GDPR Compliance Policy

Last Updated: December 01, 2025

1. Introduction

Tastykitchenbox (the “Company”, “we”, “our”, or “us”) respects the privacy of our users and is committed to protecting personal data in accordance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”). This policy explains what personal data we collect, how we process it, the legal bases for processing, the security measures we employ, and the rights you enjoy under the GDPR. If you have any questions or wish to exercise any of your rights, please contact us at gdpr@tastykitchenbox.com.

2. Personal Data We Collect

We only collect data that is necessary for the provision of our services and for improving the user experience. The categories of personal data we process include:

Email address – used for order confirmations, newsletters, and customer support.
Cookies and similar tracking technologies – enable us to remember preferences, analyse site traffic, and deliver personalised content.
Analytics data – aggregated information such as IP address, device type, browser, and pages visited, collected via Google Analytics and other tools.

We do not collect sensitive categories of data (e.g., health, political opinions, or biometric data) unless you voluntarily provide them through a specific request.

3. How We Protect Your Data

Security is a core principle of our data‑processing activities. We implement a range of technical and organisational measures to safeguard personal data, including:

SSL/TLS encryption for all data transmitted between your browser and our servers.
Secure servers hosted in GDPR‑compliant data centres with regular security audits.
Limited retention periods – personal data is retained only as long as necessary for the purposes for which it was collected, after which it is securely deleted or anonymised.
Access controls – only authorised personnel with a legitimate business need can access personal data.

4. Legal Basis for Processing

Under the GDPR, we must have a lawful basis for each processing activity. Our bases are:

Consent – when you subscribe to our newsletter or agree to receive promotional emails, you provide explicit consent.
Legitimate interest – processing such as analytics, fraud prevention, and improving website functionality is based on our legitimate interest, balanced against your rights and freedoms.

If we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing based on consent before its withdrawal.

5. Your GDPR Rights

As a data subject, you enjoy the following rights. Each right is accompanied by a Bootstrap icon for quick reference.

Right to Access

You may request confirmation that we process your personal data and obtain a copy of the data we hold. This includes information about the purposes of processing, categories of data, and recipients of the data.

Right to Rectification

If any of your personal data is inaccurate or incomplete, you have the right to request that we correct or complete it without undue delay.

Right to Erasure (Right to be Forgotten)

You may ask us to delete your personal data where it is no longer necessary for the purposes for which it was collected, or where you withdraw consent and no other legal basis applies.

Right to Restrict Processing

You can request that we limit the processing of your data while we verify the accuracy of the data or assess the legality of the processing.

Right to Data Portability

You have the right to receive your personal data in a structured, commonly used, machine‑readable format and to transmit that data to another controller without hindrance.

Right to Object

You may object to the processing of your data for direct marketing, scientific/historical research, or statistical purposes. We will cease processing unless we demonstrate compelling legitimate grounds that override your interests.

Right to Withdraw Consent

Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing based on consent before its withdrawal.

6. How to Exercise Your Rights

To exercise any of the rights listed above, please submit a written request to our Data Protection Officer at gdpr@tastykitchenbox.com. Your request should include:

Your full name and contact details (email address is sufficient).
A clear description of the right you wish to invoke.
Any additional information that helps us identify the data (e.g., order number, newsletter subscription email).

We will acknowledge receipt of your request within 5 business days and will respond no later than 30 calendar days, as required by the GDPR. If the request is complex or numerous, we may extend the period by an additional two months, but we will inform you of the extension and the reasons for it within the original 30‑day timeframe.

7. International Transfers

Tastykitchenbox operates primarily within the European Economic Area (EEA). When personal data is transferred outside the EEA (e.g., to our email service provider), we ensure that appropriate safeguards are in place, such as Standard Contractual Clauses approved by the European Commission.

8. Changes to This Policy

We may update this GDPR Compliance Policy from time to time to reflect changes in our practices or legal requirements. Any material changes will be posted on this page with an updated “Last Updated” date. Continued use of the Tastykitchenbox website after such updates constitutes acceptance of the revised policy.

9. Contact Information

If you have any questions about this policy, the data we hold about you, or wish to lodge a complaint, please contact our Data Protection Officer:

Tastykitchenbox – Data Protection Officer
Email: gdpr@tastykitchenbox.com
Address: 123 Flavor Street, Kitchen City, 56789, United Kingdom

You also have the right to lodge a complaint with a supervisory authority in the EU member state where you reside, work, or where the alleged infringement took place.