GDPR Compliance Policy

Effective Date: December 06, 2025

Contact for Data‑Protection Queries: gdpr@cozykitchenfood.com

What Personal Data We Collect

Cozy Kitchen Food (the “Company”, “we”, “us”, or “our”) processes personal data in order to provide a safe, personalized, and enjoyable experience on our website. The categories of personal data we collect include:

Email address: collected when you subscribe to our newsletter, request a recipe, or contact us.
Cookies and similar tracking technologies: used to remember your preferences, analyse site traffic, and improve functionality. This includes first‑party session cookies, analytics cookies (e.g., Google Analytics), and marketing cookies when you consent.
Analytics data: aggregated information such as pages visited, time spent on each page, and device/browser details. This data is anonymised wherever possible.

Legal Basis for Processing

Under the General Data Protection Regulation (GDPR), we rely on the following lawful bases for processing your personal data:

Consent (Article 6(1)(a)): When you voluntarily provide your email address or accept cookies, you give us explicit consent to process that data for the purposes described at the point of collection.
Legitimate Interests (Article 6(1)(f)): We process analytics data and use cookies to improve website performance, security, and user experience. Our legitimate interests are balanced against your fundamental rights and freedoms, and you may object at any time (see the Right to Object below).

How We Protect Your Data

We take the security of your personal data seriously and implement a layered approach to protect it:

SSL Encryption: All data transmitted between your browser and our servers is encrypted using HTTPS (TLS 1.2 or higher).
Secure Servers: Our hosting environment is hardened, regularly patched, and monitored 24/7 for suspicious activity.
Limited Retention: Email addresses are retained only as long as you remain subscribed or until you request deletion. Cookies are deleted automatically after their predefined lifespan (session cookies at the end of the session, persistent cookies according to the duration set at issuance). Analytics data is stored in aggregated form for a maximum of 24 months.
Access Controls: Only authorized personnel with a legitimate need to process data have access, protected by strong passwords and two‑factor authentication.
Regular Audits: We conduct periodic security assessments and penetration tests to identify and remediate vulnerabilities.

Your GDPR Rights

As a data subject, you enjoy a set of rights under the GDPR. Each right is explained below, together with the steps you can take to exercise it.

Right to Access

You may request confirmation that we are processing your personal data and obtain a copy of that data, together with information about the purposes of processing, categories of data, recipients, and the retention period.

Right to Rectification

If any of your personal data is inaccurate or incomplete, you have the right to request that we correct or complete it without undue delay.

Right to Erasure (Right to be Forgotten)

You may ask us to delete your personal data when it is no longer necessary for the purposes for which it was collected, you withdraw consent, or you object to the processing and there are no overriding legitimate grounds.

Right to Restrict Processing

You can request that we limit the processing of your data while we verify the accuracy of the data, resolve a dispute, or assess the legality of the processing.

Right to Data Portability

When processing is based on consent or a contract, you have the right to receive your personal data in a structured, commonly used, machine‑readable format and to transmit it to another controller.

Right to Object

You may object at any time to the processing of your data for direct marketing, profiling, or where processing is based on legitimate interests. Upon receipt of a valid objection, we will cease the processing unless we can demonstrate compelling legitimate grounds that override your interests.

Right to Withdraw Consent

If we rely on your consent to process data (e.g., newsletter subscription or cookie consent), you can withdraw that consent at any moment, free of charge, and without affecting the lawfulness of processing based on consent before its withdrawal.

How to Exercise Your Rights

To exercise any of the rights listed above, please follow these steps:

Send a written request to gdpr@cozykitchenfood.com. Include your full name, the email address you used on our site, and a clear description of the right you wish to invoke.
If you are requesting access, rectification, erasure, restriction, or data portability, you may attach any proof of identity (e.g., a scanned government ID) to help us verify that the request originates from the data subject.
We will acknowledge receipt of your request within 5 business days and will provide a substantive response no later than 30 calendar days, as required by GDPR Article 12(3).
If we need additional information to verify your identity or to clarify the scope of the request, we will contact you promptly. The 30‑day deadline may be extended by a further two months for complex or numerous requests, and you will be informed of any extension.

International Transfers

All personal data processed by Cozy Kitchen Food is stored on servers located within the European Economic Area (EEA). When we use third‑party services (e.g., email marketing platforms or analytics providers) that may involve transfers outside the EEA, we ensure that appropriate safeguards—such as Standard Contractual Clauses—are in place.

Complaints

If you believe that our handling of your personal data violates the GDPR, you have the right to lodge a complaint with a supervisory authority in the EU member state where you reside, work, or where the alleged infringement occurred. For residents of the United Kingdom, the relevant authority is the Information Commissioner's Office (ICO).

Policy Updates

We review this GDPR Compliance Policy regularly and may update it to reflect changes in law, technology, or our business practices. The “Last Updated” date at the top of this page indicates the most recent revision. Continued use of the website after any changes constitutes acceptance of the revised policy.

This GDPR Compliance Policy is intended to provide transparent information about how Cozy Kitchen Food collects, uses, stores, and protects personal data in accordance with the EU General Data Protection Regulation (Regulation (EU) 2016/679).