Privacy Policy

Last Updated: June 23, 2026

At Barret & Blair (commercially operated by FF COMMERCE LTD, "we", "us", "our"), we are committed to protecting your personal information and handling it in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations (PECR).

This policy explains how we collect, use, and safeguard your personal data when you visit www.barretandblair.com, purchase our products, or interact with our customer services.

1. Who We Are (Data Controller)

FF COMMERCE LTD (trading as Barret & Blair) is the Data Controller responsible for processing your personal data. For any data protection inquiries, privacy requests, or statutory exercise of your rights, please reach out directly to our Privacy Team at info@barretandblair.com.

2. Information We Collect

Depending on your interactions with our store, we collect and process the following categories of personal information:

3. How We Use Your Information & Lawful Bases

We process your personal information under the following lawful bases set forth in Article 6 of the UK GDPR:

• Performance of a Contract: To process and fulfill your orders, arrange delivery, manage refunds/returns, and communicate about your transactions.
• Consent: To send marketing communications, newsletters, and special offers via email (you may withdraw your consent at any time).
• Legitimate Interests: To improve our storefront, enhance security, optimize user experience, and prevent fraudulent transactions.
• Legal Obligation: To comply with mandatory UK tax laws, accounting records, and statutory reporting requirements.

4. Sharing Data & International Transfers

Data Sharing: We do not sell your personal data. We share information strictly with essential service providers who support our storefront operations, including payment gateways, logistics carriers (Royal Mail, Evri, DPD), analytics providers, and email marketing platforms, or where required by law enforcement.

International Transfers: Where data is processed outside the United Kingdom (for instance, via global hosting infrastructure or technical partners), we ensure recognized UK GDPR transfer safeguards are applied, such as the UK International Data Transfer Agreement (IDTA) or Standard Contractual Clauses (SCCs).

5. Cookies & Data Retention

Cookies (PECR): We use cookies and tracking technologies to enable site functionality. In accordance with PECR, non-essential performance and advertising cookies are placed only with your explicit consent, which you can adjust at any time via your browser settings or our consent manager.

Data Retention: We retain your personal data only for as long as necessary to fulfill order requirements, resolve disputes, maintain account preferences, or satisfy legal accounting and tax retention periods.

6. Your Statutory Rights (UK GDPR)

Under UK data protection laws, you hold the following statutory rights regarding your personal information:

• Right of Access: Request a copy of the personal data we hold about you.
• Right to Rectification: Request correction of inaccurate or incomplete information.
• Right to Erasure ("Right to be Forgotten"): Request deletion of your personal data.
• Right to Restrict or Object: Limit or object to certain processing activities or direct marketing.
• Right to Data Portability: Request transfer of your data in a structured, electronic format.
• Withdraw Consent: Revoke consent for marketing processing at any time.

7. Security, Children & ICO Complaints

Data Security: We employ 256-bit SSL encryption, restricted access controls, and administrative safeguards to protect your personal details against unauthorized access, loss, or disclosure.

Children's Privacy: Our website is not intended for use by children under 13 years of age, and we do not knowingly collect personal data from minors.

Complaints & Regulatory Supervision: If you have privacy concerns, please contact us first at info@barretandblair.com. You also hold the right to lodge a formal complaint with the UK data protection supervisory authority: the Information Commissioner’s Office (ICO) at ico.org.uk.

Corporate Profile & Addresses