This privacy policy for Colorado residents (this “CO Privacy Policy”) supplements the information contained in the Vitamin Cottage Natural Food Markets, Inc.’s (“Natural Grocers,” “we,” or “us”) general Privacy Policy and applies solely to all visitors, users, and others who reside in the State of Colorado (“consumers” or “you”). We adopt this CO Privacy Policy to comply with applicable Colorado law, including the Colorado Privacy Act, as amended from time to time (hereinafter “CPA”) and any terms defined in the CPA have the same meaning when used in this CO Privacy Policy. Any other capitalized but undefined terms shall have the meanings set forth in the general Privacy Policy.

Please note that, as used in this CO Privacy Policy, “Personal Data” means information that is linked or reasonably linkable to an identified or identifiable individual. Personal Data does not include de-identified data, publicly available information, or data that is not governed by the CPA.

Use the links below to toggle to each section.

Collection and Use of Personal Data

We have collected the following categories of Personal Data from our consumers within the last 12 months and will continue to collect such information in the future:

We will not use your Personal Data for the purpose of profiling in furtherance of solely automated decisions that produce legal or similarly significant effects concerning the consumer.

Disclosure of Information

We may disclose your Personal Data to third parties. Please refer to our general Privacy Policy for more information on how we disclose your Personal Data to third parties and to which third parties we specifically disclose.

“Sale” or Use of Information for Targeted Advertising

Our use of automated tracking technologies may be considered a “sale” or targeted advertising under the CPA. Please refer to our general Privacy Policy for more information on automated tracking technologies.

The categories of Personal Data disclosed that may be considered a “sale” or targeted advertising include: Contact Information and Non-Personal Information/Automated Information.

The categories of third parties to whom Personal Data was disclosed that may be considered a “sale” or targeted advertising include: advertisers, marketers, data analytics providers, and payment or financial providers.

Rights and Choices of Colorado Residents

The CPA provides Colorado residents with specific rights regarding their Personal Data. This section describes the rights of Colorado residents under the CPA and explains how to exercise those rights. Certain requirements must be met for a Colorado resident to exercise their rights; see below for more information on what requirements must be met and how to exercise said rights.

Consent

Conflict of Consent

If you opt out through a preference signal and such signal conflicts with your existing consent/preference given to us or is in conflict with your voluntary participation in our {N}Power Loyalty Program, we will comply with the opt-out preference signal. Notwithstanding the foregoing, we may contact you to notify you of the conflict and give you the choice to confirm your preference as it relates to the existing consent.

Revocation

If you would like to revoke our right to process your Personal Data after you consented, you may change your preferences in the settings on your account or unsubscribe by clicking the unsubscribe button at the bottom of the marketing email you received. We will comply with your request as soon as is reasonably practical.

Opt-Out Rights

Targeted Advertising

If you would like to opt out of targeted advertising, you may click “Your Opt-Out Rights” (also found at the bottom of the page).

Sale of Your Information

We may exchange your Personal Data in a manner in which may constitute a “sale” under the CPA. If you would like to opt out of the “sale” of your Personal Data you may click “Your Opt-Out Rights” (also found at the bottom of the page).

Access Rights

Colorado residents have the right to request that we disclose certain information to you about our collection and use of your Personal Data. You may request the following:

• confirmation whether or not we are processing your Personal Data;
• access to your Personal Data that we process.

Once we receive and confirm a consumer request, we will provide confirmation/access to the applicable Personal Data. Please also see Data Portability Rights for how we may provide your information. 

Data Correction Rights

Colorado residents have the right to request that we correct inaccuracies in their Personal Data, considering the nature of the Personal Data and the purposes of the processing of the Personal Data. Once we receive and confirm a consumer request, we will use commercially reasonable efforts to correct the inaccurate Personal Data.

Deletion Rights

Colorado residents have the right to request that we delete any of their Personal Data that we collected from or obtained about them, subject to certain exceptions. Once we receive and confirm a consumer request, we will delete (and direct our service providers to delete) their Personal Data from our records if and to the extent required by the CPA.

Data Portability Rights

Colorado residents have a right to request that we provide a portable copy of the Personal Data that the resident previously provided to us. Once we receive and confirm a valid consumer request, we will provide a copy of your Personal Data, to the extent reasonably and technically feasible, in a readily useable format to transmit the data to another business.

Exercising Your Rights

Only Colorado residents (or to exercise an opt-out right, their authorized agent) may make a verifiable consumer request related to a Colorado resident’s Personal Data. A Colorado resident may also make a verifiable consumer request on behalf of their minor child or in the case of a guardianship or similar, the guardian may exercise such rights on a Colorado resident’s behalf. The verifiable consumer request must:

• Provide sufficient information that allows us to reasonably verify that the Colorado resident is the person about whom we collected Personal Data or to identify an authorized agent and verify that the authorized agent has the authority to submit a request on behalf of a Colorado resident.
• Describe the request with sufficient detail that allows us to properly understand, evaluate, and respond to it.

Each of the foregoing requests are individually and collectively are referred to as a “consumer request.”

Once we receive a consumer request, we will take commercially reasonable actions to authenticate the identity of the person exercising the request, including comparing any such identification information you have provided against Personal Data we have about you. We authenticate a request by asking for the requestors name, phone number, physical address, and email.

We cannot respond to your request or provide you with Personal Data if we cannot verify your identity or authority to make the request and confirm the Personal Data relates to that Colorado resident.

Making a verifiable consumer request does not require a Colorado resident to create an account with us, but we may require authentication of the consumer that is reasonable considering the nature of the Personal Data requested.

To exercise the rights described above, please submit a verifiable consumer request to us by clicking this link and filling out the form.

Initial Request Format and Timing

We endeavor to respond to a verifiable consumer request within 45 days of its receipt. If we require more time (for a maximum total of 90 days), we will notify you within 45 days of receiving the request that we require more time and provide a reason for the delay. Any disclosures we provide will only cover the 12‑month period preceding the receipt of a verifiable consumer request. 

We do not charge a fee to process or respond to a Colorado resident’s consumer request unless the request is made more than once in a 12‑month period. If we determine that the request warrants a fee, we will tell the Colorado resident why we made that decision and provide them with a cost estimate before completing the request.

If we determine that we will not act on a request, we will provide a response to you that includes the basis of our reasoning. If the reasoning is our inability to authenticate the request, we will explain the efforts we took to authenticate the request and why we were unable to do so.

Appeals Response Format and Timing

If we decide that we cannot comply with a Colorado resident’s initial request, that Colorado resident has a right to appeal our decision. Any appeal should be sent to the place where the initial request was sent. The appeal should clearly indicate that it is an appeal of an initial request, and should include the initial request along with our response explaining why we cannot comply with the request. We will review all appeals and provide a response within 45 days of receipt of the appeal. If we require more time (for a maximum total of 105 days), we will notify the Colorado resident within 45 days of receipt of the appeal that we require more time and provide a reason for the delay. Once we respond, we will inform the Colorado resident of any action taken or not along with an explanation of the reason in support of the response. If we cannot comply with a request after an appeal is made, Colorado residents may submit a complaint to the Colorado Attorney General, which can be found here: https://coag.gov/file-complaint/.

Bona Fide Loyalty Program

We offer our customers a loyalty program (“{N}power”) that provides certain perks, such as freebies. We may also offer you promotional campaigns such as sweepstakes or contests (“Promotional Offers”). When you sign up for {N}power or Promotional Offers, we typically ask that you provide email, phone number, preferred store, and collect log data associated with your IP address as well as any information that may be specific to the Promotional Offers. You should review the terms and conditions of {N}power or the Promotional Offers to view the full details of such loyalty program or Promotional Offer. You may also withdraw from {N}power and/or a Promotional Offer at any time by contacting us using the contact information below.

The categories of Personal Data we collect through {N}power that we may sell or process for targeted advertising is: name, email, associated purchase information, transactional history, and preferred store.

We do share some of your Personal Data with our service providers, including our vendors who assist in the administration of the {N}power program, solely to provide the services and benefits of {N}power.

You understand that the exercise of certain of your rights set forth in the “Exercising Your Rights” section above may impact our ability to provide you with the benefits of the {N}power program. Please see the {N}power terms for more information.

Changes to Our CO Privacy Policy

From time to time, we may update this CO Privacy Policy. If our information practices change at some time in the future, we will notify you of these changes, and we will only use data collected from the time of the CO Privacy Policy change forward for these new or different purposes. In the event we make a material change to how we use your Personal Data, we will notify you and provide you with an opportunity to opt out of such new or different use. The date this CO Privacy Policy was last updated is at the top of this page. You are responsible for periodically reviewing the Offerings and this CO Privacy Policy to check for any updates or changes.

Contact Information

If you have any questions or comments about this CO Privacy Policy, the ways in which Natural Grocers collects and uses your information described here and in the general Privacy Policy, your choices and rights regarding such use, or wish to exercise your rights under Colorado law, please do not hesitate to contact us You may also reach us by mail at:

Vitamin Cottage Natural Food Markets, Inc.
Attn: General Counsel
12612 West Alameda Parkway
Lakewood, Colorado 80226