Privacy Policy

Effective Date: January 1, 2026 | Last Updated: February 2026

Spotbridgematrixx Culinary Media Ltd. ("Spotbridgematrixx", "we", "us", or "our") is dedicated to safeguarding the personal data of our culinary magazine readers, newsletter subscribers, and mobile users. This comprehensive Privacy Policy outlines the mechanisms through which we collect, process, store, and protect your personal information in compliance with the General Data Protection Regulation (EU GDPR / UK GDPR), the California Consumer Privacy Act (CCPA), and applicable global data privacy statutes.

1. Identity of Data Controller

The data controller responsible for the processing of personal data collected via spotbridgematrixx.com is:

Spotbridgematrixx Culinary Media Ltd.
Company Registration Number: 14829104
Registered Address: 38 St John's Lane, Farringdon, London EC1M 4BJ, United Kingdom
Data Protection Officer (DPO) Contact: [email protected]

2. Categories of Information We Collect

Depending on your interactions with our editorial publication, we collect both direct and automated categories of data:

• Directly Provided Information: Full name, email address, physical correspondence address, submitted culinary story pitches, restaurant recommendations, feedback, and user inquiries submitted via our web forms.
• Automated Telemetry & Device Data: IP address, browser type and version, language preferences, operating system, approximate geographic location (city/country level), referral URL strings, timestamp records, time spent on culinary itineraries, and interaction history across our digital articles.
• Interactive Culinary Profile Data: Saved food trails, dietary preference filters (e.g., wine trails, artisanal bakeries), and newsletter category preferences.

3. Legal Bases for Data Processing

We process your personal data under the following recognized legal grounds:

• Consent (Art. 6(1)(a) GDPR): When you explicitly consent to receive culinary editorial newsletters, marketing communications, or accept non-essential analytics cookies.
• Contractual Performance (Art. 6(1)(b) GDPR): When processing information necessary to fulfill digital guide purchases, magazine subscriptions, or user account servicing.
• Legitimate Interests (Art. 6(1)(f) GDPR): To enhance website cybersecurity, detect and prevent malicious traffic, optimize user interface design, analyze reader aggregate metrics, and maintain editorial standards.
• Legal Obligation (Art. 6(1)(c) GDPR): To comply with financial reporting, statutory audits, and legal notices issued by competent judicial authorities.

4. Third-Party Data Processors & Sub-Processors

We do not sell, rent, or trade your personal information to data brokers. We engage strictly vetted third-party vendors who process data on our explicit instructions under signed Data Processing Agreements (DPAs):

• Cloud Hosting Infrastructure: Cloudflare (Content Delivery & DNS security), AWS EU-West Datacenters (London/Frankfurt).
• Newsletter & Communication Engines: MailerLite / SendGrid (for delivering editorial email broadcasts and verifying double-opt-in subscriptions).
• Web Analytics: Privacy-focused aggregate analytics (Plausible / Google Analytics with IP-anonymization active).

5. International Data Transfers

Where personal data is transferred outside the United Kingdom or European Economic Area (EEA), Spotbridgematrixx ensures adequate protection through European Commission Standard Contractual Clauses (SCCs), the UK International Data Transfer Addendum (IDTA), and adequacy decisions under Art. 45 GDPR.

6. Data Retention Period

We retain personal information only for as long as necessary to fulfill the purposes for which it was collected. Newsletter subscriber data is maintained until unsubscribed. Editorial pitch correspondence is archived for 24 months. Web server access logs are purged every 90 days, unless a security incident requires ongoing investigation.

7. Your Statutory Data Protection Rights

Under GDPR and international privacy legislation, you have the right to:

• Right to Access (Art. 15 GDPR): Request a copy of all personal data held about you.
• Right to Rectification (Art. 16 GDPR): Request correction of inaccurate or incomplete records.
• Right to Erasure / 'Right to Be Forgotten' (Art. 17 GDPR): Request deletion of your personal records where no statutory retention exception applies.
• Right to Restrict Processing (Art. 18 GDPR) & Right to Data Portability (Art. 20 GDPR).
• Right to Object (Art. 21 GDPR): Object at any time to direct marketing and processing based on legitimate interests.

To exercise any of these rights, email our Data Protection Officer directly at [email protected]. We respond to verified requests within thirty (30) calendar days without fee.

8. Complaints to Supervisory Authorities

If you believe our data processing violates applicable privacy laws, you have the right to lodge a formal complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk or your local EU Member State Data Protection Authority.