Interest-based advertising through advertising partners
WHOOP says it engages advertising partners, including third-party advertising companies and social media companies, to advertise its Services. WHOOP and those partners may use cookies and similar technologies to collect information about your interaction over time across the web, WHOOP's communications and other online services, and may use that information to serve online ads. WHOOP states that it complies with the Digital Advertising Alliance Self-Regulatory Principles for Online Behavioral Advertising and points to its "Online tracking opt-outs" section for choices. Third parties may place their own cookies on your devices.
Supporting quotations
We engage our advertising partners, including third party advertising companies and social media companies, to advertise our Services.
We and our advertising partners may use Cookies and similar technologies to collect information about your interaction over time across the web, our communications, and other online services, and may use that information to serve online ads.
We comply with the Digital Advertising Alliance Self-Regulatory Principles for Online Behavioral Advertising.
including third parties that have placed their own Cookies on your device(s)
Qualifications & exceptions
The collection described covers interaction over time across the web, not only WHOOP's own site.
The compliance statement refers to an industry self-regulatory program.
Sharing & Disclosure · Company practice
Sharing with service providers, including the AI partner behind WHOOP Coach
WHOOP says it may share your Personal Data with service providers that provide services to it or on its behalf. The examples named are payment processors, vendors who advertise WHOOP's Services or other products, security and fraud prevention consultants, hosting and other technology and communications providers, its third-party large language model ("LLM") partner that powers WHOOP Coach (described in Section 8), analytics providers, and staff augmentation and contract personnel. "Such as" means the list is illustrative, and the policy does not name the providers in this part.
Supporting quotations
We may share your Personal Data with:
Service providers, such as payment processors, vendors who advertise our Services or other WHOOP products, security and fraud prevention consultants, hosting and other technology and communications providers, our third-party Large Language Model (“LLM”) partner that powers WHOOP Coach (as described in Section 8 below), analytics providers, and staff augmentation and contract personnel, that provide services to us or on our behalf;
Qualifications & exceptions
The list is introduced with "such as," so these are examples of service providers, not an exhaustive list.
Service providers are those that "provide services to us or on our behalf."
Not stated here
The providers are not named in this section.
What data each kind of provider receives is not stated here.
Sharing & Disclosure · Company practice
Advertising partners can collect information through cookies; WHOOP says it does not sell Personal Data
WHOOP says it may share your Personal Data with advertising partners that may collect information on its website through cookies and other automated technologies, including for the interest-based advertising purposes described earlier. In its California paragraph WHOOP says that in the 12 months before the policy date it did not sell any Personal Data, that it does not sell Personal Data, and that it only shared Personal Data as described in the policy.
Supporting quotations
Advertising partners that may collect information on our website through Cookies and other automated technologies, including for the interest-based advertising purposes described above.
For the 12-month period prior to the date of this Privacy Policy, WHOOP has not sold any Personal Data. We do not sell Personal Data.
We and our advertising partners may use Cookies and similar technologies to collect information about your interaction over time across the web
including third parties that have placed their own Cookies on your device(s)
Qualifications & exceptions
The advertising partners collect information through cookies and automated technologies on the website.
The no-sale statement is given for the 12-month period before the policy date and in the present tense.
Not stated here
Whether sharing through cookies counts as a "sale" or "share" under each state law is for those laws; this policy states only that it does not sell Personal Data.
Sharing & Disclosure · Company practice
Laboratory and health provider partners receive data when you join Advanced Labs
WHOOP says it may share your Personal Data with third-party laboratory or health provider partners when you choose to participate in WHOOP Advanced Labs. In the section on sharing you control, WHOOP adds that if you choose to participate, it may share your Personal Data with those third parties subject to your explicit consent.
Supporting quotations
Third-party laboratory or health provider partners, when you choose to participate in WHOOP Advanced Labs;
If you choose to participate in WHOOP Advanced Labs, we may share your Personal Data with such third-parties subject to your explicit consent.
Qualifications & exceptions
Sharing is tied to your choice to participate in WHOOP Advanced Labs and, per the later statement, subject to your explicit consent.
Not stated here
The laboratory and provider partners are not named, and which data is shared is not specified.
Sharing & Disclosure · Company practice
Sharing with professional advisors, distributors and retailers, and affiliates
WHOOP says it may share your Personal Data with professional advisors such as lawyers, auditors, bankers and insurers, where necessary in the course of the professional services they provide to WHOOP; with distributors and retailers of its Services or other WHOOP products; and with affiliates of WHOOP. The advisor item is limited to where the sharing is necessary for their professional services; the distributor, retailer and affiliate items state no purpose limit.
Supporting quotations
Professional advisors, such as lawyers, auditors, bankers, and insurers, where necessary in the course of the professional services they render to us;
Distributors and retailers of our Services or other WHOOP products; and
Affiliates of WHOOP.
Qualifications & exceptions
Advisor sharing is limited to what is "necessary in the course of the professional services they render to us."
Not stated here
No purpose or data limit is stated for sharing with distributors, retailers or affiliates.
Sharing & Disclosure · Company practice
Business transfers can include your Personal Data
WHOOP says it may share Personal Data with business transferees, such as acquirers and other participants in business transactions, or in diligence or negotiations for them, involving a divestiture, merger, consolidation, acquisition, reorganization, sale or other disposition of all or any part of the business, assets or equity of WHOOP or its affiliates, including in a bankruptcy or similar proceeding. Sharing can occur at the diligence or negotiation stage, before a transaction is completed.
Supporting quotations
Business transferees, such as acquirers and other relevant participants in business transactions (or diligence or negotiations for such transactions) involving a corporate divestiture, merger, consolidation, acquisition, reorganization, sale, or other disposition of all or any portion of the business or assets of, or equity interests in, WHOOP or our affiliates (including, in connection with a bankruptcy or similar proceedings);
Qualifications & exceptions
Sharing may occur "diligence or negotiations for such transactions," not only after a deal closes.
Not stated here
The policy does not say what happens to your Personal Data or what choices you have after a transfer.
Sharing & Disclosure · Company practice
WHOOP Live and WHOOP Teams: other users, searchability and public visibility
Depending on how you use the Services, you may share Personal Data with other users of the Services or the general public, such as through the WHOOP Live or WHOOP Teams features, which let you choose to share information and content with other users. Users are by default searchable by other users. When you make Personal Data visible to other users, including through WHOOP Live or WHOOP Teams, it may become publicly available and can be collected, viewed and used by anyone.
Supporting quotations
Depending on how you use the Services, you may share Personal Data with:
users are by default searchable by other users
When you make Personal Data visible to other users of the Services, including through the WHOOP Live or WHOOP Teams features, it may become publicly available and can be collected, viewed, and used by anyone;
Qualifications & exceptions
Sharing through these features is something you choose, but users are by default searchable by other users.
Once visible to other users, data "may become publicly available" and can be collected, viewed and used by anyone.
Not stated here
The text does not say which fields are visible in search by default.
Sharing & Disclosure · User right or choice
Linked social media and third-party accounts
You may share Personal Data with third-party social media platforms, or linked accounts, devices or features, when you choose to connect your account on those services with your WHOOP account or post content to social media, such as through the WHOOP Live feature.
Supporting quotations
Third-party social media platforms, or linked accounts, devices, or features, when you choose to connect your account on those services with your WHOOP account or post content to social media, such as through the WHOOP Live feature;
Qualifications & exceptions
Sharing occurs when you choose to connect an account or post content.
Sharing & Disclosure · Company practice
Managing entities and corporate wellness programs
If you use the Services on behalf of, or managed by, a managing entity such as a coach, team, organizing body or other affiliated entity, your account information and Personal Data may be shared with that entity subject to your consent. The text also says "you hereby consent to that managing entity allowing that information to be publicly shared, subject to any features of the Services that expressly override that control," and that the managing entity determines how the information and content are shared. If you use the Services with an employer or organizational corporate wellness program, WHOOP may share your information with that organization subject to your consent, and typically shares only aggregated data with these organizations.
Supporting quotations
your account information and Personal Data may be shared with the managing entity subject to your consent, and you hereby consent to that managing entity allowing that information to be publicly shared, subject to any features of the Services that expressly override that control. The managing entity will determine how the relevant information and content is shared
we may share your information with that organization subject to your consent. Typically, we will share only aggregated data with these organizations.
Qualifications & exceptions
Sharing with a managing entity is "subject to your consent," and the same item states you consent to the entity allowing public sharing.
The managing entity determines how information is shared, except where a Service feature expressly overrides that control.
For corporate wellness programs the policy says WHOOP "typically" shares only aggregated data.
Not stated here
"Typically" leaves open when non-aggregated data could be shared with an employer or organization.
Sharing & Disclosure · Company commitment
The AI partner receives only de-identified metrics and is bound by a zero-retention, zero-training policy
WHOOP says it requires its LLM partner to use your WHOOP metrics strictly to allow WHOOP Coach to generate content for you, and that it has ensured the partner has a "Zero-Retention/Zero Training Policy" for your WHOOP metrics, meaning the partner will not store or retain any of your Personal Data or use any WHOOP metrics to train algorithms or LLM technology. WHOOP also says it will only share de-identified WHOOP metrics with the partner and asks you not to provide identifying information, such as your name, in conversations with WHOOP Coach.
Supporting quotations
We require our LLM partner to use your WHOOP metrics strictly to allow WHOOP Coach to generate content for you.
our LLM partner will not store or retain any of your Personal Data nor use any WHOOP metrics for training any algorithms or LLM technology
We will only share de-identified WHOOP metrics with our LLM partner. Please do not provide any identifying information, such as your name, in conversations with WHOOP Coach.
Qualifications & exceptions
The zero-retention and zero-training description is stated about WHOOP metrics and WHOOP's arrangement with its partner.
The request not to type identifying information in Coach conversations puts that part on you; conversations are also described elsewhere as retained by WHOOP.
Not stated here
The partner's own terms are not supplied, so the policy text cannot show how the arrangement is enforced.
The text does not say what protections apply to identifying information you type into a conversation.
Cross-references
contrast (model-proposed): WHOOP may keep Coach conversation history, share context with the AI partner, and you can delete it — contrast: WHOOP says its LLM partner will not store or retain any of your Personal Data, while also saying WHOOP may retain Coach conversation history and share the context of earlier conversations with that partner when you revisit topics. The text does not reconcile the two, so the reader should treat the partner's handling of earlier conversation context as unclear.
Sharing & Disclosure · Company commitment
Membership Services AI: the AI partner gets only de-identified metrics under a zero-retention, zero-training policy
For Membership Services AI, WHOOP says it requires its LLM partner to use your WHOOP metrics only to let Membership Services AI generate content for you. It says the partner has a "Zero-Retention/Zero Training Policy" for your WHOOP metrics, meaning the partner will not store or retain any WHOOP metrics it receives through your use of Membership Services and will not use any of them to train algorithms or LLM technology. WHOOP says it will only share de-identified WHOOP metrics with the partner. These statements are about WHOOP metrics; the text does not mention other information such as prompts or purchase records.
Supporting quotations
We require our LLM partner to use your WHOOP metrics only for the purpose of allowing Membership Services AI to generate content for you.
our LLM partner will not store or retain any of the WHOOP metrics they receive through your use of Membership Services, and our LLM partner will not use any of the WHOOP metrics they receive for training any algorithms or LLM technology
We will only share de-identified WHOOP metrics with our LLM partner.
Qualifications & exceptions
The retention and training statements are limited to "WHOOP metrics" the partner receives through Membership Services.
Not stated here
The partner's own terms are not supplied.
The text does not say whether the partner stores or trains on your prompts or purchase records.
Sharing & Disclosure · User right or choice
Leave a WHOOP Team to stop sharing with team members
If you have joined a WHOOP Team, you may stop the sharing of your Personal Data with the members of the WHOOP Team at any time by opening the WHOOP mobile app, going to the Team view, opening the Team menu and selecting "Leave Team."
Supporting quotations
If you have joined a WHOOP Team, you may stop the sharing of your Personal Data with the members of the WHOOP Team at any time by accessing your WHOOP mobile application, navigating to the Team view, opening the Team menu, and selecting “Leave Team”.
Qualifications & exceptions
The step applies to sharing with Team members, and it is done in the mobile application.
Sharing & Disclosure · User right or choice
State right to opt out of sale, sharing, targeted advertising and profiling
The notice lists a right to opt out of the selling or sharing of your Personal Data, the processing of your Personal Data for targeted advertising, and/or profiling in furtherance of decisions that produce legal or similarly significant effects. WHOOP says you exercise it according to the instructions in the "Online tracking opt-outs" section. That section describes opt-outs of "certain" interest-based advertising and tracking, many cookie-based. Elsewhere WHOOP says it did not sell Personal Data in the prior 12 months, only shared it as described, and uses cookies and tracking technologies to analyze traffic and facilitate advertising.
Supporting quotations
Opt-out of sale and sharing of your Personal Data: You can ask to opt out of the selling or sharing of your Personal Data, the processing of your Personal Data for purposes of targeted advertising, and/or profiling in furtherance of decisions that produce legal or similarly significant effects, which you can exercise according to the instructions in the “Online tracking opt-outs” section of the Privacy Policy.
WHOOP has not sold any Personal Data. We do not sell Personal Data.
we use Cookies and other tracking technologies to analyze website and application traffic and use, and to facilitate advertising
We and our advertising partners may use Cookies and similar technologies
Qualifications & exceptions
The way to exercise this right is the online tracking opt-outs, which cover "certain" interest-based advertising.
WHOOP states it has not sold Personal Data; the opt-out applies to selling or sharing, targeted advertising and certain profiling.
Not stated here
The text does not describe a separate request form for this right beyond the opt-out instructions.
Sharing & Disclosure · Company practice
California "sold" and "shared" disclosure: no sale; cookies facilitate advertising
For the 12 months before the policy date, WHOOP says it has not sold any Personal Data and does not sell Personal Data, and that it has only shared Personal Data as described in the policy. It says it uses cookies and other tracking technologies to analyze website and application traffic and use, and to facilitate advertising. To limit use of cookies and tracking technologies, it points to its "Online tracking opt-outs" instructions, and says you may also direct WHOOP to share your data as described in the section on how you share Personal Data through the Services.
Supporting quotations
WHOOP has not sold any Personal Data. We do not sell Personal Data.
WHOOP has only shared Personal Data as described above.
we use Cookies and other tracking technologies to analyze website and application traffic and use, and to facilitate advertising
To limit use of Cookies and other tracking technologies, please review the instructions provided in the “Online tracking opt-outs” section.
Qualifications & exceptions
The no-sale statement is given for the 12-month period before the policy date and in the present tense.
The statement that data was "only shared" is tied to sharing "as described above" in the policy.
Not stated here
Whether cookie-based advertising counts as "sharing" under California law is not stated; the text says WHOOP uses cookies to facilitate advertising.
Sharing & Disclosure · User right or choice
California Shine the Light: once-a-year request about sharing for third-party direct marketing
The California Shine the Light law lets a California resident request, once per calendar year, information about Personal Information shared with third parties for their own direct marketing purposes, including the categories of information and the names and addresses of those businesses. WHOOP says to make the request, or ask other questions about its privacy practices and compliance with California law, you should contact it through the contact form on its website.
Supporting quotations
If you are a California resident, the Shine the Light law permits you to request and obtain from us once per calendar year information about any of your Personal Information shared with third parties for their own direct marketing purposes
To request this information and for any other questions about our privacy practices and compliance with California law, please contact us through the contact form on our website.
Qualifications & exceptions
The right is for California residents and limited to once per calendar year.
Not stated here
The policy does not say what the response will list; it only describes what the law permits you to request.
Sharing & Disclosure · Company commitment
Brazil: international transfers use safeguards where protection is not adequate
WHOOP says some third parties with access to Personal Data may be located in other countries or may process data outside Brazil, where the level of data protection may not be equivalent to Brazil's. Where it transfers Personal Data to a country that does not provide an adequate level of protection, it says it will only do so under appropriate safeguards to protect the data.
Supporting quotations
Some of the third parties that have access to your Personal Data may be located in other countries or may process data outside Brazil.
Where we transfer Personal Data to a country that doesn't provide an adequate level of protection, we’ll only do so under appropriate safeguards to protect your Personal Data.
Qualifications & exceptions
The safeguards promise applies where the destination country does not provide an adequate level of protection.
Not stated here
The safeguards are not described in this paragraph.
Sharing & Disclosure · Company commitment
Japan: transfers outside Japan, with the United States listed
In the Japan notice, WHOOP says your Personal Data may be transferred to third parties located outside Japan, and that it has ensured the recipient has measures equivalent to those required of a Business Handling Personal Information under the APPI. The notice lists the United States as the country where such third parties (other than those in the European Economic Area) are located, "subject to change due to addition and removal of the Third Parties." It points to reports on U.S., Illinois, California and New York personal information protection legislation published in Japanese by Japan's Personal Information Protection Commission. For the measures third parties take, WHOOP says it will examine the suitability of each third party in advance and confirm appropriate security and other measures consistent with the OECD privacy principles it lists.
Supporting quotations
Your Personal Data may be transferred to third parties who may be located outside of Japan. In this regard, we have ensured that the recipient of Personal Data has put in place adequate measures equivalent to those required for a Business Handling Personal Information under the APPI.
Countries where such Third Parties are located (subject to change due to addition and removal of the Third Parties)
WHOOP will thoroughly examine the suitability of each Third Party to which personal information is provided in advance, and confirm that appropriate measures have been taken in terms of security and other factors regarding the handling of personal information
Qualifications & exceptions
The list of countries is subject to change as third parties are added or removed.
Third parties in the European Economic Area are excluded from the listed information.
The measures commitment is to examine suitability and confirm appropriate measures before providing personal information.
Not stated here
The linked reports from Japan's Personal Information Protection Commission are not supplied here, so this card cannot say what they state about U.S. or state laws.
The third parties are not named in this notice.
Sharing & Disclosure · User right or choice
Mexico: marketing and advertising-partner sharing are with your consent
In the Mexico notice, WHOOP says that with your consent it may use data from your Personal Data and certain data collected when you browse its website to send direct offers or marketing messages or to advertise its Services and products. It says marketing is a secondary purpose not necessary for the legal relationship and that you always have the choice not to receive marketing information, and gives the Data Management and unsubscribe options; you cannot opt out of certain non-marketing emails about the Services. With your consent, it may also share your Personal Data with advertising partners that may collect information on its website through cookies and other automated technologies, including for interest-based advertising.
Supporting quotations
With your consent, we may use data from the Personal Data we collect and certain data collected when you browse our website, to send you direct offers, marketing messages, or advertise the Services or other WHOOP product offerings.
you always have the choice not to receive marketing information
You cannot opt-out of receiving certain non-marketing emails regarding the Services.
With your consent, we may share your Personal Data with advertising partners that may collect information on our website through Cookies and other automated technologies, including for the interest-based advertising purposes described above.
Qualifications & exceptions
Marketing use and advertising-partner sharing in the Mexico notice are stated as "with your consent."
Certain non-marketing emails cannot be opted out of.
Sharing & Disclosure · Company commitment
Qatar: data is transferred to the United States with safeguards for transfers outside Qatar
In the Qatar notice, WHOOP says that to provide the Services it will transfer your Personal Data to the United States. It says it will ensure adequate safeguards are implemented if and when it transfers Personal Data outside Qatar, so that an adequate degree of protection is afforded to it, and you can contact privacy@whoop.com for more information on how it transfers and protects data outside Qatar.
Supporting quotations
In order to provide the Services, WHOOP will transfer your Personal Data to the United States.
WHOOP will ensure that adequate safeguards are implemented if and when we need to transfer Personal Data outside of Qatar so that an adequate degree of protection is afforded to it.
Not stated here
The safeguards are not described in this paragraph.
Sharing & Disclosure · Company commitment
Singapore: overseas transfers need comparable protection
In the Singapore notice, WHOOP says some third parties with access to Personal Data may be located or process data outside Singapore. Where it transfers Personal Data outside Singapore, it says it will take appropriate steps to ensure the overseas recipient is bound by legally enforceable obligations or specified certifications to provide a standard of protection comparable to the Personal Data Protection Act 2012 of Singapore. Data Protection Officer information is said to be available through a link that is not part of the saved text.
Supporting quotations
Where we transfer Personal Data outside Singapore, we will take appropriate steps to ensure that the overseas recipient is bound by legally enforceable obligations or specified certifications to provide the transferred Personal Data a standard of protection that is comparable to that under the Personal Data Protection Act 2012 of Singapore.
Data Protection Officer information can be found here.
Not stated here
The Data Protection Officer information is behind a link that is not supplied here.
Sharing & Disclosure · Company commitment
South Africa: data is transferred to the United States with safeguards for transfers outside South Africa
In the South Africa notice, WHOOP says that to provide the Services it will transfer your Personal Data to the United States, and that it will ensure adequate safeguards are implemented if and when it transfers Personal Data outside South Africa.
Supporting quotations
In order to provide the Services, WHOOP will transfer your Personal Data to the United States. WHOOP will ensure that adequate safeguards are implemented if and when we need to transfer Personal Data outside of South Africa.
Not stated here
The safeguards are not described.
Sharing & Disclosure · Restriction or exception
South Korea: the transfer provisions override the general sharing section
For Korean data subjects, the notice says its transfer provisions apply "notwithstanding" the policy's numbered section on how WHOOP shares Personal Data, which it numbers 6. It states that WHOOP collects and processes Personal Data in the United States and shares Personal Data with the third parties listed below. A note defines "outsourcing" as transfers of personal data to WHOOP's service providers for WHOOP's benefit and business purpose, consistent with the original purposes for collection and use.
Supporting quotations
Notwithstanding "6. HOW WE SHARE PERSONAL DATA” in this Privacy Policy, the following provisions will apply to Korean data subjects.
We collect and process Personal Data in United States.
We share your Personal Data with third parties below.
Note: Outsourcing refers to personal data transfers to service providers of WHOOP for the benefit and business purpose of WHOOP consistent with the original purposes for the collection/use of personal data.
Qualifications & exceptions
The provisions apply to Korean data subjects and take precedence over the general sharing section where they differ.
"Outsourcing" is defined as transfers to WHOOP's service providers for WHOOP's benefit and business purpose, consistent with the original purposes.
Sharing & Disclosure · User right or choice
South Korea: you may object to cross-border transfer, but then you can no longer use the Services
Korean data subjects have the right to object to the cross-border transfer of their Personal Data by submitting a request to privacy@whoop.com. WHOOP states that in that case the ability to use the Services will cease.
Supporting quotations
You have the right to object to the cross-border transfer of your Personal Data by us as above by submitting a request to privacy@whoop.com, in which case your ability to use the Services will cease.
Qualifications & exceptions
Objecting to the cross-border transfer ends your ability to use the Services.
Sharing & Disclosure · Company practice
South Korea: Transcend receives transferred data
In the South Korea notice, WHOOP lists Transcend among the third parties it transfers Personal Data to. The entry gives the type of transfer as "Outsourcing / Privacy rights data", the purpose as "Data rights management", the countries as "United States, Ireland, and Germany, in times of collection, via network", the retention period as "As long as necessary to fulfill the purposes on the left", and the legal basis as "PIPA Article 28-8(1)(i), PIPA Article 28-8(1)(iii)". A website and a contact for Transcend are also listed. The legal basis cites articles of the Korean Personal Information Protection Act; the text of those articles is not supplied here.
Supporting quotations
Transcend
Website:
Contact:
Type of transfer: Outsourcing / Privacy rights data
Countries: United States, Ireland, and Germany, in times of collection, via network
Purpose: Data rights management
Retention period: As long as necessary to fulfill the purposes on the left
"As long as necessary to fulfill the purposes on the left" is the retention period stated; no fixed period is given.
Not stated here
Transcend's website and contact are listed as links or addresses, and their content is not supplied here, so this card cannot say what they state.
The entry does not say which specific items of Personal Data are sent beyond the data type in the type of transfer.
Sharing & Disclosure · Company practice
South Korea: Typeform receives transferred data
In the South Korea notice, WHOOP lists Typeform among the third parties it transfers Personal Data to. The entry gives the type of transfer as "Outsourcing / Survey data", the purpose as "Survey execution and management", the countries as "United States, in times of collection, via network", the retention period as "As long as necessary to fulfill the purposes on the left", and the legal basis as "PIPA Article 28-8(1)(i), PIPA Article 28-8(1)(iii)". A website and a contact for Typeform are also listed. The legal basis cites articles of the Korean Personal Information Protection Act; the text of those articles is not supplied here.
Supporting quotations
Typeform
Website: https://admin.typeform.com/to/dwk6pt
Contact: https://www.typeform.com/help/contact/
Type of transfer: Outsourcing / Survey data
Countries: United States, in times of collection, via network
Purpose: Survey execution and management
Retention period: As long as necessary to fulfill the purposes on the left
"As long as necessary to fulfill the purposes on the left" is the retention period stated; no fixed period is given.
Not stated here
Typeform's website and contact are listed as links or addresses, and their content is not supplied here, so this card cannot say what they state.
The entry does not say which specific items of Personal Data are sent beyond the data type in the type of transfer.
Sharing & Disclosure · Company practice
South Korea: UserTesting receives transferred data
In the South Korea notice, WHOOP lists UserTesting among the third parties it transfers Personal Data to. The entry gives the type of transfer as "Outsourcing / User testing data", the purpose as "User research", the countries as "United States, in times of collection, via network", the retention period as "As long as necessary to fulfill the purposes on the left", and the legal basis as "PIPA Article 28-8(1)(i)". A website and a contact for UserTesting are also listed. The legal basis cites articles of the Korean Personal Information Protection Act; the text of those articles is not supplied here.
Countries: United States, in times of collection, via network
Purpose: User research
Retention period: As long as necessary to fulfill the purposes on the left
Legal basis: PIPA Article 28-8(1)(i)
Qualifications & exceptions
"As long as necessary to fulfill the purposes on the left" is the retention period stated; no fixed period is given.
Not stated here
UserTesting's website and contact are listed as links or addresses, and their content is not supplied here, so this card cannot say what they state.
The entry does not say which specific items of Personal Data are sent beyond the data type in the type of transfer.
Sharing & Disclosure · Company practice
South Korea: ZenKraft receives transferred data
In the South Korea notice, WHOOP lists ZenKraft among the third parties it transfers Personal Data to. The entry gives the type of transfer as "Outsourcing / Shipping data", the purpose as "Shipping management", the countries as "in times of collection, via network", the retention period as "As long as necessary to fulfill the purposes on the left", and the legal basis as "PIPA Article 28-8(1)(i), PIPA Article 28-8(1)(iii)". A website and a contact for ZenKraft are also listed. The legal basis cites articles of the Korean Personal Information Protection Act; the text of those articles is not supplied here.
Supporting quotations
ZenKraft
Website: https://zenkraft.com/privacy-policy
Contact: support@zenkraft.com
Type of transfer: Outsourcing / Shipping data
Countries: in times of collection, via network
Purpose: Shipping management
Retention period: As long as necessary to fulfill the purposes on the left
"As long as necessary to fulfill the purposes on the left" is the retention period stated; no fixed period is given.
Not stated here
ZenKraft's website and contact are listed as links or addresses, and their content is not supplied here, so this card cannot say what they state.
The entry does not say which specific items of Personal Data are sent beyond the data type in the type of transfer.
The entry does not name a country; it says only "in times of collection, via network."
Sharing & Disclosure · Company practice
South Korea: Segment receives transferred data
In the South Korea notice, WHOOP lists Segment among the third parties it transfers Personal Data to. The entry gives the type of transfer as "Outsourcing / Sensor, app, and other data", the purpose as "Facilitate data collection and analysis", the countries as "United States, in times of collection, via network", the retention period as "As long as necessary to fulfill the purposes on the left", and the legal basis as "PIPA Article 28-8(1)(i), PIPA Article 28-8(1)(iii)". A website and a contact for Segment are also listed. The legal basis cites articles of the Korean Personal Information Protection Act; the text of those articles is not supplied here.
"As long as necessary to fulfill the purposes on the left" is the retention period stated; no fixed period is given.
Not stated here
Segment's website and contact are listed as links or addresses, and their content is not supplied here, so this card cannot say what they state.
The entry does not say which specific items of Personal Data are sent beyond the data type in the type of transfer.
Sharing & Disclosure · Company practice
South Korea: Shopify receives transferred data
In the South Korea notice, WHOOP lists Shopify among the third parties it transfers Personal Data to. The entry gives the type of transfer as "Outsourcing / Transaction data", the purpose as "E-commerce", the countries as "United States, in times of collection, via network", the retention period as "As long as necessary to fulfill the purposes on the left", and the legal basis as "PIPA Article 28-8(1)(i), PIPA Article 28-8(1)(iii)". A website and a contact for Shopify are also listed. The legal basis cites articles of the Korean Personal Information Protection Act; the text of those articles is not supplied here.
Supporting quotations
Shopify
Website: https://www.shopify.com/legal/privacy
Contact: privacy@shopify.com
Type of transfer: Outsourcing / Transaction data
Countries: United States, in times of collection, via network
Purpose: E-commerce
Retention period: As long as necessary to fulfill the purposes on the left
"As long as necessary to fulfill the purposes on the left" is the retention period stated; no fixed period is given.
Not stated here
Shopify's website and contact are listed as links or addresses, and their content is not supplied here, so this card cannot say what they state.
The entry does not say which specific items of Personal Data are sent beyond the data type in the type of transfer.
Sharing & Disclosure · Company practice
South Korea: Signifyd receives transferred data
In the South Korea notice, WHOOP lists Signifyd among the third parties it transfers Personal Data to. The entry gives the type of transfer as "Outsourcing / Transaction data", the purpose as "Facilitate e-commerce transactions", the countries as "United States, in times of collection, via network", the retention period as "As long as necessary to fulfill the purposes on the left", and the legal basis as "PIPA Article 28-8(1)(i), PIPA Article 28-8(1)(iii)". A website and a contact for Signifyd are also listed. The legal basis cites articles of the Korean Personal Information Protection Act; the text of those articles is not supplied here.
Supporting quotations
Signifyd
Website: https://www.signifyd.com/privacy/
Contact: privacy@signifyd.com
Type of transfer: Outsourcing / Transaction data
Countries: United States, in times of collection, via network
Purpose: Facilitate e-commerce transactions
Retention period: As long as necessary to fulfill the purposes on the left
"As long as necessary to fulfill the purposes on the left" is the retention period stated; no fixed period is given.
Not stated here
Signifyd's website and contact are listed as links or addresses, and their content is not supplied here, so this card cannot say what they state.
The entry does not say which specific items of Personal Data are sent beyond the data type in the type of transfer.
Sharing & Disclosure · Company practice
South Korea: Slack receives transferred data
In the South Korea notice, WHOOP lists Slack among the third parties it transfers Personal Data to. The entry gives the type of transfer as "Outsourcing / User data and other data", the purpose as "Internal WHOOP communications", and the countries as "United States, in times of collection, via network". A website and a contact for Slack are also listed. The legal basis cites articles of the Korean Personal Information Protection Act; the text of those articles is not supplied here.
Type of transfer: Outsourcing / User data and other data
Countries: United States, in times of collection, via network
Purpose: Internal WHOOP communications
Retention period: As long as necessary to fulfill the purposes on the left
Not stated here
Slack's website and contact are listed as links or addresses, and their content is not supplied here, so this card cannot say what they state.
The entry does not say which specific items of Personal Data are sent beyond the data type in the type of transfer.
Sharing & Disclosure · Company practice
South Korea: Slack retention period and legal basis
The Slack entry in the South Korea notice continues with its retention period, "As long as necessary to fulfill the purposes on the left", and its legal basis, "PIPA Article 28-8(1)(i), PIPA Article 28-8(1)(iii)". The purpose listed earlier in the entry is "Internal WHOOP communications." The legal basis cites articles of the Korean Personal Information Protection Act; the text of those articles is not supplied here.
Supporting quotations
Purpose: Internal WHOOP communications
Retention period: As long as necessary to fulfill the purposes on the left
No fixed retention period is given; it is "as long as necessary to fulfill the purposes on the left."
Not stated here
The text of the cited PIPA articles is not supplied here.
Sharing & Disclosure · Company practice
South Korea: Snowflake receives transferred data
In the South Korea notice, WHOOP lists Snowflake among the third parties it transfers Personal Data to. The entry gives the type of transfer as "Outsourcing / Sensor, app, and other data", the purpose as "Data warehousing", the countries as "United States, in times of collection, via network", the retention period as "As long as necessary to fulfill the purposes on the left", and the legal basis as "PIPA Article 28-8(1)(i), PIPA Article 28-8(1)(iii)". A website and a contact for Snowflake are also listed. The legal basis cites articles of the Korean Personal Information Protection Act; the text of those articles is not supplied here.
"As long as necessary to fulfill the purposes on the left" is the retention period stated; no fixed period is given.
Not stated here
Snowflake's website and contact are listed as links or addresses, and their content is not supplied here, so this card cannot say what they state.
The entry does not say which specific items of Personal Data are sent beyond the data type in the type of transfer.
Sharing & Disclosure · Company practice
South Korea: Sprout Social receives transferred data
In the South Korea notice, WHOOP lists Sprout Social among the third parties it transfers Personal Data to. The entry gives the type of transfer as "Outsourcing / Interaction data", the purpose as "Social media management", the countries as "United States, in times of collection, via network", the retention period as "As long as necessary to fulfill the purposes on the left", and the legal basis as "PIPA Article 28-8(1)(i)". A website and a contact for Sprout Social are also listed. The legal basis cites articles of the Korean Personal Information Protection Act; the text of those articles is not supplied here.
Supporting quotations
Sprout Social
Website: https://sproutsocial.com/privacy-policy/
Contact: privacy@sproutsocial.com
Type of transfer: Outsourcing / Interaction data
Countries: United States, in times of collection, via network
Purpose: Social media management
Retention period: As long as necessary to fulfill the purposes on the left
Legal basis: PIPA Article 28-8(1)(i)
Qualifications & exceptions
"As long as necessary to fulfill the purposes on the left" is the retention period stated; no fixed period is given.
Not stated here
Sprout Social's website and contact are listed as links or addresses, and their content is not supplied here, so this card cannot say what they state.
The entry does not say which specific items of Personal Data are sent beyond the data type in the type of transfer.
Sharing & Disclosure · Company practice
South Korea: Stream.io receives transferred data
In the South Korea notice, WHOOP lists Stream.io among the third parties it transfers Personal Data to. The entry gives the type of transfer as "Outsourcing / Interaction data", the purpose as "Management of community and social interactions", the countries as "United States, in times of collection, via network", the retention period as "As long as necessary to fulfill the purposes on the left", and the legal basis as "PIPA Article 28-8(1)(i)". A website and a contact for Stream.io are also listed. The legal basis cites articles of the Korean Personal Information Protection Act; the text of those articles is not supplied here.
Supporting quotations
Stream.io
Website: https://getstream.io/legal/privacy/
Contact: privacy@getstream.io
Type of transfer: Outsourcing / Interaction data
Countries: United States, in times of collection, via network
Purpose: Management of community and social interactions
Retention period: As long as necessary to fulfill the purposes on the left
Legal basis: PIPA Article 28-8(1)(i)
Qualifications & exceptions
"As long as necessary to fulfill the purposes on the left" is the retention period stated; no fixed period is given.
Not stated here
Stream.io's website and contact are listed as links or addresses, and their content is not supplied here, so this card cannot say what they state.
The entry does not say which specific items of Personal Data are sent beyond the data type in the type of transfer.
Sharing & Disclosure · Company practice
South Korea: Stripe receives transferred data
In the South Korea notice, WHOOP lists Stripe among the third parties it transfers Personal Data to. The entry gives the type of transfer as "Outsourcing / Transaction data", the purpose as "Payment processing", the countries as "United States, in times of collection, via network", the retention period as "As long as necessary to fulfill the purposes on the left", and the legal basis as "PIPA Article 28-8(1)(i), PIPA Article 28-8(1)(iii)". A website and a contact for Stripe are also listed. The legal basis cites articles of the Korean Personal Information Protection Act; the text of those articles is not supplied here.
Supporting quotations
Stripe
Website: https://stripe.com/privacy
Contact: dpo@stripe.com
Type of transfer: Outsourcing / Transaction data
Countries: United States, in times of collection, via network
Purpose: Payment processing
Retention period: As long as necessary to fulfill the purposes on the left
"As long as necessary to fulfill the purposes on the left" is the retention period stated; no fixed period is given.
Not stated here
Stripe's website and contact are listed as links or addresses, and their content is not supplied here, so this card cannot say what they state.
The entry does not say which specific items of Personal Data are sent beyond the data type in the type of transfer.
Sharing & Disclosure · Company practice
South Korea: Aircall receives transferred data
In the South Korea notice, WHOOP lists Aircall among the third parties it transfers Personal Data to. The entry gives the type of transfer as "Outsourcing / Call data", the purpose as "Manage WHOOP support line data", the countries as "United States, in times of collection, via network", the retention period as "As long as necessary to fulfill the purposes on the left", and the legal basis as "PIPA Article 28-8(1)(i), PIPA Article 28-8(1)(iii)". A website and a contact for Aircall are also listed. The legal basis cites articles of the Korean Personal Information Protection Act; the text of those articles is not supplied here.
Supporting quotations
Aircall
Website: https://aircall.io/privacy/
Contact: privacy@aircall.io
Type of transfer: Outsourcing / Call data
Countries: United States, in times of collection, via network
Purpose: Manage WHOOP support line data
Retention period: As long as necessary to fulfill the purposes on the left
"As long as necessary to fulfill the purposes on the left" is the retention period stated; no fixed period is given.
Not stated here
Aircall's website and contact are listed as links or addresses, and their content is not supplied here, so this card cannot say what they state.
The entry does not say which specific items of Personal Data are sent beyond the data type in the type of transfer.
Sharing & Disclosure · Company practice
South Korea: Amazon (AWS) receives transferred data
In the South Korea notice, WHOOP lists Amazon (AWS) among the third parties it transfers Personal Data to. The entry gives the type of transfer as "Outsourcing / Sensor, app data, and other data", the purpose as "Cloud storage and data processing", the countries as "United States, in times of collection, via network", the retention period as "As long as necessary to fulfill the purposes on the left", and the legal basis as "PIPA Article 28-8(1)(i), PIPA Article 28-8(1)(iii)". A website and a contact for Amazon (AWS) are also listed. The legal basis cites articles of the Korean Personal Information Protection Act; the text of those articles is not supplied here.
"As long as necessary to fulfill the purposes on the left" is the retention period stated; no fixed period is given.
Not stated here
Amazon (AWS)'s website and contact are listed as links or addresses, and their content is not supplied here, so this card cannot say what they state.
The entry does not say which specific items of Personal Data are sent beyond the data type in the type of transfer.
Sharing & Disclosure · Company practice
South Korea: Amplitude receives transferred data
In the South Korea notice, WHOOP lists Amplitude among the third parties it transfers Personal Data to. The entry gives the type of transfer as "Outsourcing / User interaction data", the purpose as "Analysis of user interactions with webpages and app", the countries as "United States, in times of collection, via network", the retention period as "As long as necessary to fulfill the purposes on the left", and the legal basis as "PIPA Article 28-8(1)(i), PIPA Article 28-8(1)(iii)". A website and a contact for Amplitude are also listed. The legal basis cites articles of the Korean Personal Information Protection Act; the text of those articles is not supplied here.
Supporting quotations
Amplitude
Website: https://amplitude.com/privacy
Contact: privacy@amplitude.com
Type of transfer: Outsourcing / User interaction data
Countries: United States, in times of collection, via network
Purpose: Analysis of user interactions with webpages and app
Retention period: As long as necessary to fulfill the purposes on the left
"As long as necessary to fulfill the purposes on the left" is the retention period stated; no fixed period is given.
Not stated here
Amplitude's website and contact are listed as links or addresses, and their content is not supplied here, so this card cannot say what they state.
The entry does not say which specific items of Personal Data are sent beyond the data type in the type of transfer.
Sharing & Disclosure · Company practice
South Korea: Attentive receives transferred data
In the South Korea notice, WHOOP lists Attentive among the third parties it transfers Personal Data to. The entry gives the type of transfer as "Outsourcing / User interaction data", the purpose as "Analysis of user interactions with marketing campaigns", the countries as "United States, in times of collection, via network", the retention period as "As long as necessary to fulfill the purposes on the left", and the legal basis as "PIPA Article 28-8(1)(i)". A website and a contact for Attentive are also listed. The legal basis cites articles of the Korean Personal Information Protection Act; the text of those articles is not supplied here.
Supporting quotations
Attentive
Website: https://www.attentive.com/legal/privacy
Contact: privacy@attentive.com
Type of transfer: Outsourcing / User interaction data
Countries: United States, in times of collection, via network
Purpose: Analysis of user interactions with marketing campaigns
Retention period: As long as necessary to fulfill the purposes on the left
Legal basis: PIPA Article 28-8(1)(i)
Qualifications & exceptions
"As long as necessary to fulfill the purposes on the left" is the retention period stated; no fixed period is given.
Not stated here
Attentive's website and contact are listed as links or addresses, and their content is not supplied here, so this card cannot say what they state.
The entry does not say which specific items of Personal Data are sent beyond the data type in the type of transfer.
Sharing & Disclosure · Company practice
South Korea: Bringg receives transferred data
In the South Korea notice, WHOOP lists Bringg among the third parties it transfers Personal Data to. The entry gives the type of transfer as "Outsourcing / shipping data", the purpose as "Shipping management data", the countries as "United States, in times of collection, via network", the retention period as "As long as necessary to fulfill the purposes on the left", and the legal basis as "PIPA Article 28-8(1)(i), PIPA Article 28-8(1)(iii)". A website and a contact for Bringg are also listed. The legal basis cites articles of the Korean Personal Information Protection Act; the text of those articles is not supplied here.
Supporting quotations
Bringg
Website: https://www.bringg.com/privacy-policy/
Contact: privacy@bringg.com
Type of transfer: Outsourcing / shipping data
Countries: United States, in times of collection, via network
Purpose: Shipping management data
Retention period: As long as necessary to fulfill the purposes on the left
"As long as necessary to fulfill the purposes on the left" is the retention period stated; no fixed period is given.
Not stated here
Bringg's website and contact are listed as links or addresses, and their content is not supplied here, so this card cannot say what they state.
The entry does not say which specific items of Personal Data are sent beyond the data type in the type of transfer.
Sharing & Disclosure · Company practice
South Korea: Dovetail Research receives transferred data
In the South Korea notice, WHOOP lists Dovetail Research among the third parties it transfers Personal Data to. The entry gives the type of transfer as "Outsourcing / Feedback data", the purpose as "Gather and review customer feedback", the countries as "United States, in times of collection, via network", the retention period as "As long as necessary to fulfill the purposes on the left", and the legal basis as "PIPA Article 28-8(1)(i), PIPA Article 28-8(1)(iii)". A website and a contact for Dovetail Research are also listed. The legal basis cites articles of the Korean Personal Information Protection Act; the text of those articles is not supplied here.
"As long as necessary to fulfill the purposes on the left" is the retention period stated; no fixed period is given.
Not stated here
Dovetail Research's website and contact are listed as links or addresses, and their content is not supplied here, so this card cannot say what they state.
The entry does not say which specific items of Personal Data are sent beyond the data type in the type of transfer.
Sharing & Disclosure · Company practice
South Korea: Dremio receives transferred data
In the South Korea notice, WHOOP lists Dremio among the third parties it transfers Personal Data to. The entry gives the type of transfer as "Outsourcing / Sensor, app, and other data", the purpose as "Enable access and organization of WHOOP data", the countries as "United States, in times of collection, via network", and the retention period as "As long as necessary to fulfill the purposes on the left". A website and a contact for Dremio are also listed. The legal basis cites articles of the Korean Personal Information Protection Act; the text of those articles is not supplied here.
"As long as necessary to fulfill the purposes on the left" is the retention period stated; no fixed period is given.
Not stated here
Dremio's website and contact are listed as links or addresses, and their content is not supplied here, so this card cannot say what they state.
The entry does not say which specific items of Personal Data are sent beyond the data type in the type of transfer.
Sharing & Disclosure · Company practice
South Korea: Dremio retention period and legal basis
The Dremio entry in the South Korea notice ends with its retention period, "As long as necessary to fulfill the purposes on the left", and its legal basis, "PIPA Article 28-8(1)(i), PIPA Article 28-8(1)(iii)". The purpose listed earlier in the entry is "Enable access and organization of WHOOP data." The legal basis cites articles of the Korean Personal Information Protection Act; the text of those articles is not supplied here.
Supporting quotations
Retention period: As long as necessary to fulfill the purposes on the left
No fixed retention period is given; it is "as long as necessary to fulfill the purposes on the left."
Not stated here
The text of the cited PIPA articles is not supplied here.
Sharing & Disclosure · Company practice
South Korea: Hex Technologies receives transferred data
In the South Korea notice, WHOOP lists Hex Technologies among the third parties it transfers Personal Data to. The entry gives the type of transfer as "Outsourcing / Sensor, app, and other data", the purpose as "Enable access and use of data by WHOOP", the countries as "United States, in times of collection, via network", the retention period as "As long as necessary to fulfill the purposes on the left", and the legal basis as "PIPA Article 28-8(1)(i), PIPA Article 28-8(1)(iii)". A website and a contact for Hex Technologies are also listed. The legal basis cites articles of the Korean Personal Information Protection Act; the text of those articles is not supplied here.
"As long as necessary to fulfill the purposes on the left" is the retention period stated; no fixed period is given.
Not stated here
Hex Technologies's website and contact are listed as links or addresses, and their content is not supplied here, so this card cannot say what they state.
The entry does not say which specific items of Personal Data are sent beyond the data type in the type of transfer.
Sharing & Disclosure · Company practice
South Korea: Hightouch receives transferred data
In the South Korea notice, WHOOP lists Hightouch among the third parties it transfers Personal Data to. The entry gives the type of transfer as "Outsourcing / Customer Data", the purpose as "Customer Relations Management", the countries as "United States, in times of collection, via network", the retention period as "As long as necessary to fulfill the purposes on the left", and the legal basis as "PIPA Article 28-8(1)(i), PIPA Article 28-8(1)(iii)". A website and a contact for Hightouch are also listed. The legal basis cites articles of the Korean Personal Information Protection Act; the text of those articles is not supplied here.
Supporting quotations
Hightouch
Website: https://hightouch.com/privacy-policy
Contact: hello@hightouch.com
Type of transfer: Outsourcing / Customer Data
Countries: United States, in times of collection, via network
Purpose: Customer Relations Management
Retention period: As long as necessary to fulfill the purposes on the left
"As long as necessary to fulfill the purposes on the left" is the retention period stated; no fixed period is given.
Not stated here
Hightouch's website and contact are listed as links or addresses, and their content is not supplied here, so this card cannot say what they state.
The entry does not say which specific items of Personal Data are sent beyond the data type in the type of transfer.
Sharing & Disclosure · Company practice
South Korea: Intercom receives transferred data
In the South Korea notice, WHOOP lists Intercom among the third parties it transfers Personal Data to. The entry gives the type of transfer as "Outsourcing / Interaction data", the purpose as "Gather and analyze data from user interactions in chat support feature", the countries as "United States, in times of collection, via network", the retention period as "As long as necessary to fulfill the purposes on the left", and the legal basis as "PIPA Article 28-8(1)(i), PIPA Article 28-8(1)(iii)". A website and a contact for Intercom are also listed. The legal basis cites articles of the Korean Personal Information Protection Act; the text of those articles is not supplied here.
Supporting quotations
Intercom
Website: https://www.intercom.com/legal/privacy
Contact: team@intercom.com
Type of transfer: Outsourcing / Interaction data
Countries: United States, in times of collection, via network
Purpose: Gather and analyze data from user interactions in chat support feature
Retention period: As long as necessary to fulfill the purposes on the left
"As long as necessary to fulfill the purposes on the left" is the retention period stated; no fixed period is given.
Not stated here
Intercom's website and contact are listed as links or addresses, and their content is not supplied here, so this card cannot say what they state.
The entry does not say which specific items of Personal Data are sent beyond the data type in the type of transfer.
Sharing & Disclosure · Company practice
South Korea: Iterable receives transferred data
In the South Korea notice, WHOOP lists Iterable among the third parties it transfers Personal Data to. The entry gives the type of transfer as "Outsourcing / Interaction and transaction data", the purpose as "Gather and analyze data from web interactions, app interactions, and other sources", the countries as "United States, in times of collection, via network", the retention period as "As long as necessary to fulfill the purposes on the left", and the legal basis as "PIPA Article 28-8(1)(i), PIPA Article 28-8(1)(iii)". A website and a contact for Iterable are also listed. The legal basis cites articles of the Korean Personal Information Protection Act; the text of those articles is not supplied here.
"As long as necessary to fulfill the purposes on the left" is the retention period stated; no fixed period is given.
Not stated here
Iterable's website and contact are listed as links or addresses, and their content is not supplied here, so this card cannot say what they state.
The entry does not say which specific items of Personal Data are sent beyond the data type in the type of transfer.
Sharing & Disclosure · Company practice
South Korea: Klaviyo receives transferred data
In the South Korea notice, WHOOP lists Klaviyo among the third parties it transfers Personal Data to. The entry gives the type of transfer as "Outsourcing / Interaction and transaction data", the purpose as "Gather and analyze data from WHOOP webpages and ecommerce platform and other sources", the countries as "United States, in times of collection, via network", the retention period as "As long as necessary to fulfill the purposes on the left", and the legal basis as "PIPA Article 28-8(1)(i), PIPA Article 28-8(1)(iii)". A website and a contact for Klaviyo are also listed. The legal basis cites articles of the Korean Personal Information Protection Act; the text of those articles is not supplied here.
"As long as necessary to fulfill the purposes on the left" is the retention period stated; no fixed period is given.
Not stated here
Klaviyo's website and contact are listed as links or addresses, and their content is not supplied here, so this card cannot say what they state.
The entry does not say which specific items of Personal Data are sent beyond the data type in the type of transfer.
Sharing & Disclosure · Company practice
South Korea: Looker receives transferred data
In the South Korea notice, WHOOP lists Looker among the third parties it transfers Personal Data to. The entry gives the type of transfer as "Outsourcing / Sensor, app, and other data", the purpose as "Access, analyze and visualize data", the countries as "United States, in times of collection, via network", the retention period as "As long as necessary to fulfill the purposes on the left", and the legal basis as "PIPA Article 28-8(1)(i), PIPA Article 28-8(1)(iii)". A website and a contact for Looker are also listed. The legal basis cites articles of the Korean Personal Information Protection Act; the text of those articles is not supplied here.
"As long as necessary to fulfill the purposes on the left" is the retention period stated; no fixed period is given.
Not stated here
Looker's website and contact are listed as links or addresses, and their content is not supplied here, so this card cannot say what they state.
The entry does not say which specific items of Personal Data are sent beyond the data type in the type of transfer.
Sharing & Disclosure · Company practice
South Korea: NetSuite receives transferred data
In the South Korea notice, WHOOP lists NetSuite among the third parties it transfers Personal Data to. The entry gives the type of transfer as "Outsourcing / Enterprise and user data", the purpose as "Enterprise Resource Planning", the countries as "United States, in times of collection, via network", the retention period as "As long as necessary to fulfill the purposes on the left", and the legal basis as "PIPA Article 28-8(1)(i), PIPA Article 28-8(1)(iii)". A website and a contact for NetSuite are also listed. The legal basis cites articles of the Korean Personal Information Protection Act; the text of those articles is not supplied here.
Supporting quotations
NetSuite
Website: https://www.oracle.com/legal/privacy/
Contact: privacy_kr_grp@oracle.com
Type of transfer: Outsourcing / Enterprise and user data
Countries: United States, in times of collection, via network
Purpose: Enterprise Resource Planning
Retention period: As long as necessary to fulfill the purposes on the left
"As long as necessary to fulfill the purposes on the left" is the retention period stated; no fixed period is given.
Not stated here
NetSuite's website and contact are listed as links or addresses, and their content is not supplied here, so this card cannot say what they state.
The entry does not say which specific items of Personal Data are sent beyond the data type in the type of transfer.
Sharing & Disclosure · Company practice
South Korea: Salesforce.com receives transferred data
In the South Korea notice, WHOOP lists Salesforce.com among the third parties it transfers Personal Data to. The entry gives the type of transfer as "Outsourcing / Enterprise and user data", the purpose as "Enterprise data management and analysis", the countries as "United States, in times of collection, via network", the retention period as "As long as necessary to fulfill the purpose on the left", and the legal basis as "PIPA Article 28-8(1)(i), PIPA Article 28-8(1)(iii)". A website and a contact for Salesforce.com are also listed. The legal basis cites articles of the Korean Personal Information Protection Act; the text of those articles is not supplied here.
"As long as necessary to fulfill the purposes on the left" is the retention period stated; no fixed period is given.
Not stated here
Salesforce.com's website and contact are listed as links or addresses, and their content is not supplied here, so this card cannot say what they state.
The entry does not say which specific items of Personal Data are sent beyond the data type in the type of transfer.
Sharing & Disclosure · Company practice
Mexico: what you may share with other users, social platforms and the public
In the Mexico notice, depending on your use of the Services, you may share Personal Data with other users of the Services, such as through the WHOOP Live or WHOOP Teams features, where users are by default searchable by other users; with third-party social media platforms or linked accounts, devices or features when you choose to connect your account or post content to social media; and with the public, because when you make Personal Data visible to other users, including through WHOOP Live or WHOOP Teams, it may become publicly available and can be collected, viewed and used by anyone.
Supporting quotations
Depending on your use of the Services, you may share Personal Data with:
users are by default searchable by other users
Third-party social media platforms, or linked accounts, devices, or features, when you choose to connect your account on those services with WHOOP or post content to social media, such as through the WHOOP Live feature;
When you make Personal Data visible to other users of the Services, including through the WHOOP Live or WHOOP Teams features, it may become publicly available and can be collected, viewed, and used by anyone;
Qualifications & exceptions
Sharing with other users and social platforms follows your choice to share, connect or post; users are by default searchable.
Data made visible to other users may become publicly available.
Sharing & Disclosure · Company practice
Mexico: managing entities, corporate wellness programs, and national or international transfers
In the Mexico notice, if your use of the Services is on behalf of or managed by a managing entity such as a coach, team or organizing body, your account information and Personal Data may be shared with it subject to your consent, and the text says you consent to that entity allowing the information to be publicly shared, subject to any features that expressly override that control; the entity determines how it is shared. For employer or organizational corporate wellness programs, WHOOP may share your information with that organization subject to your consent and typically shares only Aggregated Data. WHOOP adds that any of the transfers referred to may be national or international.
Supporting quotations
your account information and Personal Data may be shared with the managing entity subject to your consent, and you hereby consent to that managing entity allowing that information to be publicly shared, subject to any features of the Services that expressly override that control. The managing entity will determine how the relevant information and content is shared
we may share your information with that organization subject to your consent. Typically, we will share only Aggregated Data with these organizations.
any of the transfers referred to above may be national or international
Qualifications & exceptions
Sharing with managing entities and wellness programs is "subject to your consent," and wellness programs typically receive only Aggregated Data.
Transfers may be national or international.
Not stated here
"Typically" leaves open when non-aggregated data could be shared with a wellness program organization.