DRAFT – to be reviewed by a lawyer. Everything in
[...]still has to be confirmed or filled in.
Privacy notice – Call from Father Christmas
Last updated: [11 November 2026]
In short: we use your child's details only for that one call. The call is not recorded. Everything about your child and your phone number is deleted automatically no later than 7 days after the call. If you don't complete payment, we delete your child's details within 24 hours. We don't sell data, we don't use children's conversations to train AI, and details about your child never go to analytics or advertising services.
1. Who is responsible?
The controller is Talentoso BV, Louizalaan 367, 1050 Brussels, Belgium (company number 0680.423.029). Privacy questions: [privacy@domain.co.uk].
UK representative (Article 27 UK GDPR): [name and UK address of representative – to appoint]. You can contact them instead of us about anything in this notice.
2. What we use, why, and our lawful basis
| Data | What for | Lawful basis (UK GDPR) |
|---|---|---|
| About your child: first name, age, and only if you add them: school year, hobbies, wish list, something to praise, something to work on, first names of brothers/sisters, extra notes | So Father Christmas (and Pip) can have a personal conversation; for the letter by post | Performance of our contract with you (Art. 6(1)(b)) and your consent as parent or guardian (Art. 6(1)(a)) |
| What your child says during the call (turned into text, see section 3) | So the AI Father Christmas can answer | As above |
| About you: first name, email address, mobile number | Making the call and sending the reminder text, confirming, rescheduling, contacting you about problems | Contract |
| Letter by post: name on the envelope and postal address | Printing and posting the letter | Contract |
| Payment: amount, date, status, extras chosen | Payment, refunds, accounts | Contract and legal obligation (Art. 6(1)(c)) |
| Technical call data: time, length, answered or not, cost | Retrying a missed call, quality, costs | Contract and legitimate interests (Art. 6(1)(f)) |
| Booking started but not paid: your name and email | At most 2 reminder emails that your booking isn't finished | Legitimate interests; one-click unsubscribe [lawyer: check PECR reg. 22 "negotiations for a sale" soft opt-in] |
| Feedback after the call: rating, ticked items, comment | Improving the service; shown anonymously on the website only with your explicit consent | Legitimate interests; consent for publication |
| Messages via the contact form or replies to our emails | Helping you | Legitimate interests / contract |
Please only share what you are happy to share. In the fields about your child, don't enter a surname, address, health information or anything sensitive. We only ask for a postal address for the letter.
3. The call and AI
- The call is not recorded.
- During the call, what your child says is turned into text in real time so that an AI language model can come up with an answer, which Father Christmas speaks with an AI voice. This happens at our voice-technology provider and, through them, at an AI language-model provider (see section 5). Text transcripts there are deleted within 7 days of the call.
- We do not use children's conversations to train AI models, and we have switched this off with our providers [to confirm for each provider].
- There is no automated decision-making with legal or similarly significant effects (Art. 22 UK GDPR), and we do not create a voiceprint of your child.
- We keep only technical data about the call: whether it happened, when and how long.
4. How long we keep data
| Data | Kept for |
|---|---|
| Details about your child, mobile number, postal address | Deleted automatically no later than 7 days after the call (the address once the letter has been posted, at the latest together with the rest) |
| Text transcript at the voice-technology provider | No more than 7 days after the call |
| Unpaid booking | Child's details: deleted within 24 hours. Your name and email: no later than [7] days after you started (after the reminders). Unsubscribes are kept as an unreadable hash so we don't email you again. |
| Feedback (without name, email or phone number) | Up to 1 year |
| Messages / emails | 1 year after the last message |
| Payment and invoice records (no child details) | As long as tax and accounting law requires ([6 years UK / 7–10 years Belgium – to confirm]) |
5. Who we share data with
We use a small number of carefully chosen service providers (processors), each under a data processing agreement. They may only use your data to provide their service to us.
| Provider | Role | Location |
|---|---|---|
| Stripe | Payments. We never see your card details. | EU (Ireland) / US |
| Voice-technology provider (AI) | Voices of Father Christmas and Pip, speech-to-text, running the conversation | US / EU |
| AI language-model provider (through the voice-technology provider) | Coming up with Father Christmas's answers | US |
| Telecoms provider | The call and the reminder text | US / EU |
| Email service | Sending emails and receiving replies | EU |
| Print and post service | Printing and posting the letter (only if you order it) | Switzerland |
| Hosting provider | Website and booking system | EU (Frankfurt) |
International transfers. Your data is handled by us in the EU, which the UK recognises as adequate. Transfers to the US rely on the UK Extension to the EU-US Data Privacy Framework (the "UK-US data bridge") or the UK International Data Transfer Addendum to the EU Standard Contractual Clauses; Switzerland is covered by UK adequacy regulations. Ask us for a copy of the safeguards or the names of the companies: [privacy@domain.co.uk].
We never sell data. We only share data with authorities when the law requires it.
6. Website, cookies and statistics
- We count visits without cookies: per day and per source (for example "from Google"), with no IP address, cookie or click ID stored.
- During payment Stripe sets strictly necessary cookies to prevent fraud.
- [Only if we use Google Analytics or ad measurement on this market:] We set analytics or advertising cookies only if you agree in the cookie banner; you can change your choice at any time via "Cookie settings" at the bottom of every page. Even then we never send details about your child, or your name, email, phone number or address; only events such as "payment completed" with the amount. These cookies are never used on pages made for children (stories, colouring pages, crafts) [align with the ICO Children's Code].
- Fonts are loaded [from our own server / from Google Fonts – to confirm].
7. Your rights
You have the right to access, correct, erase, restrict and port your data (and your child's), and to object. You can withdraw consent at any time. Want your child's details deleted straight away? Use the button in your booking page (link in the confirmation email) or email us. If you delete them before the call, Father Christmas can no longer make it personal.
Email [privacy@domain.co.uk]; we reply within one month. Please tell us first if you are unhappy so we can try to put it right. You can also complain to the Information Commissioner's Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, ico.org.uk, 0303 123 1113.
8. Children
Call from Father Christmas is for parents and guardians of children aged 2 to 12. Children cannot book. Father Christmas never asks a child for personal details; if a child volunteers something like an address, he does not follow up on it. Our pages for children (stories, colouring pages, crafts) collect no personal data and use no tracking.
9. Security
Data is sent encrypted (HTTPS). Access to bookings is limited to people who need it, with strong passwords. The links in our emails (reschedule, Big Book, correct your number) contain a secret code: please don't forward them.
10. Changes
We update this notice when our practices change. The date at the top shows the latest version.