Privacy Policy

Last Updated: September 5, 2026

Calloway & James (operated by FF COMMERCE LTD, "we," "us," or "our") operates this store and website, including all related information, content, features, tools, products, and services, to provide you with a curated e-commerce experience (the "Services"). Our storefront is powered by Shopify, which enables us to deliver secure online commerce to you.

This Privacy Policy describes how we collect, use, and disclose your personal data when you visit, use, or make a purchase from callowayandjames.com or otherwise communicate with us. It has been prepared in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations 2003 (PECR). FF COMMERCE LTD is the data controller responsible for your personal data. If there is a conflict between our Terms of Service and this Privacy Policy, this Privacy Policy controls with respect to the collection, processing, and disclosure of your personal data.

1. Personal Information We Collect or Process

When we refer to "personal data," we mean any information relating to an identified or identifiable individual. Personal data does not include anonymised data. We only collect data that is adequate, relevant, and limited to what is necessary. Depending on how you interact with our Services, we collect and process the following categories of personal data:

Sources of Personal Information: We collect data directly from you (when creating an account or placing an order), automatically through cookies and device tracking (subject to your cookie preferences), from our technology service providers, and from business or marketing partners where you have agreed to this.

2. How We Use Your Personal Information

• Provide, Tailor, and Improve Services (lawful basis: performance of a contract): Fulfilling contracts, processing payments, executing orders, managing account credentials, arranging delivery across the UK, processing returns/exchanges, enabling product reviews, and personalising product recommendations.
• Marketing and Advertising (lawful basis: consent): Sending marketing emails and SMS messages only with your consent, or to existing customers about similar products under the PECR "soft opt-in" with an easy way to unsubscribe, and displaying tailored online advertisements based on your shopping activity where you have accepted advertising cookies.
• Security and Fraud Prevention (lawful basis: legitimate interests): Authenticating user accounts, securing checkout sessions, detecting and investigating fraudulent or illegal activity, and protecting public and system safety.
• Customer Communication (lawful basis: performance of a contract): Delivering responsive support, providing order status updates, and maintaining our business relationship with you.
• Legal Compliance (lawful basis: legal obligation): Complying with applicable laws, including keeping financial records as required by HMRC, responding to lawful requests from public authorities, and enforcing our site policies.

3. Disclosure of Personal Information & Shopify Relationship

We disclose personal data to third parties for legitimate operational purposes, including data processors acting on our behalf (IT management, payment processors, analytics, customer support, and delivery partners such as Royal Mail and DPD), business marketing partners where you have consented, affiliated corporate entities, or in connection with corporate transactions such as mergers or asset sales. All processors are bound by written contracts requiring them to protect your data. We do not sell your personal data.

Relationship with Shopify: Our store is hosted on Shopify. Shopify collects and processes personal data regarding your access to and use of the Services to support our storefront and provide enhanced e-commerce features. Shopify may process information obtained across multiple merchants to improve its services. For details on how Shopify manages data, review the Shopify Consumer Privacy Policy.

4. Your Privacy Rights & Choices

Under UK GDPR, you have the following rights regarding your personal data:

• Right of Access: Request a copy of the personal data we hold about you (a "subject access request").
• Right to Erasure: Request the deletion of your personal data in certain circumstances (the "right to be forgotten").
• Right to Rectification: Request correction of inaccurate or incomplete personal data.
• Right to Data Portability & Restriction: Receive your data in a structured, machine-readable format, or ask us to restrict how we use it.
• Right to Object & Withdraw Consent: Object to processing based on legitimate interests, object to direct marketing at any time, and withdraw any consent you have given.
• Communication Opt-Out: Unsubscribe from marketing emails anytime via the link displayed at the bottom of our emails, or reply STOP to any SMS.

Cookies & Complaints: In line with PECR, we only place non-essential cookies (such as analytics and advertising cookies) with your consent through our cookie banner, and you can change your preferences at any time. To exercise any privacy rights, email us at info@callowayandjames.com. We will respond within one month and there is usually no fee. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO). We will not discriminate against you for exercising your privacy rights.

5. Security, Retention & International Data Transfers

Security & Retention: While we employ appropriate technical and organisational security measures, no transmission over the internet can be guaranteed as completely secure. Where a personal data breach is likely to put your rights at risk, we will notify the ICO within 72 hours and inform you where required. We retain personal data only for as long as necessary, with order and financial records kept for six years to meet HMRC requirements.

Children's Privacy: Our Services are intended for adults aged 18 and over, and we do not knowingly collect personal data from children under 13 years of age.

International Transfers: Personal data may be transferred, stored, and processed outside the UK by our service providers. When this occurs, we rely on recognised safeguards, such as UK adequacy regulations, the International Data Transfer Agreement (IDTA), or the UK Addendum to the EU Standard Contractual Clauses.

Data Controller Profile & Contacts