Privacy Policy

Last updated: October 1, 2026

1 About this policy

Oxxbridge Galleries LLC runs the Shopify store at oxxbridgegalleries.com and oxxbridge.com. We sell physical books, magazines, photographs, and collectibles to adults. This policy explains what information the store collects, why it is used, who receives it, and your choices. It covers browsing, accounts, purchases, customer service, and promotional email. Our separate eBay business is outside this policy.

We decide how information is used for our store and are responsible for that use. Privacy law calls us the “controller.” Shopify and payment providers also make some of their own decisions about information, as section 5 explains. You can reach us using the details in section 15.

2 Information we collect

Personal information is information that identifies you or can reasonably be linked to you or your device. This includes information handled through Shopify and other providers, even if we do not keep a separate copy. What is collected depends on how you use the store.

Contact and delivery details. We receive your name, email address, phone number, shipping and billing addresses, messages, and order instructions from you. If someone buys an item for another person, we receive the delivery recipient’s name and delivery details from the purchaser.

Accounts and preferences. If you use an account or save-information feature, Shopify collects customer identifiers, sign-in or authentication information, saved contact details and addresses, order history, and account activity. We receive marketing choices, other preferences, and privacy requests from you and the store controls.

Shopping and payment details. The store records products viewed, searched for, added to a cart, or bought; order numbers, dates, and amounts; billing details; payment status and references; and delivery, return, refund, dispute, and chargeback records. These come from you, the store, payment providers, and delivery providers. Payment providers process complete card numbers, security codes, and payment-account details through their interfaces. Our order records contain payment status and references and can include the card brand and last four digits. These records do not require us to keep complete card numbers or security codes.

Browsing and device details. The store and its providers automatically collect IP addresses, approximate location, device and browser details, cookie and other online identifiers, referring pages, pages and products visited, searches, cart activity, and security or error logs. Cookies and similar technologies help collect this information. Providers also create fraud-risk indicators and, when the extra Shopify services in section 5 are enabled, information about interests and preferences.

Age declaration and location screening. We use your IP address and the approximate location inferred from it to apply website access restrictions. The entry screen asks you to declare that you meet the applicable age requirement. If browser storage is used to remember that declaration, it records your entry choice rather than your date of birth or identification details. We do not collect identification documents or dates of birth for the entry screen.

Customer service and call recordings. We receive your messages and keep our responses. We occasionally record customer-service calls, which include your voice and what is discussed, such as contact or order details. Before recording where consent is required, we must give the required notice and obtain consent. You can use email instead of a recorded call.

You are not generally required by law to give us information to browse or contact us. We need the contact, payment, and delivery details required at checkout to take payment and deliver an order. Required form fields help us handle your request; optional fields are voluntary. You must not send complete card details, identification documents, or unnecessary sensitive information through email or the contact form.

3 Why we use information and GDPR legal bases

The table below explains our purposes and the information used. If the EU General Data Protection Regulation or UK GDPR applies, the right-hand column identifies the legal basis. “Legitimate interests” means a necessary business purpose that is not outweighed by your interests and fundamental rights. Section 4 explains the extra conditions for sensitive information.

 

An existing-customer email exception applies only if we obtained your address in a qualifying customer relationship, gave you the required chance to opt out when collecting it and in each email, and honored your objection. It does not authorize unrelated third-party lists without the permission required by law.

Disclosures in section 5 use the basis for the purpose above. Legitimate interests under Article 6(1)(f) also support necessary professional advice, legal claims, or evaluating a proposed business transfer. Disclosures required by EEA or UK law use Article 6(1)(c); optional disclosures requiring consent use Article 6(1)(a). Each disclosure must stay within its purpose. Independent recipients determine their own bases. A foreign authority’s request does not override applicable EEA or UK disclosure restrictions.

You can withdraw consent at any time through the relevant control or by contacting us. Withdrawal does not affect lawful processing before withdrawal. We explain any effect on an unfinished order or service. Refusing optional email or tracking consent does not prevent a purchase.

4 Sensitive information

Adult-product browsing, purchases, and communications can reveal or suggest information about sex life or sexual orientation. A product choice does not necessarily establish those facts. Disclosing this history can cause embarrassment, discrimination, or reputational harm. Its sensitivity matters when limiting access, disclosure, and retention. California also treats certain account logins and financial or card numbers, combined with access codes or passwords, as sensitive. Providers handle those credentials through their interfaces.

Additional GDPR conditions. Information revealing sex life or sexual orientation, including indirectly, is “special-category data” under EEA or UK law. It needs both an Article 6 basis from section 3 and an Article 9 condition. For sensitive shopping or service processing with no other exception, the condition is explicit consent under Article 9(2)(a). Information necessary for a legal claim can instead use Article 9(2)(f), with the relevant Article 6 basis. The claims exception does not authorize unrelated shopping, marketing, or profiling.

Your consent. Where explicit consent is required, we must obtain it before the relevant processing through a separate, specific choice explaining the information and purpose. Accepting this policy, ordering, or affirming your age is not that consent. A cookie choice does not authorize every use of sensitive purchase information. Other laws’ express-consent requirements also apply. You can withdraw consent through the relevant control or by contacting us. Separate legal grounds can permit necessary legal-claim records to be kept.

Other sensitive-data protections. If applicable state law requires consent to process or sell sensitive information, that consent must come first. An opt-out or purchase contract does not replace it. Laws prohibiting sensitive-data sales or limiting processing to what is strictly necessary for a requested product or service apply even if consent has been given.

Orders and customer service. Sensitive contents of order and service records are used for access checks, payments, fulfillment, assistance, fraud prevention, and necessary records. California permits reasonably necessary and proportionate use for requested goods or services, security, fraud prevention, and other specified purposes. It separately treats information used without the purpose of inferring your characteristics. Its rules do not replace other applicable laws. The extra Shopify services in section 5 have different purposes and disclosures.

How to limit use or withdraw consent. If California law gives you the right to limit sensitive-information uses beyond permitted purposes, email oxxbridge@gmail.com, call 888-695-5355, or use the contact form. Say that you want to limit sensitive-information use. You do not need an account or identity verification. This does not stop necessary order or security processing. You can also contact us to withdraw sensitive-data consent. We need a valid legal ground to process an order; separate legal grounds can permit or require some records to be kept. Section 12 explains agents and response times.

5 Who receives your information

Shopify store services. Shopify receives contact, account, shopping, payment, browsing, device, and preference information to host the store and support accounts, checkout, orders, reports, and fraud protection. When following our instructions, it acts as our “processor” under Shopify’s Data Processing Addendum. Shopify’s processing-provider list identifies its affiliates and other providers working for it.

Extra Shopify services. When Shopify Network Intelligence and related Enhanced Services are enabled, Shopify combines interactions with our store, other merchants, and Shopify for analytics, personalized shopping, and improved or targeted advertising. Shopify makes its own decisions about that processing as an independent controller. Shopify’s Consumer Privacy Policy explains its information, purposes, legal bases, recipients, and retention; Shopify’s privacy portal provides choices. Contact us about Oxxbridge’s own use of information.

Payment providers. We use Authorize.net for international card payments; PayPal is accepted for U.S. orders. These and any other payment or wallet provider you select receive payment, contact, billing, order, and device details to authorize payments, handle refunds and disputes, prevent fraud, and meet their obligations. Their privacy notices explain their independent use of information.

Delivery and customs. Postal services and carriers receive names, addresses, contact details, and shipment information to deliver orders. Customs authorities receive shipment and transaction information required for international delivery. These recipients make their own decisions for delivery, customs, and legal duties.

Communications and recordkeeping. Email providers receive names, email addresses, preferences, and message content to send permitted communications. Contact-form and customer-service providers receive contact details, order references, messages, and responses. A provider recording a call for us receives your voice and what is discussed. Recordkeeping apps receive the contact, order, payment-reference, and service records needed for their functions. Sensitive contents are included only when present in those records. Providers working for us must follow the instructions and contractual limits that apply to their role.

Advice and legal matters. Professional advisers and insurers receive relevant contact, order, payment-reference, and service records for advice, claims, or disputes. Courts, regulators, and law enforcement receive information required for a valid demand or another legally justified disclosure. Sensitive purchase or service details must be limited to what the matter requires.

Business transfers and your instructions. Relevant contact, account, order, service, and technical records can be transferred in a proposed or completed business sale or restructuring, subject to privacy requirements and sensitive-information restrictions. We also disclose information when you direct or specifically authorize us to do so.

6 Cookies and your choices

What these technologies do. Cookies and similar technologies, including local storage and pixels, help the cart, checkout, sign-in, security, saved privacy choices, and an age declaration choice work. When enabled, optional technologies measure usage, personalize the store, or support the extra Shopify services in section 5. They use online identifiers, device details, and browsing or transaction information. Shopify’s Cookie Policy explains its technologies. Providers can collect activity over time and across stores or services.

Cookie choices. You can block or delete cookies in your browser and use a displayed cookie control to accept, reject, or change optional choices. Blocking necessary cookies can prevent checkout or sign-in from working. Choices can depend on your browser or device; deleting cookies can remove a saved choice. Where prior consent is required, optional tracking and uses must stay off until consent is obtained. Visiting the store is not consent.

Sale, sharing, and targeted advertising. Oxxbridge does not run online advertising campaigns. Shopify’s separate use across merchants can still fall under laws governing sale, sharing, or targeted advertising. California defines “sale” to include disclosures for money or other valuable consideration and “sharing” to include cross-context behavioral advertising, even without payment. When Enhanced Services are enabled, Shopify receives identifiers, contact or account records, shopping and browsing information, location information, and inferences for the purposes in section 5. Section 13 gives the California categories. Payment and delivery providers receiving information only to provide the requested service have a different role.

How to opt out. Where you have these rights, email oxxbridge@gmail.com, call 888-695-5355, use the contact form, or use a displayed data-sharing opt-out control. Say that you want to opt out and provide the email address or identifier needed to apply your choice. No account is needed. Necessary payment and delivery disclosures continue. Shopify’s privacy portal also provides choices for its own processing.

Browser opt-out signals. Where law requires an opt-out preference signal to be honored, your Global Privacy Control signal counts as an opt-out request. It applies to the browser or device and any associated customer profile as law requires; a signed-in customer does not need a separate request. If we cannot link the signal to your record, contact us to apply the choice there. The Global Privacy Control website lists compatible browsers and extensions. The older Do Not Track setting does not change our collection or use.

Sensitive-information choices. An opt-out from sale or sharing is separate from a limit on sensitive-information use. Global Privacy Control sends a sale or sharing opt-out; it does not by itself send a California sensitive-use limitation. Use section 4 for that request.

7 Automated checks

Shopify and payment providers use automated fraud checks. They examine transaction and device details, address and card-security checks, location mismatches, unusual network activity, and repeated payment attempts. Results include fraud indicators, risk recommendations, or payment approval or refusal. This can lead to review, delay, a declined payment, or a temporary checkout block.

Contact us if a check wrongly affects an order. If EEA or UK law gives you rights over a decision with legal or similarly significant effects made without meaningful human involvement, you can ask about the decision and its logic, explain your position, request human intervention, and challenge it. Payment providers review decisions they control.

Some state laws also give rights when profiling contributes to a legally or similarly significant decision, even with human involvement. Depending on the law, you can opt out, question the result and ask why, review the information used, and request correction and reevaluation of a decision based on inaccurate information. Minnesota also provides, where feasible, information about steps that could have led, or could lead, to a different decision. These rights apply only to covered decisions and processing. Use section 12 to make a request.

8 International transfers

Oxxbridge operates in the United States, where our store records are processed. Providers can process information in other countries. Shopify’s processing-provider list identifies its affiliates, other providers, and processing countries; the services used determine the locations involved. Payment processing also involves your selected provider, and international delivery involves providers and customs authorities in the destination country.

Shopify’s Data Processing Addendum explains the safeguards for its processing on our behalf. These include applicable adequacy decisions for approved destinations, standard contractual clauses, the UK transfer addendum, and Shopify’s binding corporate rules for covered transfers within its group. The method depends on the entities and transfer involved. Shopify’s safeguards do not automatically cover a separate app or another provider.

Other countries can have different privacy protections and laws allowing access by public authorities. A restricted EEA, UK, or Swiss transfer involving another provider needs a safeguard or legal exception covering that provider and transfer. Browsing or buying is not general consent to unrestricted transfers. Contact us for the recipients, countries, and transfer methods relevant to your information or a copy of applicable safeguards, with necessary confidential details removed.

9 How long we keep information

There is no single fixed period for customer information or call recordings. We consider why the record is needed, its sensitivity, whether a matter remains open, required recordkeeping, and the time reasonably needed for returns, chargebacks, complaints, investigations, or legal claims. Information must not be kept longer than needed for the applicable purposes.

Orders and accounts. Contact, order, payment-reference, and delivery records are kept to complete transactions, handle service matters, and meet accounting, tax, or claim requirements. Account and saved-preference records are kept while needed for that feature. Necessary transaction records can remain after an account closes.

Customer service. Messages and recordings are kept according to the service issue, unresolved disputes, and applicable legal or claim needs. We consider sensitive contents when deciding whether the full record is still needed.

Marketing and privacy choices. Marketing contact and consent records are kept while needed to send permitted emails and document permission. Limited opt-out records are kept to honor unsubscribes or objections. Privacy-request records are kept to handle requests and document compliance.

Technical records. Browsing, device, cookie, and security records depend on the session or cookie function and the period needed for reports, troubleshooting, or fraud investigations. Provider retention and cookie expiry also depend on the service. Shopify and payment providers explain retention for their independent uses in their own notices.

Information no longer needed must be deleted or irreversibly anonymized so it cannot identify you. Required records and legal holds can limit deletion. Backups can remain until the provider’s deletion cycle; they must not return to ordinary use without a valid reason. Contact us about retention of a particular record.

10 Promotional email

You can decline promotional emails, use the unsubscribe method in an email, or email oxxbridge@gmail.com asking us to stop. We honor requests within the applicable period. Necessary order, payment, delivery, and customer-service messages continue. You can still buy from us if you decline promotional email. Section 6 explains cookie and data-sharing choices.

11 Your privacy rights

Your rights depend on the law that applies, including its scope and exceptions. Blocking website access in a state does not remove the rights of customers or delivery recipients there. Use section 12 to exercise the rights below.

EEA and UK. If EEA or UK law applies, you can get your data and information about its use; correct it; request deletion or restricted use; withdraw consent; and receive or transfer a portable copy when the requirements are met. Section 7 explains automated-decision rights. You can complain to the authority where you live, work, or believe an infringement occurred. EEA supervisory authorities and the UK Information Commissioner’s Office provide complaint contacts.

Your right to object. You can object to legitimate-interest processing for reasons related to your situation. You can always object to direct marketing. Contact us using section 12 or unsubscribe from promotional email under section 10.

Switzerland. Swiss law provides access, correction, and applicable objection or deletion rights. You can complain to the Swiss Federal Data Protection and Information Commissioner.

California. If the California Consumer Privacy Act applies, you can learn the categories of information collected, its sources, purposes, and recipients, and obtain specific information about you. You can request deletion, correction, or a portable copy; opt out of sale or sharing; and limit sensitive-information uses beyond permitted purposes where that right applies. We must not discriminate or retaliate for exercising these rights. California’s Shine the Light law also allows requests about covered disclosures for third parties’ direct marketing where it applies.

Other U.S. states. Depending on the state law, you can confirm processing, access information including covered inferences, correct it, request deletion, obtain a portable copy, and opt out of sale, targeted advertising, or profiling for legally or similarly significant decisions. Some laws allow a list of specific third parties receiving or buying your information and an appeal of a denied request. Not every state provides every right. Sections 4 and 7 explain sensitive-data and profiling rights. We must not unlawfully discriminate or retaliate for exercising privacy rights. Nevada residents can send verified requests not to sell covered information to oxxbridge@gmail.com, our designated request address.

Canada, Australia, and New Zealand. Applicable Canadian law provides access, correction, compliance challenges, and withdrawal of consent, subject to lawful or contractual limits that we explain. Applicable Australian and New Zealand law provides access, correction, and complaint rights. If a correction is declined, you can ask to have your requested correction noted with the record where the law allows. Complaints can be made to the Office of the Privacy Commissioner of Canada, Office of the Australian Information Commissioner, or New Zealand Privacy Commissioner.

Brazil and other jurisdictions. If Brazil’s LGPD applies, you can confirm processing, access or correct data, seek portability under applicable rules, and request anonymization, blocking, or deletion of unnecessary, excessive, or unlawfully processed data. You can request deletion of consent-based data, subject to exceptions; learn about shared use and the consequences of refusing consent; withdraw consent; and object to unlawful processing. Article 20 provides review of qualifying automated decisions. You can petition Brazil’s data protection authority. Other local laws can provide additional rights; contact us to raise them.

12 How to make a request

Contact us. Email oxxbridge@gmail.com, call 888-695-5355, use the contact form, or write to the address in section 15. Explain what you want to do and give your name and the email address or order reference linked to the record. Tell us your jurisdiction if it helps identify your rights. You do not need an account. You can ask for this policy or our response in an accessible format.

Verification and agents. For access, correction, or deletion, we check identity as needed using existing account or order records or control of your email address. We ask only for necessary information and explain if verification fails. You must not send identification documents or full payment details initially. California sale or sharing opt-outs and sensitive-use limits do not require identity verification. An agent can use the same contact methods. Where permitted, access, correction, or deletion can require signed permission and direct verification; opt-outs can require evidence of authority. Valid powers of attorney and other legal exceptions apply.

Costs and exceptions. Requests are generally free. California consumers can obtain required information free twice in 12 months. A fee or refusal for an unfounded or excessive request must meet the applicable law and notice requirements. We explain refusals, partial responses, and available appeal or complaint routes. Exceptions can protect required records, legal claims, or other people’s information.

Response times. We use the deadline that applies to your request and give required extension notices. The following periods apply to covered EEA, UK, and California requests.

 

Appeals. If an appeal right applies, use the same contact methods within a reasonable time after the denial. Identify the request; “Privacy appeal” is a helpful email subject. We review the appeal and explain the outcome in writing within the applicable period, which is 60 days for Connecticut appeals. After an appeal denial, we provide any required way to contact the attorney general or regulator. California concerns can be raised with the California Privacy Protection Agency; the state attorney general directory provides other state contacts.

Complaints. Explain your concern and the outcome you want. Our privacy contact investigates and communicates the outcome. For covered UK complaints, we acknowledge receipt within 30 days, keep you informed, and provide the outcome without undue delay. You retain any right to complain to a regulator without first completing an internal appeal.

13 Additional California information

The table below maps the information described in section 2 to California’s categories of personal information. It covers collection through the store and its providers, including information handled through Shopify even if we do not keep a separate copy. The examples depend on the services used and the contents of your records; they do not mean that every example is collected about every customer.

 

Sources include you and your browser or device, a purchaser providing another person’s delivery details, Shopify, payment providers, and delivery providers. Section 3 gives the purposes, section 5 the recipients, and section 9 the retention criteria, including sensitivity.

For business purposes, service providers and contractors receive identifiers, customer records information, commercial information, network activity, location information, and fraud-risk inferences through the functions described in section 5. Account or payment credentials are handled through provider interfaces. Communications and order or service records can contain audio, protected-characteristic information, or sensitive contents when those contents are present. Disclosures are for hosting, store operation, sign-in, checkout, payments, fraud prevention, delivery support, communications, and recordkeeping. Section 5 explains each recipient’s role and separately describes providers or authorities acting for their own purposes.

When Shopify’s Enhanced Services are enabled, sale or sharing involves identifiers, California customer records information, commercial information, internet or other electronic network activity, geolocation data, and inferences. Shopify receives these for the purposes in section 5. Sections 4 and 6 explain sensitive-use limits and sale or sharing opt-outs. We do not have actual knowledge of selling or sharing information about consumers under 16.

14 Security, children, and updates

Security. We use Shopify’s hosted store and payment interfaces and reasonable safeguards suited to the information, including sensitive adult-product history. No system is completely secure. Shared devices, accounts, or email addresses can expose order confirmations and purchase details. If a breach occurs, we investigate, take appropriate containment and remedial steps, and give required notices.

Children and the age-entry screen. The store is for adults 18 and older. People under 18 must not use it or provide information. We do not knowingly collect children’s information. Contact us if you believe a child supplied it so we can investigate and delete it where required. The age-entry screen asks for an age affirmation, not identity verification. We do not collect or keep identification documents, dates of birth, or age-verification records for that screen.

Policy updates. We review this policy at least every 12 months and update it when practices or legal requirements change. The update date appears above. For material changes, including purposes, recipients, our identity, or the request process, we give affected customers a conspicuous store notice or use our usual contact channel, such as email, as law requires. Before materially different collection, use, or disclosure of previously collected information, we give required notice, an opportunity to withdraw consent, and obtain any required new consent. An update alone does not authorize uses inconsistent with an earlier promise or remove existing rights.

15 Contact us

For privacy requests, complaints, and questions:
Oxxbridge Galleries LLC
785 Franklin Ave., PO Box #794
Franklin Lakes, NJ 07417, United States
Email: oxxbridge@gmail.com
Phone: 888-695-5355