Privacy policy

Random Acts of Santa (raosanta.uk) is run by an individual based in the United Kingdom, who is the data controller for the personal data described here. For anything about your data, email [email protected].

When you sign in. Your name, email address and profile picture link from the sign-in method you choose (Google, Discord, Twitch, GitHub, Reddit or an email link). We also store the sign-in tokens that provider gives us, so you stay signed in. We never see your password for those services.

If you join a community with Discord. When you ask us to, we check which Discord servers you are in (and, for organisers, which ones you manage). We use this only to join or link a group, and we don't keep your server list. We never read or post messages.

Your profile. Your first and last name, your work or community email address, the organisation (taken from that email address) and department you choose, and the link to your Amazon wishlist.

Taking part. Which wishlists you have picked up, which you have marked as gifted (with any note you add), problems you report with a wishlist, and how many times your wishlist has been handed out. We never ask for, and never see, your home address: Amazon handles delivery.

Thank-yous (kudos). The message and any photos you post, and when you posted them.

Share cards. If you choose to share a card, we store a random link code, what the card is for and how many times its page has been viewed.

Technical data. Our servers keep short-lived logs of requests, including your IP address, browser type and the pages requested, to keep the site secure and working.

• To run the service you signed up for: your account, matching you with wishlists to pick up, recording gifts, your stamp album, and posting and sharing thank-yous. Lawful basis: performance of our agreement with you (Article 6(1)(b)).
• To let your organisation run its Christmas: organisers of your organisation or department can see your name, email, department and whether you have completed your profile, so they can manage members and moderate thank-yous. Lawful basis: our legitimate interest, and your organisation's, in running the scheme fairly and safely (Article 6(1)(f)).
• To keep the site secure: server logs, preventing abuse and fixing faults. Lawful basis: legitimate interests (Article 6(1)(f)).
• To show public totals such as “120+ gifts sent”. These are counts only, rounded, and never shown when under 10, so they do not identify anyone.
• To send sign-in links when you choose to sign in by email. Lawful basis: performance of our agreement with you.

We do not sell your data, we do not use it for advertising, and we do not use automated decision-making or profiling that affects you. Wishlists are handed out at random (people whose wishlists have had the fewest gifts are offered first), which has no legal or similarly significant effect.

• Someone who picks up your wishlist sees your Amazon wishlist link and your department, not your address and not who else is buying for you.
• Recipients never see who gifted them. Your gifts stay anonymous.
• Thank-yous you post, with their photos, are shown in the kudos feed to other members, and to visitors on the home page. They appear under a random festive name, not your real name. Organisers can hide thank-yous that break the rules.
• Share cards are public web pages you choose to create. A gift card never shows names, the gift or an address. A thank-you card shows your message and photos. Organisation and team cards show rounded totals only. Share pages ask search engines not to index them.
• Organisers (site, organisation and department admins) can see members of their organisation or department as described above.

We use a small number of service providers who process data only on our instructions:

• Hosting: the website and its database run on servers in the UK or the European Economic Area.
• Photo storage: photos posted with thank-yous are stored with iDrive e2 in the UK or the European Economic Area.
• Email delivery: an email service sends sign-in links to the address you give.

When you sign in with Google, Discord, Twitch, GitHub or Reddit, that company handles the sign-in under its own privacy policy. When you open a wishlist, you are taken to Amazon, which has its own privacy policy. We share data with authorities only where the law requires it.

We store and process your data in the UK and the European Economic Area, which the UK recognises as giving adequate protection. If we ever use a provider outside these areas, we will put appropriate safeguards in place (such as the UK International Data Transfer Agreement) and update this policy first.

• Your account and profile: until you ask us to delete them. Membership carries over from one Christmas to the next so your stamp album keeps working. Accounts that have not been signed into for 24 months are deleted.
• Gifts, reports, thank-yous, photos and share cards: as long as your account exists. Deleting a thank-you or a gift record also removes its share card.
• Server logs: up to 30 days.
• Sign-in links: they expire after 24 hours.

We use only cookies that are strictly necessary for the site to work, so we do not ask for consent to them. We do not use analytics, advertising or tracking cookies.

• next-auth.session-token: keeps you signed in (30 days).
• next-auth.csrf-token and next-auth.callback-url: protect and complete sign-in (up to 1 hour).
• cookie-consent: remembers that you have seen our cookie notice (1 year).

If you install the site as an app, your browser also stores the site's icons and a few pages so it opens quickly.

In some groups, wishlists open from a gift page with an Amazon affiliate link. As an Amazon Associate, Random Acts of Santa earns from qualifying purchases. The price you pay is the same.

We don't send Amazon your name, email or anything else about you. When you follow the link, Amazon may set its own cookies on amazon.co.uk under Amazon's privacy notice. Amazon reports to us only totals of clicks and orders for each tracking ID, never who bought what. Gift pages show no names, groups or emails.

You have the right to:

• get a copy of the personal data we hold about you;
• have inaccurate data corrected;
• have your data deleted;
• restrict or object to how we use it;
• receive your data in a portable format and have it sent to someone else.

You can update your profile on the site at any time. For anything else, email [email protected]. We will respond within one month. To have a thank-you removed, ask your organiser or email us.

If you are unhappy with how we have handled your data, please tell us first. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113.

Random Acts of Santa is for people aged 16 and over. If you are under 16, please don't use it. If we learn that someone under 16 has an account, we will delete it.

The site is only served over HTTPS. Sign-in sessions are stored on our server, not in your browser. Access to the database and photo storage is restricted to the person who runs the service. No system is perfectly secure, but if a breach affecting your data happens we will tell you and, where required, the ICO.

We will update this page when what we do with data changes, for example before we add affiliate links or new features, and change the date at the top. For significant changes we will tell signed-in members on the site.

Back to Random Acts of Santa