Privacy Policy – Dear Santa

This Privacy Policy explains what information we collect when you order a personalized video message from Santa, why we collect it, how long we keep it and how we protect it. Because our videos are made for children, we apply stricter rules than the law requires. They are described in section 3.

1. Who is responsible for your information

Your information is handled by HKG Lab, a French simplified joint-stock company (SAS) with a share capital of €1,000, La Maison Bleue, 16 rue Alsace Lorraine, 76000 Rouen, France, registered with the Rouen Trade and Companies Register (RCS) under number 108 490 830. HKG Lab does business as Dear Santa. For any question about your information, email us at contact@dear-santa.co or use our Contact page.

2. Information we collect

We only collect what is strictly necessary to make and deliver the video.

a) Information about the parent (or the person placing the order)

Email address: to send you the video and your order confirmation.
Country: to calculate the price and taxes and to choose the language.
First name of the person giving the video, if you provide it.
Payment information: handled only by our payment providers (Stripe and PayPal). We never have access to your card number.

b) Information about the child (provided by the parent)

First name and age (or date of birth, optional), and whether the child is a girl or a boy, so that Santa addresses the child correctly.
What the child did well this year, if you tell us (optional question).
A photo of the child, only if you choose the “photo in the video” option.

We never ask for the child’s last name, address, school or any other information that could be used to locate the child. Please do not include such information in free-text fields.

c) Technical information

Browsing data (pages viewed, type of device, language) and, with your consent, analytics and advertising cookies (see section 10).

We do not collect any sensitive information (health, religion, opinions, etc.).

3. Protecting children: our commitments

We do not keep any image of your child. The photo you send for the “photo in the video” option is used only to make your video. It is stored in a closed area that only the team making the video can access, then automatically deleted 30 days after it is uploaded.
Never published, never shared. Your child’s information and photos are never published, sold or rented, and never used in our advertising or on our social media.
Never used to train artificial intelligence. The information and photos you entrust to us are used only to make your video.
A private video. The video can only be accessed through the personal link sent to your email address. It is not indexed by search engines and cannot be seen by anyone other than you and the people you share it with.
Automatic deletion. Quiz answers that are not followed by an order are deleted after 90 days. Information about the child is removed from our orders 12 months after purchase.
No contact with your child. We only communicate with the parent. Our emails, including offers if you agree to receive them, are addressed to you, never to your child.
Deletion on request. At any time, you can ask us to immediately delete the photo, your child’s information and the video, through our Contact page.

The photos of children shown on our website are for illustration only. We never publish the photo, video or reaction of a customer’s child without the parents’ written consent.

4. Children’s privacy (COPPA)

Our service is directed to parents, not to children. We do not knowingly collect personal information directly from children under 13. The child’s first name, age and, if the option is chosen, photo are provided by the parent when ordering. Parents can review this information or ask us to delete it at any time through our Contact page. If we learn that a child under 13 has sent us personal information directly, we will delete it.

5. How we use your information

To make the personalized video and its options, then deliver it to you by email.
To manage your order, payment, billing, customer service and refunds.
To offer you optional add-ons right after your purchase.
To send you our news and offers by email, only if you have agreed to it.
To keep the website secure, prevent fraud and improve our services.

6. Legal basis

HKG Lab is based in France and handles your information in accordance with the EU General Data Protection Regulation (GDPR), on the following grounds:

Performance of our contract with you: making and delivering the video you ordered.
Your consent: offer emails, analytics and advertising cookies, sending a photo. You can withdraw your consent at any time.
Our legal obligations: billing and accounting.
Our legitimate interest: website security and fraud prevention.

7. How long we keep your information

Child’s photo: 30 days after it is uploaded, then automatically deleted.
Quiz answers without an order: 90 days.
Information about the child linked to an order: 12 months after purchase.
Personalized video: available through your link at least until January 31 following your order, as stated in our Terms of Sale. Remember to download it to keep it.
Email address for offers: until you unsubscribe (there is a link in every email), and no later than 3 years after your last purchase.
Billing records: 10 years (legal obligation under French law). They do not contain any information about the child.

8. Who receives your information

HKG Lab does not sell, rent or transfer any personal information. Your information can only be accessed by our team and by the technical service providers that we strictly need, who are bound by confidentiality:

Website hosting: Rocket.net.
Payment: Stripe and PayPal.
Sending emails and, if you agree, offers: our emailing tool.
Analytics and advertising, only with your consent: Google Analytics, Microsoft Clarity, Meta and TikTok. These tools never receive your child’s information or photo.

We may also disclose information to the competent authorities when required by law.

9. International transfers

HKG Lab is based in France, and some of our service providers, including our website host, are located in or have servers in the United States. Your information is therefore processed in the European Union and in the United States. Transfers of information between the European Union and the United States are covered by the safeguards required by the GDPR: the EU–US Data Privacy Framework or the standard contractual clauses adopted by the European Commission.

10. Security

Encrypted connection (HTTPS) across the entire website.
Children’s photos stored in an area closed to any public access, viewable only through a link tied to your order or by our team.
Access to information limited to the people who need it to make and deliver your order.
No payment card data stored on our servers.

11. Cookies and analytics tools

The website uses cookies that are necessary for it to work (cart, payment, language, security). Analytics and advertising cookies are only placed with your consent, collected through our cookie banner. You can change your choice at any time from this banner or in your browser settings.

Do Not Track and Global Privacy Control

If your browser sends a Do Not Track or Global Privacy Control (GPC) signal, we treat it as a refusal of non-essential cookies: analytics and advertising cookies are not placed, and only the cookies necessary for the website to work are used.

12. Your rights

Wherever you live, you have the right to access, correct and delete your information and your child’s information, to restrict or object to its use, to receive it in a portable format, and to withdraw your consent at any time. Under French law, you can also set instructions for what happens to your information after your death. To use these rights, please go to our Contact page. We reply within 30 days at most, and without delay for any request to delete information about a child.

You can also file a complaint with the French data protection authority, the CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France (www.cnil.fr).

13. Your California privacy rights (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act, gives you the following rights:

Right to know what personal information we collect about you, where it comes from, why we use it and to whom we disclose it, and to get a copy of it.
Right to delete the personal information we hold about you.
Right to correct inaccurate personal information.
Right to opt out of the sale or sharing of your personal information.
Right not to be discriminated against for using any of these rights: we will not deny you our services or charge you a different price because you used them.

The categories of personal information we collect, their sources, the reasons we use them and the service providers that receive them are described in sections 2, 5 and 8 above. Our retention periods are listed in section 7.

We do not sell your personal information. We do not “share” it for cross-context behavioral advertising without your consent: advertising cookies (Meta, TikTok) are only placed if you accept them in our cookie banner. You can withdraw that consent at any time from the banner, or by turning on Global Privacy Control in your browser (see section 11).

To submit a request, email us at contact@dear-santa.co or use our Contact page and tell us which right you wish to use. You can also have an authorized agent submit a request on your behalf. To protect your information, we may ask you to confirm your identity, for example by replying from the email address used for your order. We respond within 45 days.

14. Changes to this policy

We may update this policy, for example if our service providers change. The date of the last update is shown at the top of the page. If we make a significant change, we will let you know by email or on the website.