Cooking by Mum – GDPR Compliance Policy

Last Updated: December 06, 2025

1. Introduction

Cooking by Mum (the “Website”, “we”, “us”, or “our”) is committed to protecting the privacy and personal data of our visitors, subscribers, and customers in accordance with the General Data Protection Regulation (EU) 2016/679 (GDPR). This policy explains what personal data we collect, why we collect it, how we protect it, and the rights you have under the GDPR. By using our site (https://cookingbymum.com) you consent to the practices described herein.

2. Personal Data We Collect

We only collect data that is necessary for the purposes described below:

Email address – collected when you subscribe to our newsletter, submit a recipe request, or contact us via the contact form.
Cookies and similar technologies – used to remember your preferences, analyse site usage, and deliver personalized content. This includes first‑party session cookies, analytics cookies, and marketing cookies.
Analytics data – aggregated information such as IP address, browser type, device type, pages visited, and time spent on the site. This data is collected through Google Analytics (or an equivalent analytics platform) to improve the user experience.

3. How We Use Your Data

We process the collected data for the following legitimate purposes:

Sending you newsletters, recipe updates, and promotional offers (with your explicit consent).
Responding to enquiries, comments, or support requests.
Personalising your browsing experience (e.g., remembering your language or layout preferences).
Analysing website traffic to improve content, design, and functionality.
Ensuring the security of the site and protecting against fraud or malicious activity.

4. Legal Basis for Processing

We rely on the following lawful bases under the GDPR:

Consent – when you voluntarily provide your email address and expressly agree to receive communications.
Legitimate interests – for site security, fraud prevention, and analytics that help us improve the service, provided these interests do not override your fundamental rights and freedoms.

If you have not given consent, we will not process your data for marketing purposes.

5. Data Protection Measures

We employ a range of technical and organisational safeguards to protect your personal data:

SSL/TLS encryption – all data transmitted between your browser and our servers is encrypted using HTTPS.
Secure servers – our hosting environment is hardened, regularly patched, and monitored 24/7.
Access controls – only authorised personnel with a legitimate need can access personal data, and they are bound by confidentiality agreements.
Limited retention – email addresses are retained only while you remain subscribed or for a maximum of 24 months after the last interaction. Analytics data is stored in an aggregated, anonymised form for up to 12 months.
Regular audits – we conduct periodic security assessments and vulnerability scans.

6. Your GDPR Rights

Under the GDPR you have the following rights concerning your personal data. Each right is accompanied by a Bootstrap icon for easy identification.

Right to Access

You may request a copy of the personal data we hold about you, together with information about how we process it.

Right to Rectification

If any of your data is inaccurate or incomplete, you can ask us to correct or complete it without undue delay.

Right to Erasure (Right to be Forgotten)

You may request the deletion of your personal data where there is no legitimate reason for us to continue processing it.

Right to Restrict Processing

You can ask us to limit the way we use your data while we verify the accuracy of the information or assess a legal claim.

Right to Data Portability

You have the right to receive your personal data in a structured, commonly used, machine‑readable format and to transmit it to another controller.

Right to Object

You may object to the processing of your data for direct marketing, scientific/historical research, or any other legitimate interest that we rely on.

Right to Withdraw Consent

If processing is based on your consent, you can withdraw that consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

To exercise any of these rights, please follow the procedure outlined in the next section.

7. How to Exercise Your Rights

Requests can be made in writing or via email. Please include the following information to help us verify your identity and locate your data:

Your full name and, if applicable, the email address you used on our site.
A clear description of the right you wish to invoke (e.g., “I would like to exercise my Right to Erasure”).
Any supporting documentation that proves your identity (e.g., a scanned ID) – this is required only when the request could affect another individual's data.

Send your request to gdpr@cookingbymum.com. We will acknowledge receipt within 5 business days and aim to provide a substantive response within 30 calendar days, as required by the GDPR.

8. Data Retention

We retain personal data only for as long as necessary:

Email addresses – retained while you remain subscribed or for up to 24 months after the last interaction, after which they are securely deleted.
Cookie data – session cookies are deleted when you close your browser; persistent cookies are set with a maximum lifespan of 12 months, after which they expire automatically.
Analytics data – stored in an aggregated, anonymised form for up to 12 months, then automatically purged.

9. International Transfers

All processing takes place on servers located within the European Economic Area (EEA). If a transfer outside the EEA becomes necessary, we will ensure an adequate level of protection through standard contractual clauses or other approved mechanisms.

10. Contact Information

If you have questions about this policy, wish to lodge a complaint, or need assistance exercising your rights, please contact our Data Protection Officer at:

Cooking by Mum – Data Protection Officer
Email: gdpr@cookingbymum.com

You also have the right to lodge a complaint with a supervisory authority in the EU member state where you reside.

11. Changes to This Policy

We review this policy regularly and may update it to reflect changes in law, technology, or our practices. Any material changes will be posted on this page with an updated “Last Updated” date. Continued use of the website after such changes constitutes acceptance of the revised policy.