GDPR Compliance Policy – Happyfoodkitchen

Last Updated: April 03, 2026

Introduction

Happyfoodkitchen (“we”, “our”, “us”) is committed to protecting your privacy and ensuring that your personal data is processed in accordance with the General Data Protection Regulation (EU) 2016/679 (GDPR). This policy explains what data we collect, why we collect it, how we protect it, and the rights you have as a data subject. By using our website https://happyfoodkitchen.com, you acknowledge that you have read and understood this policy.

Data We Collect

We collect the following types of personal data:

• Email addresses: Collected when you subscribe to our newsletter, place an order, or contact us through the website.
• Cookies and tracking pixels: Used to store session identifiers, analyze user behaviour, and personalize content.
• Analytics data: Generated by third‑party services (e.g., Google Analytics) to understand traffic patterns, device usage, and conversion rates.

Legal Basis for Processing

We process personal data based on the following lawful bases:

• Consent: For email marketing and newsletters, we obtain explicit consent. You can withdraw this consent at any time.
• Legitimate Interest: For website analytics and improving user experience, we rely on legitimate interest. We ensure that this interest does not override your fundamental rights and freedoms.
• Contractual Necessity: When you place an order, we process your email address and payment details to fulfill the contract.

Data Protection Measures

We employ robust technical and organisational safeguards to protect your data:

• SSL/TLS Encryption: All data transmitted between your browser and our servers is encrypted using industry‑standard TLS 1.3.
• Secure Servers: Our hosting provider uses hardened servers with regular security patches, firewalls, and intrusion detection systems.
• Access Controls: Only authorised personnel with a legitimate business need can access personal data. All staff receive GDPR training.
• Limited Retention: Personal data is retained only for as long as necessary to fulfil the purpose for which it was collected or as required by law. For example, email addresses are deleted 12 months after the last interaction unless the user subscribes again.

Your GDPR Rights

Right to Access

You have the right to obtain confirmation that we are processing your personal data, and if so, access the data and receive a copy in a structured, commonly used format.

Right to Rectification

If any of your personal data is inaccurate or incomplete, you may request that we correct or update it promptly.

Right to Erasure (Right to be Forgotten)

You may request the deletion of your personal data where no legitimate reason for retaining it exists, such as when you unsubscribe from our newsletter.

Right to Restrict Processing

You can request that we suspend processing of your data while we verify its accuracy or the legality of the processing.

Right to Data Portability

You may receive your personal data in a machine‑readable format and request that we transmit it to another controller, where technically feasible.

Right to Object

You can object to the processing of your personal data for direct marketing, profiling, or other legitimate interest purposes. Upon objection, we will cease processing unless we can demonstrate compelling legitimate grounds.

Right to Withdraw Consent

If we rely on your consent, you may withdraw it at any time. Withdrawal will not affect the lawfulness of processing based on consent before withdrawal.

How to Exercise Your Rights

To exercise any of the above rights, please contact us at [email protected]. In your request, provide:

• Your full name and email address.
• A clear statement of the right you are invoking.
• Any supporting evidence or documentation (e.g., screenshots of a subscription page).

We will respond to your request within 30 days. If you need an extension, we will inform you in writing and provide a reasonable explanation. In exceptional cases where a longer period is required, we will provide a provisional decision and the reasons for the delay.

Data Retention Policy

Personal data is retained for the minimal period necessary to achieve the purposes outlined in this policy. Typical retention periods are:

• Email addresses: 12 months after last interaction unless renewed by the user.
• Cookies: Session cookies expire when the browser closes; persistent cookies are deleted after 30 days.
• Analytics data: Aggregated data is retained for 12 months, but personal identifiers are never stored.

Security of Your Data

We implement a comprehensive security framework that includes:

• Regular penetration testing and vulnerability assessments.
• Encryption of data at rest using AES‑256.
• Multi‑factor authentication for administrative access.
• Annual audits by external security consultants.

Policy Updates

This policy may be amended from time to time. Any changes will be communicated via our website and, where appropriate, by email. The “Last Updated” date will reflect the most recent revision.

Contact Information

For any questions, concerns, or complaints about how we process your data, please reach out:

• Email: [email protected]
• Postal Address: Happyfoodkitchen, 123 Culinary Lane, Foodville, FL 12345, USA

We appreciate your trust in us and are committed to safeguarding your personal information in line with GDPR and other applicable data protection laws.