Submit a privacy request

Use this form to exercise any of your data protection rights under the GDPR (EU/EEA/UK/Switzerland), CCPA/CPRA (California), or equivalent state and national laws. We respond within 30 days (GDPR) / 45 days (most US state laws), extendable once with written justification.

How to submit

Please email privacy@vox-arcana.org with the following information:

  1. Type of request (select one or more):
    • Right of access — provide me a copy of the personal information you hold about me
    • Right to deletion / erasure — delete my personal information
    • Right to correction / rectification — correct inaccurate information
    • Right to data portability — provide my personal information in a machine-readable format
    • Right to opt out of sale / sharing — stop selling or sharing my personal information for cross-context behavioural advertising
    • Right to limit use of sensitive personal information
    • Right to restrict processing
    • Right to object to processing
    • Right to withdraw consent
    • Right to lodge a complaint with a supervisory authority
  2. Your jurisdiction (e.g. France, California, New Mexico)
  3. Identity verification: the email address you used to make purchases or sign up to our newsletter, plus any order number if applicable. We may request additional verification (e.g. date of last order) to prevent fraudulent requests.
  4. Authorized agent (if applicable): proof of written authorization from the data subject.

Response timelines

  • EU / EEA / UK / Switzerland (GDPR / UK-GDPR / Swiss DPA): 30 days, extendable by 60 days with justification.
  • California (CCPA / CPRA): 45 days, extendable by 45 days with notice.
  • Colorado, Connecticut, Virginia (VCDPA / CTDPA / CPA): 45 days, with right of appeal.
  • US state privacy laws (CCPA/CPRA): 40 days for access and correction requests under sections 19 and 23 of the Ordinance.

What we cannot delete

Some categories of data are subject to legal retention obligations and cannot be deleted on request:

  • Order and transaction records — retained for 7 years (New Mexico Inland Revenue Ordinance) and up to 10 years (German Commercial Code §257)
  • Tax and accounting records — up to 10 years (per HK Inland Revenue Ordinance §51C and applicable national tax laws)
  • Financial dispute records (Stripe, payment processors)

For these categories, your data is retained only for the legal-obligation purpose and is not used for any other purpose.

Right to lodge a complaint

If you believe we have not handled your personal data in accordance with applicable law, you have the right to lodge a complaint with a supervisory authority:

  • EU / EEA: any national Data Protection Authority — list at edpb.europa.eu
  • UK: Information Commissioner's Office — ico.org.uk
  • California: California Privacy Protection Agency — cppa.ca.gov
  • New Mexico: Office of the Privacy Commissioner for Personal Data — pcpd.org.hk

Last updated: 2026-04-28. Vox Arcana LLC, State of New Mexico, USA. Contact: privacy@vox-arcana.org.