Jacinto's Culinary Atelier

1. Data Controller

The controller responsible for your personal data is Chef Jacinto Samuel, operating Jacinto's Culinary Atelier at jacintosculinaryatelier.com. Contact: jacintof.samuel@gmail.com.

2. What Data We Collect

We only collect what is necessary to run the Atelier:

Account data — name and email address (via Google Sign-In)
Purchase data — items purchased, order date, amount (via Stripe)
Gift data — sender and recipient emails when using Gift-a-Pass
Usage data — anonymised traffic statistics (via Google Analytics)
Support data — content of messages you send us

We do not collect or store your payment card details. Stripe handles that securely.

3. Legal Basis (GDPR Article 6)

Contract — to deliver the recipes you purchase
Legitimate interest — to keep the Atelier safe and improve it
Consent — for analytics cookies and marketing emails
Legal obligation — to keep tax and accounting records

4. Who We Share Data With

We share the minimum necessary data with these trusted processors:

Stripe — payment processing (USA/EU, PCI-DSS compliant)
Google — authentication & analytics (Google Ireland)
Resend — transactional emails for gifts (EU)
Emergent — hosting infrastructure
Cloudflare — content delivery and security (EU)

We never sell your data to third parties.

5. Data Retention

Account data — until you request deletion
Purchase records — 7 years (tax law)
Analytics — 14 months (Google Analytics default)
Support messages — 2 years

6. Your Rights (GDPR)

You have the right to:

Access the personal data we hold about you
Correct inaccurate data
Request deletion of your data ("right to be forgotten")
Restrict or object to processing
Data portability (receive your data in a machine-readable format)
Withdraw consent at any time (where processing is based on consent)
Lodge a complaint with your national data protection authority

To exercise any of these rights, email jacintof.samuel@gmail.com. We respond within 30 days.

7. Cookies

The Atelier uses a small number of cookies. Essential cookies (login, session, payment) are always active. Analytics cookies only run if you accept them via the cookie banner. See our Cookie Notice for details.

8. International Transfers

Some of our processors (Stripe, Google) may transfer data outside the EU under Standard Contractual Clauses approved by the European Commission, providing equivalent protection.

9. Security

We use HTTPS across the site, encrypted database connections, and industry- standard access controls. However, no system is 100% secure. If we detect a breach affecting your data, we will notify you within 72 hours.

10. Children

The Atelier is not directed to children under 16. We do not knowingly collect data from minors. If you believe we have, contact us and we will delete it.

11. Changes to This Policy

We may update this policy occasionally. Material changes will be highlighted on the site and, where required, notified by email.

Privacy Policy