Middle Eats — Privacy Policy

Last updated: 2nd September 2026

1. Who we are

Middle Eats is operated by Lamoona Media Ltd (company number 13623153), registered in England & Wales at Lamoona Media Ltd, C/O Ocelot Accounting, 54 Parkstone Road, Poole, Dorset, England, BH15 2PG.

We’re the “data controller” for the personal information described below — the ones responsible for deciding how and why it’s used. If you have a question about this policy or want to exercise any of the rights below, contact us at privacy@middleeats.co.uk.

2. What this policy covers

This applies to middleeats.co.uk and anything connected to it — the blog, the Middle Eats shop page, the contact form, the newsletter signup, and any embedded video or social content. It doesn’t cover third-party sites we link to (YouTube, Instagram, TikTok, Amazon, PayHip, Patreon, Made In, etc) — once you leave our site, their own privacy policies apply.

3. Information we collect

What you give us directly:

• Contact form — name, email address, subject, and message.
• Comments — name, email address, and your comment text (WordPress also stores your IP address and browser “user agent” string with each comment, and, if you have a Gravatar linked to your email, may display your Gravatar image).
• Newsletter signup — your email address, and your name if the signup form asks for it, via ConvertKit (Kit).

What we collect automatically:

• Analytics — via Google Site Kit (Google Analytics), we collect approximate location (derived from IP), device/browser type, pages viewed, how long you stay, and what site referred you to us.
• Server logs — our hosting provider (Cloudways) automatically logs IP addresses and request data for security and performance, as most web servers do.
• Cookies and similar technologies — see the table in Section 5.

We don’t collect payment information — Shop links take you to Amazon, PayHip, Patreon, or other stores who handle payment directly and have their own privacy policies.

4. Why we use it, and our legal basis

5. Cookies

Non-essential cookies (analytics, embedded video, advertising) only load after you accept them in our cookie banner.

You can change your cookie preferences at any time here:

6. Who we share information with

We don’t sell your personal information. We do share it with the service providers who help us run the site, each acting as a data processor (or, for the ad pixels, sometimes as an independent controller of the data they receive):

• Google (Site Kit / Analytics, Search Console, Workspace, Postmark) — United States
• ConvertKit (Kit) — newsletter delivery — United States
• Meta Platforms (Meta Pixel) — United States
• Pinterest — Pinterest tag — United States
• Cloudways — hosting — Cloudways Ltd is registered in Malta, part of the DigitalOcean group; the hosting server itself is provisioned in the United States

7. International data transfers

Several of the service providers above are based outside the UK and EU, or (in Cloudways’ case) store data on servers outside the UK/EU even though the company itself is EU-based. Sending personal data outside the UK legally counts as an “international transfer” under UK GDPR, and — because the US doesn’t have blanket UK adequacy status — needs an approved safeguard. For most of the providers below, that safeguard is one or both of:

• The UK Extension to the EU–U.S. Data Privacy Framework (sometimes called the “UK–US Data Bridge”) — a UK-government-approved mechanism that covers transfers to specific US companies that have self-certified to it, or
• The UK International Data Transfer Agreement (IDTA), or the UK Addendum to the EU Standard Contractual Clauses (SCCs) — a set of UK ICO-approved contract terms.

• Google — Google LLC is self-certified under the EU–U.S. Data Privacy Framework and its UK Extension (verifiable on the US Department of Commerce’s Data Privacy Framework list), and separately relies on the UK Addendum to the EU SCCs for any transfers not covered by that certification.
• ConvertKit (Kit) — Kit’s Data Processing Addendum states it relies on the EU–U.S. DPF and UK Extension where applicable, and otherwise on the EU SCCs approved by the European Commission together with the UK IDTA issued by the ICO. Both are incorporated into Kit’s DPA, which forms part of its Privacy Policy.
• Meta Platforms (Meta Pixel) — Meta Platforms, Inc. is certified under the EU–U.S. DPF and its UK Extension (confirmed on the DPF participant list), and also maintains SCCs and a UK Data Transfer Addendum as an alternative/fallback mechanism.
• Pinterest — Pinterest, Inc. is certified under the EU–U.S. DPF, its UK Extension, and the Swiss–U.S. DPF, and separately relies on SCCs (with the UK Addendum) for transfers the DPF certification doesn’t cover.
• Cloudways — Cloudways Ltd (Malta) is part of the DigitalOcean group. DigitalOcean’s group-wide DPA states it relies primarily on its own DPF certification (EU–U.S. DPF + UK Extension), falling back to SCCs and a UK IDTA Addendum.

8. How long we keep it

• Contact form messages: kept for 90 days
• Comments: kept indefinitely (WordPress keeps these indefinitely by default unless you delete them)
• Newsletter subscribers: kept until you unsubscribe, then ConvertKit will permanently delete all related personal information within 30 days
• Analytics data: per your Google Analytics retention setting (Google’s own default is 14 months unless changed)

9. Your rights (UK/EU visitors)

Under UK GDPR, you have the right to:

• Ask what personal data we hold about you, and get a copy (access)
• Ask us to correct inaccurate data (rectification)
• Ask us to delete your data (erasure), where applicable
• Object to or restrict certain processing, including direct marketing
• Withdraw consent at any time, without affecting anything done before you withdrew it
• Move your data to another provider (portability), where technically feasible
• Complain to the UK’s Information Commissioner’s Office (ico.org.uk) if you think we’ve mishandled your data

To exercise any of these, email privacy@middleeats.co.uk

10. California and US visitors (CCPA/CPRA)

If you’re a California resident, you additionally have the right to:

• Know what categories of personal information we’ve collected about you and why
• Delete personal information we hold about you, subject to certain exceptions
• Correct inaccurate personal information
• Opt out of the “sale” or “sharing” of your personal information. Passing browsing data to Meta, TikTok, and Pinterest via their pixels for advertising purposes counts as “sharing” under California law, even though no money changes hands. You can opt out by clicking here, and we honor the Global Privacy Control browser signal where sent.
• Non-discrimination for exercising any of these rights

We don’t sell personal information for money, and we don’t knowingly collect personal information from anyone under 13 (or 16, where COPPA/state law applies) — the site isn’t directed at children.

11. Children’s privacy

Middle Eats is a general-audience cooking site not directed at children, and we don’t knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us and we’ll delete it.

12. Changes to this policy

We’ll update this page when what we collect or how we use it changes — check the “last updated” date at the top. For material changes (a new tracker, a new use of your data), we’ll look at giving more prominent notice, such as a banner on the site.

13. Contact us

Lamoona Media Ltd, trading as Middle Eats
Lamoona Media Ltd, C/O Ocelot Accounting, 54 Parkstone Road, Poole, Dorset, England, BH15 2PG
privacy@middleeats.co.uk