Walmart Marketplace Solution Provider Privacy Notice

Updates include:

• Updated “Contact Us” Information

This Notice outlines how and why Walmart (collectively referred to as “Walmart”, “we”, “us” or “our” in this Notice) collect, use, disclose, retain and otherwise process, and protect, personal information or equivalent information, which is protected by applicable privacy laws, in connection with Walmart’s dealings with solution provider agencies, also referred to as channel partners, and their representatives that engage with Walmart’s ecommerce platforms (“Walmart Marketplace”). This Notice also explains what rights the individuals referred to above have in respect of our processing of their personal information. The data controller is Walmart Inc. with an address of 811 Excellence Dr., Bentonville, Arkansas 72716-0160, United States of America.

In case of any contradictions between the provisions outlined in this Notice, the provisions of the pertinent, country-specific section will prevail.

Reference to “you” or “your” in this Notice are to the individuals described above.

What is not covered in this Privacy Notice?

This Notice does not apply to any services, websites, or applications that have their own privacy notice, such as the Global Marketplace Seller Privacy Notice.

We may collect the following categories of personal information. Not all categories may be collected about every individual:

• Basic Personal Identifiers, such as name, telephone number, physical address, email address, government-issued identifiers (e.g., national identification, driver’s license, taxpayer identification numbers, and a passport), signatures, and username or similar identifiers.
• Device and Online Identifiers, such as account login information, MAC address, IP address, cookie IDs, mobile ad IDs, login data, browser type and version, browser plug-in types and versions, operating system and platform, social media information, and other technology on devices used to access seller areas of the Walmart Marketplace.
• Internet and Other Network Activity Information, such as information about your browsing or search activity as well as your interactions with Walmart Marketplace Websites, mobile applications, emails, or advertisements such as keystroke patterns (these tell us if it is you who is interacting with us, or a bot).
• Communications, such as the content of emails, text messages, or other communications where Walmart is a party to the exchange.
• Demographic Information, such as age, gender, citizenship, ethnicity, date of birth, family or marital status, household income, education, professional and employment information, family health, number of children, number of cars owned, and software or virtual assets or property owned.
• Financial Information, such as financial institution account information and/or credit scores, where applicable.
• Biometric Information, such as voice prints, imagery of the iris or retina, face geometry, and palm prints or fingerprints.
• Geolocation: Data about the location of your device, which may be imprecise (i.e., inferred from your device’s IP address).
• Sensory Information, such as audio, visual information, and other sensory information such as photographs and audio and video recordings.
• Inferences, individual preferences and characteristics, such as inferences drawn from and related to selling patterns and behaviors, intelligence, and aptitudes.
• Onboarding Information, such as information to help us assess solution provider suitability.
• Any other information you choose to provide to us, such as through surveys or during discussions with Walmart or its affiliates.

We may process your personal data for the purposes identified below, such as to fulfill the contract we have entered into with you and to provide you with our services, as well as to carry out the transactions on our platform. This processing includes the following purposes:

Automated Decision-Making Technologies Pre-Use Notice: We may use Automated Decision-Making Technologies to help us make decisions that could have a significant impact on you. If we implement those technologies, we will provide you with notice and you will be able to exercise any rights available to you under applicable law.

We collect personal information from you in a variety of ways. It may be:

Provided Directly by You

You may provide personal information to us in various ways, such as when you engage with us for solution provider verification, account management, and participate in voluntary surveys or interviews.

Collected Through Automated Means

We may automatically collect personal information from devices that you (or anyone from your household) uses to interact with the Walmart Marketplace, as well as from your interaction with emails that we send to you. The personal information we automatically collect may include Device and Online Identifiers.

When you visit or interact with Walmart Marketplace Websites, we may obtain certain personal information by automated means, such as cookies.

Obtained from Other Companies Within Our Family

We may obtain your personal information from another organization within our corporate family of companies.  

Obtained from External Third-Party Sources

As part of our standard solution provider onboarding process and to help control solution provider risk throughout their lifecycle, we may receive personal information from third party sources, including:

• Organizations that carry out onboarding for us. The personal information that we may collect about you in this context, may include all or some of the following: the Onboarding Information, Personal Identifiers, Device and Online Identifiers, Financial Information and Non-Precise Location Information specified above; and
• Organizations that may share details regarding potential solution providers and enrich existing leads for our business-to-business sales and marketing teams. The personal information that we may collect about you in this context may include Personal Identifiers and Employment Information.

Within Our Corporate Family of Companies

The categories of personal information that we collect may be provided to other companies, including those within our corporate family for the purposes described above.

Other Companies

Vendors for Business Operations: We may also disclose personal information to vendors for business operations to perform services to us or help with our business activities.  We may also disclose personal information to our banks, credit reference agencies, and insurers and brokers. We require our vendors for business operations to keep your personal information secure, and we do not allow our vendors for business operations to use or disclose your personal information for any purpose other than providing services on our behalf.

We may anonymize your personal information and disclose the resulting aggregated information that does not identify you or a household (directly or indirectly) (“deidentified data”) with third parties for any purpose including industry analysis and demographic analysis.

Law Enforcement, Courts, and Other Legal or Government Bodies

We may also provide your personal information to third parties, such as law enforcement, courts, or other legal or government bodies when legally required to do so by law when we believe that this will help to protect the safety, property, or rights of Walmart, our customers, our associates, or other persons. We may also share to respond to a request from law enforcement, search warrant, or other valid legal inquiry, or to respond to a court or other investigative body in the case of an alleged breach of an agreement or violation of law.

Your personal information may, in addition, be disclosed to regulatory authorities, for example, in response to consumer protection inquiries.

Business Transfers

If we plan to merge, sell, or reorganize our business, we may disclose your personal information as part of the business arrangement. (This may also include transfers of personal information made as a part of insolvency or bankruptcy proceedings). We will use reasonable measures to help ensure your information is handled in accordance with this Privacy Notice.

Categories of Personal Information We Disclose to Third Parties
We may disclose your personal information to certain categories of third parties, as described below or as otherwise described in this Notice.

We take steps to ensure that the personal information we collect is processed according to the provisions of this Notice and the requirements of applicable data protection laws for the data subject. We may process your personal information in other jurisdictions, including but not limited to the United States, Canada, Mexico, Chile, and India.

We will retain your personal information for as long as reasonably necessary to fulfill the purposes we collected it for as set forth in this Privacy Notice or any other notice provided at the time of collection, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements. We may retain your personal information for a longer period in the event of a complaint, investigation, or if we reasonably believe there is a prospect of litigation in respect to our relationship with you, or the organization that you work for. However, we will not retain your information for any longer than is required or permitted under applicable law or internal Walmart policy. We dispose of the personal information that we collect in accordance with Walmart retention policies and procedures.

We use reasonable information security measures, in compliance with data protection laws, including physical, administrative, and technical safeguards. Learn more about measures you can take to protect the security of your personal information.

During your interactions with Walmart Marketplace, you may be presented with links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or disclose personal information about you. We may not own or control these linked online services or third-party features, and we are not responsible for the information practices of the third parties that have ownership or control over them. In some cases, these third parties operate independently from us, which means their privacy practices are not covered in this Notice. We recommend that you review their privacy statements to learn about these third parties' privacy practices, including details on the personal information they may collect about you.

California

If you are a California resident, you can make certain requests regarding your personal information, and we will fulfill each request to the extent required by law.

To request to exercise any of your privacy rights, or to appeal the result of a data request, email globalprivacy@wal-mart.com with the subject line “CA Solution Provider Privacy Rights Request”, or call 1-800-Walmart (1-800-925-6278) and say “Privacy”.

If we are unable to comply with your request in whole or in part, we will notify you with reasons for the denial. We do not offer the option for you to request we stop selling your personal information or sharing it for cross-context behavioral advertising because we do not conduct such selling or sharing of our channel partners’ personal information. You can request to:

• Access your personal information. Requests to access your personal information may be submitted up to two times in a rolling twelve-month period. In response, we will return to you the following categories of information, to the extent required by law:
  • The categories of personal information we have collected about you.
  • The categories of sources from which we collect your personal information.
  • The business or commercial purpose for collecting, selling, or sharing your personal information.
  • The categories of third parties to whom we disclose personal information.
  • The specific pieces of personal information we have collected about you.
  • A list of categories of personal information that we have sold or shared for cross-context behavioral advertising, along with the categories of third parties we sold it to or shared it with for cross-context behavioral advertising.
  • A list of categories of personal information that we have disclosed for a business purpose, along with the categories of vendors for business operations and contractors we disclosed it to.
• Correct your personal information. You have the right to ask that we correct the personal information we may have collected about you if that information is inaccurate.
• Delete your personal information. You have the right to ask that we delete your personal information. Once we receive a request, we will delete the personal information (to the extent required by law) we hold about you as of the date of your request from our records and direct our service providers to do the same. Choosing to delete your personal information may impact your ability to use Walmart Marketplace Websites and online features that require your personal information, including closure of your online account.
• Limit the use or disclosure of your sensitive personal information. If we have processed your request to limit the use and disclosure of your SPI, you can confirm your preference on the same page on which you made the request by selecting “Your Privacy Choices”.
• Opt-Out of Automated Decision Making. You have the right to ask that we not make significant decisions about you using Automated Decision-Making Technologies. When we use these technologies, you can opt out at any time by selecting “Your Privacy Choices” and following the prompts provided.

We will not retaliate against you for exercising your rights. We will not deny you goods or services, charge different prices or rates, provide a different level of service or quality of goods, or suggest that you might receive a different price or level of quality for goods. Some programs or membership services require usage of personal information to function, so compliance with your request may impact those experiences.

How Do We Verify Your Identity to Complete Your Access, Correction, and Deletion Requests

If you request access to your personal information, including significant decisions we may have made about you using Automated Decision-Making Technologies, or the correction or deletion of, your personal information we will verify your identity before disclosing the requested information. To do so, we may ask that provide us with your:

First name and last name

Address

Email address

Phone number

You may be asked to complete a one-time passcode validation. In the event more documentation is necessary to verify your identity, we will notify you directly.

What If You Can’t Verify My Identity?

If we can’t verify your identity, we will notify you, and your request(s) to access, request, or delete your personal information may not be processed. Any requests may be denied if we have reason to believe they are fraudulent.

How Do I Submit a Request Using an Authorized Agent?

If you’d like an authorized agent to exercise your rights for you, they may use the same links described above to submit requests. We require documentation demonstrating your agent’s authority to submit requests on your behalf. For example, a valid power of attorney or other documentation, including a letter, signed by you (the California resident) authorizing the agent to submit your requests. You can download a sample letter from the request form. Documentation may be uploaded at the time you submit your request on our website or provided to us up to 10 business days after. If you submit your request by calling, you can email your forms to globalprivacy@wal-mart.com.

Number of Requests We Fulfilled Last Year

To view metrics about how many requests we received last year, please click How Many California Consumer Privacy Act Requests Did We Fulfill Last Year?

Additional California Consumer Privacy Act Disclosures

Walmart may occasionally provide compensation in exchange for your time. However, Walmart does not provide financial incentives for solution providers’ personal information.

Walmart does not knowingly sell or share (for cross-context behavioral advertising) the personal information of consumers under 16 years of age.

Canada

You may request that we:

• Provide you with access to a copy of and certain details regarding the personal information we have about you
• Delete your personal information
• Correct your inaccurate personal information
• Stop sharing/disseminating your personal information

Your request must be detailed enough to allow us to identify the documents or other media containing the personal information you wish to access. Once we receive your written request, we may need to validate your identity and the reason for your request. If you’d like an authorized agent to exercise your privacy rights for you, they may use the same links described above to submit requests. We require documentation demonstrating your agent’s authority to submit requests on your behalf. For example, a notarized power of attorney or other documentation, including a letter, signed by you authorizing the agent to submit your requests.

For your protection, we only fulfill requests for the personal information associated with the email address that you identify in your request, and we may need to take other steps to verify your identity before taking any action. If we can’t verify your identity, we will notify you, and your Privacy Request may not be processed.

When permitted by law, we may charge an appropriate fee to cover the costs of responding to your request. These fees, if any, are reasonable and are usually limited to the cost of transcription, reproduction or transmission.

If you make a request, we will confirm that we have received your request and let you know if we need further information. We typically fulfill your request within one month unless the request is particularly complex, or we receive multiple requests from you. In these cases, we may extend the time period but we will always let you know. Please note that we may refuse your Privacy Request where we are entitled to do so under applicable law.

We will not discriminate against you for exercising your privacy rights. We will not deny you goods or services, charge different prices or rates, provide a different level of service or quality of goods, or suggest that you might receive a different price or level of quality for goods. Some programs or services require usage of personal information to function, so compliance with your request may impact those experiences.

If you have a concern about the way we addressed your Privacy Request, use this tool to find the right organization to contact or reach out to the appropriate provincial or federal privacy commissioner.

Canadian data subjects can submit their request to exercise their data privacy rights by emailing globalprivacy@wal-mart.com with the subject line “Canada Solution Provider Privacy Rights Request”.

Chile

You have the following rights where Chile data protection laws apply (subject to certain conditions and limitations):

• Provide you with access to a copy of and certain details regarding the personal information we have about you.
• Correct your inaccurate personal information.
• Oppose certain processing of personal information Walmart holds about you.
• Revoke your consent for processing your personal information. Solution providers must submit this request in writing to globalprivacy@wal-mart.com.
• Request your personal information be deleted or not processed for commercial communications, either permanently or temporarily.

Chile data subjects can submit their request to exercise their data privacy rights by emailing globalprivacy@wal-mart.com with the subject line “Chile Solution Provider Privacy Rights Request”.

Hong Kong

You have the following rights where Hong Kong Special administered Region data protection laws apply (subject to certain conditions and limitations):

• Access: You can request access to your personal information held by us and obtain a copy of such personal information.
• Correction: If you find that your personal information is inaccurate, you have the right to request correction of that information.
• Erasure: You can request the deletion of your personal data when it is no longer necessary for the purpose for which it was collected.
• Object: You have the right to object to the use of your personal information for direct marketing purposes.

Hong Kong data subjects can submit their request to exercise their data privacy rights by emailing globalprivacy@wal-mart.com with the subject line “Hong Kong Solution Provider Privacy Rights Request”.

India

You have the following rights where India data protection laws apply (subject to certain conditions and limitations):

• Request information about how your data is being processed. 
• Ask that the inaccurate or incomplete data provided by you be corrected. 
• Request that your data be deleted if it's no longer needed or if you withdraw your consent subject to complying with key requirements under any agreement that you may have with us. 
• Withdraw consent for the processing of your data at any time. 
• Seek redressal for issues related to your rights and the obligations that may be cast on us under prevailing law. 
• Nominate someone to exercise your rights if you become incapacitated. 
• Request a copy of your data in a format agreed with us. 
• Object to the processing of your data for certain or specific purposes subject to complying with the requirements under any agreement that you may have with us.

You also retain certain responsibilities for the information provided by you and they are as follows;

• You must provide authentic and accurate personal information when sharing the same with us. 
• You have fully read and accurately understand the contents of our Privacy Notice and also the purpose for which your data is being collected and have provided informed consent before sharing your personal information. 
• If you believe your data is being processed incorrectly, you can file a complaint with us or the Data Protection Board through the informed and established grievance redressal mechanism. 
• When exercising your rights, you may need to provide adequate proof of identity to verify your claim. 

India data subjects can submit their request to exercise their data privacy rights by emailing globalprivacy@wal-mart.com with the subject line “India Solution Provider Privacy Rights Request”.

Mexico

You have the following rights where Mexico data protection laws apply (subject to certain conditions and limitations):

• Access personal information Walmart holds about you
• Correct inaccurate personal information in Walmart’s systems
• Request erasure of certain of your personal information in Walmart’s systems
• Oppose certain processing of personal information Walmart holds about you
• Withdraw your consent (this may affect your relationship with us)
• Limit the consent you have provided for processing your personal information according to Mexican Privacy regulation.

Once you submit your request you will receive a response in 20 business days. If your request is approved it will be processed within 15 business days.

When you submit your request you must attach: copy of your official ID, if you are acting by your legal representative you must attach copy of the power of attorney that appoints you a legal representative and copy of the official ID.

Mexico data subjects can submit their request to exercise their data privacy rights by emailing globalprivacy@wal-mart.com with the subject line “Mexico Solution Provider Privacy Rights Request”.

Turkey

You have the following rights where Turkey data protection laws apply (subject to certain conditions and limitations):

• Learn whether your personal information has been processed.
• Request information about processing if your personal information has been processed.
• Learn the purpose of the personal information processing and whether personal information is being used in accordance with that purpose.
• Know the third parties to whom your personal information is being transferred.
• Request the rectification of incomplete or inaccurate personal information.
• Request the erasure of your personal information.
• Request reporting regarding the correction or erasure of personal information transferred to third parties.
• Object to the occurrence of a detrimental result against you when it is made through the solely automated processing of personal information.
• Request compensation for damages incurred due to the unlawful processing of personal information.

Turkey data subjects can submit their request to exercise their data privacy rights by emailing globalprivacy@wal-mart.com with the subject line “Turkey Solution Provider Privacy Rights Request”.

UK and EEA

You have the following rights where UK or EU data protection laws apply (subject to certain conditions and limitations):

• Access: The right to be provided with a copy of your personal information.
• Rectification: The right to require us to correct any mistakes in your personal information.
• Erasure (also known as the right to be forgotten): The right to require us to delete your personal information in certain situations.
• Restrict Processing: The right to require us to restrict processing of your personal information in certain circumstances, e.g. if you contest the accuracy of the data.
• Data portability: The right to receive the personal information you provided to us, in a structured, commonly used and machine-readable format and/or transmit that data to a third party—in certain situations.
• Object:
  • (i) at any time to your personal information being processed for direct marketing (including profiling); and
  • (ii) in certain other situations to our continued processing of your personal information, e.g. processing carried out for the purpose of our legitimate interests unless there are compelling legitimate grounds for the processing to continue or the processing is required for the establishment, exercise or defense of legal claims
• Not Be Subject to Automated Individual Decision Making: The right not to be subject to a decision based solely on automated processing (including profiling) that produces legal effects concerning you or similarly significantly affects you.
• Withdraw Consent: If you have provided us with a consent to use your personal information you have a right to withdraw that consent easily at any time. Withdrawing consent will not affect the lawfulness of our use of your personal information in reliance on that consent before it was withdrawn.

Depending on whether UK and/or EU data protection laws apply you may have the right to make a complaint to the Information Commissioner’s Office (ICO), the UK regulator for data protection issues, and/or to the data protection supervisory authority in your jurisdiction. We would, however, always appreciate the chance to deal with your concerns before you approach a supervisory authority. Contact details for the ICO are available here. For a list of EEA data protection supervisory authorities and their contact details see here.

UK and EEA data subjects can submit their request to exercise their data privacy rights by emailing globalprivacy@wal-mart.com with the subject line “UK and EEA Solution Provider Privacy Rights Request”.

Vietnam

You have the following rights where Vietnam data protection laws apply (subject to certain conditions and limitations):

• Access and correct your personal information.
• Withdraw your consent.
• Request the deletion of your personal information.
• Limit the processing of your personal information.
• Be provided with your personal information.
• Object to the processing of your personal information.
• Complain, denounce, and/or initiate lawsuits.
• Claim damages.
• Self-defense.

If we are unable to comply with your request in whole or in part, we will notify you with reasons for the denial when necessary to do so under the law.

Under the Decree, Vietnamese citizens also have certain obligations that apply to personal information. These obligations include:

• The obligation to self-protect your own personal information and request other relevant organizations and individuals to protect your personal information.
• The obligation to respect and protect the personal information of others.
• The obligation to fully and accurately provide personal information upon giving consent to personal information processing.
• The obligation to participate in the propaganda and dissemination of skills for personal information protection.
• The obligation to comply with the law on personal information protection and to participate in the prevention of violations of regulations on personal information protection.

What Are the Potential Harms from Data Processing? We respect the trust that you place in us and the privacy of the information that you share, and we use reasonable information security measures to protect your personal information. However, there are risks presented by personal data processing, such as accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored, or otherwise processed which may lead to physical, material, or non-material damage.

Vietnam data subjects can submit their request to exercise their data privacy rights by emailing globalprivacy@wal-mart.com with the subject line “Vietnam Solution Provider Privacy Rights Request”.

Other Regions

All other data subjects outside of the US can contact us at globalprivacy@wal-mart.com with the subject line “Solution Provider Privacy Rights Request”, or at the address below to exercise their applicable privacy rights.

Walmart Corporate
Privacy Office, MS #0160
811 Excellence Dr
Bentonville, AR 72716-0160

Contact our Customer Service Team or write the Walmart Privacy Office with any questions or comments about this Notice or about how we handle your personal information. The Privacy Office’s address is:

Walmart Corporate
Privacy Office, MS #0160
811 Excellence Dr
Bentonville, AR 72716-0160

globalprivacy@wal-mart.com

For EU data subjects only:

Our local representative is CMS Hasche Sigle Partnerschaft von Rechtsanwälten und Steuerberatern mbB. Their address is:

Walmart EU Privacy (MRN)

c/o CMS Hasche Sigle

Nymphenburger Strasse 12

80335 Munich

Germany

GDPR-Representative@cms-hs.com

For Mexico data subjects only:

If you have questions about this Notice or our data privacy practices, you may contact us by mail at:

Nueva Walmart de México

S. de R.L. de C.V. Av. Nextengo No. 78

Colonia Santa Cruz Acayucan

Alcaldía Azcapotzalco, C.P. 02770, Mexico City

privacidad@wal-mart.com

For UK data subjects only:

Our local representative is CMS Cameron McKenna Nabarro Olswang. You can contact them by email at WMTUKrep@cms-cmno.com.