GDPR Compliance Policy

Effective date: December 01, 2025

This GDPR (General Data Protection Regulation) Compliance Policy explains how evadishes (https://evadishes.com) collects, processes, stores, and protects personal data of individuals located in the European Economic Area (EEA). We are committed to respecting your privacy and to providing transparent information about your data‑protection rights.

1. Data We Collect

We collect and process the following categories of personal data:

Email addresses – provided voluntarily when you subscribe to newsletters, request support, or sign up for promotional offers.
Cookies and similar tracking technologies – used to remember your preferences, analyse site traffic, and improve user experience. This includes both first‑party and third‑party analytics cookies.
Analytics data – aggregated information about page visits, device type, IP address (in a pseudonymised form), and browsing behaviour, collected via Google Analytics and similar services.

2. Legal Basis for Processing

We rely on the following lawful bases under Article 6 of the GDPR:

Consent (Article 6(1)(a)) – When you voluntarily provide your email address for newsletters or marketing communications, you give explicit consent to receive such messages.
Legitimate interests (Article 6(1)(f)) – The use of cookies and analytics is necessary for the legitimate interest of improving the website’s performance, security, and user experience. You may object to this processing at any time (see Section 4).

3. How We Protect Your Data

We implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk:

SSL/TLS encryption – All data transmitted between your browser and our servers is encrypted using HTTPS.
Secure servers – Our hosting environment is protected by firewalls, intrusion detection systems, and regular security patches.
Limited retention – Email addresses are retained only for as long as you remain subscribed or until you request deletion. Cookies are automatically deleted after their specified lifespan (max 12 months). Analytics data is retained in an aggregated, pseudonymised form for a maximum of 24 months.
Access controls – Only authorised personnel with a legitimate need to access personal data are granted permissions, and all access is logged.

4. Your GDPR Rights

Under the GDPR you have the following rights. Each right is accompanied by a Bootstrap icon for quick visual reference.

Right to Access

You may request confirmation that we process your personal data and obtain a copy of the data we hold about you, together with information about the purposes of processing, categories of data, and recipients.

Right to Rectification

If any of your personal data is inaccurate or incomplete, you have the right to request that we correct or complete it without undue delay.

Right to Erasure (Right to be Forgotten)

You may ask us to delete your personal data when it is no longer necessary for the purposes for which it was collected, when you withdraw consent, or when you object to the processing and there are no overriding legitimate grounds.

Right to Restrict Processing

You can request that we limit the processing of your data while we verify the accuracy of the data, or when you contest the lawfulness of the processing.

Right to Data Portability

You have the right to receive your personal data in a structured, commonly used, machine‑readable format and to transmit that data to another controller without hindrance.

Right to Object

You may object, on grounds relating to your particular situation, to the processing of your personal data for direct marketing, profiling, or when processing is based on legitimate interests.

Right to Withdraw Consent

Where processing is based on your consent, you may withdraw that consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

5. How to Exercise Your Rights

To exercise any of the rights listed above, please contact our Data Protection Officer (DPO) using the details provided in Section 9. In your request, include:

Your full name and the email address associated with your account (if applicable).
A clear description of the right you wish to invoke (e.g., “I would like to exercise my right to erasure”).
Any additional information that will help us verify your identity (e.g., a copy of a government‑issued ID, when appropriate).

We will acknowledge receipt of your request within 5 business days and will provide a substantive response within 30 calendar days**, as required by the GDPR. In exceptional cases where the request is complex or numerous, we may extend the period by up to two further months, but we will inform you of any such extension within the initial 30‑day period.

6. Data Retention

We retain personal data only for as long as necessary:

Email addresses – retained until you unsubscribe or request deletion.

Cookies – session cookies are deleted when the browser is closed; persistent cookies are set with a maximum lifespan of 12 months.

Analytics data – retained in an aggregated, pseudonymised form for up to 24 months for trend analysis.

7. International Data Transfers

All processing takes place on servers located within the European Economic Area (EEA). If a transfer outside the EEA becomes necessary (e.g., for third‑party analytics), we will ensure an adequate level of protection by using Standard Contractual Clauses approved by the European Commission.

8. Changes to This Policy

We may update this GDPR Compliance Policy from time to time to reflect changes in our practices or legal requirements. Any material changes will be posted on this page with an updated “Last Updated” date. Continued use of the website after such changes constitutes acceptance of the revised policy.

9. Contact Information

If you have questions about this policy, wish to exercise any of your GDPR rights, or want to lodge a complaint, please contact our Data Protection Officer:

evadishes – Data Protection Officer
Email: gdpr@evadishes.com
Website: https://evadishes.com

In addition, you have the right to lodge a complaint with a supervisory authority in the Member State of your habitual residence, place of work, or place of the alleged infringement.