GDPR Compliance Policy – Flavor Cooking Spot

Last Updated: April 03, 2026

1. Introduction

Flavor Cooking Spot (the “Company”, “we”, “our”, or “us”) respects your privacy and is committed to protecting your personal data in accordance with the General Data Protection Regulation (EU) 2016/679 (GDPR). This policy explains how we collect, use, store, and share information about you, and describes your rights under the GDPR. By using our website, you acknowledge that you have read and understood this policy.

2. Types of Personal Data We Collect

Email Addresses: When you subscribe to our newsletter, create an account, or contact us, we collect your email address.
Cookies & Similar Technologies: We use first‑party and third‑party cookies to remember your preferences, analyse traffic, and personalise content.
Analytics Data: We use Google Analytics and Matomo to collect anonymised statistics such as page views, session duration, and geographical location.

3. Legal Basis for Processing

Our processing activities are based on the following lawful bases:

Consent: When you explicitly opt‑in to receive marketing emails or enable personalised content, we process your data on the basis of your consent.
Legitimate Interest: We process data necessary for the operation of our website, such as analytics and cookie usage, because it is in our legitimate interest to provide a quality user experience and improve our services.
Contractual Necessity: When you sign up for a paid subscription, we process your email and payment information to fulfil the contract.

4. How We Protect Your Personal Data

We implement a range of technical and organisational measures to safeguard your data:

Encryption: All data transmitted between your browser and our servers is protected by TLS 1.3 (HTTPS).
Secure Servers: Our servers are hosted in EU‑based data centres with redundant power, fire suppression, and 24/7 monitoring.
Limited Retention: We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by law. Email addresses are deleted after 12 months of inactivity, while analytics data is retained for 6 months.
Access Controls: Only authorised staff members have access to personal data, and all staff undergo privacy training.

5. Your GDPR Rights

Right to Access

You may request a copy of the personal data we hold about you. We will provide you with a summary of the categories of data, the sources, the purposes of processing, and the recipients.

Right to Rectification

If any of your personal data is inaccurate or incomplete, you can request that we correct it promptly.

Right to Erasure

Under certain circumstances, you can ask us to delete your personal data. We will comply unless we have a legal obligation to retain it.

Right to Restrict Processing

You may request that we limit the processing of your personal data, for example, while we verify its accuracy.

Right to Data Portability

We can provide you with your personal data in a structured, commonly used, and machine‑readable format, enabling you to transfer it to another controller.

Right to Object

You have the right to object to processing that is based on legitimate interests, including direct marketing. Upon objection, we will stop processing unless we can demonstrate compelling legitimate grounds.

Right to Withdraw Consent

At any time, you can withdraw consent for any processing activity. We will cease processing the data used for that purpose and delete it if possible.

6. How to Exercise Your Rights

To exercise any of the rights listed above, please contact us at [email protected]. In your request, provide:

Full name and contact details.
Specific request (e.g., “I would like to exercise my right to erasure”).
Any supporting documentation that verifies your identity.

We will respond to your request within 30 calendar days, as required by the GDPR. If we need additional time, we will inform you of the reasons and the new deadline.

7. Data Sharing and Third‑Party Processors

We only share your data with third parties when necessary for the purposes described in this policy. For example, we use Google Analytics and Matomo for analytics, and Mailchimp for email marketing. All processors sign data processing agreements that impose GDPR‑compliant obligations. We regularly review these agreements to ensure ongoing compliance.

8. Data Breach Notification

In the unlikely event of a personal data breach, we will assess the risk, notify the relevant supervisory authority within 72 hours if required, and inform affected individuals if the breach poses a high risk to their rights and freedoms.

9. Changes to This Policy

We may update this policy from time to time. Any changes will be posted on this page with an updated “Last Updated” date. Continued use of our website after changes constitutes your acceptance of the revised policy.

10. Contact Us

If you have any questions or concerns about this policy or your personal data, please contact our Data Protection Officer:

Flavor Cooking Spot
[email protected]