Round Table Santa Sleigh

1. Who We Are & Data Controllers

The Santa Sleigh digital platform is operated by Round Table Great Britain & Ireland (and its affiliated local Round Table charitable trusts and associations) in partnership with the TurboSanta 2.0 digital operations system.

We are passionate volunteers dedicated to bringing festive cheer and raising vital charitable funds for local community causes, vulnerable families, sports clubs, youth groups, and hospices. We treat all personal information entrusted to us with strict confidentiality, care, and statutory compliance.

2. What Data We Collect & Why

We only collect the absolute minimum personal data necessary to provide safe, real-time community Santa tracking and statutory charity services:

3. Children’s Privacy & Parent/Guardian Safeguarding Notice (ICO Children’s Code)

Our interactive festive features—including Santa Radio Chat, Letters to Santa, Magic Mailbox Voice Messages, and Nice List Certificates—are designed for families to enjoy together in compliance with the UK Information Commissioner’s Office (ICO) Age Appropriate Design Code (Children’s Code):

• High Privacy by Default: Children’s interactive features never track geolocation, never build user profiles, and never share data with third-party advertisers.
• Strict AI Safeguarding Guardrails: Our Santa Claus AI Radio assistant is enforced with strict Google Gemini child-safety filters (blocking harmful, adult, or unsafe content at the lowest threshold) and system instructions that actively discourage sharing surnames, home addresses, schools, or phone numbers.
• Parent/Guardian Supervision: Where an email address is optionally entered (for example, to receive a printable Letter from Santa by email), we ask that a parent or guardian enters their own email address. Parent email addresses are used strictly once to deliver the requested reply and are never added to marketing lists.
• Immediate Parent Deletion Rights: Parents and guardians may request immediate removal of any Letter to Santa, Magic Mailbox voice message, or Memory Book photo at any time by emailing santa@roundtable.org.uk.

4. Lawful Basis for Processing (UK GDPR Article 6)

• Consent (Art. 6(1)(a)): You explicitly choose to subscribe your email for arrival alerts, submit a photo to the memory book, or write a letter to Santa. You can revoke consent at any moment.
• Legal Obligation (Art. 6(1)(c)): We are legally mandated under UK Tax Legislation (Taxes Management Act 1970 & Finance Act 2010) to collect and retain donor Gift Aid declarations for 6 years to submit valid claims to HM Revenue & Customs (HMRC).
• Legitimate Interests (Art. 6(1)(f)): Organizing voluntary community service, vehicle safety on suburban streets, volunteer marshaling, and preventing automated bot abuse of our digital services.

5. Data Retention & Automatic Purging Schedule

We do not hoard data. Information is retained only as long as strictly necessary for operational delivery or statutory tax audit:

6. Third-Party Service Providers & Processors

We do not sell, rent, or trade your personal data with commercial advertisers or marketing agencies under any circumstances. We utilize trusted, enterprise-grade infrastructure providers bound by strict data processing agreements:

• Cloudflare Inc. (Edge Network, R2 & D1 Database): Provides high-speed UK CDN hosting, AES-GCM encrypted credential storage, and DDoS/rate-limit security protection.
• Google Workspace (Gmail API) & Google Gemini API: Used by local Table administrators to dispatch operational volunteer run-sheets and power child-safe Santa replies.
• HM Revenue & Customs (HMRC Charities): Receives official Gift Aid schedules for tax reclaims directly benefiting local causes.
• Charitable Donation Gateways (Zeffy, JustGiving, NatWest Payit, Stripe/SumUp): Process online card payments directly on PCI-DSS compliant secure servers. Round Table never receives or stores your credit or debit card numbers.

7. Cookies & Local Storage

Our website is built on an ethical, privacy-first foundation. We do not use third-party advertising or tracking cookies. We use only strictly necessary browser LocalStorage keys:

• volume_pref: Remembers your preferred festive sleigh music volume level.
• snow_pref: Remembers if you toggled the falling snowflake animation on or off.
• notif_dismissed: Ensures you don't receive repetitive announcements during the same visit.

8. Your Statutory Rights Under UK GDPR

You have statutory rights regarding your personal information, including:

• Right to Withdraw Consent: You can unsubscribe from doorstep arrival emails at any time with a single click or by notifying us.
• Right of Access & Portability: You may request a copy of any personal data we hold about you.
• Right to Rectification: If any details are incorrect, we will promptly update them.
• Right to Erasure ("Right to be Forgotten"): You can request immediate deletion of your email, doorstep subscription, letter, or memory book photo. (Note: Statutory HMRC Gift Aid declarations are exempt from immediate erasure until the mandatory 6-year statutory audit period has elapsed).
• Right to Lodge a Complaint: If you believe we have not handled your data fairly, you have the right to contact the UK Information Commissioner's Office (ICO) at ico.org.uk.

9. Contact Our Volunteer Data Officer

If you have any questions, wish to exercise any of your data rights, or want to verify the charitable activities of your local Round Table, please reach out to our team: