GDPR Compliance Policy – MumFlavors

Last Updated: April 03, 2026

MumFlavors (“we”, “our”, “us”) is committed to protecting the privacy and personal data of our website visitors, customers, and partners. This GDPR Compliance Policy explains how we collect, use, store, and protect your personal data in accordance with the General Data Protection Regulation (EU) 2016/679 and other applicable privacy laws. By using our website https://mumflavors.com, you acknowledge that you have read and understood this policy.

1. Types of Personal Data We Collect

Email addresses: When you sign up for newsletters, place orders, or contact us, we collect your email address to communicate with you, process orders, and send relevant information.
Cookies and Similar Technologies: We use first‑party cookies to remember your preferences, shopping cart contents, and to provide a personalized browsing experience. Third‑party analytics cookies (e.g., Google Analytics) help us understand how visitors use our site and improve our services.
Analytics Data: We collect aggregated, anonymous data such as page views, referral sources, device information, and geographic location. This data is used to analyze traffic patterns and optimize website performance.

2. Legal Basis for Processing Personal Data

We process personal data based on the following lawful bases:

Consent: For marketing communications (newsletters, promotional emails) we obtain your explicit consent. You can withdraw consent at any time by clicking the unsubscribe link in the email or contacting us.
Legitimate Interest: We process data for legitimate business purposes such as improving our website, ensuring security, and providing customer support. We conduct a legitimate interest assessment to confirm that our interests do not override your fundamental rights.

3. How We Protect Your Personal Data

SSL/TLS Encryption: All data transmitted between your browser and our servers is encrypted using industry‑standard SSL/TLS protocols.
Secure Servers: We host our website on secure, up‑to‑date servers with regular vulnerability scans, firewalls, and intrusion detection systems.
Access Controls: Personal data is stored on encrypted databases and accessed only by authorized staff who have a legitimate business need.
Limited Retention: We retain personal data only for as long as necessary to fulfill the purposes for which it was collected or to comply with legal obligations. Once no longer needed, data is securely deleted or anonymized.

4. Your GDPR Rights

Under the GDPR you have the following rights regarding your personal data. We are committed to respecting these rights and providing you with a straightforward process to exercise them.

Right to Access

You can request a copy of all personal data we hold about you, including the purposes of processing, categories of data, and third parties with whom we share it.

Right to Rectification

If any of your personal data is inaccurate or incomplete, you may ask us to correct it. We will update the data within a reasonable time.

Right to Erasure

Also known as the “right to be forgotten”. You can request deletion of your personal data if it is no longer necessary, if you withdraw consent, or if the data was processed unlawfully.

Right to Restrict Processing

You may request that we limit the processing of your data while we verify its accuracy or assess the legality of its use. During this period, the data will be stored but not used for further processing.

Right to Data Portability

You can receive your personal data in a structured, commonly used, and machine‑readable format, or request that we transfer it directly to another controller if technically feasible.

Right to Object

You may object to the processing of your data for direct marketing or profiling purposes. Upon objection, we will stop processing unless we can demonstrate a compelling legitimate interest.

Right to Withdraw Consent

If you have given us consent to process your data, you can withdraw that consent at any time. Withdrawal will not affect the lawfulness of processing carried out before the withdrawal.

5. How to Exercise Your Rights

To exercise any of the rights above, please contact us at:

GDPR Contact: [email protected]

When contacting us, please provide enough information for us to verify your identity (e.g., name, email address, order number, or other identifying details). This is necessary to prevent unauthorized access to your data.

Procedure for Requests

Send an email to [email protected] stating the specific right you wish to exercise and any relevant details.
We will acknowledge receipt of your request within 5 business days.
We will respond to your request within 30 calendar days, as required by GDPR. If additional time is needed, we will inform you of the delay and the reason.

6. Data Retention Policy

We retain personal data for the period necessary to fulfill the purposes identified in this policy, including:

Email addresses: up to 5 years after the last interaction, unless you opt‑out earlier.
Cookies: session cookies are deleted when the session ends; persistent cookies are deleted after 12 months.
Analytics data: retained for 12 months, after which it is aggregated and anonymized.

7. International Data Transfers

MumFlavors may transfer personal data to servers located in countries outside the European Economic Area (EEA). We ensure that such transfers are subject to adequate safeguards, including standard contractual clauses, to maintain the level of protection required by GDPR.

8. Changes to This Policy

We may update this GDPR Compliance Policy from time to time. Any changes will be posted on this page with a new “Last Updated” date. We encourage you to review this policy periodically to stay informed about how we protect your personal data.

9. Contact Us

If you have any questions, concerns, or complaints about our data processing practices, please contact our Data Protection Officer at: