Data Processing Agreement (DPA)

This Data Processing Agreement (“Agreement” or “DPA”) forms part of the Terms & Conditions or any other written or electronic agreement (“Principal Agreement”) between:

(1) RecipesBible.com (“Controller”),.

This DPA ensures compliance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”), the UK GDPR, and any applicable data protection laws.

1. Definitions

“Personal Data”: Any information relating to an identified or identifiable natural person.
“Processing”: Any operation performed on Personal Data, including collection, storage, use, disclosure, or deletion.
“Controller”: The entity determining the purposes and means of processing Personal Data (RecipesBible.com).
“Processor”: The entity processing Personal Data on behalf of the Controller.
“Sub‑processor”: Any third party engaged by the Processor to assist in processing Personal Data.
“Data Subject”: The individual whose Personal Data is processed.

2. Subject Matter & Duration

This DPA governs the Processor’s handling of Personal Data on behalf of RecipesBible.com.

It remains in effect for as long as the Processor provides services involving Personal Data.

3. Nature & Purpose of Processing

The Processor may process Personal Data solely for the following purposes:

Hosting, infrastructure, and platform services
Analytics and performance monitoring
Email delivery and communication services
Customer support tools
Advertising, marketing, and affiliate integrations
Any other services explicitly agreed in writing

The Processor may not process Personal Data for its own purposes.

4. Categories of Data Subjects

Processing may involve Personal Data relating to:

Website users
Registered account holders
Newsletter subscribers
Competition participants
Customer support requesters

5. Types of Personal Data

The Processor may handle:

Names
Email addresses
IP addresses
Device and browser data
Usage and analytics data
User‑submitted content (recipes, comments, images)
Any other data provided by the Controller

No special category data is intentionally processed.

6. Processor Obligations

The Processor agrees to:

6.1 Process Only on Documented Instructions

Process Personal Data only according to the Controller’s written instructions.

6.2 Confidentiality

Ensure all personnel with access to Personal Data are bound by confidentiality obligations.

6.3 Security Measures

Implement appropriate technical and organizational measures, including:

Encryption
Access controls
Secure storage
Regular security testing
Incident detection and response

6.4 Data Breach Notification

Notify the Controller without undue delay (and no later than 48 hours) after becoming aware of a Personal Data breach.

6.5 Assistance with Data Subject Rights

Assist the Controller in responding to:

Access requests
Rectification
Erasure
Objections
Data portability

6.6 Assistance with Compliance

Support the Controller in meeting GDPR obligations, including:

Security
Breach notifications
Data protection impact assessments (DPIAs)

6.7 Return or Deletion of Data

Upon termination of services, delete or return all Personal Data unless required by law to retain it.

7. Sub‑processors

The Processor may engage Sub‑processors only if:

The Controller is informed in advance
A written contract is in place with equivalent data protection obligations
The Processor remains fully liable for Sub‑processor actions

The Controller may object to new Sub‑processors on reasonable grounds.

8. International Data Transfers

Personal Data may not be transferred outside the UK/EEA unless:

The destination country has an adequacy decision, or
Appropriate safeguards are in place (e.g., Standard Contractual Clauses), or
The Controller has provided explicit written consent

9. Audits & Inspections

The Controller may audit the Processor’s compliance:

With reasonable notice
During normal business hours
Without disrupting operations

The Processor must provide all necessary information to demonstrate compliance.

10. Liability

Each Party’s liability under this DPA is subject to the limitations set out in the Principal Agreement, except where prohibited by law.

11. Governing Law

This DPA is governed by the laws of:

[England & Wales]

Any disputes shall be resolved in the courts of that jurisdiction.

12. Order of Precedence

If there is a conflict between this DPA and the Principal Agreement, this DPA prevails regarding data protection matters.

13. Termination

This DPA terminates automatically when all processing activities have ceased and all Personal Data has been deleted or returned.