At Santa's Letterbox, we take your privacy seriously. This policy explains what personal data we collect, how we use it, and what rights you have. If you have any questions, email us at hello@santasletterbox.co.uk.
✦1. Who We Are
Santa's Letterbox is operated by PostRight Ltd, a company registered in England and Wales. Our website is santasletterbox.co.uk. You can contact us at hello@santasletterbox.co.uk.
We are the data controller for personal data collected through this website.
✦2. What Data We Collect
Waitlist signups: When you join our waitlist, we collect your email address and a record of which form you signed up from. We do not currently collect any payment information, as no orders are yet open.
At order time (future): When orders open, we will collect your name, delivery address, and details about your child solely for the purpose of producing and delivering your personalised letter.
Usage data: We may collect anonymised analytics data about how visitors use our website. This data is not linked to individuals.
✦3. How We Use Your Data
We use your email address to send you a confirmation that you have joined our waitlist, notify you when orders open for Christmas 2026, and provide you with early access to ordering.
We will not use your email address for any other purpose without your explicit consent. We do not sell, rent, or share your personal data with third parties for marketing purposes.
✦4. Our Legal Basis
Under UK GDPR, our legal basis for processing your email address is legitimate interests — specifically, our legitimate interest in communicating with people who have expressed interest in our service, balanced against your right to privacy. You can withdraw from our waitlist at any time by clicking the unsubscribe link in any email we send you, or by emailing hello@santasletterbox.co.uk.
✦5. Data Processors
We use the following third-party services to process data on our behalf:
Supabase (Supabase Inc.) — We use Supabase as our database to store waitlist email addresses. Supabase servers are hosted in the EU.
Resend (Resend Inc.) — We use Resend to send confirmation emails to waitlist signups.
✦6. Data Retention
We retain waitlist email addresses until you unsubscribe or request deletion, or 12 months after the close of the Christmas 2026 ordering window, whichever comes first.
✦7. Your Rights
Under UK GDPR, you have the right of access, right to rectification, right to erasure, right to restriction, right to object, and right to data portability.
To exercise any of these rights, email hello@santasletterbox.co.uk. We will respond within one calendar month.
✦8. Cookies
Our website uses only essential cookies required for the site to function. We do not use tracking cookies, advertising cookies, or third-party analytics cookies that require consent.
✦9. Data Security
We take appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or destruction. Our database is hosted on Supabase's secure, EU-based infrastructure with encryption at rest and in transit.
✦10. Children's Data
At present, the only data we collect is the email address of the adult who signs up to our waitlist. We do not collect any data directly from children.
✦11. Complaints
If you have a concern about how we handle your personal data, please contact us first at hello@santasletterbox.co.uk. If you remain unsatisfied, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.
✦12. Changes to This Policy
We may update this privacy policy from time to time. We will notify waitlist subscribers of any material changes by email. This policy was last updated: April 2026.