Privacy Policy

Last updated: July 2026

This document should be reviewed by qualified legal counsel before publication.

1. Introduction

This Privacy Policy explains how Pop Up Experiences Events Management L.L.C collects, uses, stores and protects your personal information when you visit our website, make a purchase, book tickets, sign up to receive updates, contact us, enter a promotion, attend one of our events or otherwise interact with us.

This Privacy Policy applies to our website: www.dearsantaexperience.com (our “Site”) and to the personal information we collect in connection with the Dear Santa Experience and any related experiences, events, products, services, offers, promotions and communications. Part B of this Privacy Policy applies to the Dear Santa mobile app (the “App”).

This Site is operated by Pop Up Experiences Events Management L.L.C, trading as the Dear Santa Experience (“We”, “Us” or “Our”). We are a limited liability company licensed in the Emirate of Dubai, United Arab Emirates under trade licence number 1625740, with our registered office at Office C-27, Iris Bay, Business Bay, Dubai, United Arab Emirates.

To contact us about this Privacy Policy or how we use your personal information, please email info@dearsantaexperience.com.

2. The personal information we collect

We may collect and use the following types of personal information:

• your name;
• your email address;
• your telephone number;
• your billing address;
• your delivery address, where relevant;
• payment and transaction information;
• booking, order and ticket information;
• details of the event, experience, date, time, location or ticket type you have booked;
• information you provide when completing forms on our Site;
• information you provide when signing up to receive updates, offers or marketing communications;
• information you provide when entering a competition, promotion or giveaway;
• information you provide when contacting us by email, phone, social media, WhatsApp, SMS or other communication channels;
• your marketing preferences and consent choices;
• your communication history with us;
• technical information about how you use our Site, including IP address, browser type, device information, pages visited and cookie data;
• any other information you choose to provide to us.

We do not intentionally collect more personal information than we need.

3. How we collect your personal information

We may collect personal information when you:

• visit or use our Site;
• make a purchase or booking;
• buy tickets;
• create or use an account;
• sign up to receive news, offers, pre-sale access or marketing updates;
• provide your mobile number or other contact details;
• complete a form on our Site;
• enter a competition, giveaway or promotion;
• contact us directly;
• interact with us on social media;
• respond to our emails, SMS messages, WhatsApp messages or other communications;
• attend one of our events or experiences;
• use third-party ticketing, payment, marketing or booking platforms connected to our services.

We may also receive personal information from third-party service providers where this is necessary to provide our services, process bookings, manage payments, send communications or operate our business.

4. How we use your personal information

We may use your personal information to:

• process and manage purchases, bookings, orders and ticket sales;
• provide you with access to events, experiences, products or services you have purchased;
• send booking confirmations, receipts, reminders and event information;
• contact you about changes to your booking, event, purchase or experience;
• provide customer support;
• respond to your enquiries;
• manage our relationship with you;
• administer competitions, promotions or giveaways;
• personalise your experience where appropriate;
• improve our Site, events, experiences, products, services and communications;
• manage security, fraud prevention and website performance;
• comply with our legal, tax, accounting and regulatory obligations;
• send you marketing communications where permitted by law.

5. Marketing communications by email, SMS and WhatsApp

Where you make a purchase through our Site, book tickets, create an account, sign up to our mailing list, enter a promotion, complete a form or otherwise provide your contact details to us, we may use your personal information to send you marketing communications where permitted by law.

This may include marketing communications about the Dear Santa Experience, Pop Up Experiences Events Management L.L.C, our events, experiences, tickets, offers, promotions, pre-sales, related products and services.

We may send these communications by:

• email;
• SMS;
• WhatsApp;
• telephone;
• social media;
• other electronic messaging channels.

We will only send you marketing communications where:

• you have given us your consent to do so; or
• where permitted by law, you have previously purchased, booked, enquired about or shown interest in similar products or services from us and have not opted out.

Where we ask for your consent, this will usually be collected through a clear opt-in box, sign-up form or similar affirmative action. We will not rely on pre-ticked boxes.

By providing your mobile number and choosing to opt in to SMS and/or WhatsApp marketing, you agree that we may contact you using that mobile number for marketing purposes, including event updates, offers, pre-sale access, promotions and related news.

You can opt out of marketing communications at any time by:

• using the unsubscribe link in our emails;
• replying “STOP” to SMS messages where available;
• following the opt-out instructions in WhatsApp messages;
• changing your marketing preferences where available; or
• contacting us at info@dearsantaexperience.com.

If you opt out of marketing, we may still contact you with important non-marketing messages relating to your booking, purchase, account, event attendance, safety information, customer service enquiries or other service-related matters.

6. Lawful bases for using your personal information

We will only use your personal information where we have a lawful basis to do so under applicable data protection law, including the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the “PDPL”). Depending on the circumstances, we may rely on one or more of the following lawful bases:

Contract

We may use your personal information where it is necessary to provide you with something you have purchased, booked or requested from us, such as processing your ticket purchase, managing your booking or sending you event information.

Consent

We may rely on your consent where you have agreed to receive certain marketing communications, including by email, SMS or WhatsApp.

Legitimate interests

We may use your personal information where it is necessary for our legitimate business interests, provided your rights and interests do not override those interests. This may include improving our services, responding to enquiries, managing customer relationships, preventing fraud and sending marketing communications where permitted by law.

Legal obligation

We may use your personal information where necessary to comply with legal, tax, accounting or regulatory obligations.

7. Sharing your personal information

We may share your personal information with trusted third parties where necessary to operate our business, provide our services, manage bookings, process payments, send communications or comply with legal obligations.

This may include:

• ticketing and booking platforms;
• payment processors;
• website hosting providers;
• email marketing providers;
• SMS marketing providers;
• WhatsApp messaging providers;
• customer relationship management systems;
• analytics providers;
• professional advisers, including accountants, lawyers and insurers;
• event partners, suppliers and operational service providers;
• regulators, law enforcement agencies or other authorities where required by law.

We will not sell your personal information.

Where we use third-party service providers, they are only permitted to use your personal information for the purposes we have instructed, unless they are acting as an independent controller under their own privacy terms.

8. Payment information

Where you make a purchase or booking, your payment may be processed by a third-party payment provider. We do not usually store full payment card details ourselves.

Payment providers may collect and process your payment information in accordance with their own privacy policies and security standards.

9. Cookies and tracking technologies

Our Site may use cookies and similar tracking technologies to help the Site function, improve performance, understand how visitors use the Site and support advertising or marketing activity.

For more information about how we use cookies, please see our Cookie Policy.

10. How long we keep your personal information

We will only keep your personal information for as long as reasonably necessary for the purposes set out in this Privacy Policy.

This may include keeping your information for the period necessary to:

• provide services to you;
• manage purchases, bookings and event attendance;
• deal with customer service enquiries;
• maintain business records;
• comply with legal, tax and accounting obligations;
• resolve disputes;
• enforce our terms;
• maintain marketing preference and opt-out records.

Where you have opted out of marketing, we may keep a record of your opt-out so that we can respect your preferences.

11. International transfers

Some of the third-party service providers we use may process personal information outside the United Arab Emirates.

Where this happens, we will take appropriate steps to ensure that your personal information is protected in accordance with applicable data protection laws.

12. How we protect your personal information

We take reasonable steps to protect your personal information against unauthorised access, loss, misuse, disclosure, alteration or destruction.

However, no website, platform or communication method is completely secure, and we cannot guarantee the absolute security of your personal information.

13. Your rights

Depending on the circumstances, you may have the right to:

• request access to the personal information we hold about you;
• request correction of inaccurate or incomplete personal information;
• request deletion of your personal information;
• object to our use of your personal information;
• request restriction of our use of your personal information;
• request transfer of your personal information;
• withdraw consent where we rely on consent;
• opt out of marketing communications at any time.

To exercise your rights, please contact us at info@dearsantaexperience.com.

We may need to verify your identity before responding to certain requests.

14. Marketing opt-out

You can opt out of receiving marketing communications from us at any time.

You can do this by using the unsubscribe link in our emails, replying “STOP” to SMS messages where available, following the opt-out instructions in WhatsApp messages or contacting us at info@dearsantaexperience.com.

Please note that opting out of marketing does not prevent us from sending important service messages relating to your booking, purchase, account, event attendance or customer service enquiry.

15. Children’s personal information

Our events and experiences may be attended by families and children, but our Site and booking process should be used by adults.

We do not knowingly collect personal information directly from children for marketing purposes. Where information about children is provided as part of a booking or event attendance, we will only use that information where necessary to manage the booking, event, safety, access requirements or customer service.

Where a parent or guardian shares information about a child through the Dear Santa App (for example, by scanning a child’s letter), Part B below applies.

16. Third-party links

Our Site may contain links to third-party websites, platforms or services.

We are not responsible for the privacy practices, content or security of those third-party websites. You should read their privacy policies before providing them with personal information.

Part B: The Dear Santa App

This Part B must be reviewed by qualified legal counsel (UAE PDPL, Federal Decree-Law No. 45 of 2021, and GDPR-grade standards for international visitors) before the App is released.

The Dear Santa App is the digital companion to the Dear Santa Experience. It is operated by Pop Up Experiences Events Management L.L.C, the company described in section 1 of this Privacy Policy. This Part B explains how the App handles personal information. Where this Part B is more specific than Part A, this Part B applies to the App.

B1. The short version for parents

• You hold the account. Children never create accounts. Child mode contains no purchases, no external links, and no third-party advertising or analytics.
• The letter is the most personal thing we hold. A scanned letter is an image of your child’s handwriting containing their name, age and wishes. We store it so that Quill’s messages can be about your child’s wish, so that Santa’s Christmas Eve reply can quote their words, and so that you keep a keepsake copy.
• AI reads the scan once. We use an AI service (Anthropic Claude) to read the letter image into text. You review and correct what it read before anything is saved. The letter is not used to train AI models.
• Who can see it: you, and the small number of Dear Santa staff who operate the experience. Nobody else. Never advertisers.
• Delete everything, any time. Settings > “Delete my account & all data” permanently removes your account, children’s details, letters, photos and the reply. Deletion is immediate and irreversible.

B2. What the App collects

• Parent name, email and password: to operate your account. You are the consent holder. Kept until you delete the account.
• Booking reference and visit date and time slot: to unlock the journey, manage check-in and send entry alerts. Kept until you delete the account.
• Letter scan image and the extracted names, ages and wishes: for personalisation, Santa’s Christmas Eve reply and your keepsake copy. Kept until you delete the account; our operational review window closes on 31 January following each season.
• Check-in time and feather-hunt progress: to manage your entry slot and hunt progress. Kept for the season only.
• Visit photos: delivered to you in the App. Kept until you delete the account.
• Push notification token: for entry alerts and Quill’s messages. Kept until you sign out or uninstall.

The App does not collect location data, contacts, advertising identifiers, or any analytics in child mode. The App contains no third-party advertising.

B3. Children’s data in the App

The parent account holder provides consent for any child data scanned into the App. We collect the minimum the experience needs: name, age and wishes, and only what the letter itself says. Child data is encrypted in transit and at rest, is visible only to the family and our operations staff, and can be deleted by the parent at any time.

B4. AI letter reading

When you scan a letter, the image is read once by an AI service (Anthropic Claude) to extract the text so the experience can be personalised. You review and correct the result before it is saved. Letters are not used to train AI models and are never used for advertising or sold.

B5. Where App data is stored

App data is stored with our hosting provider (Supabase) and is encrypted in transit and at rest. Some processing may take place outside the United Arab Emirates; where it does, we take appropriate steps to protect your information in accordance with applicable data protection laws, as described in section 11.

B6. Safeguarding

Children’s letters occasionally disclose something concerning. Our staff follow a flag-and-escalate process (process owner: [TO BE NAMED BEFORE LAUNCH]). Where we have a legal duty to report, we will.

B7. Your rights and deleting your data

You can delete your account and all associated data at any time in the App: Settings > “Delete my account & all data”. Deletion is immediate and irreversible. For access, correction, deletion or portability requests, contact info@dearsantaexperience.com. UAE PDPL applies; we honour GDPR-grade requests for international visitors.

17. Changes to this Privacy Policy

We may update this Privacy Policy from time to time.

Any changes will be posted on this page. We recommend that you check this Privacy Policy regularly to ensure you understand how we use your personal information.

This Privacy Policy was most recently updated in July 2026.

18. Contact us

If you have any questions about this Privacy Policy or how we use your personal information, please contact us at:

Pop Up Experiences Events Management L.L.C
Office C-27, Iris Bay, Business Bay
Dubai
United Arab Emirates

Email: info@dearsantaexperience.com