Privacy policy

Last updated: 19 September 2026

This notice explains how JUMAHA GROUP LTD, trading as Jumaha, handles personal information when you use jumaha.store, shop with us or contact our team. We are the controller for the processing we determine. Our company number is 17454606 and our contact details appear below.

The store runs on Shopify. Shopify and other providers process information to operate the service, and may act as independent controllers for some of their own activities. This notice takes priority over our general terms when explaining our handling of personal information.

Information we receive

The information involved depends on your interaction with us. It can include:

Contact and delivery information: name, email, telephone number, billing address and delivery address.
Orders and transactions: products viewed or placed in a cart, purchases, payment status, delivery records, returns, cancellations and customer-service history.
Payment information: transaction identifiers, payment method and information needed by payment providers to authorise and process a payment. Payment-card information is processed through the relevant payment service; do not send it to customer support.
Account information: login details managed through the account service, preferences and settings, where you use an account.
Messages and submissions: information you send in a support request, review or other communication.
Technical and usage data: IP address, browser and device information, identifiers, navigation activity and interactions with the store, including information collected through cookies and similar technologies where permitted.

Anonymous information that cannot reasonably identify or be linked to a person is not personal data for this notice. Please provide only information needed for the relevant request.

Where information comes from

We receive information directly when you browse, order, create an account or contact us; automatically from your device and permitted cookies or similar tools; from providers helping us operate payments, fulfilment, security and support; and, where relevant, from partners or other lawful third-party sources.

Why we use it and our legal bases

For processing subject to UK or EEA data-protection rules, the legal basis depends on the purpose:

Purpose	Usual legal basis
Taking steps you request before purchase; processing payment, delivery, returns and order support	Performing a contract or taking pre-contract steps
Keeping required transaction and tax records; responding to lawful regulatory requests	Legal obligation
Protecting the store, preventing fraud, managing support, resolving disputes and improving a secure shopping service	Legitimate interests, balanced against your rights; legal obligation where applicable
Optional cookies and similar advertising or analytics technologies where consent is required	Consent
Sending promotional communications	Consent where required, or another lawful basis permitted for the particular communication, including the relevant existing-customer rules

Our legitimate interests include providing effective customer service, securing transactions, maintaining business records and understanding how to improve the store. We do not treat a visit to the website as consent to every form of marketing or tracking. Where information is needed for a purchase or a legal requirement, not providing it may prevent us from completing that transaction.

Shopping, support and personalisation

We use relevant information to process orders and payments, arrange delivery, manage accounts where offered, remember cart choices, handle returns and warranties, send service messages, and respond to questions. Where permitted, information about interactions may also help us recommend relevant products and improve the service.

Security checks help detect unusual transactions, investigate misuse and protect customers. If an automated check affects an order, contact us to request a review. If processing constitutes a solely automated decision with a legally significant or similarly significant effect, the protections required by applicable law apply, including human intervention where available.

Marketing, cookies and your choices

Where enabled and permitted, marketing providers and Shopify features may help measure advertising, tailor recommendations or show relevant advertisements on this or other websites. Optional cookies and similar technologies are used subject to the choices and consent requirements that apply to you. You can use the store's available privacy controls and your browser settings, or contact us for help exercising a privacy choice. Blocking essential cookies can affect cart or account functionality.

Unsubscribe from promotional emails using the link in the message. Opting out of marketing does not stop necessary messages about an order, account, refund or security issue.

Where local law provides a right to opt out of a data “sale”, “sharing” or targeted advertising, you can request it through available privacy controls or by contacting us. We honour applicable Global Privacy Control opt-out signals where required for the browser or device involved, and associated accounts where supported. Other browser “Do Not Track” signals are not a universal standard for the store's processing.

Who may receive information

We share the information needed for legitimate purposes with:

Shopify and providers supporting hosting, payments, IT, security, support, storage, analytics, order fulfilment and delivery.
Marketing or advertising partners where those services are enabled and the required legal basis or consent is in place.
A recipient you ask us to share with, or a service you choose to connect.
Related businesses where relevant and lawful for the stated purposes.
Advisers, authorities or other parties where necessary to comply with law, handle claims, protect rights, or manage a business sale, reorganisation or similar transaction with appropriate safeguards.

We do not provide an unrestricted entitlement for partners to use your information. Providers' roles, contractual restrictions and their own privacy notices apply according to the service involved.

Shopify's role

Shopify processes information about transactions and use of the store to supply and protect its platform. Where enhanced Shopify features are enabled, Shopify may also use information from interactions with this and other merchants for its own described purposes and may be responsible for those activities as a controller.

Read the Shopify Consumer Privacy Policy and visit the Shopify privacy portal for details of Shopify's practices and relevant rights. Those links do not replace your ability to contact Jumaha about processing for which we are responsible.

International processing

Shopify, fulfilment partners and other providers may process information outside the country where you live. Where UK or EEA rules require safeguards for an international transfer, we use an applicable adequacy decision or recognised contractual safeguards, such as EU Standard Contractual Clauses and relevant UK transfer arrangements. Contact us for information about the safeguards relevant to your data and how to obtain a copy, subject to necessary confidentiality protections.

Keeping information secure and deciding how long to retain it

We use reasonable organisational and technical safeguards, but no online system or transmission can be guaranteed perfectly secure. Keep account credentials private and avoid sending unnecessary sensitive information through ordinary support channels.

Retention depends on the purpose: completing and documenting a transaction, maintaining an account, handling support or warranty issues, meeting tax and accounting obligations, preventing abuse, and establishing or defending legal claims. We retain information only for as long as reasonably necessary for those purposes and applicable legal requirements, then delete or anonymise it as appropriate. You can ask for further information about the retention criteria applying to your records.

Children

The store is intended for adults making purchases, rather than for children to provide their information independently. We do not knowingly collect children's personal data in breach of applicable law or knowingly sell or share personal information of under-16s for targeted advertising. A parent or guardian who believes a child has supplied information can contact us to request an assessment and deletion where appropriate.

Your information rights

Depending on your location and the circumstances, you may be entitled to access or obtain a copy of your information, correct inaccuracies, request deletion, receive portable data, restrict processing, object to processing based on legitimate interests, or opt out of applicable targeted-advertising uses. You can object to direct marketing at any time. If we rely on consent, you may withdraw it without affecting processing that was lawful before withdrawal.

Rights are subject to applicable conditions and exceptions. We may verify identity and request only the information reasonably needed to handle a request. An authorised representative may act for you where permitted, with evidence of authority. We do not penalise you for exercising your rights and respond within the deadlines the law requires, generally one month for UK GDPR requests, subject to permitted extensions and notice.

Questions and complaints

Contact us first if you have a concern so we can investigate. You may also complain to the UK's Information Commissioner's Office, or to another competent data-protection authority where you live. Where local law provides an appeal process for a privacy decision, contact us to request that review. You do not have to contact us before exercising a right to complain to a regulator.

Independent websites

Other websites, third-party app providers and social platforms have their own privacy practices. Review their notices before providing information. Public reviews or posts may be visible to others; avoid including information you do not want to disclose publicly.

Changes to this notice

We may update this notice when our practices or legal requirements change. The published version will show its revision date, and we provide additional notice of material changes where required. A change to wording does not retrospectively create consent for a new processing purpose.