WhatsApp Business Data Transfer Addendum

October 29, 2020

This WhatsApp Business Data Transfer Addendum (“Data Transfer Addendum”) applies to the extent that WhatsApp Ireland Limited is acting as your Processor of EU Data under the Business Terms, and transfers originating in the UK, EU, EEA or Switzerland of EU Data are made to its subprocessor WhatsApp, LLC.

1. Taking into account the circumstances, you instruct WhatsApp Ireland Limited to transfer EU Data to WhatsApp LLC in the US for storage and further Processing. The Clauses apply between you and WhatsApp LLC to transfers originating in the UK, EU, EEA or Switzerland of EU Data to WhatsApp LLC, unless such transfer is otherwise permitted under the GDPR.

a. For the purposes of the Clauses: you are the “data exporter” and WhatsApp LLC is the “data importer” as those terms are defined in the Clauses.

b. For the purposes of Appendix 1 of the Clauses: ‘data subjects’ are individuals whose data is comprised in the EU Data transferred, who may include your customers and individuals with whom you communicate using WhatsApp, ‘categories of data’ are phone numbers, there are no ‘special categories of data’ and ‘processing operations’ are the processing of customer contacts for the purposes of delivering your messages to your customers, in each case to the extent comprising EU Data.

c. For the purposes of Appendix 2 of the Clauses: the technical and organisational measures implemented by WhatsApp LLC are as set out in the Data Security Terms.

d. You and WhatsApp LLC are taken to have executed the Clauses when you agree to this Data Transfer Addendum or the Business Terms.

2. You agree that:

a. where regulatory approval is required for use of the Clauses, you will obtain such approval;

b. any subprocessor agreement to be provided under clause 5(j) of the Clauses will be provided to you on request only, is confidential, and will be limited to the data protection provisions related to EU Data with commercial information redacted;

c. the general authorisation given under the Data Processing Terms to the use of a subprocessor is also consent under clause 11 of the Clauses; and

d. you will use your rights of information, reports, and audit under the Data Processing Terms to satisfy any requirements you have for an audit under the Clauses, unless you demonstrate to WhatsApp LLC that you cannot reasonably satisfy your obligations under the GDPR in this way. In that case, you can request WhatsApp LLC provides for other means of audit under the Clauses (using the least intrusive and disruptive means possible, e.g. additional information, questions, meetings or other means suggested by WhatsApp LLC) to the extent you can show this is reasonably necessary to satisfy your obligations under the GDPR. Any other means of audit under the Clauses is subject to mutual agreement of the details such as (as relevant) manner, timing, scope, duration, control, confidentiality procedures, evidence requirements, auditor identity, and subject to you paying all associated fees and costs, including for time expended by WhatsApp LLC in connection with the request.

3. Any claim or action brought by you against WhatsApp LLC under or in connection with the Clauses or this Data Transfer Addendum shall be subject to the exclusions and limitations of liability and disclaimers in the Business Terms as if they applied in respect of the Clauses (as well as this Data Transfer Addendum) and as if WhatsApp LLC was a party to them and so that the combined liability of WhatsApp Ireland Limited and WhatsApp LLC under or in connection with the Clauses, this Data Transfer Addendum and the Business Terms does not in aggregate exceed the cap on liability in the Business Terms.

4. In order to implement or allow for an alternative means of transfer recognised by the GDPR (including any alternative form of standard data protection clauses recognised under article 46 of the GDPR), WhatsApp LLC may terminate the Clauses by notice to you, and WhatsApp Ireland Limited may modify this Data Transfer Addendum in accordance with the Business Terms or terminate this Data Transfer Addendum by notice. By continuing to access or use Business Services after any modification to the Data Transfer Addendum takes effect, you agree to be bound by any new form of standard data protection clauses (recognised under article 46 of the GDPR) provided for in the modified Data Transfer Addendum.

5. The Data Transfer Addendum and Clauses will not apply to the extent WhatsApp LLC has adopted Binding Corporate Rules for Processors or an alternative means under the GDPR for the lawful transfer of Personal Data outside the EU, EEA, UK or Switzerland.

6. This Data Transfer Addendum takes priority over the Business Terms to the extent of a conflict or inconsistency. The Clauses take priority over this Data Transfer Addendum to the extent of any conflict or inconsistency and nothing in this Data Transfer Addendum or Business Terms varies or modifies clauses 1 to 12 of the Clauses or affects the rights of any supervisory authority or data subject under the Clauses or GDPR.

7. You agree that, where relevant to WhatsApp LLC's rights and obligations under the Clauses or this Data Transfer Addendum, WhatsApp LLC is entitled to rely upon the provisions of the Business Terms as if it was a party to them. WhatsApp LLC is a party to this Data Transfer Addendum but solely to acknowledge and obtain the benefit of the provisions of this Data Transfer Addendum and accept its entry into the Clauses on the basis set out in this Data Transfer Addendum. WhatsApp LLC is not otherwise a party to the Business Terms and has no obligations or liability under or in connection with them in any respect (whether in contract, tort, negligence or otherwise). This does not limit or affect its obligations under the Clauses.

8. In this Data Transfer Addendum:

a. “Clauses” mean the standard data protection clauses for the transfer of personal data to processors established in third countries which do not ensure an adequate level of data protection, as described in Article 46 of the GDPR and approved by the European Commission decision 2010/87/EC, dated 5 February 2010 (but excluding the optional illustrative clauses).

b. “EU Data” means Personal Data under your sole controllership which is Processed by WhatsApp Ireland Limited as your Processor pursuant to the Business Terms, to the extent that the GDPR or the data protection laws of Switzerland apply to the Processing of such data.

c. “GDPR” means the General Data Protection Regulation of the European Union (Regulation (EU) 2016/679). References to GDPR and its provisions include the GDPR as amended and incorporated into UK law after the GDPR ceases to apply in the UK.

d. Terms defined in the Business Terms have the same meaning given to them there, except where stated otherwise. References to the Data Security Terms are to them as updated in accordance with the Business Terms or Data Processing Terms from time to time.

9. By continuing to access or use WhatsApp under the Business Terms after the effective date above, you agree to this Data Transfer Addendum.