We are taking extended measures to ensure the safety and wellness of our communities, including adjusting store hours. Check your local store page for new hours. Customers 60+ are welcome to shop beginning one hour before stores open to the general public. Learn more.


Additional Disclosures for California Customers

Last Updated: January 1, 2020

These “Additional Disclosures for California Customers” apply only to customers who are residents of the state of California, and to the personal information of those customers that is collected by Whole Foods Market Services, Inc. and its affiliates and subsidiaries (“Whole Foods,” “our,” “we,” or “us”) both online—via any Whole Foods website, mobile application, or other online service that includes a link to these additional disclosures or via a third-party website or application—and offline.

Notice at Collection

We set forth below the categories of personal information that may be collected by Whole Foods, and the business and commercial purposes for which the categories of personal information may be used.

Identifiers including real name, alias, postal address, date of birth, unique personal identifier (such as customer number, telephone number, and cookies, beacons, pixel tags, mobile ad identifiers, or similar technologies), online identifier, internet protocol address, and email address

  • Business/Commercial Purposes for Use: Providing customer service; processing or fulfilling orders and transactions; verifying customer information; processing payments; administering contests, sweepstakes, and other promotions; marketing; data analytics; product/service improvement and development; internal research and development; detecting security incidents, protecting against malicious, deceptive, fraudulent, or illegal activity, and prosecuting those responsible for that activity; auditing related to a current interaction with a customer and concurrent transactions, including, but not limited to, counting ad impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance with this specification and other standards; debugging to identify and repair errors that impair existing intended functionality; and administration of claims and handling of customer incidents

Financial Information including credit/debit card number, security code, and expiration date

  • Business/Commercial Purposes for Use: Processing or fulfilling orders and transactions; processing payments; detecting security incidents, protecting against malicious, deceptive, fraudulent, or illegal activity, and prosecuting those responsible for that activity; and providing customer service

Physical Characteristics or Description

  • Business/Commercial Purposes for Use: Detecting security incidents, protecting against malicious, deceptive, fraudulent, or illegal activity, and prosecuting those responsible for that activity

Medical/Health Insurance Information

  • Business/Commercial Purposes for Use: Administration of claims and handling of customer incidents

Demographic Information - including age, gender, ethnicity, education history, employment status, marital status, household size/composition, and household income

  • Business/Commercial Purposes for Use: Providing customer service; internal research and development; marketing; data analytics; product/service improvement and development; and administration of claims and handling of customer incidents

Commercial Information including records of products or services purchased or other purchasing or consuming histories or tendencies, and event registration/attendance information

  • Business/Commercial Purposes for Use: Providing customer service; processing or fulfilling orders and transactions; event management; marketing; data analytics; product/service improvement and development; internal research and development; detecting security incidents, protecting against malicious, deceptive, fraudulent, or illegal activity, and prosecuting those responsible for that activity; and administration of claims and handling of customer incidents

Internet or Other Electronic Network Activity Information – including browsing history, search history, information regarding a customer’s interaction with an internet website, application, or advertisement, and information customers post or make available on social media or other public-facing websites or mobile applications

  • Business/Commercial Purposes for Use: Providing customer service; marketing; data analytics; product/service improvement and development; internal research and development; detecting security incidents, protecting against malicious, deceptive, fraudulent, or illegal activity, and prosecuting those responsible for that activity; auditing related to a current interaction with a customer and concurrent transactions, including, but not limited to, counting ad impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance with this specification and other standards; and debugging to identify and repair errors that impair existing intended functionality

Geolocation Data

  • Business/Commercial Purposes for Use: Providing customer service (in particular, to automatically display the closest Whole Foods store to users of our website)

Audio/Visual Information – including video footage from CCTV cameras in our stores and audio recordings of customer service calls

  • Business/Commercial Purposes for Use: Providing customer service; detecting security incidents, protecting against malicious, deceptive, fraudulent, or illegal activity, and prosecuting those responsible for that activity; and administration and handling of claims and customer incidents

Questionnaire/Survey Responses

  • Business/Commercial Purposes for Use: Providing customer service; marketing; data analytics; product/service improvement and development; and internal research and development

Other any other information a customer provides to us in connection with a customer service request or issue, a claim or incident, or otherwise

  • Business/Commercial Purposes for Use: Providing customer service; administration of claims and handling of customer incidents; and any other purpose relevant to the reason that the information is provided

In addition, we may use any of the categories of personal information to be collected to comply with legal obligations, to pursue or defend against legal actions or claims, and to protect the rights, property, life, health, security, and/or safety of us or any third party.

For more information about our privacy practices, please see the California-Specific Privacy Policy below.

California-Specific Privacy Policy

1. Collection and Disclosure of Personal Information

We describe below the categories of personal information collected in the preceding 12 months and, for each category of personal information collected, the categories of sources of that personal information, the business and commercial purposes for collection, and the categories of third parties to whom the personal information is disclosed for a business purpose or commercial purpose.

Whole Foods does not sell our customers’ personal information.

Identifiers – including real name, alias, postal address, date of birth, unique personal identifier (such as customer number, telephone number, and cookies, beacons, pixel tags, mobile ad identifiers, or similar technologies), online identifier, internet protocol address, and email address

  • Categories of Sources: Directly from customers, from service providers, and from affiliates
  • Purposes for Collection: Providing customer service; processing or fulfilling orders and transactions; verifying customer information; processing payments; administering contests, sweepstakes, and other promotions; marketing; data analytics; product/service improvement and development; internal research and development; detecting security incidents, protecting against malicious, deceptive, fraudulent, or illegal activity, and prosecuting those responsible for that activity; auditing related to a current interaction with a customer and concurrent transactions, including, but not limited to, counting ad impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance with this specification and other standards; debugging to identify and repair errors that impair existing intended functionality; and administration of claims and handling of customer incidents
  • Categories of Third Parties: Service providers, affiliates, law enforcement, insurers, and social networks (where a customer has requested to share content on a social network)

Financial Information – including credit/debit card number, security code, and expiration date

  • Categories of Sources: Directly from customers
  • Purposes for Collection: Processing or fulfilling orders and transactions; processing payments; detecting security incidents, protecting against malicious, deceptive, fraudulent, or illegal activity, and prosecuting those responsible for that activity; and providing customer service
  • Categories of Third Parties: Service providers, payment processors, and law enforcement

Physical Characteristics or Description

  • Categories of Sources: Directly from customers and from law enforcement
  • Purposes for Collection: Detecting security incidents, protecting against malicious, deceptive, fraudulent, or illegal activity, and prosecuting those responsible for that activity
  • Categories of Third Parties: Service providers and law enforcement

Medical/Health Insurance Information

  • Categories of Sources: Directly from customers and from service providers
  • Purposes for Collection: Administration of claims and handling of customer incidents
  • Categories of Third Parties: Service providers and insurers

Demographic Information – including age, gender, ethnicity, education history, employment status, marital status, household size/composition, and household income

  • Categories of Sources: Directly from customers and service providers
  • Purposes for Collection: Providing customer service; internal research and development; marketing; data analytics; product/service improvement and development; and administration of claims and handling of incidents
  • Categories of Third Parties: Service providers, affiliates, and law enforcement

Commercial Information including records of products or services purchased or other purchasing or consuming histories or tendencies, and event registration/attendance information

  • Categories of Sources: Directly from customers and from service providers
  • Purposes for Collection: Providing customer service; processing or fulfilling orders and transactions; event management; marketing; data analytics; product/service improvement and development; internal research and development; detecting security incidents, protecting against malicious, deceptive, fraudulent, or illegal activity, and prosecuting those responsible for that activity; and administration of claims and handling of customer incidents
  • Categories of Third Parties: Service providers, affiliates, and law enforcement

Internet or Other Electronic Network Activity Information – including browsing history, search history, information regarding a customer’s interaction with an internet website, application, or advertisement, and information customers post or make available on social media or other public-facing websites or mobile applications

  • Categories of Sources: Directly from customers, from service providers, and from social media or other public-facing websites or mobile applications
  • Purposes for Collection: Providing customer service; marketing; data analytics; product/service improvement and development; internal research and development; detecting security incidents, protecting against malicious, deceptive, fraudulent, or illegal activity, and prosecuting those responsible for that activity; auditing related to a current interaction with a customer and concurrent transactions, including, but not limited to, counting ad impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance with this specification and other standards; and debugging to identify and repair errors that impair existing intended functionality
  • Categories of Third Parties: Service providers and affiliates

Geolocation Data

  • Categories of Sources: Directly from customers (via their browsers)
  • Purposes for Collection: Providing customer service (in particular, to automatically display the closest Whole Foods store to users of our website)
  • Categories of Third Parties: None

Audio/Visual Information – including video footage from CCTV cameras in our stores and audio recordings of customer service calls

  • Categories of Sources: Directly from customers
  • Purposes for Collection: Providing customer service; detecting security incidents, protecting against malicious, deceptive, fraudulent, or illegal activity, and prosecuting those responsible for that activity; and administration of claims and handling of customer incidents
  • Categories of Third Parties: Service providers, insurers, and law enforcement

Questionnaire/Survey Responses

  • Categories of Sources: Directly from customers and from service providersPurposes for
  • Collection: Providing customer service; marketing; data analytics; product/service improvement and development; and internal research and development
  • Categories of Third Parties: Service providers

Other Any other information a customer has provided to us in connection with a customer service request or issue, a claim or incident, or otherwise

  • Categories of Sources: Directly from customers
  • Purposes for Collection: Providing customer service; administration of claims and handling of customer incidents; and any other purpose relevant to the reason that the information was provided
  • Categories of Third Parties: Service providers, insurers, and any other third party relevant to the reason that the information was provided

We also may use and disclose any of the personal information we collect:

  • as necessary to comply with legal obligations;
  • in response to subpoenas or other legal process or, if in our good faith opinion, such disclosure is required by law;
  • at the request of governmental authorities conducting an investigation;
  • to pursue or defend against legal actions or claims;
  • to protect the rights, property, life, health, security, and/or safety of us or any third party; and
  • in connection with, or during negotiations of, any proposed or actual merger, purchase, sale (including a liquidation, realization, foreclosure or repossession), lease, amalgamation or any other type of acquisition of all or any portion of Whole Foods assets, financing, disposal, conveyance or transfer of all or a portion of our business to another company.

In addition, we may collect and use any other personal information for any other purpose, and share it with any other third party, with your consent or at your direction.

2. Notice of Financial Incentive

In certain cases, we may offer a gift card or other financial incentive in exchange for your response to a survey that seeks feedback about Whole Foods, information about your shopping behaviors, and, in some cases, demographic information. You may opt in to receive that financial incentive by completing the survey and any related requirements. If you do not want to receive the financial incentive, you may elect to not complete the survey.

3. Your Rights

Access/Deletion

California customers have the right to request:

  • that Whole Foods disclose what personal information about them that we collect, use, and disclose, including the specific pieces of the personal information about them that we have collected (referred to as an “access request” or a “request to know”); and
  • that Whole Foods delete the personal information about them collected or maintained by Whole Foods (referred to as a “deletion request”).

California customers may submit an access or deletion request (each, a “California Consumer Rights Request”) by completing the online request form , calling us at 844-WFM-TALK, or visiting the customer service desk at one of our California-based stores. Before we can begin fulfilling a request, we will need to verify your identity by validating that you have control over the email address that was provided with the request. To do so, we will send a verification email asking you to click a link to verify your identity. In limited cases, we may request additional information to verify your identity.

California customers may designate an authorized agent to submit a California Consumer Rights Request on their behalf. To do so, please have the agent submit a request on your behalf by completing the online request form , calling us at 844-WFM-TALK, or visiting the customer service desk at one of our California-based stores.

When submitting a request, the agent will need to:

1. Provide your zip code, name, email address, and phone number when prompted by the online request form or the Customer Care representative.

2. Provide their own name and email address, a statement indicating that they are acting as an authorized agent to submit a request on your behalf, and, if applicable, a statement indicating that you have provided them with a power of attorney that is valid under California law. That information should be included in the free-text field at the bottom of the online request form , or, if the request is made by phone, that information should be provided to the Customer Care representative.

After the agent has submitted the request, you will receive an email asking you to verify your identity. After you verify your identity, we may follow up with you and/or your agent to gather any additional information we need to fulfill the request.

In accordance with California law, we have a policy of responding to only two access requests from a customer in a 12-month period.

Please see the “ California Consumer Rights Request FAQs ” for more information about access and deletion requests.

Non-Discrimination

In addition, you have a right to not receive discriminatory treatment by Whole Foods for the exercise of the privacy rights conferred by California law.

Opt Out of Certain Data Sharing

California law permits customers in California to request certain details about how their information is shared with third parties and, in some cases, affiliates, for those third parties’ and affiliates’ own direct marketing purposes. Under the law, a business must either provide this information or permit California customers to opt in to, or opt out of, this type of sharing.

We may from time to time elect to share certain information about you collected by us on the Service (as defined in the Privacy Notice) with third parties or affiliates for those third parties’ or affiliates’ own direct marketing purposes. If you are a California resident, you may opt out of such future sharing of your personal information (as defined by the California Shine the Light Act) and/or request information about our compliance with this law by contacting us at privacyandterms@wholefoods.com or by sending a letter to Whole Foods Market Services, Inc., 550 Bowie Street, Austin, TX 78703-4644, United States (Attention: Legal Counsel). Any such request must include "California Privacy Rights Request" in the first line of the request and include your name, street address, city, state, and ZIP code. Please note that we are only required to respond to one request per customer each year, and we are not required to respond to requests made by means other than through this email address or mail address.

4. Contact Information

If you have questions or concerns about Whole Food’s privacy policies and practices, you may contact us at:

Whole Foods Market Services, Inc.550 Bowie Street
Austin, TX 78703-4644, United States
(Attention: Legal Counsel)
privacyandterms@wholefoods.com

We may not respond to all request or inquiries.

Explore More

Join Vitamin Angels in the Fight Against Malnutrition
What’s New: Matcha Energy Drinks, Gochujang Condiments and More
Meet Summer’s Hottest Cool Dessert: Cheesecake Bites
Break the Fast With Tons of Flavor and Zero Stress This Ramadan