Last Updated: December 2025
1. Introduction
This Privacy Policy explains how SantaHQ Limited trading as SantaCall (“we”, “us”, “our”) collects, uses, stores, and protects your personal information when you use the SantaCall service (“Service”). We are committed to protecting your privacy and handling your data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
By using the Service, you consent to the collection and use of your information as described in this Privacy Policy. Please read this policy carefully alongside our Terms and Conditions.
2. Data Controller
The data controller responsible for your personal data is:
SantaHQ Limited
Trading as: SantaCall
SantaHQ, Barn Owl Cottage, Chapel Hill, Ponsanooth, Cornwall, TR3 7ET, United Kingdom
Company Number: 8649718 VAT Number: GB 170 7697 79
Email: [email protected]
Website: www.santacall.co.uk
3. Information We Collect
3.1 Information You Provide Directly
When you register for and use the Service, we collect:
- Account Information: Name, email address, password (encrypted), and phone number
- Child Information: Children’s names, ages, achievements, interests, and other details you provide to personalise messages
- Message Content: The text and parameters you submit to generate personalised Santa messages
- Payment Information: Transaction details processed through our payment provider (we do not store full card numbers)
- Communication Data: Any correspondence you send to us via email or support channels
3.2 Information Collected Automatically
When you access the Service, we automatically collect:
- Technical Data: IP address, browser type and version, device type, operating system, and time zone
- Usage Data: Pages visited, features used, timestamps, session duration, and interaction patterns
- Call and Message Logs: Delivery status, timestamps, phone numbers called, and message generation metadata
- Cookies and Similar Technologies: See Section 9 for details on our use of cookies
3.3 Generated Content
We store AI-generated audio files created through the Service. These files are associated with your account and contain synthesised voice content based on the information you provided.
4. How We Use Your Information
We use your personal information for the following purposes:
4.1 Service Delivery
- Creating and managing your account
- Generating personalised Santa voice messages using AI technology
- Delivering messages via SMS and voice calls through Twilio
- Processing payments and managing credits
- Providing customer support
4.2 Service Improvement
- Analysing usage patterns to improve the Service
- Troubleshooting technical issues
- Developing new features and functionality
4.3 Security and Compliance
- Detecting and preventing fraud, abuse, and security incidents
- Enforcing our Terms and Conditions and Acceptable Use Policy
- Complying with legal obligations
- Maintaining audit logs for regulatory purposes
4.4 Communications
- Sending service-related notifications (e.g., message delivery confirmations)
- Responding to your enquiries
- Sending marketing communications (only with your consent, and you can opt out at any time)
5. Legal Basis for Processing
We process your personal data on the following legal bases under UK GDPR:
- Contract: Processing necessary for the performance of our contract with you (providing the Service)
- Consent: Where you have given explicit consent (e.g., marketing communications)
- Legitimate Interests: Processing necessary for our legitimate interests (e.g., fraud prevention, service improvement) where these are not overridden by your rights
- Legal Obligation: Processing necessary to comply with legal requirements
6. Data Sharing and Third-Party Services
6.1 Third-Party Service Providers
We share your data with the following categories of third-party service providers who process data on our behalf:
- Cloud Infrastructure: Amazon Web Services (AWS) for hosting, storage, and computing services
- AI Voice Generation: ElevenLabs for AI-powered voice synthesis
- Communications: Twilio for SMS delivery and voice call services
- Payment Processing: Stripe or similar payment processors for secure transaction handling
- Analytics: Analytics providers to help us understand Service usage
6.2 Other Disclosures
We may also disclose your information:
- To comply with legal obligations, court orders, or lawful requests from authorities
- To protect our rights, property, or safety, or that of our users or others
- In connection with a merger, acquisition, or sale of assets (you will be notified of any such change)
- To report suspected illegal activity or violations of our Acceptable Use Policy to relevant authorities
7. International Data Transfers
Important Notice: Your personal data may be transferred to, stored, and processed in countries outside the United Kingdom and European Economic Area (EEA), including the United States. Our third-party service providers, including AWS, Twilio, and ElevenLabs, operate servers globally.
Where we transfer data outside the UK/EEA, we ensure appropriate safeguards are in place, including:
- Transfers to countries with an adequacy decision from the UK or EU Commission
- Standard Contractual Clauses (SCCs) approved by the UK/EU
- Other lawful transfer mechanisms as appropriate
By using the Service, you acknowledge and consent to your data being transferred and processed internationally as described above.
8. Data Retention
We retain your personal data for as long as necessary to fulfil the purposes for which it was collected:
- Account Data: Retained for the duration of your account plus 2 years following account closure
- Generated Audio Files: Retained for 12 months from creation, unless you request earlier deletion
- Transaction Records: Retained for 7 years to comply with UK tax and accounting requirements
- Call and Message Logs: Retained for 2 years for service quality and dispute resolution
- Security Logs: Retained for 1 year for security monitoring and incident investigation
After the retention period expires, we will securely delete or anonymise your data.
9. Cookies and Similar Technologies
9.1 What Are Cookies
Cookies are small text files placed on your device when you visit our website. We use cookies and similar technologies to operate the Service, remember your preferences, and understand how you use the Service.
9.2 Types of Cookies We Use
- Essential Cookies: Required for the Service to function (e.g., authentication, session management)
- Functional Cookies: Remember your preferences and settings
- Analytics Cookies: Help us understand how visitors use the Service
9.3 Managing Cookies
You can control cookies through your browser settings. However, disabling certain cookies may affect the functionality of the Service. Most browsers allow you to refuse or delete cookies; please refer to your browser’s help documentation for instructions.
10. Your Data Protection Rights
Under UK GDPR, you have the following rights regarding your personal data:
- Right of Access: Request a copy of the personal data we hold about you
- Right to Rectification: Request correction of inaccurate or incomplete data
- Right to Erasure: Request deletion of your data in certain circumstances
- Right to Restrict Processing: Request that we limit how we use your data
- Right to Data Portability: Request a copy of your data in a structured, machine-readable format
- Right to Object: Object to processing based on legitimate interests or for direct marketing
- Right to Withdraw Consent: Withdraw consent at any time where processing is based on consent
To exercise any of these rights, please contact us at [email protected]. We will respond to your request within one month. In some cases, we may need to verify your identity before processing your request.
11. Children’s Privacy
The Service is intended for use by adults (parents and guardians) to create messages for children. We do not knowingly collect personal information directly from children under 13. The information about children that we process is provided by parents and guardians who have the legal authority to provide such information.
If you believe we have inadvertently collected personal information directly from a child under 13, please contact us immediately at [email protected] and we will take steps to delete such information.
12. Data Security
We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These measures include:
- Encryption of data in transit (TLS/SSL) and at rest
- Secure password hashing
- Access controls and authentication mechanisms
- Regular security assessments and monitoring
- Staff training on data protection
However, no method of transmission over the internet or electronic storage is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.
13. Data Breach Notification
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner’s Office (ICO) within 72 hours of becoming aware of the breach, as required by UK GDPR. Where the breach is likely to result in a high risk to your rights and freedoms, we will also notify you directly without undue delay.
14. Third-Party Links
The Service may contain links to third-party websites or services. We are not responsible for the privacy practices of these third parties. We encourage you to read the privacy policies of any third-party sites you visit.
15. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify you of material changes by posting the updated policy on our website with a new “Last Updated” date. For significant changes, we may also notify you by email. Your continued use of the Service after any changes constitutes acceptance of the updated Privacy Policy.
16. Complaints
If you have concerns about how we handle your personal data, please contact us first at [email protected] and we will endeavour to resolve your concerns.
You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO), the UK’s supervisory authority for data protection:
Information Commissioner’s Office
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Telephone: 0303 123 1113
Website: www.ico.org.uk
17. Contact Us
If you have any questions about this Privacy Policy or our data practices, please contact us:
SantaHQ Limited
Trading as: SantaCall
SantaHQ, Barn Owl Cottage, Chapel Hill, Ponsanooth, Cornwall, TR3 7ET, United Kingdom
Company Number: 8649718 VAT Number: GB 170 7697 79
Email: [email protected]
Website: www.santacall.co.uk
18. Acknowledgement
By using the SantaCall Service, you acknowledge that you have read and understood this Privacy Policy and consent to the collection, use, and processing of your personal data as described herein, including the international transfer of data outside the UK and EEA.