If you’re not a user of the WhatsApp service (a “Non-user” or “you”), WhatsApp Ireland Limited (“we”, “our” or “us”) may process your mobile phone number if a WhatsApp user has your phone number saved in their device address book and chooses to share their contacts with WhatsApp.
In this Notice we’re providing information to Non-users in the European Region.
About contact upload - how it works
Contact upload allows users to choose whether to give WhatsApp permission to discover if contacts in their device address book are WhatsApp users. If so, WhatsApp can add those phone numbers to the user’s WhatsApp contact list and keep the list updated. WhatsApp also updates users’ contact list once any of their contacts who are Non-users join WhatsApp later.
How do we use a Non-user’s information?
When a user chooses to use contact upload, the phone numbers in the user’s device address book are uploaded on a regular basis to our servers to ensure their information is kept up to date. This includes phone numbers of both WhatsApp users and other contacts who aren’t currently WhatsApp users (i.e. Non-users). We don’t collect any of the other information that could appear in a user’s device address book including names, email addresses, etc.
We manage Non-user phone numbers in a way that is designed to prevent Non-users from being identified by WhatsApp through creating a cryptographic hash value from the Non-users’ phone numbers. We don’t store Non-users’ phone numbers, we only store these cryptographic hash values.
We use the cryptographic hash values created from Non-users’ phone numbers to enable users to connect more quickly and efficiently with people in their device address book when they join WhatsApp.
Separately, we also use a cryptographic hash representation of the phone numbers from the WhatsApp user’s device address book to detect and combat misuse of contact upload.
How is this information used if a Non-user becomes a WhatsApp user?
If you are listed in the device address book of a user who uses contact upload, and you subsequently join WhatsApp, this information is used to help us automatically update their WhatsApp contact list to show that you can now be contacted via WhatsApp.
What is our legal basis for this processing?
We rely on our legitimate interests and the legitimate interests of our users to briefly process Non-users’ phone numbers and then store the cryptographic hash values in the manner described above. More specifically, we rely on the legitimate interests in operating and providing the WhatsApp service to our users and keeping WhatsApp safe and secure, and the interests of our users in more efficiently connecting with their contacts who join WhatsApp.
Retaining Non-user information
When we collect Non-users’ phone numbers, we don’t store these phone numbers and we process them for no more than a few seconds to create the cryptographic hash values from them.
The cryptographic hash values are stored in a list on WhatsApp's servers, linked to the WhatsApp users who uploaded the phone numbers from which they were created, for as long as those users use contact upload and keep these phone numbers in their devices’ address books.
How Non-users exercise their data subject rights
Data subjects have the right to access, rectify, port, and erase their information, as well as the right to restrict and object to certain processing of their personal information (“Data Subject Rights”). To exercise those rights, contact us via this form or via the contact address provided below. Given that we do not store Non-users’ phone numbers and we only store cryptographic hash values which cannot be used to identify you, our ability to respond to your request and the information we can provide to you is limited in practice. We hope this information addresses any queries you may have about how we process a Non-user’s personal information. However, if you have unresolved concerns you also have the right to complain to WhatsApp’s lead supervisory authority under the GDPR, the Irish Data Protection Commission, or any other data protection supervisory authority.
Third parties and our global operations
WhatsApp stores the cryptographic hash values in data centres, including in the United States and the European Economic Area (EEA). This means Non-users’ information will be transferred or transmitted to, or stored and processed in, third countries outside of the EEA for the purposes described in this Notice. Non-user phone numbers and cryptographic hash values are not shared with Meta.
For more information on WhatsApp’s approach to international transfers more generally please see the section on Our Global Operations in our Privacy Policy.
Contact Us
If you have questions about this Data Notice or if you wish to contact the Data Protection Officer for WhatsApp, please use this form.
You can also write to WhatsApp at the following address:
WhatsApp Ireland Limited
Attn: Privacy Policy
4 Grand Canal Square
Grand Canal Harbour
Dublin 2
Ireland
