GDPR Compliance Policy – pamdishes

Last Updated: April 03, 2026

Who We Are

pamdishes (the “Site”) is operated by PamDishes Ltd. with its principal office located in the United Kingdom. We are committed to protecting the privacy and personal data of our users in accordance with the General Data Protection Regulation (GDPR) and the UK Data Protection Act 2018.

Contact

If you have any questions, concerns, or requests regarding this policy or your personal data, please contact us at [email protected].

What Data We Collect

When you visit pamdishes, we collect the following types of personal data:

• Email addresses: When you subscribe to our newsletter, create an account, or place an order, we collect your email address.
• Cookies: We use first‑party cookies to remember your preferences and to provide a personalized experience. Third‑party cookies may also be used for analytics and advertising.
• Analytics data: We gather anonymous usage statistics via Google Analytics and other analytics providers to improve site performance and user experience.

How We Protect Your Data

We employ a range of technical and organisational measures to safeguard your personal data:

• SSL/TLS encryption: All data transmitted between your browser and our servers is encrypted using HTTPS.
• Secure servers: Our hosting environment is protected by firewalls, intrusion detection systems, and regular security audits.
• Access control: Only authorised personnel with a legitimate need to process your data are granted access, and all staff undergo data protection training.
• Data minimisation & retention: We retain personal data only for as long as necessary to fulfil the purposes for which it was collected or to comply with legal obligations.

Legal Basis for Processing

We process personal data under the following lawful bases:

• Consent: When you voluntarily provide your email address or opt‑in to marketing communications, we rely on your explicit consent.
• Legitimate interest: We process data necessary for the operation of the Site, such as maintaining user accounts, processing orders, and improving site functionality. We assess that these interests do not override your fundamental rights and freedoms.

Your GDPR Rights

Right to Access

You have the right to obtain confirmation that we are processing your personal data and to receive a copy of the data we hold about you. This includes information on the purposes of processing, categories of data, recipients, and retention periods.

Right to Rectification

If any of your personal data is inaccurate or incomplete, you may request that we correct it. We will rectify the data promptly, typically within 30 days.

Right to Erasure (Right to be Forgotten)

You can request the deletion of your personal data where it is no longer necessary for the purposes for which it was collected, or if you withdraw consent and no other legal basis exists.

Right to Restrict Processing

You may ask us to restrict the processing of your personal data if you contest its accuracy or if we no longer have a lawful basis to process it, but you still need the data for legal claims.

Right to Data Portability

You can obtain your personal data in a structured, commonly used, machine‑readable format and transfer it to another controller if you wish.

Right to Object

You may object to the processing of your personal data for direct marketing purposes or when processing is based on legitimate interests. Upon objection, we will cease processing unless we can demonstrate compelling legitimate grounds.

Right to Withdraw Consent

If you have given us consent to process your data, you can withdraw it at any time. Withdrawal does not affect the lawfulness of processing based on consent before withdrawal.

How to Exercise Your Rights

To exercise any of the rights outlined above, please send a written request to [email protected]. Your request should include:

• Your full name and contact details.
• A clear statement of the right you wish to exercise.
• Any supporting evidence that can help us identify your data (e.g., order numbers, account ID).

We will respond to your request within 30 days, as required by the GDPR. If we need additional information to verify your identity or to fulfil your request, we may contact you via the email address you have provided.

Response Time

We commit to responding to all GDPR rights requests within 30 calendar days from the date we receive your request. If we require more time, we will inform you of the delay and provide a revised timeline.

Changes to This Policy

We may update this GDPR Compliance Policy from time to time. Any changes will be posted on this page with a new “Last Updated” date. We encourage you to review this policy regularly to stay informed about how we protect your personal data.

Contact Us

For any questions or concerns regarding your personal data or this policy, please reach out to us at [email protected]. We are here to help and will address your inquiries promptly.