Santa Super Sleigh Salford | 100th Salford Scout Group
Santa Sleigh Salford (Santa Super Sleigh Salford)
Organised by 100th Salford (St Luke's) Scout Group
Last updated: 5 November 2026
Analytics preferences: optional usage statistics are currently on in this browser.
Santa Sleigh Salford is an annual community fundraising activity organised by 100th Salford (St Luke's) Scout Group. The Scout Group is the data controller for the personal information described in this notice: this means the Group decides why and how that information is used.
For privacy questions, requests to access or delete information, objections or complaints, email glv@100thsalford.co.uk.
This notice covers the Santa Sleigh website, street and route searches, live tracking, Santa sighting reports, volunteer arrangements, sign-hosting applications, donations and photographs associated with the activity.
We collect only the information needed to operate the Santa Sleigh, help residents find it, organise volunteers and fundraising, and improve future routes.
We use our own website activity records and Cloudflare Web Analytics to understand which pages and features people use, including interest in the live tracker. Our own records cover page views, clicks on particular buttons and links (for example the donate button, menu sections and the live-tracking button), and roughly how long a page stays open, in one-minute steps. We use this to improve the website and understand demand during the Christmas campaign. These are counts of events, not counts of people.
Our own analytics records do not contain IP addresses, device identifiers, browser details, referrers or persistent visitor IDs, so we cannot use them to identify individual website visitors or reliably count unique people. Cloudflare receives your IP address and basic browser details when its statistics script loads, and our hosting provider (Netlify) necessarily receives them when delivering the website; these providers may keep their own operational and security logs.
Our legal basis for processing any personal data involved in improving and securing our website is legitimate interests: operating a useful, reliable community service, understanding demand and preventing misuse. We do not use website analytics for targeted advertising or cross-site profiling.
Optional analytics are on by default. You can turn them off at any time using Analytics preferences (in the website footer and at the top of this page). Turning them off stops the Cloudflare statistics script, our own usage events and our street-search records from being sent from your browser. It does not stop street searches, maps, live tracking or volunteer login from working. If your browser sends a Global Privacy Control signal, we treat that as turning analytics off unless you switch them back on here. Your choice is remembered in your browser's local storage (no cookie), for this website address only, until you change it or clear your browser data.
QR codes on our street signs. Each of our street signs has its own numbered QR code that opens our home page (for example, santasleighsalford.co.uk/s/023). If optional analytics are on, opening one records a single usage event saying which sign number's link was opened and when — nothing else. It is stored with our other usage events, without an IP address, device details, location or visitor ID, and is deleted after up to 13 months. If analytics are off, or your browser sends Global Privacy Control, nothing is recorded and you are simply taken to the home page. We use these counts to see which sign locations are useful; they count link visits, not people or donations. Our private list of where signs are placed records a street or landmark, not the host's name, contact details or house number.
When you search for a street or postcode, we use the search to show you whether Santa is visiting, find a suitable route, and understand which streets residents are interested in. If optional analytics are on, we keep a record of the search after cleaning it: house numbers and other digits are removed, a postcode is replaced with "[postcode]", and anything containing an "@" is replaced with "[removed]". The record also holds whether it found a match, the matched street (if any), the page and the date/time. Our search records are not associated with IP addresses or visitor IDs.
A search box can still receive whatever someone chooses to type, so please enter only the street or postcode needed to find your route, not a person's name or other private details. We use overall search patterns to identify missing streets and plan future coverage.
When a search doesn't match one of our streets directly, our server looks up the location by sending the text you typed to postcodes.io (for postcodes) or OpenStreetMap's Nominatim service (for other places). That request comes from our server, so those providers receive the search text but not your IP address.
Volunteer portal accounts are for adults aged 18 or over, and we ask volunteers to confirm this. We may collect:
We use these details to organise collections, communicate arrangements and last-minute changes, manage safety, control access to the portal and prevent registration abuse. Our legal basis is legitimate interests in running the activity safely and efficiently and protecting those involved.
Only authorised administrators can access full volunteer records. Other approved, signed-in volunteers can see the names of people booked on the same shifts and in the Santa, driver and safety-walker roles, but not their email addresses or telephone numbers. The public cannot access volunteer records.
The portal sends operational emails only, not marketing emails for future campaigns. Our email delivery service is Resend. A volunteer may separately choose to join the event WhatsApp group; joining is optional, and other group members may see their phone number or profile details according to WhatsApp's settings. The volunteer portal does not collect personal information about children accompanying adult volunteers.
If you offer to host a promotional street sign, we collect the details you enter in our Microsoft Form: typically name, email address, telephone number, house number/street, postcode and any practical installation notes. This information is held in Microsoft Forms/Excel and is accessed by the Group Lead Volunteer, who arranges and carries out installation and collection.
We use these details under our legitimate interests in organising sign placement and collection. Only if you tick the separate, optional consent checkbox, we may also email you in future Christmas campaigns to ask whether you would like to host a sign again. You can withdraw this consent at any time at glv@100thsalford.co.uk. We do not use these contact details for unrelated marketing or pass them to other organisations for their own marketing.
People who submitted the form before the future-contact option was introduced are not automatically opted in to future emails.
Donations can be made using a Square Payment Link or in person through Square Tap to Pay, operated by authorised volunteers with restricted Square team accounts. When a volunteer asks for card payment access in the volunteer portal, we share their name and email address with Square to create that team account, and deactivate it when access is removed or their volunteer record is deleted. Square processes card details and may collect names, email addresses and other transaction information. The Scout Group can access individual transaction records and, where available, donor information within Square through authorised administrators, but does not receive or store full payment card numbers.
For the Group's accounts, we record daily or campaign fundraising totals rather than exporting donor-level personal details into a separate spreadsheet. We use payment information for processing, reconciliation, refunds, disputes, fraud prevention and legal/accounting obligations, not to add donors to a marketing list. Our legal bases are legitimate interests in administering donations and legal obligations where record-keeping or financial law applies. Square also has its own privacy notice for donors.
The Sleigh has a dedicated TruTrak GPS tracking device. Our website shows its location to visitors only during the public tracking window on route nights; outside that window our server does not fetch or return any position, and our team can switch public tracking off for the rest of the night at any time. The tracker is on the Sleigh, not visitors' phones; our website does not ask visitors for their location to watch the Sleigh.
To show the route travelled so far, our server keeps a temporary copy of that night's trail, which is deleted automatically after the night. TruTrak also retains historical journey/location records, accessible through its platform only to authorised Scout Group administrators. Because these may indirectly reveal the movements of volunteers operating the Sleigh, we treat them as potentially personal information. We use tracking for public route information and the safe, effective operation of the event, on the basis of legitimate interests. Historical journey retention within TruTrak is governed by TruTrak's platform arrangements; you may contact us for more information about the period that applies to our account.
If you report seeing the Sleigh, you select a street from the event's route list and the time you saw it. We store the street, that time, whether it was "just now" or "earlier today", and when the report was submitted, so other visitors can see recent reports. We do not ask for your name, email or telephone number, and we do not store your IP address with the report. Reports are held in our own database and deleted automatically 30 days after submission. We use them under our legitimate interests in helping residents follow the Sleigh. Our hosting provider may still process necessary technical request information when receiving a report.
Reports made before 24 October 2026 were collected through a Google Form and Google Sheet; we are deleting those records.
Volunteers may take photos and videos of the Sleigh, its volunteers and the general atmosphere in public streets. Residents and children may appear incidentally. Selected material may be shared on the Santa Sleigh website, the Scout Group's pages and Facebook or other event communications to explain and promote the fundraiser.
Our lawful basis for general public-event and incidental crowd photography is legitimate interests, balancing the Group's community fundraising purpose against individuals' privacy and safeguarding expectations. We do not routinely take posed portraits of individual children with Santa for publication. We seek appropriate permission before publishing an image that prominently features an identifiable child or family. If you would rather not be photographed, or want to raise a concern about an image we have published, contact glv@100thsalford.co.uk. We will consider and act on reasonable requests, including removing images within our control when appropriate. Content already shared or copied by others may not be fully retrievable.
When you email us, we use the information you provide to answer your enquiry, administer a request, or respond to a complaint. We keep correspondence only while needed for that purpose and any applicable record-keeping obligations. Our legal basis is normally legitimate interests, or legal obligations where we must handle a statutory request or complaint.
| Information | Retention or deletion rule |
|---|---|
| Matched street search records | Up to 13 months, then automatically deleted |
| Unmatched street search records | Up to 90 days, then automatically deleted |
| Our website page-view and usage events (including QR sign visits) | Up to 13 months, then automatically deleted |
| Volunteer account and personal details | While active. Records with 3 years without login or volunteering activity are flagged automatically and then deleted by an administrator, unless a particular record is required longer for a legitimate legal or safety purpose |
| Registration-abuse attempt records (IP address) | About 24 hours, then automatically deleted |
| Sign-hosting information where no future-contact consent was given | Deleted once no longer needed to install and collect signs for the current campaign |
| Sign-hosting contact details where future-contact consent was given | Up to 3 years, or sooner if consent is withdrawn or the information is no longer needed |
| Sign installation notes | Removed once no longer needed for the installation/collection arrangements |
| Santa sighting reports | 30 days, then automatically deleted |
| Our temporary copy of a night's tracker trail | Automatically deleted after the route night |
| Square payment and accounting information | As necessary for payment operations, disputes and applicable financial/accounting record-keeping requirements; Square also applies its own retention terms |
| TruTrak location history | Retained within TruTrak according to the arrangements applicable to our account; contact us for available details |
| Photographs/video | Kept while relevant to the Group's activities and publications, subject to review, safeguarding needs and appropriate removal requests |
| Enquiries, privacy requests and complaints | For as long as needed to respond and maintain any necessary record of the matter |
The rules above relate to records controlled by the Scout Group. Third-party providers may retain technical, security, payment or account records under their own relevant retention arrangements.
Our website does not use advertising cookies or tracking pixels. The only things we store on your device are:
Map pages use OpenStreetMap map tiles. Loading tiles means the map provider receives your IP address and technical request details, as with other external website resources. Map pages also load the Leaflet map software from unpkg, and the volunteer portal loads a donation QR image from api.qrserver.com when that feature is opened. These requests are needed to provide the relevant map or QR feature, not to profile you, and they are not affected by your analytics preference. Using external services can involve processing under those providers' privacy notices.
Links from our website to Square, Facebook/Meta, WhatsApp and other external services take you to their own systems, which have their own privacy information and controls. We do not embed Facebook content on our pages.
You can revisit Analytics preferences whenever you wish. Your preference does not switch off strictly necessary login storage or routine network/security processing by service providers.
We do not sell or rent personal information. Depending on which feature you use, relevant information may be handled by:
These services have different legal roles: some process information on our instructions; others also process information for their own purposes. We may also disclose information where legally required or necessary to protect people and respond to legitimate safety concerns.
Some providers may process information outside the UK. Where a restricted international transfer applies, it must be supported by an applicable UK adequacy arrangement or legally recognised protection. You may contact us to ask which providers and safeguards apply to your information.
We limit access to information according to the task: authorised administrators manage volunteer and donation records, ordinary volunteers only see permitted shift names, and sign-hosting form responses are restricted to the Group Lead Volunteer. Payment credentials are handled by Square and account login credentials by Netlify Identity. We use reasonable technical and organisational measures to protect the information we handle; no online system can promise absolute security.
Depending on the circumstances and lawful basis, UK data protection law gives you rights to ask us to access, correct, erase, restrict or, where applicable, receive a portable copy of personal information, and to object to certain uses of it. You can withdraw consent to future sign-hosting emails at any time without affecting how we used your information before withdrawal.
Your right to object: In particular, you can object to processing carried out on the basis of legitimate interests. We will consider such requests in accordance with the law. You can also use Analytics preferences to opt out of optional website analytics without contacting us.
Contact glv@100thsalford.co.uk to exercise a right or ask a privacy question. We normally respond to applicable rights requests within one calendar month, subject to any lawful extensions or exceptions. We may need enough information to verify that a request relates to you.
If you are unhappy with how we have handled your information, email glv@100thsalford.co.uk with your concern. We will acknowledge a data protection complaint within 30 days, investigate appropriately, and communicate our outcome without undue delay. You can also complain to the Information Commissioner's Office (ICO): ico.org.uk.
The Santa Sleigh website is intended for families, but the volunteer portal is for adults aged 18 or over. We do not register accompanying children through the volunteer portal or deliberately request children's details through street searches or sighting reports. Children may appear incidentally in public-event images as explained above. Families should avoid entering children's names or other private information into search fields.
Some of the graphics on this site (such as the seasonal holding-page artwork) were created using AI image-generation tools rather than drawn or photographed by hand.
We may update this notice as systems, suppliers or legal requirements change. The latest version will appear on this page, with the date of the update. For a significant change in how previously collected information will be used, we will provide appropriate additional notice where required.