Privacy Policy

Ashford & Main — United States & Canada Privacy Terms | Effective Date: September 2026

This Privacy Policy describes how Ashford & Main, commercially operated by UK-registered entity FF COMMERCE LTD ("we", "us", "our"), collects, uses, discloses, and protects your personal information when you visit, browse, make a purchase, or communicate with us on ashfordandmain.com (the "Services").

Our e-commerce store is hosted on Shopify, which provides us with a secure, PCI-DSS compliant platform to sell our products to customers in the United States and Canada. We process personal information in strict compliance with applicable North American privacy frameworks, including Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA), Quebec’s Law 25, the California Consumer Privacy Act as amended by the CPRA (CCPA/CPRA), and applicable US state-level privacy statutes.

1. Personal Information We Collect or Process

When we refer to "personal information," we mean any information that identifies, relates to, describes, or can reasonably be linked to an individual consumer or household. Depending on how you interact with our store, we collect and process the following categories:

2. Sources of Personal Information

• Directly from You: When you create an account, place an order, sign up for communications, or contact customer support.
• Automatically via Technology: When you visit or navigate our website, through cookies, log files, web beacons, and similar tracking mechanisms.
• From Third-Party Service Providers: Including payment processors, fraud analytics services, shipping carriers, and marketing partners.

3. How We Use Your Personal Information

We collect and use your personal information for legitimate operational and business purposes, including:

• Service Delivery & Order Fulfillment: Processing transactions, fulfilling orders, calculating shipping/taxes, arranging deliveries, and facilitating returns or exchanges.
• Customer Communication & Support: Sending order updates, responding to inquiries, and managing account settings.
• Marketing & Targeted Advertising: Sending promotional emails or SMS notifications (where permitted by law or explicitly consented to) and displaying interest-based advertisements across platforms.
• Security & Fraud Prevention: Authenticating accounts, verifying checkout transactions, detecting malicious activity, and securing platform functionality.
• Legal & Regulatory Obligations: Complying with applicable laws, respond to lawful subpoenas or court orders, and enforcing our store policies.

4. How We Disclose Data & Relationship with Shopify

Third-Party Vendors: We share personal information with third-party vendors who perform critical services on our behalf (e.g., IT infrastructure, cloud hosting, payment gateways, analytics, and fulfillment logistics). We do not sell your personal information for monetary compensation.

Hosted on Shopify: Our store is hosted on Shopify Inc. Shopify processes data to maintain store reliability, optimize performance, and prevent fraud. To review how Shopify handles consumer data, visit the Shopify Consumer Privacy Policy.

5. Cross-Border & International Data Transfers

As a global e-commerce operation based in the United Kingdom with international fulfillment infrastructure, your personal information may be transferred to, stored, or processed outside of your home state or province (including in the United States, Canada, the United Kingdom, or Asia). When cross-border data transfers occur, we implement contractual safeguards to ensure your information remains protected under applicable PIPEDA, Law 25, and US privacy standards.

6. Your Rights & Choices (US State & Canadian Residents)

Depending on your state or province of residence (including under PIPEDA, Quebec Law 25, CCPA/CPRA, and US state privacy laws), you may hold the following statutory privacy rights:

• Right to Access / Know: Request confirmation of processing and access to the personal information we hold about you.
• Right to Rectification (Correct): Request correction of inaccurate or incomplete personal data.
• Right to Erasure (Delete): Request deletion of your personal data, subject to statutory retention requirements.
• Right to Data Portability: Request a copy of your personal information in a structured, machine-readable format.
• Right to Opt-Out of Targeted Advertising / Sharing: Opt out of the "sale" or "sharing" of personal data for cross-context behavioral advertising by emailing us or recognizing browser-based Global Privacy Control (GPC) signals.
• Withdrawal of Consent: Canadian residents may withdraw consent for data collection or marketing at any time, subject to legal limits.

To exercise any of these rights, please email our Data Privacy Officer at info@ashfordandmain.com. We will verify your identity before processing your request.

7. Security, Retention & Children's Privacy

Data Security & Retention: We employ administrative, physical, and technical safeguards to protect your personal data. Personal information is retained only as long as necessary to fulfill store operations, comply with tax/legal obligations, or resolve disputes.

Children's Data: Our Services are not directed to individuals under the age of majority in their jurisdiction (18 in most US states, 18/19 in Canadian provinces). We do not knowingly collect personal data from minors. If you believe a child has provided us with personal information, please contact us for immediate deletion.

Data Controller & Corporate Contact Information