Loading
P-01
This notice explains what personal data Roxby collects, why, and how we look after it. It applies to roxby.xyz, admin.roxby.xyz and collector.roxby.xyz.
Last updated 2026-08-09
Roxby is a creative studio based in Dublin, Ireland, operated by Josh Roxby. For the purposes of the GDPR and the Irish Data Protection Act 2018, Roxby is the data controller for personal data collected through this site and the connected portals.
You can reach us at info@roxby.xyz with any question about this notice.
We rely on the following lawful bases under Article 6 GDPR. Contact form submissions and store orders are processed to take steps at your request before entering into a contract, and to perform that contract. Collector accounts are processed on the same basis, to record and prove ownership of the physical work you have claimed. Server logs are processed on our legitimate interest in operating a secure service. Where consent is required (for example, non-essential cookies), we ask for it and let you withdraw it at any time.
We use a small set of processors, each bound by a data processing agreement. None of them sell or profile your data.
A processor list with roles and locations is available on request.
Where a processor is based outside the European Economic Area, transfers are made under the European Commission's Standard Contractual Clauses and, where relevant, additional safeguards such as data residency in EU regions. We choose EU regions by default whenever an option exists.
Under the GDPR you have the right to access, rectify, erase, restrict or object to processing of your personal data, the right to data portability, and the right to withdraw consent where processing is based on consent. Write to info@roxby.xyz and we will respond within one month.
If you believe we have handled your data badly you can complain to the Irish Data Protection Commission at dataprotection.ie.
We use HTTPS everywhere, hashed passwords, encrypted database storage at rest and row-level security on collector data so that one collector can never see another's library. No system is perfect. We report material breaches to the Data Protection Commission within 72 hours as required.
Our services are not directed at children under 16. If you believe a child has given us personal data, please contact us and we will delete it.
We update this notice when our processing changes. The date at the top of the page marks the last change. Material changes to how we use your data trigger a direct notice by email where we have your address.