EU-U.S. and Swiss-U.S. Data Privacy Frameworks Disclosure for WhatsApp LLC
Table of Contents
WhatsApp LLC (“WhatsApp”) has certified our participation in the EU-U.S. Data Privacy Framework and the Swiss-U.S. Data Privacy Framework (collectively, the “DPF") with the U.S. Department of Commerce. This certification relates to the collection and processing of certain personal data received from our business partners in the European Economic Area (“EEA”) and Switzerland under the DPF in connection with the products and services described in the Scope section below and in our certification. Although WhatsApp has certified its participation in the DPF, we do not presently rely on the DPF for transfers of personal data from the EEA or Switzerland to the United States. Instead, standard contractual clauses approved by the European Commission (and the equivalent standard contractual clauses for the UK, where appropriate) are utilized for data transfers where required.
If there is any conflict between the terms in this disclosure and the DPF principles, the principles shall govern. To learn more about the DPF, or to review our certification on the DPF list, visit the DPF website.
Scope
WhatsApp adheres to the DPF principles for the following areas of our products and services:
- WhatsApp Business Products: WhatsApp Business Products include apps, services, features, APIs, software, or websites that enable businesses (“Business Partners”) to interact with their customers. WhatsApp Business Products process the personal data related to customers of Business Partners. While Business Partners decide what information to submit, it typically includes things like customer phone numbers and other information under the Business Partner's control. For more information, customers may contact the relevant Business Partner. WhatsApp processes such personal data in accordance with the terms applicable to the relevant Business Product and/or otherwise in accordance with the Business Partners' instructions.
Access
Within the scope of our authorization to do so, and in accordance with our commitments under the DPF, individuals have the right to access personal data about them that is held on behalf of Business Partners. WhatsApp will also take reasonable steps to enable individuals to correct, amend, or delete personal data that is demonstrated to be inaccurate.
Third Parties
WhatsApp may transfer data within the Meta Companies and to third parties, including service providers and other partners. In accordance with the DPF principles, WhatsApp is liable for any processing of personal data by such third parties that is inconsistent with the DPF principles unless WhatsApp was not responsible for the event giving rise to any alleged damage.
Legal Requests
Personal data that is transferred to us under DPF may be subject to disclosure pursuant to legal requests or other judicial and government process, such as subpoenas, warrants, or orders. For more information, review the “Law, Our Rights and Protection” section of the WhatsApp Privacy Policy.
Enforcement
WhatsApp's compliance with the DPF principles is subject to the investigatory and enforcement powers of the U.S. Federal Trade Commission.
Questions and Disputes
Please contact us with any questions or concerns relating to our DPF certification. You have the option to resolve any applicable disputes you have with us in connection with our certification free of charge through TRUSTe, an alternative dispute resolution provider based in the United States. You can contact TRUSTe through the TRUSTe Feedback and Resolution System. In some situations, the DPF gives you the right to invoke binding arbitration. You can do this to resolve complaints not resolved by other means, as described in Annex I to the DPF.
For more information about WhatsApp's privacy practices please review our Privacy Policy.