Walmart Global Marketplace Seller Privacy Notice

Updates include:

• Added additional disclosures regarding the categories of personal information collected.
• Added disclosures clarifying the individuals covered under this Notice.
• Added additional country-specific addendums for individuals in Canada, Mexico, and Hong Kong.

Walmart Marketplace (collectively referred to as “Walmart”, “we”, “us” or “our” in this Notice) is an online marketplace that allows businesses to sell their products on different Walmart ecommerce platforms. The data controller may be Wal-Mart.com USA, LLC, with an address of 850 Cherry Ave., San Bruno, CA 94066, US or Nueva Walmart de México, S. de R.L. de C.V., with an address of Av. Nextengo No. 78, Colonia Santa Cruz Acayucan, Alcaldía Azcapotzalco, C.P. 02770, Mexico City.

This Notice outlines how and why we collect, use, disclose, retain and otherwise process, and protect, personal information or equivalent information, which is protected by applicable privacy laws, in connection with our dealings with Walmart Marketplace Retailers (“sellers”, “data subjects”, or “residents”) and potential sellers, who have applied to join the Walmart Marketplace. This Notice also explains what rights the individuals referred to above have in respect of our processing of their personal information.

This Notice applies to sellers, sellers who are sole traders, and individuals engaged by corporate sellers, or potential sellers particularly where these individuals will be involved in accessing and using the Walmart Marketplace on behalf of the corporate seller.

In case of any contradictions between the provisions outlined in this Notice, the provisions of the pertinent, country-specific section will prevail.

Reference to “you” or “your” in this Notice are to the individuals described above.

What is not covered in this Privacy Notice?

This Notice does not apply to any services, websites, or applications that have their own privacy notice, such as Massmart Holdings Limited and Flipkart India Private Limited.

We may collect the following categories of personal information. Not all categories may be collected about every individual:

• Basic Personal Identifiers, such as name, telephone number, physical address, email address, government-issued identifiers (e.g., national identification, driver’s license, taxpayer identification numbers, and a passport), signatures, and username or similar identifiers.
• Device and Online Identifiers, such as account login information, MAC address, IP address, cookie IDs, mobile ad IDs, login data, browser type and version, browser plug-in types and versions, operating system and platform, social media information, and other technology on devices used to access seller areas of the Walmart Marketplace.
• Internet and Other Network Activity Information, such as information about your browsing or search activity as well as your interactions with our websites, mobile applications, emails, or advertisements such as keystroke patterns (these tell us if it is you who is interacting with us, or a bot).
• Communications, such as the content of emails, text messages, or other communications), call logs, and calendar information, where Walmart is a party to the exchange.
• Commercial Information, such as purchase and transaction history information (such as products or services you have purchased, rented, or returned), product reviews, travel and vacation information, and sweepstakes and contest entries.
• Demographic Information, such as age, gender, citizenship, ethnicity, date of birth, family or marital status, household income, education, professional and employment information, family health, number of children, number of cars owned, and software or virtual assets or property owned.
• Background Information, such as background checks and criminal convictions.
• Financial Information, such as financial institution account information and/or credit scores (where applicable).
• Biometric Information, such as voice prints, imagery of the iris or retina, face geometry, and palm prints or fingerprints.
• Geolocation, such as data about the location of your device, which may be imprecise (i.e., inferred from your device’s IP address).
• Sensory Information, such as audio, visual information, and other sensory information such as photographs and audio and video records.
• Inferences, individual preferences and characteristics, such as inferences drawn from and related to selling patterns and behaviors, intelligence, and aptitudes.
• Onboarding Information: such as whether a seller/potential seller is on a sanctions list (or subject to similar restrictions), and personal information contained in press releases relating to the seller/potential seller.

We may use the personal information we collect from you, for the following purposes and on the following lawful bases, as defined in the General Data Protection Regulation (GDPR):

We collect personal information from you in a variety of ways. It may be:

Provided Directly by You or the Marketplace Seller

You, or the marketplace seller, may provide personal information to us in various ways, such as when you, or the marketplace seller, engage with us for onboarding, account management, and otherwise using the Walmart Marketplace.

Collected Through Automated Means

We may automatically collect personal information from devices that you (or anyone from your household) uses to interact with the Walmart Marketplace, as well as from your interaction with emails that we send to you. The personal information we automatically collect may include Device and Online Identifiers.

When you visit or interact with a Walmart Marketplace website, we may obtain certain personal information by automated means, such as cookies. For more information about our use of cookies please visit the Walmart Marketplace Cookie Notice.

Obtained from Other Companies Within Our Family

We may obtain your personal information from another organization within our corporate family of companies.  

Obtained from External Third-Party Sources

As part of our standard Walmart Marketplace seller onboarding process and to help control seller risk throughout the entire seller lifecycle, we may receive personal information from third party sources, including:

• Organizations that carry out onboarding and seller risk checks throughout the entire seller lifecycle for us. The personal information that we may collect about you in this context, may include all or some of the following: the Onboarding Information, Personal Identifiers, Device and Online Identifiers, Financial Information and Non-Precise Location Information specified above;
• Organizations that may share details regarding potential sellers and enrich existing leads for our business-to-business sales and marketing teams. The personal information that we may collect about you in this context may include Personal Identifiers and Employment Information; and
• Credit check providers, that carry out credit checks for us. The information that we may collect about you in this context, is the Financial Information specified above (in particular, credit scores).

The categories of personal information that we collect may be provided to other companies, including those within our corporate family for the purposes described above.

We may also provide your personal information to third parties, such as law enforcement, courts, or other legal or government bodies when legally required to do so by law when we believe that this will help to protect the safety, property, or rights of Walmart, our customers, our associates, or other persons. We may also share to respond to a request from law enforcement, search warrant, or other valid legal inquiry, or to respond a court or other investigative body in the case of an alleged breach of an agreement or violation of law. Further may also share with service providers that help with our business activities; with our banks, credit reference agencies; insurers and brokers; and with those that have or may acquire control or ownership of our business.

Your personal information may, in addition, be disclosed to regulatory authorities, for example, in response to consumer protection inquiries.

Please see the “Categories of Personal Information We Disclose to Third Parties” table below for more detail on how we provide your personal information to third parties. We require our service providers to keep your personal information secure, and we do not allow our service providers to use or disclose your personal information for any purpose other than providing services on our behalf.

We may anonymize your personal information and disclose the resulting aggregated information that does not identify you or a household (directly or indirectly) (“deidentified data”) with third parties for any purpose including industry analysis and demographic analysis.

Categories of Personal Information We Disclose to Third Parties

We may disclose your personal information to certain categories of third parties, as described below.

We take steps to ensure that the personal information we collect is processed according to the provisions of this Notice and the requirements of applicable data protection laws wherever the personal information is located. Personal information collected by Walmart will be processed and stored in the United States. If personal information is transferred from the United States to another jurisdiction outside the United States, the transfer will be in accordance with applicable data protection laws.

We will retain your personal information for as long as reasonably necessary to fulfil the purposes we collected it for as set forth in this Privacy Notice or any other notice provided at the time of collection, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements. We may retain your personal information for a longer period in the event of a complaint, investigation, or if we reasonably believe there is a prospect of litigation in respect to our relationship with you, or the organization that you work for. However, we will not retain your information for any longer than is required or permitted under applicable law or internal Walmart policy. We dispose of the personal information that we collect in accordance with Walmart retention policies and procedures.

We use reasonable information security measures, in compliance with data protection laws, including physical, administrative, and technical safeguards. Learn more about measures you can take to protect the security of your personal information.

The Walmart Marketplace may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or disclose personal information about you. We may not own or control these linked online services or third-party features, and we are not responsible for the information practices of the third parties that have ownership or control over them. In some cases, these third parties operate independently from us, which means their privacy practices are not covered in this Notice. We recommend that you review their privacy statements to learn about these third parties' privacy practices, including details on the personal information they may collect about you.

California

California residents, see our California Privacy Notice for information about our privacy practices and your California privacy rights.

Canada

You may request that we:

• Provide you with access to a copy of and certain details regarding the personal information we have about you
• Delete your personal information
• Correct your inaccurate personal information
• Stop sharing/disseminating your personal information

Your request must be detailed enough to allow us to identify the documents or other media containing the personal information you wish to access. Once we receive your written request, we may need to validate your identity and the reason for your request. If you’d like an authorized agent to exercise your privacy rights for you, they may use the same links described above to submit requests. We require documentation demonstrating your agent’s authority to submit requests on your behalf. For example, a notarized power of attorney or other documentation, including a letter, signed by you authorizing the agent to submit your requests.

For your protection, we only fulfill requests for the personal information associated with the email address that you identify in your request, and we may need to take other steps to verify your identity before taking any action. If we can’t verify your identity, we will notify you, and your Privacy Request may not be processed.

When permitted by law, we may charge an appropriate fee to cover the costs of responding to your request. These fees, if any, are reasonable and are usually limited to the cost of transcription, reproduction or transmission.

If you make a request, we will confirm that we have received your request and let you know if we need further information. We typically fulfill your request within one month unless the request is particularly complex, or we receive multiple requests from you. In these cases, we may extend the time period but we will always let you know. Please note that we may refuse your Privacy Request where we are entitled to do so under applicable law.

We will not discriminate against you for exercising your privacy rights. We will not deny you goods or services, charge different prices or rates, provide a different level of service or quality of goods, or suggest that you might receive a different price or level of quality for goods. Some programs or services require usage of personal information to function, so compliance with your request may impact those experiences.

If you have a concern about the way we addressed your Privacy Request, use this tool to find the right organization to contact or reach out to the appropriate provincial or federal privacy commissioner.

Hong Kong

You have the following rights where Hong Kong Special administered Region data protection laws apply (subject to certain conditions and limitations):

• Be Informed: You have the right to be informed about the collection and use of your personal information, including the purpose of collection and classes of potential transferees of your personal information.
• Access: You can request access to your personal information held by us and obtain a copy of such personal information.
• Correction: If you find that your personal information is inaccurate, you have the right to request correction of that information.
• Erasure: You can request the deletion of your personal data when it is no longer necessary for the purpose for which it was collected.
• Object: You have the right to object to the use of your personal information for direct marketing purposes.

Mexico

You have the following rights where Mexico data protection laws apply (subject to certain conditions and limitations):

• Access personal information Walmart holds about you
• Correct inaccurate personal information in Walmart’s systems
• Request erasure of certain of your personal information in Walmart’s systems
• Oppose certain processing of personal information Walmart holds about you
• Withdraw your consent (this may affect your relationship with us)
• Limit the consent you have provided for processing your personal information according to Mexican Privacy regulation.

Once you submit your request you will receive a response in 20 business days. If your request is approved it will be processed within 15 business days.

When you submit your request you must attach: copy of your official ID, if you are acting by your legal representative you must attach copy of the power of attorney that appoints you a legal representative and copy of the official ID.

Turkey

You have the following rights where Turkey data protection laws apply (subject to certain conditions and limitations):

• Learn whether your personal information has been processed.
• Request information about processing if your personal information has been processed.
• Learn the purpose of the personal information processing and whether personal information is being used in accordance with that purpose.
• Know the third parties to whom your personal information is being transferred.
• Request the rectification of incomplete or inaccurate personal information.
• Request the erasure of your personal information.
• Request reporting regarding the correction or erasure of personal information transferred to third parties.
• Object to the occurrence of a detrimental result against you when it is made through the solely automated processing of personal information.
• Request compensation for damages incurred due to the unlawful processing of personal information.

UK and EEA

You have the following rights where UK or EU data protection laws apply (subject to certain conditions and limitations):

• Access: The right to be provided with a copy of your personal information.
• Rectification: The right to require us to correct any mistakes in your personal information.
• Erasure (also known as the right to be forgotten): The right to require us to delete your personal information in certain situations.
• Restrict Processing: The right to require us to restrict processing of your personal information in certain circumstances, e.g. if you contest the accuracy of the data.
• Data portability: The right to receive the personal information you provided to us, in a structured, commonly used and machine-readable format and/or transmit that data to a third party—in certain situations.
• Object:
  • (i) at any time to your personal information being processed for direct marketing (including profiling); and
  • (ii) in certain other situations to our continued processing of your personal information, e.g. processing carried out for the purpose of our legitimate interests unless there are compelling legitimate grounds for the processing to continue or the processing is required for the establishment, exercise or defense of legal claims
• Not Be Subject to Automated Individual Decision Making: The right not to be subject to a decision based solely on automated processing (including profiling) that produces legal effects concerning you or similarly significantly affects you.
• Withdraw Consent: If you have provided us with a consent to use your personal information you have a right to withdraw that consent easily at any time. Withdrawing consent will not affect the lawfulness of our use of your personal information in reliance on that consent before it was withdrawn.

Depending on whether UK and/or EU data protection laws apply you may have the right to make a complaint to the Information Commissioner’s Office (ICO), the UK regulator for data protection issues, and/or to the data protection supervisory authority in your jurisdiction. We would, however, always appreciate the chance to deal with your concerns before you approach a supervisory authority. Contact details for the ICO are available here. For a list of EEA data protection supervisory authorities and their contact details see here.

Vietnam

You have the following rights where Vietnam data protection laws apply (subject to certain conditions and limitations):

• Be informed of the processing of your personal information.
• Consent to the processing of your personal information.
• Access and correct your personal information.
• Withdraw your consent.
• Request the deletion of your personal information.
• Limit the processing of your personal information.
• Be provided with your personal information.
• Object to the processing of your personal information.
• Complain, denounce, and/or initiate lawsuits.
• Claim damages.
• Self-defense.

If we are unable to comply with your request in whole or in part, we will notify you with reasons for the denial when necessary to do so under the law.

Under the Decree, Vietnamese citizens also have certain obligations that apply to personal information. These obligations include:

• The obligation to self-protect your own personal information and request other relevant organizations and individuals to protect your personal information.
• The obligation to respect and protect the personal information of others.
• The obligation to fully and accurately provide personal information upon giving consent to personal information processing.
• The obligation to participate in the propaganda and dissemination of skills for personal information protection.
• The obligation to comply with the law on personal information protection and to participate in the prevention of violations of regulations on personal information protection.

What Are the Potential Harms from Data Processing? We respect the trust that you place in us and the privacy of the information that you share, and we use reasonable information security measures to protect your personal information. However, there are risks presented by personal data processing, such as accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored, or otherwise processed which may lead to physical, material, or non-material damage.

California residents can click “Request My Personal Information” to exercise their applicable privacy rights, and “Your Privacy Choices” to request to limit the use and disclosure of Sensitive Personal Information. See our California Privacy Notice for more information.

Mexico data subjects can submit their request to exercise their data privacy rights to the Walmart Privacy Team.

All other data subjects outside of the US can contact us at globalprivacy@walmart.com or at the address below to exercise their applicable privacy rights.

Walmart Corporate
Privacy Office, MS #0160
702 SW 8th Street
Bentonville, AR 72716-0160

We may ask you to log into your account or may need to request specific personal information from you to help us confirm your identity and ensure your right to access your personal information (or to exercise any of your other rights). This is a security measure to ensure that personal information is not shared with any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request.

Contact our Customer Service Team or write the Walmart Privacy Office with any questions or comments about this Notice or about how we handle your personal information. The Privacy Office’s address is:

Walmart Corporate
Privacy Office, MS #0160
702 SW 8th Street
Bentonville, AR 72716-0160

globalprivacy@walmart.com

For EU data subjects only:

Our local representative is CMS Hasche Sigle Partnerschaft von Rechtsanwälten und Steuerberatern mbB. Their address is:

Walmart EU Privacy (MRN)

c/o CMS Hasche Sigle

Nymphenburger Strasse 12

80335 Munich

Germany

GDPR-Representative@cms-hs.com

For Mexico data subjects only:

If you have questions about this Notice or our data privacy practices, you may contact us by mail at:

Nueva Walmart de México

S. de R.L. de C.V. Av. Nextengo No. 78

Colonia Santa Cruz Acayucan

Alcaldía Azcapotzalco, C.P. 02770, Mexico City

privacidad@wal-mart.com

For UK data subjects only:

Our local representative is CMS Cameron McKenna Nabarro Olswang. You can contact them by email at WMTUKrep@cms-cmno.com.