GDPR Compliance Policy

1. Introduction

kitchenmumsecrets (https://kitchenmumsecrets.com) is committed to protecting the personal data of its visitors, subscribers, and users in accordance with the European Union’s General Data Protection Regulation (GDPR) (Regulation (EU) 2016/679). This policy explains what personal data we collect, why we collect it, how we safeguard it, and the rights you have under the GDPR. If you have any questions or wish to exercise any of your rights, please contact us at gdpr@kitchenmumsecrets.com.

2. Personal Data We Collect

We only process personal data that is necessary for the legitimate purposes described below. The categories of data we collect include:

• Email addresses – collected when you subscribe to our newsletter, request a recipe, or contact us via the website.
• Cookies and similar tracking technologies – used to remember your preferences, analyse site usage, and improve the user experience.
• Analytics data – aggregated information such as IP address, device type, browser, and pages visited, generated by third‑party analytics services (e.g., Google Analytics) that we configure to anonymise IP addresses where possible.

We do not collect sensitive data (e.g., health information, political opinions) and we never request financial or payment details unless you voluntarily purchase a product through a secure, third‑party payment gateway.

3. How We Protect Your Data

Security is a core principle of our data handling practices. We employ the following technical and organisational measures:

• SSL/TLS encryption – all data transmitted between your browser and our servers is encrypted using HTTPS.
• Secure servers – our web‑hosting environment is protected by firewalls, intrusion‑detection systems, and regular security patches.
• Limited retention periods – email addresses are retained only as long as you remain subscribed or until you request deletion. Analytics data is stored in an aggregated, anonymised form for a maximum of 12 months.
• Access controls – only authorised personnel have access to personal data, and they must adhere to strict confidentiality obligations.

While we strive to protect your data, no transmission over the Internet can be guaranteed to be 100 % secure. In the unlikely event of a data breach, we will notify the relevant supervisory authority and affected individuals in accordance with GDPR requirements.

4. Legal Basis for Processing

We rely on the following lawful bases to process personal data:

• Consent (Article 6(1)(a)) – when you voluntarily provide your email address to receive newsletters or promotional content, you give explicit consent for us to send you communications.
• Legitimate interests (Article 6(1)(f)) – we process cookies and analytics data to improve site performance, understand visitor behaviour, and enhance the overall user experience. Your interests are balanced against our legitimate business needs, and you may object at any time (see Section 5).

5. Your GDPR Rights

Under the GDPR you have a series of rights concerning your personal data. Each right is explained below, accompanied by a Bootstrap icon for quick reference.

6. How to Exercise Your Rights

To exercise any of the rights described above, please send a written request to:

Your request should include sufficient detail to allow us to verify your identity (e.g., the email address used for subscription) and to locate the relevant data. We may ask for additional information if necessary, but we will keep any extra data only for the purpose of handling your request.

We will acknowledge receipt of your request within five (5) business days and will provide a substantive response no later than thirty (30) calendar days, in line with GDPR Article 12. If we need more time due to the complexity or number of requests, we will inform you of the extension and the reasons for it within the initial 30‑day period.

7. Data Retention

We retain personal data only for as long as necessary:

• Email addresses – retained until you unsubscribe or request deletion. Inactive subscriptions are automatically removed after 24 months of non‑engagement.
• Cookies – session cookies expire when the browser is closed; persistent cookies are set for a maximum of 12 months unless you delete them earlier.
• Analytics data – stored in an aggregated, anonymised form for up to 12 months, after which it is automatically purged.

When the retention period expires, we securely delete or anonymise the data in accordance with industry best practices.

8. International Transfers

All processing takes place on servers located within the European Economic Area (EEA). If a third‑party service processes data on our behalf and is located outside the EEA, we ensure that appropriate safeguards (Standard Contractual Clauses or EU‑US Privacy Shield equivalents) are in place.

9. Changes to This Policy

We may update this GDPR Compliance Policy from time to time to reflect changes in our practices or legal requirements. Any revisions will be posted on this page with an updated “Last Updated” date. Continued use of the website after such changes constitutes acceptance of the revised policy.