GDPR Compliance Policy

Last Updated: April 03, 2026

About This Policy

Tastydishcenter (the “Website”, “we”, “our”, or “our”) is committed to protecting the privacy and personal data of our users in full compliance with the General Data Protection Regulation (EU) 2016/679 (GDPR). This policy explains what personal data we collect, why we collect it, how we protect it, and the rights you have as a data subject under the GDPR.

Contact Information

If you have any questions, concerns, or requests regarding your personal data, please contact our Data Protection Officer at [email protected].

Data We Collect

Email addresses: Collected when you sign up for newsletters, create an account, or place an order.
Cookies and similar technologies: We use first‑party cookies to provide a personalised experience, remember your language preference, and track session behaviour. Third‑party analytics cookies (e.g., Google Analytics) collect anonymous usage statistics.
Analytics data: Information about your device (IP address, browser type, operating system), page views, click paths, and referral sources.
Transactional data: Order details, payment information (only the tokenised payment reference is stored), and delivery addresses.

How We Protect Your Data

SSL/TLS Encryption: All data transmitted between your browser and our servers is protected by HTTPS.
Secure Servers: We host our data on industry‑standard, ISO 27001 certified servers with physical and network security controls.
Access Controls: Only authorised staff with a legitimate business need can access personal data, and all access is logged.
Limited Retention: Personal data is retained only for the period necessary to fulfil the purpose for which it was collected, or as required by law. For example, email addresses are kept for up to 12 months after the last interaction unless the user requests deletion.
Data Anonymisation: Analytics data is aggregated and anonymised before analysis, ensuring that individuals cannot be identified.

Legal Basis for Processing

We rely on two primary legal bases under the GDPR:

Consent: For marketing communications and the use of non‑essential cookies. Consent is freely given, specific, informed, and unambiguous. You can withdraw consent at any time.
Legitimate Interest: For essential site functionality, order processing, fraud prevention, and improving user experience. We conduct a legitimate interest assessment to ensure that our interests do not override your rights and freedoms.

Your GDPR Rights

Right to Access

You have the right to obtain confirmation that we are processing your personal data, and if so, to receive a copy of that data in a structured, commonly used format.

Right to Rectification

If any personal data we hold about you is inaccurate or incomplete, you can request that we correct it promptly.

Right to Erasure (Right to be Forgotten)

Under certain circumstances, you may request the deletion of your personal data, such as when it is no longer necessary for the purposes it was collected for.

Right to Restrict Processing

You may request that we limit how we use your data, for example, if you contest its accuracy or we are no longer allowed to process it.

Right to Data Portability

When you have provided personal data directly to us, you can request that we transfer that data to another controller or provide it in a machine‑readable format.

Right to Object

You can object to the processing of your data for direct marketing or profiling purposes. Once you object, we will stop processing unless we can show compelling legitimate grounds.

Right to Withdraw Consent

At any time, you may withdraw consent that you gave for marketing or cookie usage. This does not affect the lawfulness of any processing based on consent before its withdrawal.

How to Exercise Your Rights

To exercise any of the rights above, please send a written request to [email protected]. Your request should include:

Identification: Your full name, email address, and any account details that help us locate your data.
Specific Request: Clearly state the right you are exercising (e.g., “I request the deletion of my email address”).
Supporting Evidence: If relevant, provide proof of identity (e.g., a scanned copy of a government ID). We will only request such evidence when necessary to verify your identity.

We will respond to your request within 30 days of receipt, in line with GDPR requirements. If your request is complex or we need additional time, we will inform you of the delay and the reasons for it.

Response Time and Exception Handling

All lawful requests will be processed within 30 calendar days. If we need more time (e.g., to verify identity or to consult with other stakeholders), we will notify you within the initial 30‑day period and provide a new deadline. We may extend the response time by an additional 15 days if the request is complex, but we will keep you informed throughout.

Further Information and Complaints

For more information about our data handling practices, please review our Privacy Policy. If you believe your rights under the GDPR have not been respected, you may file a complaint with the supervisory authority in the EU member state where you reside or where the alleged infringement occurred. For the European Economic Area, you can also contact the European Data Protection Board (EDPB).

Effective Date

This GDPR Compliance Policy is effective from April 03, 2026 and supersedes any previous versions. We reserve the right to update this policy in the future; any significant changes will be communicated via email or a prominent notice on our website.