Last updated: October 2026
This policy explains how Santa Store collects and uses your personal information when you visit santastore.co.uk, shop with us or sign up to our emails, and the rights you have under UK data protection law (the UK GDPR and the Data Protection Act 2018).
1. Who we are
Santa Store is a trading name of Combrook Limited, registered in England and Wales under company number 12789408. Combrook Limited is the “controller” responsible for your personal information.
- Registered office: 3a Mill Lane, Macclesfield, Cheshire, SK11 7NN
- Trading address: Park Lane, Poynton, Cheshire, SK12 1RQ
- Email for privacy questions: support@santastore.co.uk
- ICO registration number: ZC262227
2. Information we collect
- Contact and order details: your name, billing and delivery addresses, email address, phone number, what you ordered, and any personalisation or gift messages you enter.
- Payment information: payments are handled by our payment providers. We receive confirmation that you have paid and limited details such as the card type and last four digits; we never see or store your full card number.
- Account information: if you create an account, your login details, order history, saved addresses and wishlist.
- Marketing preferences: whether you have signed up to our emails, and how you interact with them (for example whether an email was opened).
- Communications: messages you send us, and product reviews you post.
- Technical and usage information: your IP address, browser and device type, and the pages you view, collected through cookies and similar technologies (see section 8).
3. How we use your information, and why we’re allowed to
| What we do | Lawful basis |
|---|---|
| Process, deliver and support your order, including returns and refunds | Performing our contract with you |
| Run your account and wishlist | Performing our contract with you |
| Send order confirmations and service messages | Performing our contract with you |
| Keep accounting and tax records | Legal obligation |
| Prevent fraud and keep our website secure | Our legitimate interests in protecting our business and customers |
| Improve our website, products and service | Our legitimate interests in running and developing our business |
| Send marketing emails about offers and new products | Your consent, which you can withdraw at any time |
| Use non-essential cookies for analytics and advertising | Your consent, which you can withdraw at any time |
| Remind you about items left in your basket | Your consent (only if you have signed up to our emails) |
4. Marketing emails
We only send marketing emails if you have asked to receive them, either by signing up on our website or by ticking the box at checkout. When you sign up we send an email asking you to confirm your subscription. Every marketing email includes an unsubscribe link, and you can also contact us to stop them. We use Klaviyo to manage our mailing list and send emails.
5. Who we share your information with
We do not sell your personal information. We share it only with trusted organisations that help us run our shop, under contracts that require them to protect it and use it only on our instructions:
- Payment providers, to take payments and prevent fraud: PayPal, which also processes Apple Pay and Google Pay payments. If you choose Apple Pay or Google Pay, Apple or Google will also handle your payment under their own privacy policies.
- Delivery partners and shipping software, to deliver your order: the courier companies used by us or by the supplier sending your item, and our shipping software (ShipStation).
- Website hosting and software: Fasthosts (hosting) and Automattic (WooCommerce and Jetpack).
- Email marketing: Klaviyo.
- Live chat and help articles: tawk.to, which stores your chat messages and any name or email address you give in the chat, so we can reply.
- Advertising and analytics, only with your cookie consent: Google (Google Listings & Ads) and Reddit.
- Suppliers who send items directly to you, where needed to fulfil your order. We share only your name, delivery address and the items ordered, and contact details only where the courier needs them for delivery updates. For personalised items we also share your personalisation text and any file you upload (for example a photo of your handwriting). Uploaded files are kept privately and deleted after 120 days.
- Professional advisers such as our accountants, and authorities such as HMRC or the police where the law requires.
6. International transfers
Some of the providers above, such as Klaviyo, tawk.to, PayPal, Apple, Google and Reddit, may process your information outside the UK, including in the United States. Where they do, we make sure your information is protected by appropriate safeguards, such as the UK Extension to the EU–US Data Privacy Framework or the UK International Data Transfer Addendum to standard contractual clauses.
7. How long we keep your information
- Order and payment records: six years from the end of the financial year of purchase, as required for tax purposes.
- Your account: until you ask us to close it, or after six years of inactivity, when we delete it. Order records are kept for the period above even if your account is closed.
- Marketing: until you unsubscribe. We then keep your email address on a suppression list so that we do not email you again.
- Customer service messages: up to two years after we resolve your query.
8. Cookies
Cookies are small files stored on your device. We use:
- Essential cookies, which make the website work, for example keeping items in your basket and keeping you signed in. These do not need your consent.
- Preference cookies, used by our live chat (tawk.to) to keep your conversation going as you move between pages. The chat only loads if you agree to these through our cookie banner.
- Analytics, marketing and advertising cookies (for example from Klaviyo, Google, Reddit and Jetpack), which help us understand how the site is used and show you relevant offers. We only use these if you agree through our cookie banner, and you can change your choice at any time.
9. Your rights
You have the right to:
- ask for a copy of the personal information we hold about you;
- ask us to correct information that is wrong or incomplete;
- ask us to delete your information, where we no longer have a reason to keep it;
- ask us to limit how we use your information, or object to us using it (including for marketing, which we will always stop);
- ask for your information in a format you can take to another organisation;
- withdraw your consent at any time, where we rely on consent.
To use any of these rights, contact us using the details in section 1. We will respond within one month and there is normally no charge.
If you are unhappy with how we have handled your information, please contact us first. You also have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk or on 0303 123 1113.
10. Security
Our website uses encrypted (HTTPS) connections, and access to customer information is limited to people who need it. Please keep your account password private.
11. Children
Many of our products are for children, but our website and services are intended for adults. You must be 18 or over to place an order, and we do not knowingly collect personal information from children.
12. Changes to this policy
We may update this policy from time to time. The latest version will always be on this page, with the date it was last updated at the top.