Some U.S. state privacy laws require us to inform residents about additional privacy disclosures and rights. This U.S. State-Specific Disclosure (“U.S. State-Specific Disclosure”) supplements the information contained in the Vitamin Cottage Natural Food Markets, Inc.’s (“Natural Grocers,” “we,” “us,” or “our”) Privacy Policy and applies solely to individuals who reside in the States of Connecticut, Colorado, Oregon, Montana, Texas, Utah, or Virginia (“consumers” or “you”).

As used in this U.S. State-Specific Disclosure, the term “personal data” (a) has the meaning provided under the Colorado Privacy Act (“CPA”); Connecticut Act Concerning Personal Data Privacy and Online Monitoring (“CTDPA”); Oregon Consumer Privacy Act (“OCPA”); Montana Consumer Data Privacy Act (“MCDPA”); Texas Data Privacy and Security Act (“TDPSA”); Utah Consumer Privacy Act (“UCPA”); and Virginia Consumer Data Protection Act (“VCDPA”); in each case, as such laws are amended from time to time (collectively, the “U.S. State Privacy Laws”). Any other capitalized but undefined terms shall have the meanings set forth in the Privacy Policy.

While we strive to manage various privacy laws consistently, some terms, obligations, and rights only apply or may be available to those who live in certain jurisdictions. Use of the term “right” in this U.S. State-Specific Disclosure is not intended to and shall not confer any legal rights or remedies on any person or party, and any such rights or remedies shall only exist to the extent expressly provided under applicable law.

If there is a conflict between provisions in this U.S. State-Specific Disclosure and the Privacy Policy, this U.S. State-Specific Disclosure governs with respect to the conflicting provisions.

Use the links below to toggle to each section. 
 

Collection and Use of Personal Data

We have collected the following categories of personal data from our consumers within the last 12 months, and will continue to collect such data in the future:

Data We Do Not Use

Profiling

We will not use your personal data for the purpose of profiling in furtherance of solely automated decisions that produce legal or similarly significant effects concerning the consumer.

Children

Please see the “Children’s Privacy” section of our Privacy Policy for more information on our data collection practices for children. 

Sensitive Data

We may collect your precise geolocation if you use our Mobile App and consent to our collection of that data. We may use that data to provide the product or services you request, to market to you, or for any other purpose that is disclosed at the time of collection.

Disclosure of Data

We may disclose your personal data to third parties. Please refer to our general Privacy Policy for more information on why we disclose your personal data to third parties and to which third parties we specifically disclose.

“Sale” or Use of Data for Targeted Advertising

Our use of automated tracking technologies may be considered a “sale” or targeted advertising under certain U.S. State Privacy Laws. Please refer to our general Privacy Policy for more information on automated tracking technologies.

The categories of personal data disclosed that may be considered a “sale” or targeted advertising include: Contact Information, Usage Data, Device Data, Precise Geolocation, and Behavioral Tracking.

The categories of third parties to whom personal data was disclosed that may be considered a “sale” or targeted advertising include: advertisers, marketers, and data analytics providers.

Under TDPSA, our use of your precise geolocation to market to you may be considered the “Sale” of your data. As such the following notice is required: NOTICE: We may sell your sensitive personal data.

Your Rights and Choices

U.S. State Privacy Laws provide you with specific rights regarding your personal data. This section describes your rights under U.S. State Privacy Laws and explains how to exercise those rights. Certain requirements must be met for you to exercise your rights; see below for more information on what requirements must be met and how to exercise said rights.

Consent

Conflict of Consent

If you opt out through a preference signal and such signal conflicts with your existing consent/preference given to us or is in conflict with your voluntary participation in our {N}Power Loyalty Program (“{N}power”), we will comply with the opt-out preference signal. Notwithstanding the foregoing, we may contact you to notify you of the conflict and give you the choice to confirm your preference as it relates to the existing consent.

Revocation

If you would like to revoke our right to process your personal data after you consented, you may change your preferences in the settings on your account or unsubscribe by clicking the unsubscribe button at the bottom of the marketing email you received. We will comply with your request as soon as is reasonably practical.

Opt-Out Rights

Targeted Advertising

If you would like to opt out of targeted advertising, you may click “Your Opt-Out Rights” (also found at the bottom of the page) or you may broadcast the Global Privacy Control signal through your web browser or device.

Sale of Your Data

We may exchange your personal data in a manner which may constitute a “sale” under certain U.S. State Privacy Laws. If you would like to opt out of the “sale” of your personal data, you may click “Your Opt-Out Rights” (also found at the bottom of the page) or you may broadcast the Global Privacy Control signal through your web browser or device; more information on Global Privacy Controls can be found here.

Access Rights

You have the right to request that we disclose certain information to you about our collection and use of your personal data. You may request the following:

• confirmation whether or not we are processing your personal data;
• access to your personal data that we process.

Once we receive a consumer request, we will provide confirmation/access to the applicable personal data. Please also see Data Portability Rights for how we may provide your personal data. 

Data Correction Rights

You have the right to request that we correct inaccuracies in your personal data, considering the nature of the personal data and the purposes of the processing of the personal data. Once we receive a consumer request, we will use commercially reasonable efforts to correct the inaccurate personal data.

Deletion Rights

You have the right to request that we delete any of your personal data that we collected from or obtained about you, subject to certain exceptions. Once we receive a consumer request, we will delete (and direct our service providers to delete) your personal data from our records to the extent required under U.S. State Privacy Laws.

Data Portability Rights

You have a right to request that we provide a portable copy of the personal data that you previously provided to us. Once we receive a consumer request, we will provide a copy of your personal data, to the extent reasonably and technically feasible, in a readily useable format to transmit the data to another business.

Exercising Your Rights

Only you (or to exercise an opt-out right, your authorized agent) may make a consumer request that we can verify (subsequently referred to as a “consumer request”) related to your personal data. You may also make a consumer request on behalf of your minor child or in the case of a guardianship or similar, you may exercise such rights on the ward’s behalf. The consumer request must:

• Provide sufficient information that allows us to reasonably verify that you are the person about whom we collected personal data or to identify an authorized agent and verify that the authorized agent has the authority to submit a request on your behalf.
• Describe the request with sufficient detail that allows us to properly understand, evaluate, and respond to it.

Once we receive a consumer request, we will take commercially reasonable actions to authenticate the identity of the person exercising the request, including comparing any such identification information provided against personal data requested. We authenticate a request by asking for the requestor’s name, phone number, physical address, and email. 
We cannot respond to your request or provide you with personal data if we cannot verify your identity or authority to make the request and confirm that the personal data relates to you.

Making a consumer request does not require you to create an account with us, but we may require authentication of the consumer that is reasonable considering the nature of the personal data requested.

To exercise the rights described above, please submit a consumer request to us by clicking this link and filling out the form.

Initial Request Format and Timing

We endeavor to respond to a consumer request within 45 days of its receipt. If we require more time (for a maximum total of 90 days), we will notify you within 45 days of receiving the initial consumer request that we require more time and will provide a reason for the delay. 

We do not charge a fee to process or respond to your consumer request unless the request is made more than the number of allotted times under the applicable U.S. State Privacy Law in a 12 month period. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing the request. 

If we determine that we will not act on a request, we will provide a response to you that includes the basis of our reasoning. If the reasoning is our inability to authenticate the request, we will explain the efforts we took to authenticate the request and why we were unable to do so.

Appeals Response Format and Timing

Under U.S. State Privacy Laws, you may have a right to appeal our decisions.

If we decide that we cannot comply with your initial consumer request, you may have a right to appeal our decision. Any appeal should be sent to the place where the initial consumer request was sent. The appeal should clearly indicate that it is an appeal of an initial consumer request, and should include the initial consumer request along with our response explaining why we cannot comply with the initial consumer request. 

If we decide that we cannot comply with a Colorado resident’s initial consumer request, that Colorado resident has a right to appeal our decision. We will review all appeals and provide a response within 45 days of receipt of the appeal. If we require more time (for a maximum total of 105 days), we will notify the Colorado resident within 45 days of receipt of the appeal that we require more time and will provide a reason for the delay. Once we respond, we will inform the Colorado resident of any action taken or not along with an explanation of the reason in support of the response. If a Colorado resident has any concerns about the results of an appeal, such Colorado resident may submit a complaint to the Colorado Attorney General, which can be found here: https://coag.gov/file-complaint/.

If we decide that we cannot comply with a Connecticut, Montana, Texas, or Virginia resident’s initial consumer request, that Connecticut, Montana, Texas, or Virginia resident has a right to appeal our decision. We will review all appeals and provide a response within 60 days of receiving the appeal, including the action taken or not and the justification for the action. If we cannot comply with a request after an appeal is made, Connecticut residents may submit a complaint to the Connecticut Attorney General, which can be found here: https://portal.ct.gov/AG/Common/Complaint-Form-Landing-page. If we cannot comply with a request after an appeal is made, Montana residents may submit a complaint to the Montana Attorney General, which can be found here: https://app.doj.mt.gov/OCPPortal/?q=node/395. If a Texas resident has any concerns about the results of an appeal, such Texas resident may submit a complaint to the Texas Attorney General, which can be found here: https://oag.my.salesforce-sites.com/CPDOnlineForm. If we cannot comply with a request after an appeal is made, Virginia residents may submit a complaint to the Virginia Attorney General, which can be found here: https://www.oag.state.va.us/consumer-protection/index.php/file-a-complaint.

If we decide that we cannot comply with an Oregon resident’s initial consumer request, that Oregon resident has a right to appeal our decision. We will review all appeals and provide a response within 45 days of receiving the appeal, including the action taken or not and the justification for the action. If we cannot comply with a request after an appeal is made, you have the right to contact the Oregon Attorney General, which can be found here: https://justice.oregon.gov/consumercomplaints/OnlineComplaints/OnlineComplaintForm/en.

Bona Fide Rewards Program

We offer our customers a rewards program (“{N}power”) that provides certain perks, such as freebies. We may also offer you promotional campaigns such as sweepstakes or contests (“Promotional Offers”). When you sign up for {N}power or Promotional Offers, we typically ask that you provide email, phone number, preferred store, and collect log data associated with your IP address as well as any data that may be specific to the Promotional Offers. You should review the terms and conditions of {N}power or the Promotional Offers to view the full details of such rewards program or Promotional Offer. You may also withdraw from {N}power and/or a Promotional Offer at any time by contacting us using the contact information below.

The categories of personal data we collect through {N}power that we may sell or process for targeted advertising is: 

• name, 
• email, 
• phone number,
• associated purchase information, 
• transactional history, and 
• preferred store

We share some of your personal data with our service providers, including our vendors who assist in the administration of the {N}power program, solely to provide the services and benefits of {N}power.

You understand that the exercise of certain of your rights set forth in the Exercising Your Rights section above may impact our ability to provide you with the benefits of the {N}power Rewards Program. Please see the {N}power terms for more information.

Changes to Our U.S. State-Specific Disclosure

From time to time, we may update this U.S. State-Specific Disclosure. If our information practices change at some time in the future, we will notify you of these changes, and we will only use data collected from the time of the U.S. State-Specific Disclosure change forward for these new or different purposes. If there is a material change to this U.S. State-Specific Disclosure, we will notify you through the means we regularly use to communicate with you. The date this U.S. State-Specific Disclosure was last updated is at the top of this page. You are responsible for periodically reviewing the Offerings and this U.S. State-Specific Disclosure to check for any updates or changes.

Contact Us

If you have any questions or comments about this U.S. State-Specific Disclosure, the ways in which Natural Grocers collects and uses your data described here and in the general Privacy Policy, your choices and rights regarding such use, or if you wish to exercise your rights under U.S. State Privacy Laws, please do not hesitate to contact us. You may also reach us by mail at:

Vitamin Cottage Natural Food Markets, Inc.
Attn: General Counsel
12612 West Alameda Parkway
Lakewood, Colorado 80228