GDPR Policy - tastybyma

1. Introduction

Tastybyma (https://tastybyma.com) is committed to protecting the privacy and personal data of its users, customers, and visitors. This GDPR (General Data Protection Regulation) Compliance Policy explains how we collect, process, store, and safeguard personal data in accordance with EU Regulation (EU) 2016/679. By using our website, you acknowledge that you have read, understood, and agreed to the practices described herein.

2. Data We Collect

We only collect personal data that is necessary for the legitimate operation of our services. The categories of data we process include:

Email address: collected when you subscribe to newsletters, create an account, or contact us.
Cookies and similar tracking technologies: used to remember your preferences, analyse site usage, and improve user experience.
Analytics data: aggregated information such as IP address, device type, browser, and pages visited, processed via third‑party analytics services.

We do not collect sensitive data (e.g., health, political opinions, or biometric data) unless you voluntarily provide it, in which case it will be treated with the same level of protection.

3. Legal Basis for Processing

Our processing activities are based on the following lawful grounds under GDPR:

Consent (Article 6(1)(a)): When you sign up for newsletters or accept cookies, you explicitly consent to the processing of your data for those specific purposes.
Legitimate Interests (Article 6(1)(f)): We process analytics data and use cookies to improve website performance, security, and marketing effectiveness, which constitute legitimate business interests.

In all cases, we ensure that your rights are not overridden by our legitimate interests, and you may withdraw consent at any time.

4. How We Protect Your Data

Tastybyma employs a layered security approach to protect personal data from accidental loss, unauthorized access, or disclosure:

Encryption in transit: All data transmitted between your browser and our servers is encrypted using SSL/TLS (HTTPS).
Secure servers: Our hosting environment is hardened, regularly patched, and monitored 24/7 for suspicious activity.
Access controls: Only authorized personnel with a legitimate need can access personal data, and they are required to sign confidentiality agreements.
Limited retention: Personal data is retained only for as long as necessary to fulfil the purpose for which it was collected, after which it is securely deleted or anonymised.

5. Your GDPR Rights

Under GDPR, you enjoy a series of fundamental rights concerning your personal data. Each right is listed below with a brief description and an accompanying Bootstrap Icon for quick reference.

Right to Access

You may request a copy of the personal data we hold about you, together with information about how we process it.

Right to Rectification

If any of your personal data is inaccurate or incomplete, you have the right to have it corrected without undue delay.

Right to Erasure (Right to be Forgotten)

You may ask us to delete your personal data when it is no longer necessary for the purposes for which it was collected, or if you withdraw consent.

Right to Restrict Processing

You can request that we limit the processing of your data while we verify its accuracy or while a dispute is being resolved.

Right to Data Portability

You may receive your personal data in a structured, commonly used, machine‑readable format and transmit it to another controller.

Right to Object

You have the right to object, on grounds relating to your particular situation, to the processing of your data for direct marketing or legitimate interest purposes.

Right to Withdraw Consent

Where processing is based on consent, you may withdraw that consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

6. How to Exercise Your Rights

To exercise any of the rights listed above, please contact our Data Protection Officer (DPO) using the details provided in Section 8. Your request must be made in writing (email is acceptable) and should include sufficient information for us to verify your identity.

Upon receipt of a valid request, we will:

Acknowledge receipt within 5 business days.
Assess the request and determine the appropriate action.
Provide the requested information or take the required action within 30 calendar days, unless a longer period is necessary due to complexity, in which case we will inform you of the extension and its reasons.

7. Data Retention

We retain personal data only for the period required to fulfil the purpose for which it was collected, as follows:

Email subscriptions: retained until you unsubscribe or request erasure.
Analytics data: retained for a maximum of 24 months in an aggregated, non‑identifiable form.
Cookies: session cookies expire at the end of the browsing session; persistent cookies are stored for up to 12 months unless you delete them earlier.

When the retention period expires, we securely delete or anonymise the data in accordance with industry best practices.

8. Contact Information

If you have questions about this policy, wish to exercise your GDPR rights, or need further assistance, please contact our Data Protection Officer:

Tastybyma – Data Protection Officer
Email: gdpr@tastybyma.com
Website: https://tastybyma.com

9. Changes to This Policy

We may update this GDPR Compliance Policy from time to time to reflect changes in our practices or legal requirements. Any revisions will be posted on this page with an updated “Last Updated” date. We encourage you to review the policy periodically.

GDPR Compliance Policy