Privacy policy

1. Data controller

Julemandens hjælpere CVR no.: [INSERT CVR NO.] [INSERT ADDRESS] Email: [INSERT CONTACT EMAIL]

2. Information about families

When you create a request, we process your email, the address for the visit, a phone number the Santa can use, the number of children, and any practical notes you write yourself. We never collect children's names.

The address and practical notes are stored in a separate, restricted part of our database and are only ever shown to the Santa you have paid for and confirmed.

3. Information about Santas

We process name, email, phone number, home address, photos and a description, which are shown to families (except the exact home address, which is never shown).

We also collect full legal name, date of birth, CPR number or a foreign tax ID, and a CVR number if you have one. This information is used only to report to the Danish tax authority under the platform-operator rules (DAC7), and is never shown to families or other Santas.

4. Messages

Messages between a family and a Santa are stored and scanned automatically for fraud and attempts to circumvent the platform. A member of staff only reads a conversation if it has been automatically flagged, or if a party reports it — and any such reading is logged.

5. Legal basis

We process this information to perform the contract for our introduction service (GDPR Article 6(1)(b)), to comply with legal obligations such as Danish bookkeeping law and the DAC7 rules (Article 6(1)(c)), and to detect fraud and protect both parties (Article 6(1)(f)).

6. How long we keep information

Address and practical notes for a visit: deleted 90 days after the visit.

Postcode, times and children's count on requests: made anonymous after 12 months.

Payments, refunds and receipts: kept for 5 years under Danish bookkeeping law.

Messages between a family and a Santa: kept for 13 months.

Logs of booking and approval events: kept for 2 years.

When an account is deleted or anonymised, we overwrite the name, email and phone number, but keep accounting information we are legally required to retain.

7. Who we share information with

We use the following processors to run the service: Vercel (hosting), Neon (database, located in Frankfurt in the EU), Resend (sending email), and Stripe (payment). We do not use an SMS provider. All processors are covered by a data processing agreement.

8. Your rights

You have the right to access, correct or delete your information, and to object to our processing of it. Because we are required to keep accounting and tax records under Danish law and DAC7, we can't always delete those, but we can anonymise your other information.

You can complain to the Danish Data Protection Agency (Datatilsynet, datatilsynet.dk) if you're unhappy with how we handle your information.

9. Changes to this policy

We may update this policy. Material changes are announced on this page.