Walmart Global Anti-Corruption Due Diligence Privacy Notice

Updates include:

• Updated “Contact Us” Information

Walmart needs to ensure compliance with applicable anti-corruption laws. This Privacy Notice describes the types of personal and business information Walmart Inc. and its holding, subsidiary and affiliated companies (herein after referred to as “Walmart”) collect as part of the anti-corruption due diligence process, how we may use the information, protect it, and with whom we may share it. The disclosures in this Privacy Notice supplement our other privacy notices that may apply to you.

Walmart will act as the data controller in relation to its compliance activities and will capture the information required for the purposes outlined in this Notice, unless otherwise indicated.

Before making certain donations or engaging any contractor or supplier that falls within the definition of a third-party intermediary, Walmart conducts due diligence including the collection of information, the specific purpose of which is to:

1. Assess the anti-corruption risks associated with each potential donation recipient, contractor or supplier (together known as “Candidate”) for compliance with our legal obligations, specifically to determine if a Candidate represents a risk of non-compliance with the Foreign Corrupt Practices Act (FCPA), the UK Bribery Act 2010, and the UK Criminal Finances Act, where applicable;

2. Evaluate, select, and approve or reject the Candidate;

3. Communicate with Candidates;

4. Where required, to assess the suitability of suppliers providing specialist services;

5. Monitor compliance with Walmart group anti-corruption process; and

6. Obtain legal advice from external legal advisers (when applicable).

For successful Candidates, these checks will be refreshed every 2 years.

This due diligence will include:

1. Completion of a Candidate questionnaire that, where applicable, requires information such as:

• Candidate’s personal and business information (information that personally identifies the Candidate and their business and qualifications);
• Contact information for the individual(s) responsible for the business relationship between Candidate and Walmart, including name, year of birth, country of residence, telephone number and email address.
• Information relating to the services provided or proposed donation.
• Information relating to any sub-contractors, subsidiaries and/or related parties (e.g., partnerships, sister companies, joint ventures), third parties, intermediaries, or other persons or entities the Candidate will engage when providing services, including name, year of birth, country of residence, telephone number and email address.
• Information relating to owners, partners or shareholders of companies Candidate will engage when providing services, including name, year of birth, country of residence, citizenship, ownership percentage and indication of whether they are associated with a government entity or political party or campaign.
• Reference information (company and individual contact information for Candidate’s references);
• Information regarding any formal charges or convictions against the Candidate, its trustees, officers, or its executives, including bribery or corruption related violations.

2. Searches on the Internet or other public sources of information (e.g. public data registries), and from a third party provided database (Deloitte Financial Advisory Services LLP, (“Deloitte”) with an address of 30 Rockefeller Plaza, New York, New York 10112-0015, United States of America).

To the extent you have provided personal information about another individual in connection with this questionnaire, you must provide assurance that you have obtained their written consent for Walmart to process their information as outlined within this Privacy Notice and you agree that you will maintain a record of all these consents and provide them upon request.

The information collected from you and other sources will be stored on behalf of Walmart in an electronic database provided by Deloitte. This database is hosted in the United States. Deloitte may also use the business and contact information collected from you to update its global business database. The information maintained by Deloitte as part of its global business database is the responsibility of Deloitte as a data controller and is subject to their privacy notice.

3. Legal Basis for Processing Personal Information

• Where applicable, Walmart will process your information as described above as necessary to comply with applicable anti-corruption laws, including, without limitation, the Foreign Corrupt Practice Act.
• When no specific legal obligation directly applies, Walmart may process your data as necessary to protect its legitimate interest in ensuring compliance with applicable laws, protecting our organization from reputational risks and maintaining ethical business practices.
• Consent may also be sought for certain types of processing, particularly where sensitive or special categories of data are involved.

We may share the information you provide with our domestic and international Walmart affiliates for the purposes described above. We also share this information with Deloitte so that they can supply commercial data about organizations to the Walmart anti-corruption teams to inform the due diligence assessment. Walmart will engage Deloitte to complete Candidate searches using their global business database.

In addition to Deloitte, we may also share the information you supply with third parties who perform services for us or with whom we contract for the purposes described in this Privacy Notice. These third-party service providers are given the information that they need to perform their designated functions and are prohibited from using or disclosing your personal or business information for unrelated business purposes. These service providers are instructed to process the data in accordance with any applicable legal requirements regarding data protection and data security.

We may disclose your information in other special circumstances. These include situations when the sharing is necessary to protect the safety, property, or other rights of Walmart, our customers, our associates, or any other person, or where otherwise required by law. For example, we may be required to disclose your information as is required by law pursuant to lawful requests such as subpoenas, court orders, or when we believe disclosure is necessary or appropriate in connection with an investigation of reasonably suspected or actual criminal activity.

We may transfer the personal and business information we collect to other countries where we do business, which may not have the same data protection laws as the country in which you reside. We have taken steps to provide an adequate level of protection in accordance with applicable data protection laws in the countries in which we operate.

We may transfer any information we have about you in connection with a merger or sale (including transfers made as part of insolvency or bankruptcy proceedings) involving all or part of Walmart or as part of a corporate reorganization or stock sale or other change of corporate control.

We require that our service providers maintain reasonable administrative and technical security safeguards to protect against accidental or unlawful destruction, accidental loss, alteration, unauthorized disclosure or access, use, and other unauthorized or unlawful forms of processing of the personal information you provide.

We keep Candidate’s information for as long as it’s required for the purposes described in this Notice. Personal information related to due diligence checks, either in hard copy or electronically, is kept for five (5) years or as otherwise required by law or Company policy, from the date that the last related action occurred.

Depending on where you reside you may exercise various data protection rights, such as:

• Access: The right to be provided with a copy of your personal information.
• Rectification: The right to require us to correct any mistakes in your personal information.
• Erasure (also known as the right to be forgotten): The right to require us to delete your personal information in certain situations.
• Restrict Processing: The right to require us to restrict processing of your personal information in certain circumstances, e.g. if you contest the accuracy of the data.
• Data portability: The right to receive the personal information you provided to us, in a structured, commonly used and machine-readable format and/or transmit that data to a third party—in certain situations.

To learn more about your individual privacy rights, please contact us as described below.

• Candidates screened to provide services for our Walmart Canada entity: to understand your rights in relation to the personal information processed, contact Walmart Canada Privacy Office at caprivacy@wal-mart.com or by mail at Wal-Mart Canada Corp. (“Walmart Canada”), c/o Privacy Office, 1940 Argentia Road, Mississauga, Ontario, L5N 1P9. Walmart Canada is the controller of your personal information to the extent a third-party intermediary provides services to Walmart Canada.
• Candidates screened to provide services for our Walmart Chile entity: to understand your rights in relation to the personal information processed, contact Walmart Chile Privacy Office at privachile@smiedemann.shop.
• Candidates screened to provide services for our Walmart Central America entities: for process to address Revocation Requests and ARCO Rights (Access, Rectification, Cancelation and Opposition), contact Walmart CAM Privacy Office at CAMPRIVA6@email.wal-mart.com.
• Non-Chinese Candidates screened to provide services for our Walmart Global Sourcing entities: to understand your rights in relation to the personal information processed, please contact gsprivacy@smiedemann.shop.
• Candidates screened to provide services for our Walmart Mexico entity: to exercise your data subject rights visit Walmart Mexico’s privacy portal. Please also see Walmart Mexico’s Privacy Notices.
• Candidates screened to provide services for our Massmart entities: to understand your rights in relation to the personal information processed, contact Massmart Privacy at privacy@massmart.co.za.
• Candidates screened to provide services for our PhonePe entity: to understand your rights in relation to the personal information processed, contact us at ethics@phonepe.com.
• Candidates screened to provide services for our Flipkart Group of Companies: to understand your rights in relation to the personal information processed, contact us at:
  
  • Flipkart: ethics@flipkart.com
  • Myntra: ethics@myntra.com

California residents should refer to the Walmart Supplier Privacy Notice for more information about our privacy practices and their California privacy rights.

Please check this Privacy Notice periodically for changes. We will post the date it was last updated at the top of the Notice.

For any Walmart locations not addressed above or if you have questions or comments about this Privacy Notice, please contact the Privacy Office:
By Email: globalprivacy@wal-mart.com
By Mail:
Walmart Corporate
Privacy Office, MS #0160
811 Excellence Dr
Bentonville, AR 72716-0160