Last Updated: June 28, 2024.
This additional state-specific privacy disclosure page ("Disclosure") supplements the Whole Foods Market Privacy Notice and is effective as of June 28, 2024. The Amazon Privacy Notice (which is supplemented and modified by the Whole Foods Market Privacy Notice) describes the personal information that we collect, the sources from which we collect it, the purposes for which we use it, the limited circumstances under which we share personal information, and with whom we share it. These additional disclosures are required by certain state privacy laws and provide a Notice at Collection under the California Privacy Rights Act:
1. Categories of personal information collected. The personal information that Whole Foods Market collects, or has collected from consumers in the twelve months prior to the effective date above, falls into the following categories established by the California Privacy Rights Act and other state privacy laws, depending on which Whole Foods Market Service is used:
- identifiers such as your name, alias, email address, address, phone numbers, IP address, or your Amazon account log-in information (which is used to log-in to the Whole Foods Market website);
- personal information, such as a credit card number or other payment information;
- information that may reveal age, gender or gender identity, race, or other protected classifications, for example if you completed a consumer insights survey;
- commercial information, such as purchase activity;
- internet or other electronic network activity information, including information regarding your interaction with our websites, emails, or advertisements or information used to prevent and detect fraud or other unauthorized activity, including informing customers if such activity were to affect them;
- geolocation data, which may in some cases constitute precise geolocation information, such as if you consented to the collection of the location of your device or computer when visiting our website for purposes of allowing us to show you information about the Whole Foods Market stores closest to you;
- audio or visual information, such as photographs or video footage from CCTV cameras in our stores and audio recordings of customer service calls;
- inference data, such as information about your purchase preferences; and
- health data and/or health insurance information, in the rare case where there is an accident or injury in our stores or relating to our products or services. Our Consumer Health Data Privacy Disclosure provides additional information about “Consumer Health Data” under certain state laws.
2. Categories of personal information disclosed for a business purpose. The personal information that Whole Foods Market may have disclosed for a business purpose to the third parties identified in the “Does Amazon Share Your Personal Information?” section of the Amazon Privacy Notice in the twelve months prior to the effective date above falls into the following categories established by the California Privacy Rights Act and other state privacy laws, depending on which Whole Foods Market Service is used:
- identifiers such as your name, email address, address, phone numbers, or IP address, for example if we co-sponsor a promotion or event with a third party;
- personal information, such as a credit card number or other payment information, for example if we use a third-party payment processor;
- information that may reveal age, gender or gender identity, race, or other protected classifications, for example if you choose to participate in a survey distributed by a survey provider;
- commercial information, such as the details of a product or service you purchased if a third-party service provider assists in providing that product or service to you;
- internet or other electronic network activity information, such as if we use a service provider to help us analyze usage of our websites, or information relating to our prevention and detection of fraud or other unauthorized activity, which may require disclosing certain information about potentially affected customers to law enforcement;
- geolocation data, which may constitute precise geolocation data, such as if a third party assists us with showing you information about the Whole Foods Market stores closest to you based on the location of your device or computer;
- audio or visual information, for example if we use a service provider to store recordings of customer service phone calls for quality assurance purposes or to provide a platform for the monitoring and storage of CCTV footage; and
- health data and/or health insurance information, such as if we use a service provider to help us respond to the rare case where there is an accident or injury in our stores or relating to our products or services.
3. Advertising. Whole Foods Market processes personal information for the purposes of targeted advertising, as that term is defined under certain state privacy laws.
4. Teens. As stated in the Amazon Privacy Notice, Amazon allows children or teens to use certain products or services, such as creating a teen login, with parental involvement or permission. Whole Foods Market may process the personal information of teens with their own teen login when those teens self-identify as an Amazon accountholder when using the Whole Foods Market Services, such as when a teen self-identifies as an Amazon accountholder at a Whole Foods Market store to receive their Prime benefits. That data may be disclosed in a limited set of circumstances, such as if we use a service provider to help us process transaction data. We do not serve cross-context behavioral ads to teens under 18 years old unless they opt in.
5. Your Data Rights: You may have certain data rights under state privacy laws, including to request information about the collection of your personal information by Whole Foods Market, to access your personal information in a portable format, and to correct or delete your personal information. If you wish to do any of these things, please complete the online request form (choose “Data Subject Request” from the drop-down menu) or contact Customer Service at 1-844-WFM-TALK. Additionally, you may have the right to opt out of the processing of your personal data for cross-context behavioral advertising (also referred to as targeted advertising under certain state privacy laws) . To do so, please visit “Your Ads Privacy Choices,” where you can opt out of cross-context behavioral advertising, or our Advertising Preferences page, where you can opt out of interest-based advertising. You can also enable the Global Privacy Control (GPC) on your browser to opt out of cross-context behavioral ads. You may have the right to appeal the denial of any of these rights by following instructions that will be provided to you if we deny a data request. Depending on your data choices, certain services may be limited or unavailable.
To ensure the security of your personal information, we will generally ask you to verify your request using the contact information you have already provided. For more information about exercising your data rights, including how an authorized agent under applicable state law may make a request, visit here.
6. No Sale or Sharing of Personal Information. In the twelve months prior to the effective date of this Disclosure, Whole Foods Market has not sold or shared any personal information of consumers, as those terms are defined under the California Privacy Rights Act.
7. De-identified Data Disclosure. Whole Foods Market may use de-identified data in some instances. Whole Foods Market either maintains such data without attempting to re-identify it or treats such data as personal data subject to applicable law.
8. California Privacy Rights Act Sensitive Personal Information Disclosure. The categories of data that Whole Foods Market collects and discloses for a business purpose include “sensitive personal information” as defined under the California Privacy Rights Act. Whole Foods Market does not use or disclose sensitive personal information for any purpose not expressly permitted by the California Privacy Rights Act.
9. California Privacy Rights Act Retention Disclosure. To enable your continued use of Whole Foods Market Services, we keep your personal information for as long as it is required in order to fulfill the relevant purposes described in the Whole Foods Market Privacy Notice, as permitted or as may be required by law, or as otherwise communicated to you.
10. California Privacy Rights Act Non-Discrimination Statement. Whole Foods Market will not discriminate against any consumer for exercising their rights under the California Privacy Rights Act.
11. Colorado Privacy Act and Oregon Consumer Privacy Act Profiling Disclosure. Whole Foods Market does not engage in profiling of consumers in furtherance of automated decisions that produce legal or similarly significant effects, as those terms are defined under the Colorado Privacy Act or the Oregon Consumer Privacy Act.
12. Oregon Consumer Privacy Act Controller Entity Disclosure. The controller entities that are subject to the Whole Foods Market Privacy Notice and this Disclosure include WFM-WO, Inc., Whole Foods Market Pacific Northwest, Inc., and Whole Foods Market Services, Inc.
13. Annual Reporting for 2023
Access Requests. In 2023, Whole Foods Market received 12 requests from Whole Foods Market customers to initiate the data access process. For 3 of these customers, their request was not completed because the customer did not complete the verification process or canceled the request. The remaining 9 requests were processed with a median return time of 41 days.
Deletion Requests. In 2023, Whole Foods Market received 17 requests from Whole Foods Market customers to initiate the data deletion process. For 3 of these customers, their request was not completed because the customer did not complete the verification process or canceled the request. The remaining 14 requests were processed with a median processing time of 39.5 days.
Correction Requests. In 2023, Whole Foods Market did not receive any requests from Whole Foods Market customers to correct their data.
