MyWalmart

"Biometric Information, such as voiceprints, imagery of the iris, retina and facial geometry, and fingerprints. ... Sensory Information, such as audio and/or video information and recordings, photographs, and other sensory information such as device acceleration and movements and environmental sensors."

Walmart collects an extraordinarily broad range of biometric and sensory data from associates, including iris scans, retinal imagery, facial geometry, voiceprints, fingerprints, and device motion/environmental sensor data — well beyond what most employment relationships require.

"Location information, such as precise geo-location information. ... Additionally, we collect telematics data in corporate vehicles and devices. Telematics data involves the use of installed hardware to collect and transmit data about a vehicle or device which may include the vehicle or device's location, use, and maintenance needs."

Walmart collects precise geolocation data and uses telematics hardware in corporate vehicles and devices to continuously track location and usage, and shares this location data with vendors and business partners.

"Business partners, including those that receive data for their own independent use and not to provide services to a Walmart entity. ... Device Information and Online Activity [is disclosed to] Vendors for Business Operations... Business partners, including those that receive data for their own independent use and not to provide services to a Walmart entity; Recruitment services; and Local, state, or federal government entities."

Walmart shares associate personal information — including device/online activity, demographic information, geolocation, and employment info — with business partners who use the data for their own independent purposes, not just to serve Walmart.

"Walmart may modify this Notice at its sole discretion without notice, at any time, consistent with applicable law. ... Walmart reserves the right to change this Notice at any time. Associates should check OneWalmart regularly for updates."

Walmart reserves the right to change the privacy notice at any time, at its sole discretion, without providing notice to associates, placing the burden on employees to regularly check for updates.

"Associate information may be shared with our business teams or within our corporate family of companies (retail companies and non-retail companies, e.g., Sam's Club and One Finance), as permitted by law. ... We may collect your personal information from another organization within our corporate family of companies, such as with Sam's Club."

Walmart combines associate data across its corporate family including Sam's Club and One Finance, and also draws inferences from multiple data sources to build profiles of associates.

"We will keep the personal information we collect about you for as long as necessary to carry out the purposes set forth in this Privacy Notice or any other notice provided at the time of data collection, but no longer than as required or permitted under applicable law or internal Walmart policy."

The retention policy is open-ended — data is kept as long as 'necessary' or 'permitted' by law or internal policy, with no specific timelines given for most data categories, and biometric data may be kept up to three years after last interaction.

"If we can't verify your identity, we will notify you, and your request(s) to access, request, or delete your personal information may not be processed. Any requests may be denied if we have reason to believe they are fraudulent. ... Requests to access your personal information may be submitted up to two times in a rolling twelve-month period."

Deletion requests require a multi-step identity verification process, can be denied if verification fails, and access requests are limited to twice per year, creating barriers to exercising data rights.