Privacy policy
This Privacy Policy explains how Jamota, operated by Nuvela Group LLC, collects, uses, stores, and shares your personal data when you visit or make a purchase at jamota. We are committed to protecting your personal data and processing it in accordance with applicable data protection laws, including the General Data Protection Regulation (GDPR), the UK Data Protection Act 2018, and the California Consumer Privacy Act (CCPA/CPRA).
Data controller
The data controller responsible for your personal data is:
Legal entity: Nuvela Group LLC, trading as Jamota
Address: 1500 N Grant St, STE B, Denver, CO 80203, United States
Email: support@jamota.com
Phone: +1 (339) 800-8572,
Monday to Friday: 9:00 AM to 5:00 PM (MST)
As data controller, we determine the purposes and means of processing your personal data. If you have any questions about how we handle your personal data or wish to exercise your data protection rights, please contact us at the details above.
Personal Data
What personal data we collect
We collect and process the following categories of personal data:
Identity and contact data: your name, email address, phone number, and billing and delivery address when you place an order or create an account.
Transaction data: details of the products you purchase, order history, payment method type (not full card numbers), and transaction amounts.
Technical and usage data: your IP address, browser type and version, device type, pages visited, time spent on pages, referring URLs, and other information about how you interact with our website. This data is collected automatically via cookies and similar technologies.
Communications data: messages, emails, or other correspondence you send us, including customer service enquiries.
Marketing preferences: your preferences regarding receiving marketing communications from us.
We do not collect or process any special categories of personal data (also known as sensitive personal data), such as health information, racial or ethnic origin, religious beliefs, or biometric data.
Legal basis for processing personal data
Under GDPR and applicable data protection law, we must have a lawful legal basis for processing your personal data. We rely on the following legal bases:
Contract performance: processing your personal data is necessary to fulfil your order, process payment, arrange delivery, and manage your account.
Legitimate interests: we process certain personal data for our legitimate business interests, such as preventing fraud, improving our website, and understanding how customers use our store. We only rely on this basis where our interests are not overridden by your rights.
Consent: where you have given us clear consent to send you marketing communications. You may withdraw consent at any time.
Legal obligation: processing is necessary to comply with applicable legal requirements, such as tax and accounting obligations.
How we use your personal data
We use the personal data we collect for the following purposes: to process and fulfil your orders including sending order confirmations and shipping notifications; to manage your account and respond to your enquiries; to send you marketing emails where you have opted in, with an unsubscribe option in every email; to improve our website and customer experience using anonymised analytics data; to detect and prevent fraud and unauthorised access; and to comply with our legal and regulatory obligations.
We do not use your personal data to make solely automated decisions that have a significant effect on you.
Data protection
We take data protection seriously and implement appropriate technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, or damage. Our website uses HTTPS encryption for all data in transit. Checkout is hosted on Shopify's infrastructure, which is certified to PCI DSS Level 1 — the highest level of payment card data security. Access to personal data within our organisation is restricted to those who need it to perform their job functions.
Despite these measures, no method of transmission over the internet or electronic storage is completely secure. If you have reason to believe your interaction with us is no longer secure, please contact us immediately at support@jamota.com.
Who we share your personal data with
We do not sell your personal data. We share personal data only with the following categories of recipients where necessary:
Shopify Inc.: our e-commerce platform provider, which hosts our store and processes payments. Shopify acts as a data processor on our behalf. See shopify.com/legal/privacy.
Shipping carriers: USPS, UPS, DHL, Fedex receive your name and delivery address to fulfil your order.
Payment processors: Shopify Payments, PayPal, Apple Pay, Google Pay, and Shop Pay process your payment. They handle card data directly and are independently PCI DSS certified.
Email service providers: we use third-party platforms to send order confirmation and marketing emails.
Analytics providers: anonymised browsing data is shared with analytics platforms to help us understand website usage.
Advertising platforms: we may share hashed or anonymised identifiers with platforms such as Google and Meta to show relevant advertising. You can opt out via your account settings or your browser.
Legal authorities: we may disclose personal data when required by law or to protect the rights and safety of our users.
All third parties we work with are required to process your personal data only as instructed by us and in accordance with applicable data protection law.
International transfers of personal data
Jamota is based in the United States. If you are located in the European Economic Area (EEA), the United Kingdom, or another jurisdiction with data protection laws, your personal data will be transferred to and processed in the United States. We ensure that any such transfer of personal data is subject to appropriate safeguards as required by applicable data protection law, including the use of European Commission Standard Contractual Clauses where required under GDPR.
How long we keep your personal data
We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, including to satisfy legal, accounting, or reporting requirements. Order and transaction data is retained for a minimum of 7 years to comply with US tax and financial record-keeping obligations. Account data is retained for as long as your account is active. Marketing preference data is retained until you unsubscribe or ask us to delete it. We securely delete or anonymise personal data when it is no longer needed.
Cookies and tracking technologies
We use cookies and similar tracking technologies on jamota.com. Cookies are small data files placed on your device that help us keep your shopping cart active, remember your preferences, understand how you use the site, and show you relevant advertising. You can control cookie settings through your browser. Disabling certain cookies may affect how parts of the website function. For more details, please see our Cookie Policy or the cookie consent banner on our website.
Your data protection rights
Depending on your location, you have the following rights regarding your personal data:
Right of access: you may request a copy of the personal data we hold about you.
Right to rectification: you may ask us to correct inaccurate or incomplete personal data.
Right to erasure: you may ask us to delete your personal data in certain circumstances (also known as the right to be forgotten).
Right to restrict processing: you may ask us to limit how we use your personal data in certain circumstances.
Right to data portability: you may request a machine-readable copy of your personal data to transfer to another service.
Right to object: you may object to processing based on legitimate interests or for direct marketing purposes.
Right to withdraw consent: where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
EU and UK residents may also lodge a complaint with their local data protection supervisory authority. In the UK this is the Information Commissioner's Office (ico.org.uk). In Ireland it is the Data Protection Commission (dataprotection.ie). In other EU member states, contact the relevant national supervisory authority.
California residents have additional rights under the CCPA/CPRA, including the right to know what personal data we collect, the right to opt out of the sale or sharing of personal data, and the right to non-discrimination for exercising these rights. To opt out of the sharing of your personal data for targeted advertising, visit jamota.com/pages/do-not-sell-my-data or email support@jamota.com with the subject "CCPA Opt Out".
To exercise any of these rights, please contact us at support@jamota.com, we will respond within 30 days. We may need to verify your identity before processing your request.
Children's personal data
Our store is not directed at children under the age of 13 and we do not knowingly collect personal data from children. If you believe we have inadvertently collected personal data from a child, please contact us at support@jamota.com and we will delete it promptly.
Third-party links
Our website may contain links to third-party websites. This Privacy Policy does not apply to those websites. We are not responsible for their data protection practices and recommend you read their privacy policies before providing any personal data.
Changes to this Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or applicable data protection law. The updated date at the top of this page will always reflect when the policy was last revised. We will notify you of material changes by email or by a prominent notice on our website. Continued use of jamota.com after changes are posted constitutes acceptance of the updated policy.
Contact and data protection enquiries
For any questions, concerns, or requests relating to this Privacy Policy or your personal data, please contact us:
Email: support@jamota.com — Subject: Privacy / Data Protection
Business Address
1500 N Grant St, STE B
Denver, CO 80203
United States
Customer Support
Phone: +1 (339) 800-8572
Email: support@jamota.com
Customer Service Hours: Mountain Standard Time - Denver (MST)
Monday – Friday: 9:00 AM – 5:00 PM
Saturday – Sunday: 11:00 AM – 4:00 PM