Dishmum GDPR Compliance Policy

Last Updated: December 01, 2025

1. Introduction

Dishmum (https://dishmum.com) is committed to protecting the personal data of its users in accordance with the EU General Data Protection Regulation (GDPR) (Regulation (EU) 2016/679). This policy explains what personal data we collect, the legal bases for processing that data, how we safeguard it, and the rights you enjoy under the GDPR. If you have any questions or wish to exercise any of your rights, please contact us at gdpr@dishmum.com.

2. Personal Data We Collect

Dishmum processes the following categories of personal data:

Email address: used for account creation, newsletters, and transactional communications.
Cookies & tracking identifiers: small data files stored on your device to enable session management, remember preferences, and analyse site usage.
Analytics data: aggregated information such as IP address, browser type, operating system, pages visited, and time spent on each page. This data is collected via third‑party analytics services that comply with GDPR.

We do not collect any sensitive data (e.g., health, biometric, or political information) unless you voluntarily provide it through a specific feature, in which case we will update this policy accordingly.

3. Legal Basis for Processing

Our processing activities are based on the following lawful grounds:

Consent (Article 6(1)(a)): When you subscribe to newsletters, accept cookies, or explicitly agree to receive marketing communications.
Legitimate Interests (Article 6(1)(f)): For purposes such as improving website functionality, preventing fraud, and conducting statistical analysis that benefits our users.
Performance of a Contract (Article 6(1)(b)): When processing is necessary to fulfil your orders, deliver services, or manage your account.

Whenever we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before the withdrawal.

4. How We Protect Your Data

Dishmum employs a layered security approach to ensure the confidentiality, integrity, and availability of personal data:

Transport Layer Security (TLS/SSL): All data transmitted between your browser and our servers is encrypted using industry‑standard TLS 1.3.
Secure Servers: Our hosting environment is hardened, regularly patched, and monitored 24/7 for unauthorized access.
Access Controls: Only authorized personnel with a legitimate business need can access personal data, and they must do so under strict confidentiality agreements.
Limited Retention: Personal data is retained only for as long as necessary to fulfil the purposes for which it was collected, after which it is securely deleted or anonymised.
Data Breach Procedures: In the unlikely event of a breach, we have a documented incident‑response plan that includes timely notification to the relevant supervisory authority and affected individuals.

5. Your GDPR Rights

Under the GDPR, you enjoy the following rights. Each right is accompanied by a Bootstrap icon for quick reference.

Right to Access

You may request confirmation of whether we process your personal data and obtain a copy of that data, along with information about the purposes, categories, recipients, and retention periods.

Right to Rectification

If any of your personal data is inaccurate or incomplete, you have the right to have it corrected without undue delay.

Right to Erasure (“Right to be Forgotten”)

You may ask us to delete your personal data when it is no longer necessary for the purposes for which it was collected, when you withdraw consent, or when processing is unlawful.

Right to Restrict Processing

You can request that we limit the processing of your data while we verify its accuracy or while you contest its legality.

Right to Data Portability

You have the right to receive your personal data in a structured, commonly used, machine‑readable format and to transmit that data to another controller where technically feasible.

Right to Object

You may object to processing based on legitimate interests or direct marketing. Upon objection, we will cease processing unless we demonstrate compelling legitimate grounds that override your interests.

Right to Withdraw Consent

Whenever processing is based on your consent, you may withdraw that consent at any time. Withdrawal will not affect the lawfulness of processing carried out before the withdrawal.

6. How to Exercise Your Rights

To exercise any of the rights listed above, please follow these steps:

Send a clear request to gdpr@dishmum.com. Include your full name, the email address associated with your Dishmum account, and a description of the specific right you wish to invoke.
If you are requesting access, rectification, erasure, restriction, or data portability, please provide any additional information that will help us identify the relevant records (e.g., order numbers, dates of interaction).
We will acknowledge receipt of your request within 5 business days and will aim to respond no later than 30 calendar days, in line with Article 12 of the GDPR.
If we need more time (e.g., for complex requests), we will inform you of the extension and the reasons within the initial 30‑day period, extending the deadline by up to two additional months.

All communications will be handled securely, and we will verify your identity before disclosing any personal data.

7. International Transfers

Dishmum may transfer personal data to service providers located outside the European Economic Area (EEA). Such transfers are protected by standard contractual clauses approved by the European Commission, ensuring an adequate level of protection.

8. Changes to This Policy

We review this policy regularly. Any material changes will be posted on this page with an updated “Last Updated” date. Continued use of the Dishmum platform after such changes constitutes acceptance of the revised policy.

9. Contact Information

If you have any concerns about how Dishmum processes your personal data, or if you wish to lodge a complaint, you may contact our Data Protection Officer at gdpr@dishmum.com. You also have the right to lodge a complaint with a supervisory authority in the EU member state where you reside.