Privacy Policy

1. What we collect

When you submit a recipe through the Share Your Recipe form, we may collect:

• Your name
• Your email address
• Your town or region
• The recipe itself, including any free-text personal story or memory you share with it
• A photograph of the finished dish
• A photograph of the recipe as originally written (if you provide one)
• An audio recording of you or someone else telling the recipe's story (if you provide one)

If you join the Founding Table, we collect your name and email address.

We do not knowingly collect information from children. [LEGAL REVIEW REQUIRED — confirm age restriction / parental consent position if under-18 submissions are possible.]

2. Why we collect it

We use this information to:

• Publish your recipe and story on the site, and in other OPR formats (print, film, events) under the licence you grant us when you submit (see our Terms)
• Contact you about your submission, including if we'd like to feature it
• Send you OPR news and updates, but only if you've opted in to marketing communications
• Maintain a searchable archive of contributors as the record of the project

3. Our lawful basis for processing

• Submissions (publishing your recipe, story and images): legitimate interest — maintaining and growing the OPR archive, which you have actively chosen to contribute to under an explicit licence grant. [LEGAL REVIEW REQUIRED — confirm legitimate interest is the correct basis rather than consent, given the licence-grant mechanism in the Terms.]
• Marketing communications: consent, given separately and optionally via the marketing checkbox. You can withdraw this at any time.
• Founding Table membership: consent, confirmed via double opt-in.

4. How long we keep it

[LEGAL REVIEW REQUIRED — retention period not yet confirmed.] As a living archive, submitted recipes, stories and images are intended to be retained indefinitely as part of the cookbook, unless you ask us to remove them. Contact details used only for marketing are retained until you unsubscribe or withdraw consent.

5. Who we share it with

We use third-party services to run the site and process submissions. As of this draft:

• Hosting: [PROVIDER — TO BE CONFIRMED]
• Form / submission processing: [PROVIDER — TO BE CONFIRMED]
• Email / mailing list: [PROVIDER — TO BE CONFIRMED]

We do not sell your personal information. [LEGAL REVIEW REQUIRED — a full processor list and data processing agreements should be confirmed and named here once vendors are finalised.]

6. Your rights

Under UK GDPR, you have the right to:

• Access the personal information we hold about you
• Ask us to correct inaccurate information
• Ask us to delete your information
• Ask us to restrict how we use it
• Object to our use of it
• Receive your information in a portable format
• Withdraw consent at any time, where we rely on consent

To exercise any of these rights, contact us at [CONTACT EMAIL — TO BE CONFIRMED].

7. Complaints

If you're unhappy with how we've handled your information, you can complain to the Information Commissioner's Office (ICO) at ico.org.uk, or by calling 0303 123 1113.

[LEGAL REVIEW REQUIRED — confirm whether OPR needs to register with the ICO. As a general guide, most small organisations processing personal data pay a data protection fee, currently around £52 a year, though the correct tier depends on turnover and staff numbers and should be checked directly on the ICO's fee self-assessment tool.]

8. Cookies

This site does not currently use analytics or non-essential cookies. If that changes, this policy will be updated and a cookie consent banner will be added before any such cookies are set.

9. Changes to this policy

We may update this policy from time to time. The date at the top shows when it was last revised.