WhatsApp Business UK Data Transfer Addendum

Effective Date: April 27, 2023

This WhatsApp Business UK Data Transfer Addendum (“UK Data Transfer Addendum”) applies where you are located in the United Kingdom, WhatsApp LLC is your contracting entity and you are transferring Personal Information to WhatsApp LLC, which is subject to the UK GDPR , EU GDPR and/or applicable data protection laws in Switzerland, for WhatsApp LLC to process as your Processor under the Business Terms and the Data Processing Terms.

In those circumstances, you and we agree that the Standard Contractual Clauses or the UK Addendum (as applicable) are incorporated into this UK Data Transfer Addendum by reference and are deemed to have been entered into and completed as set out in this UK Data Transfer Addendum.

This UK Data Transfer Addendum consists of four parts:

Part A: Definitions

Part B: Special Terms

Part C: Standard Contractual Clauses

Part D: UK Addendum

PART A: DEFINITIONS

1. For the purposes of this UK Data Transfer Addendum, the following terms have the meanings set out below:
   1. "Standard Contractual Clauses" means the standard contractual clauses approved by the European Commission in Commission Decision 2021/914 dated 4 June 2021, for transfers of personal data in countries not otherwise recognised as offering an adequate level of protection for personal data by the European commission (as amended and updated from time to time).
   2. "UK Addendum" means the International Data Transfer Addendum to the Standard Contractual Clauses, Version B1.0, issued by the Information Commissioner under s119A of the Data Protection Act 2018 and dated 21 March 2022.

PART B: SPECIAL TERMS

2. You agree that:

1. where regulatory approval is required for your use of this UK Data Transfer Addendum, you will obtain such approval;
2. any sub-processor agreement to be provided under Clause 9(c) of the Standard Contractual Clauses will be provided to you on request only, is confidential, and limited to the data protection provisions related to Personal Information transferred under this UK Data Transfer Addendum with commercial information redacted;
3. you will use your rights of information, reports, and audit under the Data Processing Terms to satisfy any requirements you have for an audit under this UK Data Transfer Addendum, unless you demonstrate to WhatsApp LLC that you cannot reasonably satisfy your obligations under the UK GDPR and/or the EU GDPR (as applicable) in this way. In that case, you can request WhatsApp LLC provides for other means of audit under this UK Data Transfer Addendum (using the least intrusive and disruptive means possible, e.g. additional information, questions, meetings or other means suggested by WhatsApp LLC) to the extent you can show this is reasonably necessary to satisfy your obligations under the UK GDPR and/or the EU GDPR. Any other means of audit under this UK Data Transfer Addendum is subject to mutual agreement of the details such as (as relevant) manner, timing, scope, duration, control, confidentiality procedures, evidence requirements, auditor identity, and subject to you paying all associated fees and costs, including for time expended by WhatsApp LLC in connection with the request.

3. Any claim or action brought by you against WhatsApp LLC under or in connection with this UK Data Transfer Addendum shall be subject to the exclusions and limitations of liability and disclaimers in the Business Terms.

4. To the extent any specific provision conflicts or appears inconsistent between this UK Data Transfer Addendum and the Business Terms (including the Data Processing Terms), this UK Data Transfer Addendum shall govern. The Standard Contractual Clauses or the UK Addendum (as applicable) take priority over any other part of this UK Data Transfer Addendum to the extent of any conflict or inconsistency, and nothing in this UK Data Transfer Addendum, the Data Processing Terms or Business Terms varies or modifies or affects the rights of any supervisory authority or data subject under the Standard Contractual Clauses or the UK Addendum (as applicable), or under the UK GDPR and/or the EU GDPR (as applicable). If any provision of this UK Data Transfer Addendum, the Data Processing Terms or Business Terms shall be found to be conflicting or inconsistent with another or otherwise rendered invalid, the remaining provisions shall not be affected and remain in force.

PART C: STANDARD CONTRACTUAL CLAUSES

The Standard Contractual Clauses will apply where you are transferring Personal Information to WhatsApp LLC which is subject to the EU GDPR. The Standard Contractual Clauses are deemed to have been entered into and completed as follows:

1. Module Two (Controller to Processor) of the Standard Contractual Clauses will apply, with you as the controller and data exporter of Personal Information transferred to WhatsApp LLC, and WhatsApp LLC as the processor and data importer of such Personal Information.
2. In that Module Two:
   1. Clause 7 of the Standard Contractual Clauses, the optional docking clause, will not apply;
   2. in Clause 9 of the Standard Contractual Clauses, Option 2 will apply and the time period for prior written notice of sub-processor changes will be 14 calendar days;
   3. in Clause 11 of the Standard Contractual Clauses, the optional language will not apply;
   4. in Clause 13 of the Standard Contractual Clauses, the first paragraph of that clause – which only applies where the data exporter is established in an EU Member State – will not apply;
   5. in Clause 17 (Option 1), the Standard Contractual Clauses will be governed by Irish law;
   6. in Clause 18(b) of the Standard Contractual Clauses, disputes will be resolved before the courts of Ireland;
   7. in Annex 1, Part A of the Standard Contractual Clauses:
      
      The data exporter is the Customer, as controller. The data exporter’s address and contact person’s name, position and contact details are available from the Customer directly.
      
      The data importer is WhatsApp LLC, as processor. The Data Importer’s address and contact details are specified in the Business Terms.
      
      Activities relevant to the data transferred: The data importer provides the Business Services to the data exporter in accordance with the Business Terms.
   8. Signature and date: The parties agree that agreement of the Business Terms by the data exporter and the data importer shall constitute agreement to, and execution of this UK Data Transfer Addendum by both parties on the date on which the Business Terms are agreed.
   9. in Annex 1, Part B of the Standard Contractual Clauses:
      
      Categories of data subjects whose personal data is transferred and categories of personal data: As specified in the Business Terms.
      Frequency of the transfer: Continuous for the duration of the agreement.
      
      Nature and purpose of the processing and transfer: The personal data transferred will be subject to the following processing activities: collecting, recording, organising, structuring, storing, altering, retrieving, using, disclosing, combining, erasing and destroying personal data for the purpose of providing the Business Services in accordance with the Business Terms.
      
      The period for which the personal data will be retained or, if that is not possible, the criteria used to determine that period: Until deletion in accordance with the provisions of the Data Processing Terms.
      
      For transfers to sub-processors, also specify subject matter, nature and duration of the processing: As above.
   10. in Annex 1, Part C of the Standard Contractual Clauses, the supervisory authority shall be the supervisory authority of the territory where the data exporter's representative within the meaning of Article 27(1) of Regulation (EU) 2016/679 is located, if any, and if not, then any territory where relevant data subjects are located;
   11. in Annex II, the data importer will implement appropriate technical and organizational measures to protect the Personal Information processed under this UK Data Transfer Addendum including against unauthorized or unlawful Processing or accidental loss, alteration, disclosure or destruction; these include the measures listed in the Data Security Terms (as updated from time to time, for example, to reflect technological developments); and
   12. in Annex III, the agreed list of sub-processors is available at https://www.whatsapp.com/legal/business-subprocessors.

PART D: UK ADDENDUM

This UK Addendum will apply where you are transferring Personal Information to WhatsApp LLC which is subject to the UK GDPR. The UK Addendum is deemed to have been entered into and completed as follows:

1. In Table 1 of the UK Addendum, the parties' details and key contact information is as set out in paragraph 2(g) of Part C: Standard Contractual Clauses.
2. In Table 2 of the UK Addendum, information about the version of the Standard Contractual Clauses, modules and selected clauses which this UK Addendum is appended to is set out in paragraphs 1 and 2 of Part C: Standard Contractual Clauses.
3. In Table 3 of the UK Addendum:
   1. the list of parties is set out in paragraph 2(g) of Part C: Standard Contractual Clauses;
   2. The description of the transfer is set out in paragraph 2(i) of Part C: Standard Contractual Clauses;
   3. The description of the technical and organizational measures, including to ensure the security of data is set out in paragraph 2(k) of Part C: Standard Contractual Clauses; and
   4. The agreed list of sub-processors is available at https://www.whatsapp.com/legal/business-subprocessors.
4. In Table 4 of the UK Addendum, the data importer may end this UK Addendum in accordance with the terms of the UK Addendum.