Merger and Acquisition Data Disclosure

What it is

TaskRabbit can share your personal information with prospective buyers or merger partners even before any deal is finalized, during the negotiation phase.

Why it matters (compliance & governance perspective)

This clause establishes the operational framework for handling personal information in corporate transaction scenarios. It permits data transfer to prospective acquirers without requiring separate user consent, treating personal information as a transferable business asset during ownership changes.

Consumer impact (what this means for users)

Your personal information, including sensitive data categories such as identity documents and background check results, may be shared with prospective acquirers or merger partners during deal negotiations, which could expose your data to a third party that does not ultimately complete the transaction.

Institutional analysis (Compliance & governance intelligence)

1. REGULATORY LANDSCAPE: Under GDPR, disclosure of personal data to prospective acquirers during M&A due diligence requires a valid legal basis; legitimate interests under Article 6(1)(f) is commonly invoked but requires a balancing test demonstrating that the legitimate interest overrides data subject rights, particularly for sensitive data categories. The FTC has previously scrutinized data asset transfers in M&A contexts under Section 5. CCPA requires that data transferred in a merger qualify as a business purpose or that consumers be notified and given opt-out rights. 2. GOVERNANCE EXPOSURE: Medium. The clause's extension to 'negotiations of any proposed' transaction is broader in pre-closing scope than some comparable policies, and the absence of any stated contractual safeguard requirement (such as NDAs or data use limitations for prospective buyers) creates due diligence exposure. For EEA and UK users, sharing sensitive data categories with prospective acquirers during negotiations may require DPIA review. 3. JURISDICTION FLAGS: California residents may have CCPA rights triggered if personal data is transferred in a merger that constitutes an asset sale. EEA and UK users retain GDPR rights regardless of corporate restructuring, and any acquirer must be bound by equivalent data protection obligations. Canada's PIPEDA requires notification to affected individuals where personal information is being transferred for processing by a third party. 4. CONTRACT AND VENDOR IMPLICATIONS: M&A due diligence data rooms containing TaskRabbit user personal data should be governed by data room access agreements that limit use to evaluation purposes and require destruction of data if the transaction does not close. Acquirers should conduct privacy due diligence assessments covering the full scope of sensitive data categories disclosed in this policy. 5. COMPLIANCE CONSIDERATIONS: Compliance teams involved in any TaskRabbit transaction should assess whether user notification or opt-out rights are triggered under CCPA or state equivalents, and whether GDPR legitimate interests assessments have been documented for pre-closing data sharing. Post-closing, the acquirer's privacy policy obligations and any required user notifications should be evaluated before the transaction closes.

Applicable agencies

Provision details

Other risks in this policy

• Third-Party Advertising Data Sharing high
• Sensitive Data Collection: Government ID, SSN, and Background Checks high
• CCPA Sale Acknowledgment and Opt-Out medium
• Canadian Cross-Border Data Transfer Consent medium
• Identity Verification Requirement for Rights Requests medium
• Legal Obligations and Discretionary Disclosure medium