Privacy Policy

Last Updated: 25 September 2026

Sterling & Hayes (operated by FF COMMERCE LTD, "we," "us," or "our") operates this store and website, including all related information, content, features, tools, products, and services, to provide you with a curated men's fashion shopping experience (the "Services"). Our storefront is powered by Shopify, which enables us to deliver secure online commerce to you.

This Privacy Policy explains how we collect, use, and share your personal data when you visit, use, or make a purchase from sterling-hayes.com or otherwise communicate with us. It has been prepared in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations 2003 (PECR).

FF COMMERCE LTD is the data controller responsible for your personal data. If there is a conflict between our Terms of Service and this Privacy Policy, this Privacy Policy controls with respect to the collection, processing, and disclosure of your personal data.

1. Personal Data We Collect or Process

"Personal data" means any information relating to an identified or identifiable individual. It does not include anonymised data. We collect only the personal data that is adequate, relevant, and limited to what is necessary for the purposes described in this policy. Depending on how you interact with our Services, we process the following categories of personal data:

Sources of Personal Data: We collect data directly from you (when creating an account, subscribing, or placing an order), automatically through cookies and device technologies (subject to your cookie preferences), from our technology service providers, and from business or marketing partners where you have agreed to this.

2. How We Use Your Data & Our Lawful Bases

Under UK GDPR, we must have a lawful basis for each way we use your personal data. We rely on the following:

• Performance of a Contract: Processing payments, fulfilling orders, managing your account, arranging delivery across the UK, processing returns and exchanges, and providing customer service.
• Consent: Sending marketing emails and SMS messages, and placing non-essential cookies (such as analytics and advertising cookies), in line with PECR. You may withdraw your consent at any time.
• Legitimate Interests: Personalising product and style recommendations, improving our website, preventing fraud, securing our systems, and sending marketing about similar products to existing customers (the "soft opt-in"), always with an easy way to opt out. We balance these interests against your rights and freedoms.
• Legal Obligation: Keeping financial and tax records as required by HMRC, responding to lawful requests from public authorities, and complying with consumer protection law.

Automated Decision-Making: We do not make decisions that produce legal or similarly significant effects about you based solely on automated processing, other than routine automated fraud screening at checkout, which you may ask to have reviewed by a person.

3. Sharing Your Personal Data & Shopify Relationship

We share personal data with third parties only where necessary, including data processors acting on our behalf (IT management, payment processors, analytics, customer service, and delivery partners such as Royal Mail and couriers), business marketing partners where you have consented, affiliated companies, or in connection with a business transaction such as a merger or sale of assets. All processors are bound by written contracts requiring them to protect your data and use it only on our instructions. We do not sell your personal data.

Relationship with Shopify: Our store is hosted on Shopify. Shopify collects and processes personal data regarding your access to and use of the Services to support our storefront and provide enhanced e-commerce features. Shopify may process information obtained across multiple merchants to improve its services. For details on how Shopify manages data, review the Shopify Consumer Privacy Policy.

4. Your Data Protection Rights

Under UK GDPR, you have the following rights regarding your personal data:

• Right of Access: Request a copy of the personal data we hold about you (a "subject access request").
• Right to Rectification: Ask us to correct inaccurate or complete incomplete personal data.
• Right to Erasure: Ask us to delete your personal data in certain circumstances (the "right to be forgotten").
• Right to Restrict Processing: Ask us to limit how we use your personal data in certain circumstances.
• Right to Data Portability: Receive your personal data in a structured, commonly used, machine-readable format, or ask us to transfer it to another organisation.
• Right to Object: Object to processing based on legitimate interests, and object at any time to direct marketing.
• Right to Withdraw Consent: Where we rely on consent, withdraw it at any time without affecting the lawfulness of processing before withdrawal.
• Marketing Opt-Out: Unsubscribe from marketing emails at any time via the link at the bottom of our emails, or reply STOP to any SMS.

To exercise any of these rights, email us at info@sterling-hayes.com. We will respond within one month of receiving your request, which may be extended by a further two months for complex requests. There is usually no fee, and we may need to verify your identity before responding.

Right to Complain: If you are unhappy with how we handle your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's data protection regulator, at ico.org.uk or by calling 0303 123 1113. We would, however, appreciate the chance to address your concerns first.

5. Cookies & Similar Technologies

We use strictly necessary cookies to operate our store (for example, to keep items in your basket and secure checkout). In accordance with PECR, we only place non-essential cookies, such as analytics, personalisation, and advertising cookies, with your consent, which you can give or refuse through our cookie banner. You can change your cookie preferences at any time through the cookie settings link on our website or your browser settings; disabling certain cookies may affect site functionality.

6. Security, Retention & International Data Transfers

Security: We use appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or misuse. However, no transmission over the internet can be guaranteed as completely secure. Where a personal data breach is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours and inform you without undue delay where required.

Retention: We keep personal data only for as long as necessary for the purposes for which it was collected. Order and financial records are retained for six years to meet HMRC and legal requirements. Account data is kept while your account is active, and marketing data until you unsubscribe. After this, data is securely deleted or anonymised.

Children's Privacy: Our Services are intended for adults aged 18 and over and are not directed at children. We do not knowingly collect personal data from children under 13. If you believe a child has provided us with personal data, please contact us so we can delete it.

International Transfers: Some of our service providers (including Shopify and payment processors) may process personal data outside the UK. Where this happens, we ensure an appropriate safeguard is in place, such as a UK adequacy regulation, the International Data Transfer Agreement (IDTA), or the UK Addendum to the EU Standard Contractual Clauses.

7. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or the law. Updates will be posted on this page with a revised "Last Updated" date, and where changes are significant, we will notify you by email or through our website.

Data Controller Profile & Contacts