MumCooks GDPR Compliance Policy

Last Updated: February 24, 2026

1. Introduction

MumCooks (accessible at https://mumcooks.com) is committed to protecting the privacy and personal data of its users, customers, and visitors in accordance with the European Union’s General Data Protection Regulation (GDPR) (Regulation (EU) 2016/679). This policy explains what personal data we collect, why we process it, how we protect it, and the rights you enjoy under the GDPR.

2. Data We Collect

We collect and process the following categories of personal data:

Email address: Used for newsletter subscriptions, order confirmations, and customer support.
Cookies & similar technologies: To remember your preferences, analyse site traffic and improve user experience.
Analytics data: Aggregated information such as IP address, browser type, device type, and pages visited, collected through Google Analytics and other analytics services.

3. Legal Basis for Processing

We rely on the following lawful bases to process your personal data:

Consent (Article 6(1)(a)): When you voluntarily sign up for our newsletter or accept optional cookies, you give us explicit consent to process your data for those specific purposes.
Legitimate Interests (Article 6(1)(f)): For activities such as website security, fraud prevention, and improving the functionality of the site, we process data based on our legitimate business interests, provided your fundamental rights and freedoms are not overridden.

4. How We Protect Your Data

We employ a range of technical and organisational measures to ensure the confidentiality, integrity, and availability of personal data:

SSL Encryption: All data transmitted between your browser and our servers is protected by HTTPS using industry‑standard TLS encryption.
Secure Servers: Our hosting environment is hosted on servers that are regularly patched, monitored, and protected by firewalls and intrusion‑detection systems.
Limited Retention: Personal data is retained only for as long as necessary to fulfil the purpose for which it was collected. Email addresses are kept until you unsubscribe or request deletion; analytics data is anonymised after 12 months.
Access Controls: Only authorised personnel with a legitimate need‑to‑know can access personal data, and they are required to sign confidentiality agreements.
Regular Audits: We conduct periodic security audits and vulnerability assessments to identify and remediate potential risks.

5. Your GDPR Rights

Under the GDPR, you have the following rights concerning your personal data. Each right is accompanied by a Bootstrap 5 icon for easy reference.

Right to Access (Article 15)

You may request confirmation of whether we process your personal data and, if so, obtain a copy of the data, the purposes of processing, the categories of data, and the recipients of that data.

Right to Rectification (Article 16)

If any of your personal data is inaccurate or incomplete, you have the right to have it corrected or completed without undue delay.

Right to Erasure (Right to be Forgotten) (Article 17)

You may request the deletion of your personal data where it is no longer necessary for the purposes for which it was collected, or where you withdraw consent and no other legal basis applies.

Right to Restrict Processing (Article 18)

You can ask us to limit the processing of your data while we verify the accuracy of the data, or when you contest the lawfulness of the processing.

Right to Data Portability (Article 20)

You have the right to receive your personal data in a structured, commonly used, machine‑readable format and to transmit that data to another controller without hindrance.

Right to Object (Article 21)

You may object, on grounds relating to your particular situation, to processing of your personal data for direct marketing, scientific/historical research, or statistical purposes.

Right to Withdraw Consent (Article 7(3))

Whenever processing is based on your consent, you have the right to withdraw that consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

6. How to Exercise Your Rights

To exercise any of the rights listed above, please contact our Data Protection Officer (DPO) using the details below. We will acknowledge your request within five (5) business days and aim to provide a full response within thirty (30) calendar days, in line with GDPR requirements.

Data Protection Officer (DPO):
Email: [email protected]

7. Response Time & Fees

Our standard response time for any GDPR‑related request is thirty (30) days from the date we receive your request. In complex cases, we may extend this period by a further two months, but we will inform you of any extension within the initial 30‑day period. We do not charge any fees for exercising your rights, unless the request is manifestly unfounded or excessive, in which case we may charge a reasonable fee to cover administrative costs.

8. International Transfers

MumCooks does not transfer personal data outside the European Economic Area (EEA). All processing takes place on servers located within the EU, and any third‑party service providers we engage (e.g., email marketing platforms, analytics tools) are bound by EU‑standard contractual clauses or are certified under the EU‑US Privacy Shield (where applicable) to ensure an adequate level of protection.

9. Changes to This Policy

We may update this GDPR Compliance Policy from time to time to reflect changes in our practices, legal requirements, or technology. The “Last Updated” date at the top of this page indicates the most recent revision. Continued use of the MumCooks website after any changes constitutes acceptance of the updated policy.

10. Contact Information

If you have any questions, concerns, or complaints regarding the processing of your personal data, please reach out to our DPO at [email protected]. You also have the right to lodge a complaint with a supervisory authority in the EU Member State where you reside, work, or where the alleged infringement occurred.