Privacy policy

Last Updated: August 16, 2026

Time To Time Inc. (“Time To Time,” “we,” “us,” or “our”) respects your privacy. This Privacy Policy explains how we collect, use, disclose, retain, and protect personal information when you visit timetotimeinc.com, create an account, make or inquire about a purchase, submit a watch for evaluation, consign or sell a watch to us, contact us, or otherwise interact with us (collectively, the “Services”).

We are a U.S.-based luxury pre-owned watch dealer. We collect information to operate our business thoughtfully and securely: to respond to you, complete transactions, evaluate watches, deliver purchases, prevent fraud, comply with legal obligations, and improve the Services. This Policy does not create contractual rights beyond those that may be required by applicable law.

1. Information We Collect

1.1 Information you provide directly

We may collect information you provide to us, including:

your name, email address, telephone number, billing address, shipping address, and other contact details;
account credentials and account-profile information, where customer accounts are available;
order, payment, delivery, return, and customer-service information;
payment information submitted through Shopify checkout and its payment providers. Payment-card data is processed by the applicable payment processor; we do not ordinarily store your full payment-card number;
identity-verification information, such as a government-issued identification document, proof of address, or confirmation of payment source, when reasonably necessary for a high-value order, fraud prevention, compliance, or delivery security;
information and photos you submit to ask us to buy, evaluate, or consign a watch, including watch details, serial or reference information, ownership or provenance information, and your requested transaction terms;
correspondence, feedback, requests, and other information you choose to send us; and
your preferences for marketing communications.

1.2 Information collected automatically

When you use the Services, we and our service providers may automatically collect device and usage information, such as your IP address, browser type, device type, operating system, language, referring or exit pages, pages viewed, links clicked, date and time of activity, session information, and cookie or similar-technology identifiers. Shopify, and any analytics tools we enable, may collect this information through cookies and similar technologies.

1.3 Information from third parties

We may receive personal information from third parties, including Shopify and payment processors; fraud-prevention and identity-verification providers; shipping carriers; analytics and advertising providers if used; and social-login providers if we enable social login. We may also receive information from a person acting on your behalf, such as a recipient, consignor, or authorized representative.

2. How We Use Information

We use personal information as reasonably necessary to:

operate, maintain, secure, and improve the Services;
process orders, payments, deliveries, returns, and refunds;
create and manage accounts and respond to account-related requests;
answer questions, provide customer support, and communicate about a transaction;
evaluate watches submitted for potential purchase or consignment and administer any resulting agreement;
verify identity, address, ownership information, payment source, and delivery details for fraud prevention and transaction security;
comply with tax, accounting, sanctions, export-control, anti-fraud, recordkeeping, and other legal obligations;
send marketing communications and offers where permitted by law and consistent with your choices;
understand Service performance, troubleshoot, analyze use, and improve content and features;
establish, exercise, or defend legal claims, enforce our Terms of Service, and protect the rights, safety, property, and security of Time To Time, our customers, and others; and
carry out another purpose disclosed to you at collection or with your consent where required.

We may aggregate or de-identify information so that it no longer reasonably identifies you. We may use and disclose aggregated or de-identified information as permitted by law.

3. Legal Bases for Processing (EEA, UK, and Similar Jurisdictions)

If the General Data Protection Regulation (“GDPR”), UK GDPR, or similar law applies to our processing, we rely on one or more of these legal bases:

3.1 Performance of a contract. We process information necessary to accept and fulfill an order, manage your account, respond to an inquiry about a transaction, arrange delivery or a return, or take steps at your request before entering into a contract.

3.2 Legitimate interests. We process information where necessary for our legitimate interests or those of another party, provided those interests are not overridden by your rights. These interests include operating and securing the Services, preventing fraud, verifying transactions, improving the Services, communicating with customers, protecting legal rights, and managing our business.

3.3 Consent. We rely on consent where required, including for certain marketing communications and non-essential cookies. You may withdraw consent at any time, although withdrawal does not affect processing that occurred before withdrawal.

3.4 Legal obligation. We process information where necessary to comply with legal obligations, including tax, accounting, sanctions, export-control, anti-fraud, and recordkeeping requirements.

4. Cookies and Similar Technologies

4.1 We use cookies, local storage, and similar technologies to make the Services work, remember preferences, keep your session secure, and understand how visitors use the Site.

4.2 The categories we currently use are:

Essential cookies needed for core Site functions such as checkout, cart, customer accounts, security, session management, and fraud prevention. These are set by Shopify and cannot be disabled without breaking the Services.
Performance and analytics cookies set by Shopify’s built-in analytics (including its “Trekkie” and “Monorail” tools). These help us understand aggregate visitor behavior and improve the Site.
Functional cookies that remember choices such as preferred language, saved addresses, or an authenticated session.

4.3 We do not currently run Google Analytics, Meta / Facebook Pixel, TikTok Pixel, Pinterest Tag, LinkedIn Insight, Snapchat Pixel, Klaviyo, or any other third-party advertising or marketing pixel on the Site. If we add any such technology in the future, we will update this Policy and, where required by law, obtain consent through our cookie banner before it runs.

4.4 You can manage cookies through your browser settings, and where required by law our cookie banner lets you accept or decline non-essential cookies. Blocking certain cookies may affect Site availability, checkout, or account features.

5. How We Share and Disclose Information

We do not sell personal information for money. We disclose personal information only as described in this Policy, with your direction or consent, or as otherwise permitted or required by law. Recipients may include:

5.1 Shopify. We use Shopify to host and operate aspects of our online store, checkout, and analytics. Shopify’s privacy practices are described in Shopify’s Privacy Policy.

5.2 Payment providers. Shopify checkout and its payment providers, including Stripe where applicable, process payment information and help us detect fraud. Stripe’s privacy practices are described in Stripe’s Privacy Policy.

5.3 Shipping and delivery providers. We disclose the information needed to ship and secure delivery of your order to carriers and secure-delivery providers, including FedEx, UPS, Brinks-affiliated carriers, or another carrier selected for your shipment.

5.4 Fraud, identity-verification, and security providers. We may share information with providers that help us verify identity or transactions, prevent fraud, perform compliance screening, secure the Services, and investigate suspicious activity.

5.5 Analytics providers. If enabled, Shopify Analytics, Google Analytics, and comparable service providers may process device and usage data on our behalf to help us understand and improve the Services.

5.6 Professional advisers and business operations. We may disclose information to insurers, auditors, lawyers, accountants, banks, and vendors that support our business, subject to appropriate confidentiality and use restrictions.

5.7 Legal and safety disclosures. We may disclose information where we reasonably believe disclosure is necessary to comply with a subpoena, court order, legal process, sanctions requirement, law-enforcement request, or other legal obligation; to enforce our agreements; or to protect the rights, safety, property, and security of Time To Time, our customers, or others.

5.8 Business transfers. If we are involved in a merger, acquisition, financing, reorganization, sale of assets, bankruptcy, or similar transaction, personal information may be disclosed or transferred as part of that transaction, subject to applicable law.

5.9 We do not sell personal information. Whether a particular analytics or advertising configuration constitutes “sharing” for cross-context behavioral advertising under California law can depend on the technologies actually deployed. If we engage in activity that requires an opt-out under applicable law, we will provide the required notice and choice.

6. International Data Transfers

We are located in the United States. Personal information may be collected, stored, processed, or accessed in the United States and other countries where we or our service providers operate. Those countries may have data-protection laws that differ from the laws of your country.

Shopify may process information in Canada and other jurisdictions, and Stripe may process information in the United States and other jurisdictions. When required for transfers of personal information from the EEA, UK, or Switzerland, we will use an appropriate transfer mechanism, such as a European Commission adequacy decision, the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum, or another lawful mechanism.

7. Data Retention

We retain personal information only for as long as reasonably necessary for the purposes described in this Policy, including to meet legal, accounting, tax, fraud-prevention, and dispute-resolution obligations. Our typical retention periods are:

customer account information: for the life of the account and generally three (3) years after the last activity, unless a longer period is required or appropriate;
order, payment, return, and tax records: generally seven (7) years, subject to applicable law and recordkeeping needs;
sell-to-us and consignment inquiry records: for as long as needed to evaluate, document, or administer the potential or completed transaction and address related legal or fraud risks;
marketing information: until you unsubscribe or we otherwise determine the information is no longer needed; and
cookies and similar technologies: for the session period or the configured expiration period, unless you clear or block them earlier.

We may retain information longer where necessary to comply with law, resolve disputes, enforce our agreements, preserve evidence, or protect against fraud or misuse.

8. Data Security

We use reasonable administrative, technical, and physical safeguards designed to protect personal information. These measures include HTTPS encryption in transit, encryption at rest where supported by the systems that host or process the information, access controls, limiting access to personnel and providers who need it, and relying on service providers such as Shopify that maintain security measures for their services.

No transmission, storage system, or security control is completely secure. We cannot guarantee absolute security. You are responsible for using a secure password, protecting account credentials, and notifying us promptly if you suspect unauthorized account access.

9. Your Privacy Rights

Depending on where you live and subject to applicable law, you may have the rights described below. These rights are not absolute; we may retain or decline to delete information where an exception applies, including where needed to complete a transaction, comply with law, prevent fraud, or establish, exercise, or defend legal claims.

9.1 EEA and UK residents

If GDPR or UK GDPR applies, you may have the right to request access to, correction of, erasure of, restriction of, or portability of your personal information; to object to processing based on legitimate interests or direct marketing; and to withdraw consent where we rely on consent. You may also complain to the data-protection authority in your country of habitual residence, place of work, or alleged infringement. A list of EEA supervisory authorities is available from the European Data Protection Board.

9.2 California residents

California residents may have rights under the California Consumer Privacy Act as amended by the California Privacy Rights Act (“CCPA/CPRA”), including the right to know/access, delete, correct, receive a portable copy of certain personal information, opt out of the sale or sharing of personal information, limit certain uses of sensitive personal information, and receive non-discriminatory treatment for exercising privacy rights.

We do not sell personal information. We do not use or disclose sensitive personal information for purposes that, based on the information currently described in this Policy, would require a “Limit the Use of My Sensitive Personal Information” link. If our practices change, we will provide the notices and choices required by law.

9.3 How to make a request

To exercise a privacy right or ask a question about our privacy practices, email sales@timetotimeinc.com with the subject line “Privacy Request,” or mail us at the address in Section 16. Please describe your request and provide enough information for us to verify your identity. We may ask for information reasonably necessary to verify that you are the person whose information is involved or an authorized agent.

For GDPR requests, we aim to respond within one month, subject to permitted extensions. For CCPA/CPRA requests, we aim to respond within forty-five (45) days, subject to a permitted extension where we notify you as required by law. If we cannot fulfill a request, we will explain the reason where required or appropriate.

An authorized agent may submit a request where permitted by law. We may require proof of the agent’s authority and verification of the consumer’s identity before acting on the request.

10. Children’s Privacy

The Services are not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided personal information to us, contact us at sales@timetotimeinc.com so that we can take appropriate action.

11. Do Not Track

Some browsers offer a “Do Not Track” (“DNT”) signal. Because there is no consistent industry standard for responding to DNT signals, we do not currently respond to them. We will update this Policy if our practices change.

12. Marketing and Communications

Where permitted by law, we may send you news, offers, and other marketing communications. For EEA and UK recipients, we obtain consent where required by applicable law. You may opt out of promotional emails at any time by using the unsubscribe link in the email or contacting us at sales@timetotimeinc.com.

Opting out of marketing will not stop transactional or service communications, such as order confirmations, delivery updates, return communications, account-security notices, and responses to your requests.

13. Third-Party Links and Services

The Services may link to third-party websites, including brand sites, carrier sites, payment-provider sites, or industry resources. Those third parties have their own privacy practices, which we do not control. Review their policies before providing personal information to them. A link does not imply that we endorse or are responsible for the third party.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, Services, technology, or legal requirements. We will post the updated version on the Site and revise the “Last Updated” date. If a change is material, we will provide additional notice when required by law. Your continued use of the Services after an update is effective is subject to the updated Policy.

15. Contact and Complaints

For general questions, privacy requests, or complaints about this Policy, contact us using the information below. If you are in the EEA or UK and believe we have not resolved your concern, you may complain to the applicable data-protection supervisory authority as described in Section 9.1.