimate Interest – For analytics, improving website functionality, and ensuring security. We conduct a legitimate interest assessment to balance our interests against your privacy rights.
Contractual Necessity – When you place an order or request services, we process your data to fulfill the contract.
Legal Obligation – For tax, accounting, and regulatory compliance.

5. Your GDPR Rights

Under the GDPR, you have the following rights regarding your personal data. You can exercise any of these rights by contacting us at [email protected]. We will respond within 30 days.

Right to Access

You may request a copy of the personal data we hold about you, the purposes of processing, and the categories of data.

Right to Rectification

If your data are inaccurate or incomplete, you can request corrections or updates.

Right to Erasure

Under certain circumstances, you can request the deletion of your data (e.g., data no longer needed, withdrawal of consent).

Right to Restrict Processing

You can limit how we use your data while we verify its accuracy or resolve disputes.

Right to Data Portability

Request a structured, machine‑readable copy of your data and, if feasible, transfer it directly to another controller.

Right to Object

Object to processing based on legitimate interest, direct marketing, or profiling, and to data processing for scientific or historical research.

Right to Withdraw Consent

You can withdraw consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

6. How to Exercise Your Rights

To exercise any of the rights above, please submit a written request to:

Tastykitchenstudio
Data Protection Officer
Email: [email protected]
Phone: +44 20 1234 5678 (optional)

When contacting us, please provide:

Your full name and contact details.
A clear statement of the right you wish to exercise.
Any supporting evidence or identification to confirm your identity.

We will respond within 30 days, as required by the GDPR. If we need more time, we will inform you of the reason and the new expected response date.

7. Data Retention and Deletion

We retain personal data only for as long as necessary:

Email addresses – 12 months after the last interaction unless you request deletion earlier.
Cookies – Session cookies are deleted when the session ends; persistent cookies are retained for up to 2 years unless you opt‑out.
Analytics data – Aggregated data is stored for 12 months; raw data is deleted within 30 days of collection.

After the retention period, all personal data are securely erased or anonymised.

GDPR Compliance Policy – Tastykitchenstudio