Data Sharing in Corporate Transactions

What it is

If Whatnot is sold, merged, or acquires financing, your personal data may be transferred to the new owner as part of the deal, even before the transaction is finalized.

Why it matters (compliance & governance perspective)

This clause means your personal information could end up with a different company, potentially with different privacy practices, if Whatnot undergoes a business change, and this can occur during negotiations before a deal closes.

Consumer impact (what this means for users)

Personal data including purchase history, payment information, and behavioral profiles may be transferred to third parties during corporate transactions, and the receiving entity may not be bound by the same privacy commitments as Whatnot.

Institutional analysis (Compliance & governance intelligence)

REGULATORY LANDSCAPE: This provision is standard in commercial privacy policies but engages GDPR Article 6 requirements that any transfer of personal data in a corporate transaction must have a valid legal basis, and Article 13/14 transparency obligations regarding new data controllers. CCPA requires that the successor entity honor existing consumer rights requests. The FTC has previously taken enforcement action where acquired data was used in ways inconsistent with prior privacy representations. GOVERNANCE EXPOSURE: Medium. The inclusion of 'negotiations' as a trigger for potential data sharing expands the window during which data may be disclosed to third parties beyond a completed transaction, which may create exposure under GDPR's data minimization and purpose limitation principles. JURISDICTION FLAGS: EU and UK users face heightened exposure because GDPR imposes strict requirements on the transfer of personal data to new controllers, including notification obligations. California CPRA requires that successor entities honor opt-out and deletion requests. CONTRACT AND VENDOR IMPLICATIONS: M&A due diligence teams and acquirers should assess whether data assets transferred include GDPR-regulated personal data requiring specific transfer mechanisms, and whether consent or legitimate interest bases are portable to the acquiring entity. COMPLIANCE CONSIDERATIONS: Legal teams should ensure that any data room or due diligence process involving personal data is governed by appropriate confidentiality and data processing agreements. Post-transaction, a review of privacy notice updates and user notification obligations may be required.

Applicable agencies

Applicable regulations

Provision details

Other risks in this policy

• Sale or Sharing of Personal Data with Advertising Partners medium
• AI and Machine Learning Training on User Data medium
• Children Under 13 and COPPA Compliance medium
• Cross-Border Data Transfers medium
• Data Retention low
• California Consumer Privacy Rights low

Related Analysis

• Meta Removed 438 Sentences From Its Privacy Policy. Here Is What Disappeared.

  ConductAtlas detected a major restructuring of Meta’s privacy policy that removed detailed consumer rights disclosures and relocated them to separate documents.

• 23andMe Is Bankrupt. What Happens to Your DNA Now?

  Your genetic data may be transferred to a new owner as a business asset. Here is what the Terms of Service actually say and what you can do right now.