Last updated: 3 October 2026
1. Who is responsible?
This website (food.studiopieters.nl) is managed by Achim Pieters, trading as Studio Pieters (hereinafter: “we”, “us”), based in the Netherlands. We are the controller within the meaning of the General Data Protection Regulation (GDPR; in Dutch: AVG) for the personal data processed via this website. Questions about this privacy policy, or about the data we process about you, can be sent to info@studiopieters.nl.
This privacy policy is solely about the processing of personal data. For the terms under which the website (including the recipes and nutritional value and allergen information) may be used, and the limitation of liability for it, we refer to the separate disclaimer.
2. What data do we collect, why, and on what basis?
Below, for each part of the website, you can see what data is processed, for what purpose, on what legal basis (GDPR Article 6) and how long we keep it.
2.1 Comments
If you post a comment under a recipe or blog article, we process the data you enter in the comment form (name, email address, content of the comment), together with your IP address and browser user agent. The latter solely to help recognise spam automatically.
Basis: consent (you post the comment yourself, voluntarily) and our legitimate interest in a working, spam-free comment function.
Retention period: for as long as the associated recipe or article is online, or until you yourself ask for removal.
2.2 Ratings (stars)
If you rate a recipe with stars, we place a functional cookie in your browser (for example umami_rated_123) to remember that you have already rated that recipe, so that double voting is prevented. This cookie contains no name, email address or other traceable data.
Basis: legitimate interest (technically necessary for a fair, working rating function); no separate consent is required for this, as it is a functional cookie.
Retention period: a maximum of 1 year.
2.3 Cookie notice
If you accept the cookie notice, we place a functional cookie (umami_cookie_consent) that solely remembers your choice, so that the notice does not keep reappearing.
Basis: legitimate interest / legal obligation (being able to demonstrate and remember consent given).
Retention period: a maximum of 1 year.
2.4 Contact form
If you use the contact form, we receive the name, email address and message that you enter, by email. We use this data solely to answer your question or message. To combat spam, we also process technical data (IP address, time of loading and sending) with a submission.
Basis: consent (you send the message yourself) and our legitimate interest in being able to answer questions and keep out spam.
Retention period: a maximum of 12 months after the last contact, unless a longer retention period is legally required or necessary to deal with an ongoing matter. Technical anti-spam data (such as the IP address for rate limiting) is kept for a maximum of 1 hour.
2.5 Advertisements (Google AdSense)
If advertisements are active on this site, this happens via Google AdSense, but only after you have given your consent via the cookie notice. Without that consent, no AdSense scripts load and no advertising cookies are placed. If you give consent, Google may place cookies to show, personalise and measure advertisements. Google acts as an independent controller here and may process data on servers outside the European Economic Area (EEA), including in the United States; Google uses the standard contractual clauses approved by the European Commission for this. You can find more information in Google’s advertising policy and Google’s privacy policy.
Basis: solely your explicit consent via the cookie notice.
Retention period: determined by Google, see the sources above.
2.6 Server logs
Our hosting provider processes technical data (such as IP address, time and requested page) in server logs. This is necessary for the security, stability and operation of the website (for example detecting abuse or faults).
Basis: legitimate interest (security and management of the website).
Retention period: in accordance with our hosting provider’s retention policy, usually no longer than a few weeks to months.
2.7 Account, profile and favourites
If you create an account, we process the data you provide for it: username, email address and password. We never store your password in readable form, but only as an irreversible hash (an encrypted representation from which the original password cannot be derived) — so we cannot see your password either. Optionally you can set a display name and a profile photo; that profile photo is stored as an ordinary media attachment on our own server. If you don’t upload your own profile photo, WordPress (the software this site runs on) may use Gravatar.com, a service of Automattic, to fetch a default image based on a hash of your email address — this is core WordPress functionality, not something we activate separately.
With an account you can add recipes to a personal, private favourites list. This list is visible only to you, is not made public anywhere else on the site, and is stored linked to your account.
Basis: performance of the agreement that arises the moment you create an account yourself (GDPR Article 6(1)(b)); for the profile photo and favourites: your own active choice to use these functions.
Retention period: for as long as your account exists. If you want your account (and all associated data, including your profile photo and favourites list) to be deleted, send a request to info@studiopieters.nl — we will process this within the legal period of 1 month.
2.8 Newsletter (holiday emails)
When you create an account, or later under Edit details, you can choose to receive an email at the start of a holiday period (for example Halloween or Christmas). That email contains three recipes for that holiday and a link to the rest. You will receive at most a few of these emails per year. The box is unticked by default: without your own choice you receive nothing, and existing accounts have not been subscribed automatically.
For this we process your email address, your display name (for the greeting), the language of the email (Dutch or English), your choice (subscribed or not) and the moment you subscribed. The email contains no tracking pixels. The links to recipes do contain a parameter (utm_source=newsletter) that lets the website statistics see that a visit came through the newsletter; the choices from the cookie notice apply to those statistics.
Unsubscribing: you can do this at any time, in every email via the unsubscribe link (without logging in) and under Edit details in your account. After unsubscribing you will receive no more emails.
Basis: your consent (GDPR Article 6(1)(a)), which you can withdraw at any time without affecting processing before the withdrawal.
Processor: the emails are sent through the mail server of our email and hosting provider (see chapter 4).
Retention period: your choice, the language and the moment you subscribed are kept as long as your account exists, so that we can show what you consented to and remember your unsubscription. We only use your email address for these emails while you are subscribed. If you delete your account, this data is deleted too.
3. Cookies, overview
| Name | Purpose | Type | Retention period |
|---|---|---|---|
umami_cookie_consent |
Remembers your choice in the cookie notice | Functional | 1 year |
umami_rated_* |
Prevents double voting on a recipe rating | Functional | 1 year |
| AdSense cookies (Google) | Showing, personalising and measuring advertisements | Marketing, only after consent | Determined by Google |
wordpress_logged_in_* |
Keeps track of the fact that you are logged in, needed for access to your account and favourites | Functional, necessary | Session, or up to 14 days with “Remember me” |
wordpress_sec_* |
Secures your logged-in session (only active on login and account pages) | Functional, necessary | Session, or up to 14 days with “Remember me” |
You can always delete or block cookies yourself via your browser settings. Note: as a result, some parts of the website (such as the rating function) may work less well.
4. Sharing with third parties and transfers outside the EEA
We never sell your data to third parties. We share data only:
- with Google (AdSense), and only if you have given consent for this via the cookie notice; Google may process data outside the EEA in doing so, with the legally required safeguards (standard contractual clauses);
- with our hosting provider, solely to keep the website technically running and to send email (such as the holiday emails and messages from the contact form);
- when we are legally required to do so, for example at the demand of a competent authority.
5. How long do we keep data?
See the retention periods per section in chapter 2. As a general rule, we do not keep personal data for longer than is necessary for the purpose for which it was collected, or for as long as the law requires.
6. Your rights
Under the GDPR you have the following rights with regard to your personal data:
- Right of access, you can request which data we process about you;
- Right to rectification, you can have incorrect data corrected;
- Right to erasure (“right to be forgotten”), you can ask for your data to be deleted;
- Right to restriction of processing, you can ask for the processing of your data to be temporarily restricted;
- Right to object, you can object to processing that is based on our legitimate interest;
- Right to data portability, where applicable, you can request a copy of your data in a common format;
- Right to withdraw consent, where we base processing on your consent (for example the cookie notice, advertisements or the newsletter), you can withdraw it at any time, without this affecting the lawfulness of the processing before the withdrawal.
To exercise any of these rights, send an email to info@studiopieters.nl. We respond within the legal period of 1 month. To prevent abuse, we may ask you to identify yourself.
7. Right to complain
Do you disagree with the way we process your personal data? Then please contact us first via info@studiopieters.nl; we would prefer to solve the problem together with you. You also always have the right to lodge a complaint with the Dutch supervisory authority, the Autoriteit Persoonsgegevens (Dutch Data Protection Authority).
8. Minors
This website is not specifically aimed at children under 16 and we do not knowingly collect personal data from children below this age without the consent of a parent or guardian. Do you suspect that we have unintentionally collected data from a minor? Then please contact us via info@studiopieters.nl and we will delete this data.
9. Security
We take appropriate technical and organisational measures to protect your data against loss, misuse or unlawful access. Despite these measures, no website can guarantee 100% security; if you suspect a vulnerability, please report it via info@studiopieters.nl (responsible disclosure; we treat serious reports as a priority).
10. Data breaches
Should a data breach unfortunately occur that poses a risk to your rights and freedoms, we will, in accordance with the GDPR, report it to the Autoriteit Persoonsgegevens within 72 hours of discovery, and we will inform the people concerned directly if the breach is likely to pose a high risk to them.
11. Changes to this privacy policy
We may amend this privacy policy from time to time, for example in the event of changes to the website, legislation or the services we use. The date at the top of this page shows when it was last changed. We recommend consulting this policy regularly.
12. Contact
Questions about this privacy policy, or about how we handle your data? Contact us via info@studiopieters.nl or via the contact page.