Privacy Policy

Last Updated: 14 December 2024

1. Who We Are

SantaCalls.ai is operated by LEMA Logic Limited, a company registered on the Isle of Man.

• Company: LEMA Logic Limited
• Address: Isle of Man
• Email: elf@santacalls.ai
• Data Protection Contact: privacy@lemalogic.com

For the purposes of data protection law, LEMA Logic Limited is the "data controller" of the personal information we process.

2. Data We Collect

We collect only the information necessary to provide our service:

3. Legal Basis for Processing

We process your personal data based on:

• Consent: You explicitly consent when submitting the registration form and agreeing to this Privacy Policy.
• Contract: Processing is necessary to provide the service you requested.
• Legitimate Interests: For fraud prevention and service improvement (where it doesn't override your rights).

4. How We Use Your Data

We use your information to:

• Initiate a phone call from Santa to your child
• Personalise the conversation (Santa will greet your child by name)
• Generate a transcript of the call for your records
• Extract your child's Christmas wishes from the conversation
• Send you an email summary with wish list and gift recommendations
• Verify parental consent for calls to children
• Improve our service (aggregate, anonymised data only)

5. Children's Privacy (COPPA, UK AADC, GDPR Article 8)

Protecting children is our highest priority:

• Parental Consent Required: Only parents/guardians can request a Santa call. We do not collect data directly from children.
• Minimal Data Collection: We only collect the child's first name - no surnames, ages, addresses, or school information.
• PII Redaction: Our AI automatically redacts any personal information (addresses, school names, etc.) that children may mention during calls.
• Rapid Deletion: Voice recordings are deleted within 7 days; transcripts within 24 hours.
• No Tracking: We do not use cookies or tracking technologies that could identify children.
• No Marketing to Children: We never market directly to children or share their data with advertisers.

6. Data Sharing

We share data only with trusted service providers who help us operate SantaCalls.ai:

All providers are bound by data processing agreements and must comply with GDPR requirements. We have verified that appropriate safeguards (Standard Contractual Clauses or equivalent) are in place for international transfers.

We never sell your data to third parties for marketing purposes.

7. Affiliate Links & Gift Recommendations

The wish list emails we send may contain affiliate links to products on Amazon UK and other retailers. If you purchase through these links:

• We receive a small commission (typically 4-8%)
• This helps us keep SantaCalls.ai free for families
• The price you pay is not affected
• We do not share your purchase data with anyone

You are under no obligation to use these links. They are provided purely as a convenience.

8. Your Rights

Under the Isle of Man Data Protection Act 2018, UK GDPR, and EU GDPR, you have the right to:

• Access: Request a copy of your personal data
• Rectification: Correct inaccurate data
• Erasure: Request deletion of your data ("right to be forgotten")
• Restriction: Limit how we process your data
• Portability: Receive your data in a machine-readable format
• Object: Object to processing based on legitimate interests
• Withdraw Consent: Withdraw consent at any time (this won't affect processing before withdrawal)

To exercise any of these rights, contact us at privacy@lemalogic.com. We will respond within 30 days.

9. Data Security

We implement appropriate technical and organisational measures to protect your data:

• All data transmission is encrypted using TLS 1.3
• Data at rest is encrypted using AES-256
• Access to personal data is strictly limited to authorised personnel
• We use secure, SOC 2 compliant service providers
• Regular security reviews and updates

10. International Transfers

Some of our service providers are based in the United States. When transferring data outside the Isle of Man/UK/EEA, we ensure appropriate safeguards are in place:

• Standard Contractual Clauses (SCCs) approved by the EU Commission
• UK International Data Transfer Agreement (IDTA) where applicable
• Data Processing Agreements with all providers

11. Cookies

SantaCalls.ai uses only essential cookies required for the website to function. We do not use:

• Tracking cookies
• Analytics cookies that identify individuals
• Advertising or marketing cookies
• Social media tracking pixels

12. Changes to This Policy

We may update this Privacy Policy from time to time. If we make significant changes, we will notify you by:

• Updating the "Last Updated" date at the top of this policy
• Posting a notice on our website
• Emailing registered users (for material changes)

13. Complaints

If you're not satisfied with how we handle your data, you have the right to complain to the relevant supervisory authority:

Isle of Man

Information Commissioner
PO Box 69, Douglas, Isle of Man, IM99 1EQ
www.inforights.im

United Kingdom

Information Commissioner's Office (ICO)
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
ico.org.uk

14. Contact Us

For any questions about this Privacy Policy or our data practices:

• Email: privacy@lemalogic.com
• General enquiries: elf@santacalls.ai