GDPR Compliance Policy

Last Updated: April 03, 2026

FoodFlavorStudio (the “Company”) is dedicated to respecting your privacy and protecting the personal data you share with us. This policy explains what information we collect, why we collect it, how we protect it, and your rights under the General Data Protection Regulation (GDPR) and other applicable privacy laws.

1. Data We Collect

We collect a limited set of personal data that is strictly necessary for providing and improving our services:

Email addresses – used for newsletter subscriptions, order confirmations, support inquiries, and occasional marketing communications.
Cookies & Similar Technologies – we place session cookies (to maintain your shopping cart), persistent cookies (to remember language or theme preferences), and third‑party cookies (from Google Analytics and Matomo) to gather usage statistics.
Analytics Data – anonymous identifiers and aggregated data collected through Google Analytics (UA‑XXXXX) and Matomo to understand how visitors interact with our site, which pages are most popular, and how we can optimize the user experience.

2. How We Protect Your Data

We employ a comprehensive security framework that includes:

Transport Layer Security (TLS 1.3) – all data transmitted between your browser and our servers is encrypted.
Secure Server Infrastructure – our hosting environment is located in certified data centers with 24/7 monitoring, firewalls, intrusion detection, and regular penetration testing.
Access Controls – only staff with a legitimate business need can access personal data; access logs are maintained and reviewed.
Data Minimisation & Retention – personal data is kept only as long as necessary: marketing emails are retained for 12 months after the last interaction, analytics data is retained for 6 months, and cookie consent records are kept for 2 years.
Regular Backups – encrypted backups are performed daily and stored in a separate geographic location.

3. Legal Basis for Processing

Our lawful bases for processing are:

Consent – for non‑essential marketing emails and the use of non‑essential cookies. You can withdraw consent at any time.
Legitimate Interest – to improve our website, prevent fraud, and analyze user behavior for service optimisation. We conduct a balancing test to ensure that our interests do not override your fundamental rights.

4. Your GDPR Rights

Under the GDPR, you have the following rights. Each right is illustrated with a Bootstrap 5 icon for quick reference.

Right to Access

You can request a copy of all personal data we hold about you, the purposes of processing, the categories of data, and the recipients.

Right to Rectification

If any of your personal data is inaccurate or incomplete, you can ask us to correct it.

Right to Erasure

You may request that we delete your personal data when it is no longer necessary for the purposes we collected it or when you withdraw consent.

Right to Restrict Processing

In specific circumstances, you can ask us to limit how we use your data (e.g., while we verify the accuracy of the data).

Right to Data Portability

You can obtain your personal data in a structured, commonly used format and transfer it to another controller.