GDPR Compliance Policy

Effective Date: December 01, 2025

1. Introduction

Welcome to recipesbyeva (https://recipesbyeva.com). We respect your privacy and are committed to protecting the personal data we process in accordance with the European Union’s General Data Protection Regulation (GDPR) (Regulation (EU) 2016/679). This policy explains what personal data we collect, why we collect it, how we protect it, and the rights you enjoy under the GDPR.

2. Data We Collect

We only collect data that is necessary for providing and improving our services. The categories of personal data we process include:

Email address – supplied when you subscribe to our newsletter, comment on a recipe, or contact us.
Cookies and similar tracking technologies – used to remember your preferences, analyse site usage, and deliver personalized content.
Analytics data – aggregated information such as page views, device type, and referral source, collected via Google Analytics and other services.

3. Legal Basis for Processing

We rely on the following lawful bases to process your personal data:

Consent (Article 6(1)(a)) – when you voluntarily provide your email address for newsletters or marketing communications, you give explicit consent.
Legitimate Interests (Article 6(1)(f)) – for activities such as website security, fraud prevention, and improving user experience through analytics.

4. How We Protect Your Data

We employ a range of technical and organisational measures to safeguard your personal data:

SSL/TLS Encryption – all data transmitted between your browser and our servers is encrypted using HTTPS.
Secure Servers – our hosting environment is hosted in ISO‑27001‑certified data centres with regular security audits.
Limited Retention – email addresses are retained only as long as you remain subscribed or until you request deletion. Analytics data is anonymised after 12 months.
Access Controls – only authorised personnel with a legitimate need can access personal data, and all access is logged.

5. Your GDPR Rights

Under the GDPR you have a series of rights regarding your personal data. Each right is illustrated with a Bootstrap Icon for quick reference.

Right to Access

You may request confirmation that we are processing your personal data and obtain a copy of that data in a structured, commonly used format.

Right to Rectification

If any of your personal data is inaccurate or incomplete, you have the right to have it corrected without undue delay.

Right to Erasure (“Right to be Forgotten”)

You may ask us to delete your personal data where there is no compelling reason for its continued processing.

Right to Restrict Processing

You can request that we limit the way we use your data while we verify the accuracy of the information or while a dispute is resolved.

Right to Data Portability

You have the right to receive your personal data in a machine‑readable format and to transmit it to another controller where technically feasible.

Right to Object

You may object to the processing of your data for direct marketing, scientific/historical research, or when processing is based on legitimate interests.

Right to Withdraw Consent

If processing is based on your consent, you may withdraw that consent at any time, without affecting the lawfulness of processing before the withdrawal.

6. How to Exercise Your Rights

To exercise any of the rights listed above, please contact us using the details provided in Section 9. In your request, include:

Your full name and the email address associated with the data.
A clear description of the right you wish to invoke (e.g., “I would like to exercise my Right to Erasure”).
Any additional information that will help us verify your identity (e.g., a recent order number or subscription ID).

We will acknowledge receipt of your request within 5 business days and aim to respond within the statutory 30‑day period. If additional time is required, we will inform you of the reasons and the expected completion date.

7. Data Retention Periods

We retain personal data only for as long as necessary:

Email addresses – retained until you unsubscribe or request deletion, after which they are removed from active databases within 30 days.
Cookies & analytics – session cookies expire at the end of the browsing session; persistent cookies are set for a maximum of 12 months. Aggregated analytics data is retained for up to 24 months before being anonymised.

8. International Data Transfers

All personal data is processed on servers located within the European Economic Area (EEA). If a transfer outside the EEA becomes necessary (e.g., for third‑party analytics), we will ensure that appropriate safeguards—such as Standard Contractual Clauses—are in place.

9. Contact Information

If you have any questions about this policy, wish to exercise your rights, or need further assistance, please contact our Data Protection Officer at:

recipesbyeva
Email: gdpr@recipesbyeva.com

10. Changes to This Policy

We review this policy regularly and may update it to reflect changes in our practices or applicable law. Any material changes will be posted on this page with an updated “Last Updated” date. Continued use of the site after such updates constitutes acceptance of the revised policy.

Last Updated: December 01, 2025