GDPR Compliance Policy – mumcooks

1. Introduction

mumcooks (the “Website”, “we”, “our” or “us”) is committed to protecting the privacy and personal data of our users in accordance with the European Union General Data Protection Regulation (EU) 2016/679 (“GDPR”). This policy explains how we collect, use, store, and protect personal data, the legal bases for processing that data, and the rights you have under the GDPR.

2. Data We Collect

We collect and process the following categories of personal data:

• Email address – provided when you subscribe to our newsletter, create an account, or contact us.
• Cookies & similar technologies – used to remember your preferences, analyse site usage and improve the user experience.
• Analytics data – aggregated information such as IP address, browser type, pages visited, and time spent on the site, collected through third‑party analytics services.

We do not collect any sensitive personal data (e.g., health information, political opinions) unless you voluntarily provide it in a support request or similar communication.

3. Legal Basis for Processing

Our processing activities are based on the following lawful grounds:

• Consent – When you actively opt‑in to receive newsletters or accept our cookie banner, you give us explicit consent to process your email address and set non‑essential cookies.
• Legitimate Interests – We process analytics data and essential cookies to improve site performance, security, and user experience, which constitute a legitimate interest that does not override your fundamental rights.

4. How We Protect Your Data

We employ a range of technical and organisational measures to ensure the confidentiality, integrity, and availability of personal data:

• SSL/TLS Encryption – All data transmitted between your browser and our servers is encrypted using HTTPS.
• Secure Servers – Our hosting environment is protected by firewalls, intrusion detection systems, and regular security patches.
• Limited Retention – Email addresses are retained only as long as you remain subscribed or until you request deletion. Analytics data is anonymised after 12 months.
• Access Controls – Only authorised personnel with a legitimate need to access personal data are granted permissions, and all staff receive GDPR training.

5. Your GDPR Rights

Under the GDPR you enjoy a set of specific rights concerning your personal data. Each right is described below, accompanied by an icon for quick reference.

• Right to Access

  You may request confirmation that we are processing your personal data and obtain a copy of that data, together with information about the purposes of processing, categories of data, and recipients.

• Right to Rectification

  If any of your personal data is inaccurate or incomplete, you have the right to request correction or completion without undue delay.

• Right to Erasure (Right to be Forgotten)

  You may ask us to delete your personal data when it is no longer necessary for the purposes for which it was collected, when you withdraw consent, or when you object to the processing and there are no overriding legitimate grounds.

• Right to Restrict Processing

  You can request that we limit the processing of your data while we verify the accuracy of the data, or while we assess the legality of the processing.

• Right to Data Portability

  You have the right to receive your personal data in a structured, commonly used, machine‑readable format and to transmit that data to another controller without hindrance.

• Right to Object

  You may object at any time to the processing of your personal data for direct marketing, scientific/historical research, or statistical purposes. Upon a valid objection, we will cease processing unless we demonstrate compelling legitimate grounds.

• Right to Withdraw Consent

  Where processing is based on your consent, you can withdraw that consent at any time, without affecting the lawfulness of processing carried out before the withdrawal.

6. How to Exercise Your Rights

To exercise any of the rights listed above, please follow these steps:

1. Send a written request to gdpr@mumcooks.com. Include your full name, the email address used on mumcooks, and a clear description of the right you wish to invoke.
2. If you are requesting erasure or restriction, you may optionally provide a reason to help us verify the request.
3. We will acknowledge receipt of your request within 5 business days and will respond with the outcome within 30 calendar days, as required by the GDPR.
4. If we need additional information to confirm your identity, we will contact you promptly. Failure to provide sufficient verification may delay the process.

7. Data Retention

We retain personal data only for as long as necessary:

• Email addresses – retained until you unsubscribe or request deletion.
• Cookies – session cookies expire at the end of the browsing session; persistent cookies are set for a maximum of 12 months unless renewed by a new consent.
• Analytics data – stored in an anonymised form for up to 12 months for trend analysis.

Once the retention period expires, the data is securely deleted or irreversibly anonymised.

8. International Transfers

All processing takes place within the European Economic Area (EEA). If a transfer outside the EEA becomes necessary, we will ensure an adequate level of protection by using Standard Contractual Clauses or other approved mechanisms.

9. Contact Information

If you have any questions, concerns, or wish to exercise your rights, please contact our Data Protection Officer at: