Privacy Policy

Last Updated: September 5, 2026

Sutton Hayes (operated by FF COMMERCE LTD, "we," "us," or "our") operates this store and website, including all related information, content, features, tools, products, and services, to provide you with a curated e-commerce experience (the "Services"). Our storefront is powered by Shopify, which enables us to deliver secure online commerce to you.

This Privacy Policy describes how we collect, use, and disclose your personal information when you visit, use, or make a purchase from suttonhayes.com or otherwise communicate with us. It has been prepared in accordance with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), applicable provincial privacy laws including Quebec's Law 25, and Canada's Anti-Spam Legislation (CASL). By using our Services, you consent to the practices described in this policy. If there is a conflict between our Terms of Service and this Privacy Policy, this Privacy Policy controls with respect to the collection, processing, and disclosure of your personal information.

1. Personal Information We Collect or Process

When we refer to "personal information," we mean information about an identifiable individual. Personal information does not include anonymous or de-identified data. We collect only the information reasonably necessary for the purposes identified in this policy. Depending on how you interact with our Services, we collect and process the following categories of personal information:

Sources of Personal Information: We collect data directly from you (when creating an account or placing an order), automatically through cookies and device tracking, from our technology service providers, and from business or marketing partners where you have consented to such sharing.

2. How We Use Your Personal Information

• Provide, Tailor, and Improve Services: Fulfilling contracts, processing payments, executing orders, managing account credentials, arranging shipping across Canada, processing returns/exchanges, enabling product reviews, and personalizing product recommendations.
• Marketing and Advertising: Sending commercial electronic messages by email or SMS only with your express or implied consent as required by CASL, with an unsubscribe option in every message, and displaying tailored online advertisements on our site or third-party platforms based on your shopping activity.
• Security and Fraud Prevention: Authenticating user accounts, securing checkout sessions, detecting and investigating fraudulent or illegal activity, and protecting public and system safety.
• Customer Communication: Delivering responsive support, providing order status updates, and maintaining our business relationship with you.
• Legal Compliance: Complying with applicable Canadian laws, responding to lawful requests from government authorities, participating in legal proceedings, and enforcing our site policies.

3. Disclosure of Personal Information & Shopify Relationship

We disclose personal information to third parties for legitimate operational purposes, including service providers (IT management, payment processors, analytics, customer support, and shipping partners such as Canada Post and Purolator), business marketing partners with your consent, affiliated corporate entities, or in connection with corporate transactions such as mergers or asset sales. Our service providers are contractually required to protect your information with safeguards comparable to our own. We do not sell your personal information.

Relationship with Shopify: Our store is hosted on Shopify Inc., a Canadian company headquartered in Ottawa, Ontario. Shopify collects and processes personal information regarding your access to and use of the Services to support our storefront and provide enhanced e-commerce features. Shopify may process information obtained across multiple merchants to improve its services. For details on how Shopify manages data, review the Shopify Consumer Privacy Policy.

4. Your Privacy Rights & Choices

Under PIPEDA and applicable provincial privacy laws, you have the following rights regarding your personal information:

• Right to Access: Request access to the personal information we hold about you and information about how it has been used and disclosed.
• Right to Correction: Challenge the accuracy and completeness of your personal information and have it amended as appropriate.
• Right to Withdraw Consent: Withdraw your consent to the collection, use, or disclosure of your personal information at any time, subject to legal or contractual restrictions and reasonable notice.
• Right to Deletion & Data Portability (Quebec residents): Request that we delete your personal information where its use is no longer necessary, or receive a copy of computerized personal information in a structured, commonly used format.
• Right to Complain: File a complaint with the Office of the Privacy Commissioner of Canada or, where applicable, your provincial privacy regulator (such as the Commission d'accès à l'information du Québec).
• Communication Opt-Out: Unsubscribe from marketing emails anytime via the link displayed at the bottom of our emails; unsubscribe requests are processed within 10 business days, as required by CASL.

Cookies & Privacy Requests: Where required by law, we obtain your consent before placing non-essential cookies, and you can manage your preferences through our cookie banner or browser settings. To exercise any privacy rights, email our Privacy Officer at info@suttonhayes.com. We will respond within 30 days, as required by law, and may need to verify your identity. We will not discriminate against you for exercising your privacy rights.

5. Security, Retention & International Data Transfers

Security & Retention: While we employ industry-standard physical, organizational, and technological security measures, no transmission over the internet can be guaranteed as completely secure. In the event of a breach of security safeguards that creates a real risk of significant harm, we will notify you and the Office of the Privacy Commissioner of Canada as required by law. We retain personal information only for as long as necessary to maintain accounts, satisfy contractual obligations, or comply with legal and tax record-keeping requirements.

Children's Privacy: Our Services are not intended for individuals under the age of majority in their province or territory of residence, and we do not knowingly collect personal information from minors.

International Transfers: As our operating company is based in the United Kingdom and some service providers operate outside Canada (including in the United States), your personal information may be transferred, stored, and processed outside Canada. While there, it may be accessible to the courts, law enforcement, and national security authorities of those jurisdictions. We use contractual and other measures to provide a comparable level of protection.

Data Controller Profile & Contacts