Facebook

Controller Addendum

This Controller Addendum applies when it is expressly incorporated by reference into terms for Meta Products, such as the Meta Business Tools Terms (any such terms, “Applicable Product Terms”, any covered Meta Products, “Applicable Products”). Capitalised terms used but not defined in this Controller Addendum have the meanings given in the Applicable Product Terms. In the event of any conflict between the Applicable Product Terms and this Controller Addendum, this Controller Addendum will govern solely to the extent of the conflict.

Meta and you agree to the following:

Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland ("Meta Ireland" or “we”) and you (each a “Party”, together the “Parties”) are Joint Controllers in accordance with Article 26 GDPR for the Joint Processing specified by the Applicable Product Terms. The scope of the Joint Processing and this Controller Addendum covers the collection of the Personal Data specified by the Applicable Product Terms and its transmission to Meta Ireland; the subsequent processing of data by Meta Ireland does not form part of the Joint Processing. More information on the Joint Processing can be found in the Applicable Product Terms.

This Controller Addendum determines Meta Ireland's and your responsibilities for compliance with the obligations under the GDPR with regard to the Joint Processing. The Joint Processing is subject to the provisions of this Controller Addendum. They apply to all activities in which the Parties, their employees or their Processors are involved in the Joint Processing.

You agree to follow the available documentation regarding the correct technical implementation of the Applicable Products into your websites or apps and their configuration.

Meta Ireland's and your responsibilities for compliance with the obligations under the GDPR with regard to the Joint Processing are determined as follows:

No.	Obligation under GDPR	Meta Ireland	You
1	Article 6: Requirement of legal basis for Joint Processing	X (regarding Meta Ireland’s processing)	X (regarding your own processing)
2	Articles 13,14: Providing information on Joint Processing of Personal Data		X This includes as a minimum the provision of the following information in addition to your standard data policy or similar document: That Meta Ireland is a Joint Controller of the Joint Processing and that the information required by Article 13(1)(a) and (b) GDPR can be found in Meta Ireland’s Privacy Policy at https://www.facebook.com/about/privacy. The information that you use Applicable Products as well as the purposes for which the collection and transmission of Personal Data that constitutes the Joint Processing takes place as set out in the Applicable Product Terms. That further information on how Meta Ireland processes Personal Data, including the legal basis Meta Ireland relies on and the ways to exercise Data Subject rights against Meta Ireland, can be found in Meta Ireland’s Privacy Policy at https://www.facebook.com/about/privacy.(please see Applicable Product Terms for further information on the Joint Processing)
3	Article 26(2): Making available the essence of this Controller Addendum		X This includes as a minimum the provision of the following information: That you and Meta Ireland have: entered into this Controller Addendum to determine the respective responsibilities for compliance with the obligations under the GDPR with regard to the Joint Processing (as specified in the Applicable Product Terms); agreed that you are responsible for providing Data Subjects as a minimum with the information listed under no. 2;agreed that between the Parties, Meta Ireland is responsible for enabling Data Subjects’ rights under Articles 15-20 of the GDPR with regard to the Personal Data stored by Meta Ireland after the Joint Processing.
4	Articles 15-20: Rights of the Data Subject with regard to the Personal Data stored by Meta after the Joint Processing	X
5	Article 21: Right to object insofar as the Joint Processing is based on Article 6(1)(f)	X (regarding Meta Ireland’s processing)	X (regarding your own processing)
6	Article 32: Security of the Joint Processing	X (regarding the security of the Applicable Products )	X (regarding the correct technical implementation and configuration of the Applicable Products)
7	Articles 33, 34: Personal Data Breaches concerning the Joint Processing	X (insofar as a Personal Data Breach concerns Meta Ireland’s obligations under this Controller Addendum)	X (insofar as a Personal Data Breach concerns your obligations under this Controller Addendum)

All other responsibilities for compliance with obligations under the GDPR regarding the Joint Processing remain with each Party individually.

With regard to Article 32 GDPR, the measures taken by Meta Ireland include the measures listed in Meta’s Data Security Terms (as updated from time to time, for example to reflect technological developments) which are herewith expressly incorporated into this Controller Addendum. All employees of Meta Ireland involved in the Joint Processing are bound by appropriate obligations to maintain the confidentiality of the Personal Data subject to the Joint Processing.

This Controller Addendum does not grant you any right to request the disclosure of Personal Data of any Meta user that is processed in connection with Meta Products.

Data Subjects can exercise their rights under Articles 15-21 GDPR with regard to their Personal Data processed by Meta Ireland directly against Meta Ireland. If Data Subjects exercise their rights under the GDPR with regard to the Joint Processing against you, or you are contacted by a supervisory authority with regard to the Joint Processing, each a "Request", you will forward all relevant information regarding such Request to us promptly but within a maximum of seven calendar days. For this purpose, you can submit this form. Meta Ireland agrees to answer Requests from Data Subjects in accordance with our obligations under this Controller Addendum. You agree to take all reasonable endeavours in a timely manner to cooperate with us in answering any such Request. You are not authorised to act or answer on Meta Ireland's behalf.

If you access or use Applicable Products for any business or commercial purpose, you agree that any claim, cause of action or dispute that you have against us, which arises out of or relates to this Controller Addendum, must be resolved exclusively in the courts of Ireland, that you irrevocably submit to the jurisdiction of the Irish courts for the purpose of litigating any such claim and that the laws of Ireland will govern this Controller Addendum, without regard to conflict of law provisions. If you are a consumer who habitually resides in a Member State of the European Union, only 4.4 of our Terms of Service applies.

We may need to update this Controller Addendum from time to time. By continuing any use of Applicable Products after any notification of an update to this Controller Addendum, you agree to be bound by it. If you do not agree to the updated Controller Addendum, please stop all use of Applicable Products. If you are a consumer who habitually resides in a Member State of the European Union, only 4.1 of our Terms of Service applies.

If any portion of this Controller Addendum is found to be unenforceable, the remaining portion will remain in full force and effect. If we fail to enforce any portion of this Controller Addendum, it will not be considered a waiver. Any amendment to or waiver of these terms requested by you must be made in writing and signed by us.

This Controller Addendum applies only to the processing of personal data within the scope of Regulation (EU) 2016/679 ("GDPR"). "Personal Data", "Data Subject", "(Joint) Controller", “Processor” and “Personal Data Breach” in this Controller Addendum have the meanings set out in the GDPR.

Effective date: April 25, 2023

English (US)

فارسی

العربية

Türkçe

Deutsch

Français (France)

Polski

Svenska

Azərbaycan dili

Español

Português (Brasil)