Oculus for Business is no longer available for purchase. Learn about our latest VR for business offering, Meta Quest for Business here.

Oculus for Business Data Processing Addendum

Last Updated: October 11, 2020

This Oculus for Business Data Processing Addendum (“Addendum”) supplements the Oculus for Business Enterprise Use Agreement, available at https://www.oculusforbusiness.com/enterprise-use-agreement/ (the “Agreement”) between you and Facebook Ireland Limited (“Facebook,” “we,” “our,” “us”). This Addendum applies solely to the extent that Personal Data (as defined below) collected pursuant to the Agreement is subject to the General Data Protection Regulation (EU) 2016/679) (“GDPR”). In the event of any inconsistency between the Agreement and this Addendum pertaining to privacy and Personal Data, this Addendum prevails.

1.
Definitions
Within this Addendum, “Controller”, “Processor”, “Data Subject”, “Personal Data”, “Personal Data Breach” and “Processing” shall have the same meanings as are defined in the GDPR. “Processed” and “Process” shall be construed in accordance with the definition of “Processing”. All other terms capitalized but not deﬁned in this Data Processing Addendum (as well as “you” and “your”) will have the deﬁnition provided in the Agreement.
2.
Data Processing
1. a.
  As between the parties, you shall be the Controller of any Personal Data within the content or data that your Authorized Users submit, post or provide to the Enterprise Software, or usage or functional information that we process regarding how your Authorized Users interact with the Enterprise Software (“Your Personal Data”), and Facebook shall be the Processor of Your Personal Data.
2. b.
  In conducting its activities as Processor under this Addendum in relation to Your Personal Data, Facebook confirms that:
  i.
  the duration, subject matter, nature and purpose of the Processing shall be as specified in the Agreement;
  ii.
  the types of Personal Data Processed shall include those specified in the Oculus for Business Privacy Disclosure, available at https://business.oculus.com/legal/enterprise-privacy-disclosure/;
  iii.
  the categories of Data Subjects include your representatives, Authorized Users and any other individuals identified or identifiable by Your Personal Data; and
  iv.
  your rights as Controller in relation to Your Personal Data are as set out in this Addendum.
3. c.
  To the extent that Facebook Processes Your Personal Data under or in connection with the Agreement, Facebook shall:
  i.
  only Process Your Personal Data in accordance with your instructions as set out under the Agreement, including this Addendum, subject to any exceptions permitted by Article 28(3)(a) of the GDPR;
  ii.
  ensure that those of its employees authorised to Process Your Personal Data under this Addendum have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality in relation to Your Personal Data;
  iii.
  implement the technical and organisational measures designed to protect Personal Data against anticipated threats or hazards to their security, confidentiality or integrity;
  iv.
  respect the conditions referred to below in Sections 2.d and 2.e of this Addendum when appointing sub-Processors;
  v.
  assist you by implementing appropriate technical and organisational measures, insofar as this is possible through Oculus for Business, to enable you to fulfil your obligations to respond to requests for the exercise of rights by a Data Subject under Chapter III of GDPR;
  vi.
  on termination of the Agreement, delete Your Personal Data pursuant to the Agreement, unless European Union or Member State law requires Personal Data to be retained; and
  vii.
  make available to you the information described in this Addendum and via the Products in satisfaction of Facebook’s obligation to make available all information that is necessary to demonstrate compliance with the obligations of Facebook under Article 28 GDPR.
4. d.
  You authorise Facebook to subcontract its data Processing obligations under this Agreement to its affiliates, and to other third parties, a list of which Facebook will provide to you upon your written request. Facebook shall do so only by way of a written agreement with such sub-Processor which imposes obligations on the sub-Processor that are no less protective of Your Personal Data than the obligations imposed on Facebook under this Agreement. Where that sub-Processor fails to fulfil such obligations, Facebook shall remain fully liable to you for the performance of that sub-Processor's data protection obligations, in accordance with the Agreement.
5. e.
  Where Facebook engages an additional or replacement sub-Processor(s), Facebook shall inform you of such additional or replacement sub-Processor(s) no later than fourteen (14) days in advance of the appointment of such additional or replacement sub-Processor(s). You may object to the engagement of such additional or replacement sub-Processor(s) within fourteen (14) days of being so informed by Facebook by terminating the Agreement immediately on written notice to Facebook.
6. f.
  Facebook shall notify you without undue delay upon becoming aware of a Personal Data Breach relating to Your Personal Data. Such notice shall include, at the time of notification or as soon as possible after notification, relevant details of the Personal Data Breach where possible, including the number of your records affected, the category and approximate number of affected Authorized Users, anticipated consequences of the breach and any actual or proposed remedies, where appropriate, for mitigating the possible adverse effects of the breach.
7. g.
  In conducting its activities under the Agreement, Facebook may transfer Your Personal Data to various locations, which may include locations both inside and outside of the European Economic Area (“EEA”), including to Facebook, Inc. in the U.S. Facebook and Facebook, Inc. in the U.S. have entered into an agreement to facilitate such transfer of Personal Data between them.