Incident #6A7EAE · 22 JUL 2026notable
Nike EU privacy policy adds store CCTV, inactivity-based account deletion and clearer retention terms
The updated policy adds a section on CCTV in stores (30-day retention, shared with affiliates, security providers and law enforcement) and lists CCTV images among collected data. It also sets a three-year inactivity rule after which member accounts and activity data are permanently deleted. Other edits reword consent, legitimate-interest and cookie language, and add a data-request button in account settings.
Taken from you
- Store CCTV footage is now collected, kept 30 days (longer for incidents) and shared with affiliates, security firms and police
- Legitimate interests now explicitly include preventing and investigating incidents and defending legal claims
- Cookie and similar data is now also collected and shared through direct server-to-server communications.
- Consent withdrawal for advertising changed to a right to object
- The legal bases no longer single out the apps as relying on consent; they now refer generally to consent for certain limited purposes.
Won back
- Inactive accounts (three years) are permanently deleted, including profile and activity data
- Clear in-app 'Request data' button for copies of personal data
- Stated retention limit and separation of purchase records from deleted accounts
Evidence · 4 of 4 quotes matched in source
Les images de vidéosurveillance sont conservées pendant une durée de 30 jours, sauf si une durée plus courte est requise par la loi applicable.+ inserted · ✓ matched in source
Si votre Accès Membre Nike est inactif pendant trois années consécutives, nous supprimerons définitivement les données personnelles associées à votre adhésion+ inserted · ✓ matched in source
Les images de vidéosurveillance peuvent être consultées et partagées, selon le principe du besoin d’en connaître, avec les sociétés affiliées de Nike+ inserted · ✓ matched in source
Archived version ↗ · 4,615 words changed