This GDPR Data Protection Policy (“Policy”) explains how Mom Dish Magic (“we,” “us,” “our”) collects, processes, and safeguards personal data of individuals in the European Economic Area (EEA), the United Kingdom (UK), and Switzerland when they visit or interact with momsdishmagic.com (the “Site”). It is intended to satisfy the transparency requirements of the EU General Data Protection Regulation (“GDPR”), the UK GDPR, and applicable Swiss privacy law.
1. Who We Are
Data Controller: Emma Davies, Mom Dish Magic
Address: 155 N 1st Ave, Hillsboro, OR 97124, USA
Email: contact@momsdishmagic.com
We do not currently appoint an EU/UK representative under Article 27 because we qualify for the “occasional processing” exemption; however, we continuously monitor traffic volumes and will designate a representative if required.
2. Personal Data We Collect
| Category | Examples | Source |
|---|---|---|
| Identification | Name, email address | Directly from you (newsletter sign-up, comments) |
| Usage | IP address, browser type, pages viewed, clicks | Automatically via cookies & analytics tools |
| Marketing Preferences | Newsletter opt-in status, cookie consent choices | Directly from you |
| E-commerce (if/when applicable) | Billing/shipping details, transaction ID | Directly from you & payment processor |
We do not intentionally collect “special category” data (e.g., health, religion) or information about children under 16.
3. Purposes & Legal Bases
| Purpose | GDPR Legal Basis | Explanation |
|---|---|---|
| Delivering the Site & its core features | Art. 6(1)(b) – Contract | Necessary to provide pages, recipes, and services you request. |
| Analytics & performance measurement | Art. 6(1)(f) – Legitimate Interest | We pursue the legitimate interest of improving our content while respecting your privacy. |
| Sending newsletters & marketing emails | Art. 6(1)(a) – Consent | You can withdraw consent at any time via the “unsubscribe” link. |
| Responding to inquiries or DMCA notices | Art. 6(1)(c) – Legal Obligation | Required to comply with U.S. copyright law & other regulations. |
| Affiliate-link tracking | Art. 6(1)(f) – Legitimate Interest | Legitimate interest in monetizing the Site without intrusive profiling. |
4. How We Share Your Data
Service Providers: Hosting (e.g., DigitalOcean or equivalent), email marketing (e.g., MailerLite), analytics (e.g., Google Analytics 4), and payment processors (if e-commerce launches). All providers are vetted for GDPR compliance and bound by data-processing agreements.
Legal & Safety: Authorities or legal counsel when required to meet obligations, enforce our terms, or protect rights.
Business Transfers: In the event of a merger, acquisition, or asset sale, user data may be transferred subject to confidentiality safeguards.
We never sell or rent your personal data.
5. International Transfers
Because our servers and many service providers are located in the United States, your data is transferred outside the EEA/UK/Switzerland. Transfers rely on:
Adequacy Mechanisms (e.g., UK Extension to the EU–US Data Privacy Framework, once finalized).
Standard Contractual Clauses (SCCs) with additional safeguards (encryption in transit/rest, limited retention).
You may request a copy of relevant SCCs by emailing us.
6. Data Retention
| Data Type | Typical Retention | Rationale |
|---|---|---|
| Account/comments & identity data | Until you request deletion or 5 years after last interaction | Ongoing community management, fraud prevention |
| Newsletter subscriber lists | Until you unsubscribe | Consent-based marketing |
| Analytics data (IP address truncated) | 26 months | Industry-standard period for trend analysis |
| Legal records (DMCA notices, tax receipts) | 7 years | Statutory requirements |
We routinely review and securely delete data that is no longer needed.
7. Your GDPR Rights
You have the right to:
Access – Obtain confirmation and a copy of your personal data.
Rectification – Correct incomplete or inaccurate data.
Erasure (“Right to be Forgotten”) – Request deletion in certain circumstances.
Restriction of Processing – Ask us to suspend processing under limited conditions.
Data Portability – Receive your data in a structured, machine-readable format.
Objection – Object to processing based on legitimate interests or direct marketing.
Withdraw Consent – At any time, without affecting prior processing.
Lodge a Complaint – With your local supervisory authority.
8. Exercising Your Rights
Email privacy@momsdishmagic.com (or contact@momsdishmagic.com) with:
“GDPR Request” in the subject line
Your name and the request type
Information to help verify your identity (we may request additional proof to prevent unauthorized disclosures)
We respond within 30 days (extendable by 2 months for complex requests, per Art. 12 GDPR).
9. Automated Decision-Making
We do not use your data for automated decision-making or profiling that produces legal or similarly significant effects.
10. Security Measures
SSL/TLS encryption
Least-privilege administrator access
Regular software updates & vulnerability scanning
Secure password hashing (BCrypt)
Cloud-provider firewalls and DDoS mitigation
No system is 100% secure, but we strive to protect your data using industry best practices.
11. Children’s Privacy
The Site is not directed to children under 16. We do not knowingly collect their data. If you believe a minor has provided personal information, please contact us and we will delete it promptly.
12. Changes to This Policy
We may update this Policy to reflect legal, technical, or business changes. The “Effective Date” at the top indicates the latest revision. If changes materially affect your rights, we will post a prominent notice and (where legally required) request your renewed consent.
13. Contact & Complaints
Data Controller: Emma Davies
Mom Dish Magic
155 N 1st Ave, Hillsboro, OR 97124, USA
📧 privacy@momsdishmagic.com
EEA/UK residents may also lodge a complaint with their local data-protection authority. A list of EU authorities is available at edpb.europa.eu/about-edpb/board/members_en. UK residents may contact the ICO.
