GDPR Compliance Policy

Last Updated: April 03, 2026

1. Introduction

Mysimpleplates (the “Company”, “we”, “us” or “our”) is committed to protecting your personal data in compliance with the European Union’s General Data Protection Regulation (GDPR) and the UK Data Protection Act 2018. This policy explains how we collect, use, store, and share your personal data, and describes the rights you have under the GDPR. By using our website or providing your personal information to us, you acknowledge that you have read and understood this policy.

2. What Personal Data We Collect

We collect the following types of personal data when you interact with our website:

Email addresses: When you subscribe to our newsletter, register for a recipe plan, or contact us through the website.
Cookies and Tracking Technologies: We use first‑party cookies to remember your preferences and to enable features such as shopping carts. Third‑party analytics cookies from providers such as Google Analytics track user behaviour to improve site performance and content relevance.
Analytics Data: We collect aggregated, non‑personal data about page views, traffic sources, and device types to help us optimise the user experience.

3. Legal Basis for Processing

The GDPR requires that all processing of personal data be based on a lawful ground. Our legal bases for processing are:

Consent: When you provide an email address to subscribe to our newsletter or register for a service, you are giving us explicit consent to process that data for the purpose of delivering the requested service and for marketing communications if you opt‑in.
Legitimate Interest: We process analytics data and non‑personal cookie data to improve the functionality of the website, to personalise content, and to protect against fraud and abuse. This processing is proportionate to the benefits we provide and is balanced against your privacy interests.

4. Data Protection Measures

We employ a range of technical and organisational measures to protect your personal data:

SSL/TLS Encryption: All data transmitted between your browser and our servers is protected by industry‑standard HTTPS encryption.
Secure Servers: We host our services on reputable cloud providers with physical and network security controls, regular vulnerability assessments, and intrusion detection systems.
Access Controls: Personal data is only accessible to employees who require it for legitimate business purposes. All staff receive GDPR training and sign confidentiality agreements.
Data Retention: We retain personal data only for as long as necessary to fulfil the purposes for which it was collected or to comply with legal obligations. Email addresses are kept for the duration of the subscription or until you request deletion. Cookies and analytics data are deleted after 30 days unless you have opted for a longer retention period for a specific service.
Data Minimisation: We collect only the data that is strictly required for each purpose and avoid unnecessary duplication.

5. Your GDPR Rights

Under the GDPR, you have the following rights regarding your personal data. We provide clear procedures for you to exercise each right. Please note that the response time for each request is 30 days unless the request is complex or requires additional verification, in which case we may request further information from you.

Right to Access

You may request a copy of the personal data we hold about you, including the categories of data, the purposes of processing, and the recipients of the data. We will provide you with a concise, intelligible summary and, where possible, a machine‑readable copy of the data you supplied.

Right to Rectification

If you believe any personal data we hold about you is inaccurate or incomplete, you can request that we correct it. We will review and update the data promptly, and notify you of the changes made.

Right to Erasure

Also known as the “right to be forgotten”, you may ask us to delete your personal data where no legal or legitimate basis exists to retain it. This includes your email address, cookies, and any analytics data that can be linked to you. We will remove the data from all active databases and backups where feasible.

Right to Restrict Processing

You may request that we limit how we process your data, for instance if you contest the accuracy of the data or if the processing is unlawful. During the restriction period, we will store but not use the data, except for necessary legal or compliance purposes.

Right to Data Portability

You can obtain the personal data we hold about you in a structured, commonly used, machine‑readable format (e.g., CSV or JSON) and transmit it to another controller, provided that the data is processed automatically. We will provide the data in the format you request, unless the data is too large or complex to transfer in a single file.

Right to Object

If we process your data for direct marketing or profiling purposes, you may object to such processing. Upon receiving your objection, we will cease processing the data for the specified purpose unless we can demonstrate compelling legitimate grounds that override your interests.

Right to Withdraw Consent

If you have given us consent to process your personal data, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of any processing carried out prior to the withdrawal. We will stop processing your data for the purpose of which you withdrew consent and will delete it if no other legal basis applies.

6. How to Exercise Your Rights

To exercise any of the rights described above, please contact us at [email protected] with the following information:

Your full name and contact details.
Identification evidence (e.g., a copy of your passport or driver’s licence) to confirm your identity.
A clear statement of the right you are exercising (e.g., “Request for data access”).
Any additional details that will help us locate your personal data (e.g., the email address you used to register).

We will respond to your request within 30 days of receiving your email. If additional time is needed, we will inform you of the reason and provide a revised timeline. All correspondence will be sent to the email address you provide, and we will confirm receipt of your request.

7. Contact Information

If you have any questions about this policy, your personal data, or wish to lodge a complaint, please contact our Data Protection Officer at [email protected]. For complaints to supervisory authorities, you may refer to the relevant Data Protection Authority in your jurisdiction.

We appreciate your trust in Mysimpleplates. Protecting your privacy is a priority, and we are committed to maintaining the highest standards of data protection in line with GDPR requirements.