Walmart Marketplace Seller Privacy Notice

Updates include:

• Updated the “Who Can I Contact About the Privacy Notice” section with information about Walmart’s EU and UK representatives.

Walmart Inc. is the controller in respect of personal information collected and otherwise processed in connection with the operation of the Walmart Marketplace (collectively referred to as “Walmart”, “we”, “us” or “our” in this Notice). Walmart Marketplace is an online marketplace that allows businesses to sell their products on Walmart.com. Our contact details are set out in the “Who Can I Contact About the Privacy Notice?” section below.

This Notice outlines how and why we collect, use, disclose, retain and otherwise process, and protect, personal information or equivalent information, which is protected by applicable privacy laws, in connection with our dealings with Walmart Marketplace Retailers (“sellers”) and potential sellers, who have applied to join the Walmart Marketplace.

Specifically, this Notice applies to sellers who are sole traders, and individuals engaged by corporate sellers or potential sellers particularly where these individuals will be involved in accessing and using the Walmart Marketplace on behalf of the corporate seller.

This Notice also explains what rights the individuals referred to above have in respect of our processing of their personal information.

Reference to “you” or “your” in this Notice are to the individuals described above.

We may collect the following categories of personal information. Not all categories may be collected about every individual:

• Basic Personal Identifiers: such as name, address, contact details (including telephone number and email address), username or similar identifiers and government-issued identifiers (e.g., national identification numbers, driver’s license numbers, taxpayer identification numbers)
• Device and Online Identifiers: and related information, such as IP address, login data, browser type and version, browser plug-in types and versions, operating system and platform, and other technology on devices used to access seller areas of the Walmart Marketplace
• Communications: Communication details (such as the content of emails, text messages, or other communications), call logs, and calendar information, where Walmart is a party to the exchange
• Demographic Information: such as age and date of birth
• Financial Information: such as financial institution account information and/or credit scores (where applicable).
• Characteristics of protected classifications under applicable law: such as gender, race, and nationality
• Non-Precise Location Information: such as your location derived from an IP address that indicates a city or postal code level
• Employment Information: such as occupation, title, licenses and professional memberships
• Onboarding Information: such as whether a seller/potential seller is on a sanctions list (or subject to similar restrictions), and personal information contained in press releases relating to the seller/potential seller

We may use the personal information we collect from you, for the following purposes and on the following lawful bases:

We collect personal information from you in a variety of ways. It may be:

• Provided directly by you
• Collected from a device associated with you or your household
• Collected from another company within our family of companies
• Collected from an external third-party source (including publicly available sources)

Our goal is to limit the personal information we collect to the information needed to support our business.

Personal Information Provided Directly by You

You may provide personal information to us in various ways, such as when you engage with us for onboarding, account management, and otherwise using the Walmart Marketplace.

The personal information that you may provide to us in this context includes your name, email address, physical or postal address, phone number, date of birth and country of location. This information helps us effectively partner with you or the organization that you work for and conduct our business.

Personal Information Collected From a Device Associated With You or Your Household

We may automatically collect personal information from devices that you (or anyone from your household) uses to interact with the Walmart Marketplace, as well as from your interaction with emails that we send to you. The personal information we automatically collect may include Device and Online Identifiers.

When you visit or interact with a Walmart Marketplace website, we may obtain certain personal information by automated means, such as cookies. For more information about our use of cookies please visit the Walmart Marketplace Cookie Notice.

Personal Information We Collect From Another Company Within Our Family of Companies

We may collect your personal information from another organization within our corporate family of companies, such as Sam's Club. For more information, please see our Privacy Notices at corporate.walmart.com/privacy-security.

Personal Information We Collect From External Third-Party Sources

As part of our standard Walmart Marketplace seller onboarding process and to help control seller risk throughout the entire seller lifecycle, we may receive personal information from third party sources, including:

• organizations that carry out onboarding and seller risk checks throughout the entire seller lifecycle for us. The personal information that we may collect about you in this context, may include all or some of the following: the Onboarding Information, Personal Identifiers, Device and Online Identifiers, Financial Information and Non-Precise Location Information specified above;
• organizations that may share details regarding potential sellers and enrich existing leads for our B2B sales and marketing teams. The personal information that we may collect about you in this context may include Personal Identifiers and Employment Information; and
• credit check providers, that carry out credit checks for us. The information that we may collect about you in this context, is the Financial Information specified above (in particular, credit scores).

The categories of personal information that we collect may be provided to other companies, including those within our corporate family for the purposes described above.

We may also provide your personal information to third parties when legally required to do so by law, when we believe that this will help to protect the safety, property, or rights of Walmart, our customers, our associates, or other persons, with service providers that help with our business activities, with our banks, credit reference agencies; insurers and brokers, and with those that have or may acquire control or ownership of our business.

Your personal information may, in addition, be disclosed to regulatory authorities, for example, in response to consumer protection inquiries.

Please see the “Categories of Personal Information We Disclose to Third Parties” table below for more detail on how we provide your personal information to third parties. We require our service providers to keep your personal information secure, and we do not allow our service providers to use or disclose your personal information for any purpose other than providing services on our behalf.

We may anonymize your personal information and disclose the resulting aggregated information that does not identify you or a household (directly or indirectly) (“deidentified data”) with third parties for any purpose including industry analysis and demographic analysis.

Categories of Personal Information We Disclose to Third Parties

We may disclose your personal information to certain categories of third parties, as described below.

We take steps to ensure that the personal information we collect is processed according to the provisions of this Notice and the requirements of applicable data protection laws wherever the personal information is located. Personal information collected by Walmart will be processed and stored in the United States. If personal information is transferred from the United States to another jurisdiction outside the United States, the transfer will be in accordance with applicable data protection laws.

We will retain your personal information for as long as reasonably necessary to fulfil the purposes we collected it for as set forth in this Privacy Notice or any other notice provided at the time of collection, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements. We may retain your personal information for a longer period in the event of a complaint, investigation, or if we reasonably believe there is a prospect of litigation in respect to our relationship with you, or the organization that you work for. However, we will not retain your information for any longer than is required or permitted under applicable law or internal Walmart policy. We dispose of the personal information that we collect in accordance with Walmart retention policies and procedures.

We use reasonable information security measures, in compliance with data protection laws, including physical, administrative, and technical safeguards. Learn more about measures you can take to protect the security of your personal information.

The Walmart Marketplace may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or disclose personal information about you. We may not own or control these linked online services or third-party features, and we are not responsible for the information practices of the third parties that have ownership or control over them. In some cases, these third parties operate independently from us, which means their privacy practices are not covered in this Notice. We recommend that you review their privacy statements to learn about these third parties' privacy practices, including details on the personal information they may collect about you.

Contact our Customer Service Team or write the Walmart Privacy Office with any questions or comments about this Notice or about how we handle your personal information. The Privacy Office’s address is:

Walmart Corporate
Privacy Office, MS #0160
702 SW 8th Street
Bentonville, AR 72716-0160

Their email address is: B2Bprivacy_2022@walmart.com.

For EU data subjects only, our local representative is CMS Hasche Sigle Partnerschaft von Rechtsanwälten und Steuerberatern mbB. Their address is:

Walmart EU Privacy (MRN)

c/o CMS Hasche Sigle

Nymphenburger Strasse 12

80335 Munich

Germany

Their email address is GDPR-Representative@cms-hs.com.

For UK data subjects only, our local representative is CMS Cameron McKenna Nabarro Olswang. You can contact them by email at WMTUKrep@cms-cmno.com.

You have the following rights where UK or EU data protection laws apply (subject to certain conditions and limitations):

• Access - the right to be provided with a copy of your personal information
• Rectification - the right to require us to correct any mistakes in your personal information
• Erasure - (also known as the right to be forgotten) - the right to require us to delete your personal information in certain situations
• Restriction of processing - the right to require us to restrict processing of your personal information in certain circumstances, e.g. if you contest the accuracy of the data
• Data portability - the right to receive the personal information you provided to us, in a structured, commonly used and machine-readable format and/or transmit that data to a third party—in certain situations
• To object – (i) at any time to your personal information being processed for direct marketing (including profiling); and (ii) in certain other situations to our continued processing of your personal information, e.g. processing carried out for the purpose of our legitimate interests unless there are compelling legitimate grounds for the processing to continue or the processing is required for the establishment, exercise or defence of legal claims
• Not to be subject to automated individual decision making - the right not to be subject to a decision based solely on automated processing (including profiling) that produces legal effects concerning you or similarly significantly affects you
• The right to withdraw consent - if you have provided us with a consent to use your personal information you have a right to withdraw that consent easily at any time. Withdrawing consent will not affect the lawfulness of our use of your personal information in reliance on that consent before it was withdrawn.

For more information on each of those rights, including the circumstances in which they apply, or if you would like to exercise any of these rights please see the “Who Can I Contact About this Privacy Notice?” section above to contact us.

We may need to request specific personal information from you to help us confirm your identity and ensure your right to access your personal information (or to exercise any of your other rights). This is a security measure to ensure that personal information is not shared with any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request.

Depending on whether UK and/or EU data protection laws apply you may have the right to make a complaint to the Information Commissioner’s Office (ICO), the UK regulator for data protection issues, and/or to the data protection supervisory authority in your jurisdiction.

We would, however, always appreciate the chance to deal with your concerns before you approach a supervisory authority.

Contact details for the ICO are available here.

For a list of EEA data protection supervisory authorities and their contact details see here.

California residents, see our Supplier Privacy Notice for information about our privacy practices and your California privacy rights.

If you are a Turkish citizen, you can make certain requests regarding your personal information. You may have the right to:

• Learn whether your personal information has been processed
• Request information about processing if your personal information has been processed
• Learn the purpose of the personal information processing and whether personal information is being used in accordance with that purpose
• Know the third parties to whom your personal information is being transferred
• Request the rectification of incomplete or inaccurate personal information
• Request the erasure of your personal information
• Request reporting regarding the correction or erasure of personal information transferred to third parties
• Object to the occurrence of a detrimental result against you when it is made through the solely automated processing of personal information
• Request compensation for damages incurred due to the unlawful processing of personal information

If you are a citizen of Vietnam, you may have certain rights regarding your personal information. If we are unable to comply with your request in whole or in part, we will notify you with reasons for the denial when necessary to do so under the law. These rights include:

• The right to be informed of the processing of your personal information
• The right to consent to the processing of your personal information
• The right to access and correct your personal information
• The right to withdraw your consent
• The right to request the deletion of your personal information
• The right to limit the processing of your personal information
• The right to be provided with your personal information
• The right to object to the processing of your personal information
• The right to complain, denounce, and/or initiate lawsuits
• The right to claim damages
• The right to self-defence

Under the Decree, Vietnamese citizens also have certain obligations that apply to personal information. These obligations include:

• The obligation to self-protect your own personal information and request other relevant organizations and individuals to protect your personal information
• The obligation to respect and protect the personal information of others
• The obligation to fully and accurately provide personal information upon giving consent to personal information processing
• The obligation to participate in the propaganda and dissemination of skills for personal information protection
• The obligation to comply with the law on personal information protection and to participate in the prevention of violations of regulations on personal information protection.

What Are the Potential Harms from Data Processing?

We respect the trust that you place in us and the privacy of the information that you share, and we use reasonable information security measures to protect your personal information. However, there are risks presented by personal data processing, such as accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored, or otherwise processed which may lead to physical, material, or non-material damage.

How Can You Exercise Your Rights?

If you wish to exercise any of your rights under applicable privacy laws, please contact us at B2Bprivacy_2022@walmart.com or at the address below:

Walmart Corporate
Privacy Office, MS #0160
702 SW 8th Street
Bentonville, AR 72716-0160

To verify your identity, we may ask you to log into your account or to provide us with further information.