Privacy notice: Christmas cards
This notice is applicable to information we process in connection with sending Christmas cards.
- We keep to a minimum the information we hold about you
- We use your data for the legitimate interest of sending you a Christmas card. Which is probably marketing.
- If you have given us your name and address specifically for this purpose, we will delete it when we've posted this year's cards. Update: now deleted
- Your name and address, as addressee of the card, will be visible to the Royal Mail's staff (and staff of any other delivery service), and anyone who gets hold of the envelope (e.g. your post room, your dog)
- You have lots of privacy rights but few of them are meaningful in the context of this limited use
- We take security seriously. We'll try really hard to seal the envelope.
- We are happy to answer your questions about any of this
This page was last updated on 12 December 2022.
🎅 What data we hold
If you ask us to send you a Christmas card and we do not already have your contact information, we will hold the following information about you:
- Your name and contact information
Of course, it does not have to be your "real" or government-linked name. And you don't need to give us a name at all, if you prefer. Or you can ask us to use a different name on the envelope. But your address does need to be one at which you can receive post, as this is all a bit pointless otherwise.
🎄 Using your information
References to the basis of processing (e.g. "(Basis: Art. 6(f).)") are a reference to the article of the UK General Data Protection Regulation under which we undertake the processing in question.
- Sending you a Christmas card
We will use your information for the legitimate interest of sending you a Christmas card.
(Basis: Art. 6(f): sending you a Christmas card is a legitimate interest.)
🛷 Your data and the UK
We will not transfer or process data outside the UK unless you ask us to send your card outside the UK. If you do, we will, because it will be on the envelope. That's how posting things works. (Just tell us if you don't want your name on the envelope, or you want a different name on the envelope.)
🎁 Your rights
You have lots of rights in respect of our processing of your personal data, but they're not really that meaningful in the context of us sending you a Christmas card. The relevant rights are:
- get access to your personal data and information about our processing of it - but we'll just end up sending you back your name and address, and a copy of this notice, and we can't even do that once we've posted your card.
- it will be too late to restrict our processing, or object to our processing, unless you give us your information and then ask for a restriction or objection, but that would be pointless. If the only reason we have your data is to send you a Christmas card, we will delete it after posting this year's cards, so we cannot use it again next year anyway. If you want to exercise any of these rights, please just contact us.
You also have the right to lodge a complaint about our processing with a supervisory authority — you probably want the UK's Information Commissioner's Office.
👯 Third parties
We will use a third party postal service to send your card to you, unless you live really close.
We will not outsource the writing of the cards, even though that is tempting.
If you send us your details via a third party service (e.g. via Twitter DM or LinkedIn), they will be processing your data. Do you trust them? Do you? If you can, I suggest you use our secure form instead.
📩 Technical security
We are using a self-hosted instance of cryptpad, which offers end-to-end encryption, for the collection of name and address. You don't have to use this, this is the mechanism we recommend.
We will seal the envelope before posting. Using a bit of wet sponge, not a lick. We're not neanderthals.
If you have particular security requirements, please contact us to discuss how we can support you. But please bear in mind this is a Christmas card.
⌚ Retention periods
Update: all deleted
Your name and address: if you have given us your name and address specifically for the purpose of receiving a Christmas card, we will delete it once we have posted this year's cards.
If we decide not to send you a card - for example, in the highly unlikely situation that we get deluged, or because you have engaged in egregious pedantry about this privacy notice on social media ;) - we will delete your details once we have posted this year's card.