Skip to content
santaclaus-official.com, homeFatherChristmas-official.co.ukby santaclaus-official.com

Privacy and personal data

How we protect families’ and children’s data, simply.

Your data stays under your control

This policy explains which data is used on santaclaus-official.com, why, and how to exercise your rights. When a service concerns a child, it must be used by their parent or legal guardian.

  1. 1. Data Controller

    The santaclaus-official.com website is published by GPTPro Limited (C114704), the data controller for the personal data collected on the site.

    For any questions about your data: [email protected].

  2. 2. Data Collected

    We collect only the data necessary for our services:

    • the parent account holder's data: last name, first name, email address, encrypted password, and subscription history;
    • payment information, processed directly by our secure payment provider and never stored on our servers;
    • information about the child entered by the parent: first name, age or date of birth, interests, good deeds, toy list, and letter to Santa Claus;
    • technical browsing data (IP address, device type, pages visited), under the conditions described in our Cookie Policy.

  3. 3. Children's Data

    Our services are designed for children, but they are used by their parents. Only an adult with parental authority can create an account: a child never has an account or an email address registered with us.

    • information about the child is provided by the parent, who decides what to share;
    • we limit this information to what is needed to personalize the video, the letter, and the toy list;
    • this data is never used for targeted advertising or profiling, and is never sold;
    • the parent can view, correct, or delete it at any time from their account or upon simple request.

  4. 4. Purposes and Legal Bases

    • contract performance: account creation, personalized videos, toy lists, letters, Santa Claus messages, and subscription management;
    • compliance with our legal obligations: billing and accounting;
    • our legitimate interest: site security, fraud prevention, and improvement of our services;
    • your consent: audience measurement and optional communications, which you may withdraw at any time.

  5. 5. Data Recipients

    Your data is accessible only to authorized members of our team and to our technical processors (hosting, payment, email delivery), who are bound by confidentiality and subject to the GDPR. It is hosted in the European Union and is never sold or rented.

  6. 6. Retention Period

    Account and child data is kept as long as the account is active, then deleted no later than three years after the last activity. Billing data is kept for the period required by law.

  7. 7. Security

    We implement appropriate technical and organizational measures (encrypted communications, encrypted passwords, restricted access) to protect your data against any loss, alteration, or unauthorized access.

  8. 8. Your Rights

    In accordance with the GDPR, you have the right to access, rectify, erase, restrict, object to, and port your data and your child's data, as well as the right to withdraw your consent at any time.

    To exercise these rights, write to us at [email protected] or use our data deletion form. You may also file a complaint with the CNIL.

  9. 9. Changes to This Policy

    We may update this policy. If there is a significant change, we will inform you. The current version is always available on this page.