Privacy policy

1. Controller

The controller of your data is 21 Mateusz Matejko, Mateusz Matejko, ul. Tadeusza Bramińskiego 12/39, 80-180 Gdańsk, Poland. Data protection contact: santa@secretsantapick.com.

2. What data and where it comes from

• Organiser: name, email address and the draw details (name, date, budget, message). Card details are handled by Stripe; we only receive confirmation of payment and the details needed for the receipt.
• Participants: name and email address provided by the organiser, plus your wish list and chat messages if you write them.

3. Why and on what legal basis

• Running the draw, sending the emails and the participant pages: for the organiser, performance of a contract (Art. 6(1)(b) GDPR); for participants, the legitimate interest of the organiser and participants in holding a shared gift swap (Art. 6(1)(f) GDPR).
• Accounting and receipts: legal obligation (Art. 6(1)(c) GDPR).
• Handling complaints and possible claims: legitimate interest (Art. 6(1)(f) GDPR).
• Measuring ad performance, only after you agree in the banner: consent (Art. 6(1)(a) GDPR).

4. How long

Draw data (participants, wish lists, chat) is deleted automatically 60 days after the gift swap date, or 120 days after the draw was set up if no date was given. Unpaid draws are deleted after 30 days. Accounting records are kept for as long as tax law requires.

5. Who we share it with

Only providers the service can't run without, under data processing agreements:

• hosting: Mikrus (servers in the EU);
• email delivery: Resend, Inc. (USA, standard contractual clauses / EU-US Data Privacy Framework);
• payments: Stripe Payments Europe Ltd. (Ireland) and Stripe group companies;
• ad measurement and visit statistics, Google Ads and Google Analytics (only with consent): Google Ireland Ltd.

The organiser can't see who drew whom. Each participant only sees the person they're buying for, that person's wish list, the participants' names and the group chat.

6. Your rights

You have the right to access, correct and delete your data, to restrict processing, to data portability, to object to processing based on legitimate interest, and to withdraw consent at any time. Participants can delete their own data on their page (“Delete my data”). For anything else, email santa@secretsantapick.com. If you live in the EU, you can also complain to a data protection authority; ours is the President of the Personal Data Protection Office (UODO) in Poland.

7. Cookies and browser storage

We store only your personal access key to the draw or your page, and whether you've opened your envelope, in your browser's local storage. This is strictly necessary for the service. Google Ads and Google Analytics (Google cookies) only load after you agree in the banner. You can change your choice by clearing this site's data in your browser.

Last updated: 2026-11-15