Mealflavorspot GDPR Compliance Policy

Last Updated: April 03, 2026

1. Introduction

Mealflavorspot (the “Site”) is committed to protecting your personal data and respecting your privacy rights. This policy explains how we collect, use, store and share information that you provide to us, and how you can exercise the rights granted to you under the General Data Protection Regulation (GDPR) and the UK Data Protection Act 2018.

2. Data We Collect

We collect the following types of data when you interact with the Site:

• Email addresses: When you sign up for newsletters, create an account or place an order, we store your email address to send you relevant information and marketing communications.
• Cookies: The Site uses first‑party cookies to remember your preferences, keep you logged in, and improve your browsing experience.
• Analytics data: We use Google Analytics and similar services to collect anonymous usage data, such as pages visited, time spent on the Site, and referral sources. This data is aggregated and does not identify you personally.

3. Legal Basis for Processing

We process your data on the following legal bases:

• Consent: For marketing emails and newsletters, we rely on your explicit consent, which you can withdraw at any time.
• Legitimate interest: For analytics, we rely on legitimate interest to improve the Site, provided that this interest does not override your privacy interests.
• Contractual necessity: For order fulfilment, we process data necessary to deliver and invoice your purchases.

4. How We Protect Your Data

We implement technical and organisational measures to safeguard your personal data:

• SSL encryption: All data transmitted between your browser and our servers is encrypted using TLS 1.3.
• Secure servers: We host data on certified data centres with redundant power, fire suppression, and 24/7 monitoring.
• Limited retention: Personal data is retained only for as long as necessary to fulfil its purpose, after which it is securely deleted or anonymised.

5. GDPR Rights You Have

Under the GDPR, you have the following rights with respect to your personal data. Each right is illustrated with an icon for quick reference.

Right to Access

You can request a copy of the personal data we hold about you, including the purposes of processing and the categories of data. We will provide this information in a concise, intelligible format within 30 days.

Right to Rectification

If any of your personal data is inaccurate or incomplete, you can request us to correct it. We will update your data promptly and confirm the changes.

Right to Erasure (Right to be Forgotten)

Where lawful, you can ask us to delete your personal data. We will remove data that is no longer needed for the purpose it was collected, subject to legal obligations to retain it (e.g., for tax or contractual reasons).

Right to Restrict Processing

You may request that we restrict the processing of your data, for example while we verify the accuracy of the information. During this period, we will only store or use your data for legitimate purposes and for a limited time.

Right to Data Portability

You can obtain the personal data we hold in a structured, commonly used and machine‑readable format, and transfer it to another controller if you wish.

Right to Object

You may object to the processing of your data for direct marketing, profiling or other purposes. Upon receiving an objection, we will stop processing unless we can demonstrate compelling legitimate grounds that override your interests.

Right to Withdraw Consent

If we rely on your consent, you can withdraw it at any time. Withdrawal will not affect the legality of any processing carried out before the withdrawal.

6. How to Exercise Your Rights

To exercise any of the above rights, please contact our Data Protection Officer at [email protected]. In your request, include:

• Your full name and contact details.
• Specific information about the request (e.g., “I want to delete my email address”).
• Any supporting evidence or documentation that helps us identify your data.

We will respond to your request within 30 days. If you need a faster response, we may contact you for clarification, which could extend the timeline slightly.

7. Retention of Personal Data

We retain personal data only for as long as necessary to fulfil the purposes outlined in this policy and for compliance with legal obligations. Typical retention periods include:

• Email addresses: up to 2 years after the last interaction, unless you opt‑in for longer retention.
• Cookies: session cookies are deleted when you close the browser; persistent cookies are deleted after 6 months.
• Analytics: anonymised data is retained for 12 months to inform business decisions.

8. Data Sharing and Transfers

We do not sell or trade your personal data. We may share data with:

• Payment processors for transaction processing.
• Third‑party analytics services (e.g., Google Analytics) that process data under a Data Processing Agreement.
• Legal authorities if required by law.

Any data transfer outside the European Economic Area (EEA) is conducted in compliance with GDPR safeguards, such as Standard Contractual Clauses.

9. Contact Information

If you have any questions about this policy or wish to lodge a complaint with a supervisory authority, please contact:

Mealflavorspot Data Protection Officer
Email: [email protected]
Address: 123 Foodie Lane, Taste City, 45678, UK

10. Updates to this Policy

We reserve the right to modify this policy at any time. The updated version will be posted on the Site and will become effective immediately upon publication. Your continued use of the Site constitutes acceptance of the revised terms.