Data Sharing with Affiliates

What is data sharing with affiliates?

Data sharing with affiliates is a vendor's right to pass your data to other companies in its corporate group. An affiliate is a company that owns the vendor, is owned by it, or shares the same owner. Atlassian's customer agreement, for example, ties the definition to owning more than 50% of a company's voting shares or having the power to direct its management.

Many privacy policies include this right in broad terms. Zoom's privacy statement says "Zoom shares personal information with corporate affiliates." Atlassian's privacy policy says it discloses information to affiliated companies and "in some cases, to prospective affiliates." HubSpot's privacy policy covers its "current and future parents, Affiliates, subsidiaries."

The words "future" and "prospective" are the ones to notice. They mean the group can grow, and the right to share grows with it.

Why it matters to you

• Acquisitions change who is in the group. When a vendor is bought, the buyer and all its companies can become affiliates. HubSpot's policy says that if it were acquired, the buyer "would receive all information gathered by HubSpot." California's CCPA does not treat such a transfer as a sale, but a buyer that wants to use the data in a way materially different from what people were promised must tell them first. See change of control clause.
• New companies, new uses. An affiliate may run different products, including advertising or AI. Check whether the policy limits affiliates to the purposes in the original policy.
• Different countries. Affiliates may be abroad, which can mean international transfers of personal data.
• Who answers for them. Atlassian's agreement says it may use affiliates to perform its obligations but "remains responsible for its overall performance." Look for that kind of promise in your vendors' terms.

What to check

• Find the affiliates clause in the privacy policy and DPA. Note whether it covers "future" or "prospective" affiliates.
• Check whether affiliates must follow the same privacy policy or contract terms.
• Check whether affiliates that process your data appear on the subprocessor list.
• Read the business transfers section to see whether the vendor promises notice after a merger. Atlassian's policy says users will be notified by email or a prominent notice.
• After any acquisition news, re-read the vendor's documents for changes.

How Venpo helps

Venpo watches your vendors' privacy policies, DPAs and subprocessor lists, and emails you a plain-English alert when affiliate or business transfer language changes, or when a new group company appears.