GENERAL EEA/CH-US DATA PRIVACY
SAFE HARBOR NOTICE
SCOPE OF SAFE HARBOR CERTIFICATION.
Facebook, Inc. (hereinafter “Facebook” or “we”) recognizes that the European Community has established a data protection regime pursuant to Directive 95/46/EC (the “Directive”), which applies to the European Economic Area (“EEA”), and that Switzerland has established a data protection regime pursuant to the Federal Act on Data Protection (“FADP”). Facebook further recognizes that these regimes restrict companies and other organizations in the EEA and Switzerland (collectively, “EEA/CH”) from transferring personal data about individuals in the EEA/CH to the United States, unless there is “adequate protection” for such personal data when it is received in the United States.
To create such “adequate protection” and to overcome the restriction on international data transfers established by the Directive and the FADP, Facebook adheres to the Safe Harbor Privacy Principles published by the U.S. Department of Commerce (“Safe Harbor Principles”) with respect to certain information that it receives in the United States: namely, personal data about employees or other individual representatives in the EEA/CH of corporate customers, suppliers, distributors, advertising customers and other business partners of Facebook or a subsidiary or affiliate of the Facebook group (“EEA/CH Data”).
More information on the Safe Harbor Principles and Facebook’s scope of participation is available at http://www.export.gov/safeharbor/.
SCOPE OF THIS NOTICE.
This Notice applies to EEA/CH Data relating to data subjects residing in the EEA/CH (“EEA/CH Persons”) that we receive and process, except personal data that we receive in the context of employment with a Facebook company and except data that individuals upload to the Facebook social networking platform. We have issued separate notices to address such excepted situations: Our website Privacy Policy addresses data processing via the Facebook platform and our European Facebook employees receive specific notices in the employment context.
CATEGORIES OF EEA/CH DATA.
Facebook receives certain information related to individual independent contractors, and employees and individual representatives of companies and other organizations that do business with Facebook, such as advertising customers. Such EEA/CH Data includes, without limitation, names, addresses, work phone numbers, work email addresses, and any other personal data that such contractors and entities affirmatively provide to Facebook for purposes of managing business relationships.
Also, we provide data processing services to affiliated and unaffiliated entities, including Facebook Ireland Ltd., and in that context, we process any information that such entities instruct us to process, on their behalf and subject to their direction. When EEA/CH Data is sent to Facebook by another company in the EEA/CH for processing purposes, the categories of data sent and the purposes of processing depend on such other company, the data controller, with whom the relevant data subjects in the EEA/CH typically have a business or other relationship (and which therefore, can provide additional information on the categories of data at issue).
PURPOSES.
Facebook collects and uses EEA/CH Data for purposes of providing products and services to its customers, processing EEA/CH Data on behalf of corporate customers, communicating with corporate business partners about business matters, transmitting marketing e-mails and performing other marketing activities, managing orders, sales, purchases and financing, processing job applications, and conducting related tasks for legitimate business purposes.
EEA/CH Persons may opt-out of such use if their personal information is used for purposes that are incompatible with their prior authorizations or the foregoing or by sending an e-mail to the Safe Harbor Privacy Contact, or by following opt-out instructions that are contained in other notices that may be communicated by Facebook from time to time. Facebook will provide additional opt-out (or opt-in) opportunities where required by applicable law or the Safe Harbor Principles.
DISCLOSURE.
Facebook shares EEA/CH Data with its subsidiaries and affiliates and contractors that process EEA/CH Data on behalf of Facebook as data processing service providers. Facebook also shares EEA/CH Data with other third parties for the purposes for which Facebook receives the EEA/CH Data (e.g., performance of contractual obligations) and as required or permitted by law.
With respect to marketing e-mails, EEA/CH Persons may opt-out of receiving further e-mail marketing communications from Facebook by sending an e-mail to the Safe Harbor Privacy Contact, or by following opt-out instructions that are contained in each marketing e-mail. EEA/CH Persons may also send an e-mail to this address to ask to opt-out of disclosures to third parties, but such a limitation on data sharing may make it difficult or impossible for Facebook to provide the requested services. Notwithstanding other statements in this General Safe Harbor Notice, Facebook may disclose EEA/CH Data where it is legally required to disclose (e.g., under statutes, contracts or otherwise) or the disclosure is permitted by law and Facebook has a legitimate business interest in such disclosure.
ACCESS AND REVIEW.
EEA/CH Persons, whose EEA/CH Data Facebook holds as a data controller, may request access to, and the opportunity to update and correct EEA/CH Data that Facebook holds about them. To submit such requests or raise any other questions, please contact the Facebook Safe Harbor Privacy Contact as described below. Facebook reserves the right to take appropriate steps to authenticate an applicant’s identity, charge an adequate fee before providing access and deny requests, except as required by the Safe Harbor Principles.
SAFE HARBOR CONTACT.
If you have questions or concerns, please reach out to your contact within Facebook who will put you in contact with our Facebook Safe Harbor Privacy Contact.
If you have a concern that we do not resolve to your satisfaction, you may contact the competent local data protection authority in your EEA/CH Member State if it falls within the scope of this Notice. (For users of, and data on the Facebook social networking platform, please follow the dispute resolution channels set forth in our website Privacy Policy, which involves TRUSTe; for Facebook employees, the dispute resolution channels are set forth in the European Employee Safe Harbor notice).