EU-U.S. and Swiss-U.S. Data Privacy Frameworks Disclosure for WhatsApp LLC
Last Updated: February 15, 2024
WhatsApp LLC (“WhatsApp”) has certified our participation in the EU-U.S. Data Privacy Framework and the Swiss-U.S. Data Privacy Framework (collectively, the “DPF") with the U.S. Department of Commerce.
This certification relates to WhatsApp's processing of personal information received from the European Economic Area (“EEA”) and Switzerland under the DPF in connection with our certification. If there is any conflict between the terms in this disclosure and the DPF Principles, the Principles shall govern. To learn more about the DPF, or to review our certification on the DPF list, visit the DPF website. The Swiss-U.S. Data Privacy Framework will only be relied upon in relation to transfers of any relevant personal information to the U.S. from Switzerland from the date of entry into force of Switzerland’s recognition of adequacy (i.e., entry into force of the expected recognition by the Swiss Federal Administration that the Swiss-U.S. DPF ensures data protection consistent with Swiss law).
What this disclosure covers. WhatsApp follows the DPF for all personal information received from the EEA or Switzerland under the DPF in relation to the services offered by WhatsApp Ireland Ltd. (this includes WhatsApp Services, as defined in the Privacy Policy, Channels and WhatsApp Business Services, as defined in the Business Terms of Service):
- WhatsApp Services and Channels: For WhatsApp Services and Channels, please see the Privacy Policy and Channels Supplemental Privacy Policy for details about:
- The types of personal information processed
- The purposes for which personal information is processed
- The types of third parties to which personal information is disclosed
- An individual’s right to access personal information
- Any choices and means offered to limit the use and disclosure of personal information
- How personal information is disclosed in response to legal requests when necessary
- WhatsApp Business Services: WhatsApp Business Services include apps, services, features, APIs, software, or websites that enable businesses (“Business Partners”) to interact with their customers via WhatsApp.
- The types of personal information processed: WhatsApp Business Services process the personal information related to customers of Business Partners. While Business Partners decide what information to submit, it typically includes things like customer phone numbers. For more information, customers may contact the relevant Business Partner.
- The purpose for which personal information is processed: WhatsApp processes such personal information in accordance with the terms applicable to the relevant Business Service and/or otherwise in accordance with the Business Partners' instructions.
- The types of third parties to which personal information is disclosed: WhatsApp may transfer data within the Meta Companies and to third parties, including service providers and other partners. In accordance with the DPF principles, WhatsApp is liable for any processing of personal information by such third parties that is inconsistent with the DPF principles unless WhatsApp was not responsible for the event giving rise to any alleged damage.
- An individual’s right to access personal information and any choices and means offered to limit the use and disclosure of personal information: Within the scope of our authorization to do so, and in accordance with our commitments under the DPF, individuals have the right to access personal information about them that is held on behalf of Business Partners. WhatsApp will also take reasonable steps to enable individuals to correct, amend, or delete personal information that is demonstrated to be inaccurate.
- How personal information is disclosed in response to legal requests when necessary: Personal information that is transferred to us under DPF may be subject to disclosure pursuant to legal requests or other judicial and government process, such as subpoenas, warrants, or orders. For more information, review the “Law, Our Rights and Protection” section of the Privacy Policy.
Enforcement WhatsApp’s compliance with the DPF is subject to the investigatory and enforcement powers of the U.S. Federal Trade Commission. In accordance with the DPF, WhatsApp is also liable for onward transfers to third parties that process personal information in a way that does not follow the DPF unless WhatsApp was not responsible for the event giving rise to any alleged damage.
Questions and Disputes. Please contact us with any questions or concerns about our DPF certification. You can resolve any applicable disputes with us related to our certification free of charge through TRUSTe, an alternative dispute resolution provider based in the United States. You can contact TRUSTe through the TRUSTe Feedback and Resolution System. In some situations, the DPF gives you the right to invoke binding arbitration. You can do this to resolve complaints not resolved by other means, as described in Annex I to the DPF Framework.