Information on the processing of personal data pursuant to Article 13 of Regulation (EU) 2016/679 (GDPR)

Last updated: 13 October 2026

1. Data Controller

DishToHub, available at https://www.dishtohub.com, is a personal, non-commercial project dedicated to Italian cuisine, featuring recipes, articles, cooking tips and other food-related content.

The data controller responsible for processing personal data is Andrea Maranesi.

For questions about the processing of personal data or to exercise your privacy rights, you can contact the data controller at:

privacy@dishtohub.com

2. Personal Data We Process

When you browse DishToHub or use its services, we may process the following categories of personal data.

Browsing Data

The systems used to operate the website may automatically collect technical information necessary for communication between your device and the website.

This information may include your IP address, browser type, operating system, requested pages, dates and times of access, and other technical connection data.

We use this information to enable browsing, maintain the website, identify technical problems and prevent misuse.

Data Submitted Through Forms

When you use our contact or suggestion forms, we may collect your name (if provided), email address, type of enquiry and message content.

The forms are managed using Fluent Forms.

Submitted information is stored in the WordPress database. The data controller also receives an email notification that may contain the information you provide, including your message.

Fluent Forms is configured not to record IP addresses for new form submissions. Other technical information, such as browser type, operating system, referring page and submission date and time, may still be stored.

Registered User Data

Creating a DishToHub account gives you access to additional features, including profile management, saving favourite recipes, and participating through reviews and questions.

When you register or use your account, we may process:

• Username and email address.
• Information added to your profile.
• Authentication credentials, with passwords protected using WordPress security mechanisms.
• Recipes saved to your favourites.
• Reviews, ratings and questions you submit.
• Technical information necessary to manage login sessions and account access.

Accounts and registered-user features are managed through WordPress and Delicious Recipes Pro.

Newsletter Data

When you subscribe to our newsletter, we collect your email address and may record information necessary to manage and document your subscription.

The newsletter is managed through MailPoet and uses a double opt-in process to confirm your email address.

Newsletter subscriptions are voluntary and separate from website account registration.

3. Purposes and Legal Bases for Processing

We process personal data for the following purposes.

Website operation and security. To enable browsing, ensure the website functions correctly, prevent misuse and protect our systems. The legal basis is the data controller’s legitimate interest under Article 6(1)(f) of the GDPR, subject to applicable legal requirements.

Handling enquiries. To receive and respond to messages voluntarily submitted by visitors. The legal basis is the data controller’s legitimate interest in managing communications or, where applicable, taking steps requested by the individual.

Account management. To enable registration, authentication, profile management and access to registered-user features. The legal basis is the performance of the service requested by the user under Article 6(1)(b) of the GDPR.

Newsletter. To send new recipes, articles, cooking tips and updates about published content. The legal basis is consent under Article 6(1)(a) of the GDPR.

Website analytics. To understand how the website is used and improve its content and user experience. Processing involving non-essential analytics cookies takes place with the user’s prior consent.

Spam prevention. To prevent automated submissions, spam and misuse of our forms. The legal basis identified by the data controller is the legitimate interest in website security under Article 6(1)(f) of the GDPR, subject to the additional rules applicable to cookies and similar technologies.

Legal obligations and protection of rights. To comply with applicable legal requirements and establish, exercise or defend legal claims, relying on the relevant legal basis in each case.

4. Registration and Recipe Dashboard

You can create a personal account on DishToHub.

Your account allows you to access the Recipe Dashboard, manage your profile information, save favourite recipes and use features reserved for registered users.

Account-related data is retained for as long as your account remains active, unless you request deletion or further retention is justified by applicable legal requirements.

Users cannot delete their accounts directly through the Recipe Dashboard.

To request account deletion, please contact privacy@dishtohub.com.

Before processing a deletion request, the data controller may carry out reasonable checks to verify the requester’s identity.

Deleting your account will result in the loss of access to your profile and associated personal features.

5. Reviews, Ratings and Questions

DishToHub allows registered users to publish reviews, ratings and questions about recipes.

You must be logged in to use these features.

Your contributions may be publicly visible to other website visitors alongside the username associated with your account.

Your email address is not displayed publicly through these features.

The data controller may moderate or remove content containing spam, offensive messages or other inappropriate material.

You may request the removal of your contributions and associated personal data by contacting privacy@dishtohub.com, subject to applicable legal requirements.

If an account is deleted, published contributions will be handled in accordance with the individual’s rights. Where appropriate, content may be retained in a genuinely anonymised form.

6. Newsletter

DishToHub uses MailPoet to manage newsletter subscriptions and send communications relating to website content.

Subscribing is voluntary and requires you to confirm your email address by following a link sent during the subscription process.

Newsletter emails may include new recipes, articles, cooking tips and updates.

Our current settings do not enable individual tracking of newsletter email opens or clicks.

Every newsletter includes an unsubscribe link.

You may withdraw your consent at any time by using this link or contacting privacy@dishtohub.com.

Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

7. Google Analytics

DishToHub uses Google Analytics 4, integrated through Google Site Kit, to collect statistical information about website usage.

This service allows us to analyse visits, pages viewed, interactions with content and technical characteristics of the devices used.

Google Analytics cookies are activated according to the preferences expressed by users through our consent management system.

Our current data retention settings are:

• 2 months for event data subject to the relevant retention setting.
• 14 months for user data subject to the relevant retention setting.

The option to reset the retention period when new activity occurs is enabled, where applicable.

These periods do not necessarily correspond to the retention periods for all aggregated data or technical records managed by Google.

For more information, please refer to Google’s Privacy Policy:

https://policies.google.com/privacy

8. Spam Protection with Google reCAPTCHA v3

DishToHub uses Google reCAPTCHA v3, a service provided by Google through Google Cloud, to protect its contact and suggestion forms against spam, automated submissions and misuse.

The service loads on pages containing protected forms and analyses technical signals relating to browsing and interactions to assess the risk of automated activity.

The data processed may include IP addresses, browser and device characteristics, and other technical information necessary for risk assessment.

The service communicates with Google’s servers and may use cookies or similar technologies.

The data controller uses reCAPTCHA to pursue a legitimate interest in website security and preventing misuse, under Article 6(1)(f) of the GDPR, following an assessment of the necessity and proportionality of the processing.

Under the applicable Google Cloud reCAPTCHA terms, Google processes service data on behalf of the data controller, in accordance with the relevant contractual terms and data processing agreements.

Any use of cookies or similar technologies remains subject to applicable legal requirements, including those concerning prior consent and possible exemptions for strictly necessary technologies.

For more information:

https://cloud.google.com/security/products/recaptcha

9. Profile Images and Gravatar

DishToHub uses the avatar system supported by WordPress and Delicious Recipes Pro.

Profile images may be displayed in the Recipe Dashboard through Gravatar, a service provided by Automattic.

When a Gravatar image is loaded, your browser sends a request to the service’s external servers, particularly secure.gravatar.com.

This communication may involve processing your IP address and other technical information about your connection and device.

The request may also include an identifier derived from the email address associated with your account, which is used to locate a corresponding avatar.

Whether a personalised image is displayed depends on the availability of an avatar associated with your email address and the service’s settings.

For more information:

https://automattic.com/privacy/

10. Cookies and Similar Technologies

DishToHub uses cookies and similar technologies to support website operation and registered-user features and, where required, with prior consent, to collect statistical information.

These technologies may be used to manage sessions, authenticate users, remember language preferences and store consent choices.

Cookie preferences are managed through Complianz.

You can accept or reject non-essential cookies and subsequently change your choices using the “Manage Consent” feature available on the website.

For detailed information about cookie categories, purposes and retention periods, please refer to DishToHub’s Cookie Policy.

11. Hosting and Service Providers

DishToHub is hosted by host.it, which provides the technical services required to publish and operate the website.

Personal data may be processed by providers involved in the technical operation of the website, email services, analytics, security and newsletter management, to the extent necessary to provide their respective services.

The services and technologies used include:

• host.it, for hosting and technical services.
• WordPress and Delicious Recipes Pro, for website management and registered-user features.
• Fluent Forms, for contact and suggestion forms.
• MailPoet, for newsletter management.
• Google Analytics and Google Site Kit, for website analytics.
• Google reCAPTCHA v3, for spam prevention.
• Complianz, for cookie consent management.
• Gravatar, for profile images loaded through the service.

Some tools operate directly within the WordPress installation, and their use does not necessarily involve transmitting personal data to the respective plugin developers.

We do not sell personal data to third parties.

12. International Data Transfers

Some third-party services used by DishToHub may involve processing or transferring personal data to countries outside the European Economic Area (EEA).

This may particularly concern services provided by Google and other external providers involved in website functionality.

Where applicable, such transfers must comply with the GDPR through European Commission adequacy decisions or other legally recognised safeguards, such as Standard Contractual Clauses.

For information about the safeguards applied to specific processing activities, you may contact the data controller at privacy@dishtohub.com.

13. Personal Data Retention

Personal data is retained for as long as necessary for the purposes for which it was collected, according to the criteria described below.

Contact and Suggestion Messages

Personal data collected through Fluent Forms is retained for a maximum of 12 months from receipt.

The same retention period applies to email notifications containing personal data.

Information may be retained for longer where necessary to handle unresolved enquiries, comply with legal obligations or establish, exercise or defend legal claims.

User Accounts

Profile information and associated data are retained for as long as the account remains active, unless deletion is requested or further retention is justified.

Reviews and Questions

Contributions published by users are retained while the relevant website features remain available, unless removal is requested or other circumstances justify deletion.

If an account is deleted, associated personal data will be deleted or, where appropriate, genuinely anonymised, unless further retention is legally justified.

Newsletter

Your email address is retained while your subscription remains active.

If you unsubscribe, your data will be deleted or retained on a limited basis where necessary to document consent management, respect your decision not to receive further communications or comply with applicable obligations.

MailPoet is currently configured to retain email sending records for 6 months and previously sent email content for 30 days, in relation to the respective features.

Google Analytics

The retention periods described in the relevant section apply.

Cookies

Cookie retention periods are detailed in the Cookie Policy.

Technical Logs

Technical records relating to website operation and security are retained according to the hosting service’s settings and for as long as necessary for their respective purposes.

14. Backups

The data controller creates backups of the website and its database to enable restoration in the event of technical problems, data loss or security incidents.

Backups may contain personal data stored on the website at the time they are created.

Backup files are stored with restricted access and protected using security measures appropriate to the information they contain.

Backups are periodically replaced and retained only for as long as necessary for security and recovery purposes.

If a backup is restored, the data controller takes appropriate steps to avoid, as far as reasonably possible, reintroducing personal data that has previously been deleted.

15. Personal Data Security

DishToHub adopts technical and organisational measures designed to protect personal data against unauthorised access, loss, disclosure or misuse.

The website uses HTTPS connections and the authentication and access control mechanisms provided by WordPress.

Access to administrative information and collected personal data is restricted to individuals authorised to manage the website.

Security measures are assessed in relation to the risks associated with the processing activities.

16. Providing Personal Data

You do not need to create an account to browse the public pages of DishToHub.

Providing information through contact and suggestion forms is voluntary. However, without the information required to process your enquiry, we may be unable to receive or respond to it.

Creating an account requires you to provide the information requested during registration.

Newsletter subscription is optional and independent of website registration.

You may refuse consent to non-essential cookies without losing access to public website content, although certain features that depend on specific technologies may be unavailable.

17. Your Rights

Under Articles 15–22 of the GDPR, where applicable and subject to the conditions established by law, you have the right to:

• Request confirmation of whether your personal data is being processed and obtain access to it.
• Request correction of inaccurate personal data.
• Request deletion of your personal data.
• Request restriction of processing.
• Object to processing where the relevant conditions apply.
• Request data portability in the circumstances provided by law.
• Withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.
• Not be subject, where applicable, to decisions based solely on automated processing that produce legal or similarly significant effects.

To exercise your rights, please contact:

privacy@dishtohub.com

Requests will be handled within the time limits established by the GDPR, generally within one month of receipt, subject to any extensions permitted by law.

You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali):

https://www.garanteprivacy.it

18. Children

DishToHub publishes food-related content intended for a general audience.

The website is not designed to intentionally collect children’s personal data in breach of applicable data protection laws.

If personal data is found to have been collected in a manner that does not comply with the rules protecting children, the data controller will take appropriate action.

19. Automated Decision-Making

DishToHub does not use personal data to make decisions based solely on automated processing that produce legal effects or similarly significant consequences for individuals within the meaning of Article 22 of the GDPR.

The reCAPTCHA service performs automated assessments of spam and misuse risks to protect website forms.

20. Changes to This Privacy Policy

This Privacy Policy may be updated to reflect changes in the services used, personal data processing practices or applicable legislation.

The updated version will be published on this page, together with the date of the latest revision.

For any questions, please contact the data controller at privacy@dishtohub.com.