GDPR Compliance Policy

Last Updated: April 03, 2026

Who We Are

FlavorFoodHub Ltd. (hereafter “FlavorFoodHub”, “we”, “our” or “us”) is a food‑delivery service operating at https://flavorfoodhub.com. We are committed to protecting the personal data of our users and complying with the European Union’s General Data Protection Regulation (GDPR). If you have any questions or concerns about how we process your personal data, please contact us at [email protected].

What Personal Data We Collect

We collect personal data that you voluntarily provide when you interact with our website, mobile app, or customer support channels. The primary categories of personal data we collect include:

Email addresses: used for account registration, order confirmation, marketing communications, and customer support.
Cookies and similar tracking technologies: used to enhance your browsing experience, remember your preferences, and track site usage for analytics.
Analytics data: collected through tools such as Google Analytics and Matomo to understand how visitors use our services, which pages are most popular, and how we can improve the user experience.

Legal Basis for Processing

Under GDPR Article 6, we process personal data based on the following lawful bases:

Consent: For marketing communications and optional newsletters. We obtain clear, affirmative consent before sending any promotional messages.
Legitimate interest: For essential operations such as order processing, fraud prevention, and improving our services. We conduct a legitimate interest assessment to ensure that our interests do not override your rights.
Contractual necessity: For the execution of a contract when you place an order or subscribe to our services.

How We Protect Your Data

We employ a range of technical and organisational measures to safeguard your personal data:

SSL/TLS Encryption: All data transmitted between your device and our servers is encrypted using industry‑standard SSL/TLS protocols.
Secure Servers: We host our data on secure, geographically redundant servers managed by reputable cloud providers. Access is limited to authorised personnel only.
Limited Retention: Personal data is retained only for as long as necessary to fulfil the purpose for which it was collected, comply with legal obligations, or resolve disputes. After that, data is securely deleted or anonymised.
Staff Training: All employees receive regular training on data protection principles and secure handling of personal data.

Your GDPR Rights

Under the GDPR, you have the following rights with respect to your personal data. Each right is illustrated with a Bootstrap icon for clarity.

Right to Access

You may request a copy of the personal data we hold about you, including the sources, purposes, and categories of data processed. We will provide you with a concise, intelligible, and easily accessible summary of your data within 30 days of receiving your request.

Right to Rectification

If you believe any of your personal data is inaccurate or incomplete, you can ask us to correct it. We will promptly review and update the data, ensuring it is accurate and up to date.

Right to Erasure

Also known as the “right to be forgotten”, you may request the deletion of your personal data when there is no legal basis for its continued processing, or if you withdraw consent. We will delete or anonymise the data within 30 days, except where we are required by law to retain it.

Right to Restrict Processing

You may ask us to restrict the processing of your personal data when you contest its accuracy or when the processing is unlawful. During the restriction period, we will only store your data, not use it for any purpose, unless required by law.

Right to Data Portability

You can receive your personal data in a structured, commonly used, and machine‑readable format (e.g., CSV or JSON). We will provide this data in a format that facilitates easy transfer to another service provider, if you wish.

Right to Object

You may object to the processing of your personal data for direct marketing or profiling purposes. Upon receiving your objection, we will stop processing your data for the specified purpose unless we can demonstrate compelling legitimate grounds that override your interests.

Right to Withdraw Consent

If we process your data based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing that relied on consent before its withdrawal. We will honour your decision and cease processing your data for the purpose for which consent was given.

How to Exercise Your Rights

To exercise any of the rights listed above, please contact our Data Protection Officer (DPO) at [email protected]. Provide the following details to help us locate and process your request efficiently:

Full name and contact information: email address, phone number, or postal address.
Identity verification: a scanned copy of a government‑issued ID or other proof of identity, if required.
Specific request: clearly state which right you are exercising and any relevant details (e.g., the type of data or the specific orders).

We will respond to your request within 30 days of receipt. If additional time is needed due to the complexity of your request, we will inform you of the expected delay and the reasons for it.

Retention of Personal Data

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, comply with legal obligations, or resolve disputes. Typical retention periods are:

Email addresses: up to 5 years after the last interaction, unless you opt‑out or request deletion.
Order details: up to 7 years for tax and accounting purposes.
Analytics data: aggregated and anonymised data is retained for up to 12 months.

Changes to This Policy

We may update this GDPR Compliance Policy from time to time. Any changes will be posted on this page with a revised “Last Updated” date. Your continued use of our services after any changes constitutes acceptance of the updated policy.

Contact Information

If you have any questions, concerns, or complaints regarding our data processing activities, please contact our DPO at [email protected]. For complaints to supervisory authorities, you may refer to the relevant national data protection authority in your country.