Privacy notice

1. Who is responsible for your information

Carl Greenham trading as Delivered by Santa is the data controller. Our business address is 4a Blenheim Road, Weymouth, Dorset, DT3 5AZ, United Kingdom. Contact hello@deliveredbysanta.com with privacy questions or requests.

2. Information we collect

Depending on your order, we collect your name, email address and optional mobile number; the recipient’s first name and age; personal details, pronunciation guidance and message wording you provide; and order, payment status, delivery and support records. For doorstep visits we also collect the visit address, postcode, date, arrival window, child count and relevant access or gift instructions. For video we collect the portrait photo you upload. We may keep correspondence about an order or complaint.

Stripe processes card details for payment. We do not receive or store your full card number.

3. Why we use information and our lawful bases

• To take and fulfil your order: confirm payment, prepare the requested message, arrange a visit, send the finished link, manage changes and answer questions. Our lawful basis is performing our contract with you and taking steps you request before ordering.
• To create the personalised message or video: use the recipient details, script and, for video, portrait photo you provide. We rely on the contract with the purchaser. Please only submit another person’s information or photo when you have permission to do so.
• To send one abandoned booking reminder: only if you tick the optional reminder box. The lawful basis is your consent. You can withdraw it using the unsubscribe link in the email.
• To protect and operate the service: maintain site security, prevent misuse, check visit routes and deal with disputes. We rely on legitimate interests in running a safe, reliable service and protecting our legal rights.
• To meet legal duties: keep the accounting and transaction records we are required to retain. The lawful basis is legal obligation.

We do not use children’s personal details or photos for advertising or unrelated marketing. The optional abandoned booking reminder is separate from the order and is only sent if you opt in.

4. Children’s information and photographs

An adult placing the order must provide the details and confirm they are permitted to share them. We use a child’s name, age, personal details and any submitted photo only to prepare the Santa product you request and provide customer support. A portrait is required for a video order and is used for that video. We do not use it to identify the person.

5. Service providers and sharing

We share only the information needed for a provider to perform its part of the service. Depending on the product, providers include Vercel (website hosting), Supabase (order database and file storage), Stripe (payments), Resend (email), OpenAI or the configured script provider (draft writing), ElevenLabs (voice recording), HeyGen (video creation), Google Maps Platform (visit route calculations) and Webex Interact (SMS, if enabled). These providers may process information on our behalf under their own privacy and security arrangements.

Some providers may process information outside the UK. Where international transfers apply, we use an appropriate legal transfer safeguard. We may also disclose information where required by law or needed to establish, exercise or defend legal claims. We do not sell personal information.

6. How long we keep information

We keep order and contact details for as long as needed to take payment, create and deliver your order, provide support, handle disputes and meet accounting or legal duties. We retain photos and recordings for fulfilment, access to the keepsake and support, then delete them when no longer needed unless we must keep them for a legal claim. Accounting records may need to be kept longer. We keep a record of reminder choices and unsubscribe requests so we can honour them and avoid sending unwanted reminders.

You can ask us to delete information earlier. We will explain if some records must be retained for legal or accounting reasons.

7. Your choices and rights

You can ask us for a copy of your personal information, correct it, request deletion or restriction, object to processing based on legitimate interests, or ask for information in a portable format where that right applies. Where we rely on consent, you can withdraw it at any time; this does not affect processing already carried out. Use the contact details above. You can also complain to the UK Information Commissioner’s Office at ico.org.uk/make-a-complaint.

8. Cookies and security

We use reasonable technical and organisational measures to protect order information and keep private media links access-controlled. No internet service can be guaranteed completely secure. The website does not use advertising cookies. Strictly necessary technical storage may be used to operate and protect the site. If we introduce non-essential analytics or advertising technologies, we will update this notice and request consent where required.