Legal · us.paragraph.wine

California Consumer Privacy Notice

Your rights under the CCPA / CPRA when you shop at us.paragraph.wine.

Effective: 2026-04-30  ·  Last Updated: 2026-07-15

This California Consumer Privacy Notice supplements our Privacy Policy and applies to California residents ("you"). It is issued by LBMGB LLC, a North Carolina limited liability company operating the Paragraph U.S. online store as U.S. merchant of record ("LBMGB," "we," "us"), for the online store at us.paragraph.wine (the "Site"). It explains your rights under the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 ("CCPA").

1. Categories of Personal Information We Collect, Use, and Disclose

In the past 12 months we have collected the following categories of personal information about California residents.

We do not use sensitive personal information for any purpose other than those permitted by Cal. Civ. Code §1798.121(a) (i.e., to provide the goods or services you request, prevent fraud, ensure security, and similar limited purposes), so we are not required to offer a separate "Limit Use of My Sensitive Personal Information" link.

We have not sold personal information for monetary consideration in the last 12 months. We have shared personal information with advertising partners (Google, Meta) for cross-context behavioral advertising as indicated above, and we disclose pseudonymized identifiers and derived behavioral aggregates within the Joint Processing Environment described in Section 5A of our Privacy Policy, which may also constitute a “share” under the CCPA.

We do not knowingly sell or share the personal information of consumers under 16 years of age.

2. Categories of Sources

• Directly from you (account, checkout, support, surveys).
• Automatically through cookies, pixels, SDKs, server logs, and Google Tag Manager.
• From service providers (Shopify, Klaviyo, payment processors, fraud and analytics tools).
• From Paragraph (joint controller) — historical or cross-store records when you opt in.
• From Affiliated Controllers — pseudonymized identifiers and derived behavioral aggregates within the Joint Processing Environment (see Privacy Policy Section 5A).

3. Business and Commercial Purposes

• Performing services you request (orders, accounts, support, returns).
• Marketing and advertising (with consent or opt-out where required).
• Quality assurance, training, and product/service improvement.
• Detecting and preventing security incidents, fraud, and unlawful activity.
• Auditing and legal/compliance obligations.
• Short-term, transient use such as customizing the current Site interaction.

4. Recipients

• Joint controller: Paragraph SA (Switzerland) and Paragraph's Spanish affiliate.
• Service providers / contractors: Shopify, Klaviyo, PayPal, Apple Pay, Stripe (where applicable), Google (GTM, GA4, Ads), and customer support, fraud, fulfillment, and analytics vendors. Each is bound by a written contract limiting use to the services we engage them to perform.
• Third parties (advertising): Google and Meta receive identifiers and behavioral data via Google Tag Manager for cross-context behavioral advertising.
• Marketing-operations provider (the “Operator”): operates our first-party server-side tag endpoint, our first-party attribution pixel (arwos-px), and the Joint Processing Environment described in Section 5A of our Privacy Policy; receives event data and pseudonymized (SHA-256 hashed) identifiers as our processor/contractor and is contractually restricted from re-identifying the data, disclosing it to additional third parties, or using it outside the direct business relationship (Cal. Civ. Code §1798.140(ag)(1)).

5. Retention

We retain each category of personal information for the period required to deliver the service and to comply with our legal, tax, accounting, and dispute-resolution obligations. Order and tax records are typically retained for seven (7) years. Marketing data is retained until you opt out, then for a short reconciliation period.

6. Your California Privacy Rights

• Know. Request the categories and specific pieces of personal information we have collected about you, the sources, the business or commercial purpose for collection, and the categories of recipients.
• Delete. Request deletion of personal information we have collected, subject to legal exceptions.
• Correct. Request correction of inaccurate personal information.
• Opt-Out of Sale or Sharing. Direct us to stop "selling" or "sharing" your personal information for cross-context behavioral advertising.
• Limit Use of Sensitive Personal Information. As noted above, we do not use sensitive personal information beyond the permitted purposes, so this right does not produce additional changes for our processing — but you may still submit a request.
• Non-Discrimination. Receive equal service and pricing, even if you exercise your rights.
• Appeal. Appeal a denial of a request.

You may also designate an authorized agent to submit a request on your behalf. We will require written authorization from you and verification of your identity.

7. How to Exercise Your Rights

• Email: contact@paragraph.wine with subject line "California Privacy Request."
• Online (opt-out of sale/sharing): the "Do Not Sell or Share My Personal Information" link in the Site footer, or our Your Privacy Choices page.

We will acknowledge your request within 10 business days and respond within 45 calendar days (extendable by an additional 45 days where reasonably necessary, with notice).

To opt out of "sale" or "sharing" of personal information for cross-context behavioral advertising, use the link below. We also honor the Global Privacy Control (GPC) signal as a valid opt-out for the browser sending it.

8. Notice at Collection

This notice serves as our notice at collection. We collect the categories listed in Section 1 for the purposes listed in Section 3. We will not collect additional categories of personal information or use personal information for materially different purposes without giving you notice.

9. Other California Rights

Shine the Light. California Civil Code §1798.83 entitles California residents who have an established business relationship with us to request information about our disclosures of certain categories of personal information to third parties for direct-marketing purposes during the immediately preceding calendar year. We do not currently disclose personal information to third parties for their own direct-marketing purposes.