Meta Platform Compliance

Effective date: September 22, 2025

This is a compliance addendum for DutiesBook™ (operated by Andromeda IT) governing Meta platform data handling across WhatsApp Business API, Facebook Messenger, and Instagram Business Messaging. It complements the Privacy Policy and Terms of Service.

1. Permitted Data Processing

The platform processes Meta platform data exclusively to:

Facilitate business communication between customers and clients.
Provide a unified inbox across messaging channels.
Generate performance analytics to improve operations.
Enable authorized automation features including chatbots.
Ensure message delivery and system stability.

2. Prohibited Practices

The following practices are strictly forbidden:

Discriminatory processing based on protected characteristics.
Eligibility determinations for housing, employment, insurance, credit, education, or government benefits.
Surveillance activities for law enforcement or security purposes.
Commercial restrictions including selling, licensing, or trading data.
Technical restrictions including reverse engineering, decryption, or unauthorized profile building.

3. Data Sharing Requirements

Authorized sharing only occurs:

With written agreements binding service providers.
When legally required by Saudi regulations.
With explicit user consent for specific purposes.
With third parties under appropriate contractual safeguards.

4. User Rights and Controls

Users have the right to:

Access Meta platform data associated with their account.
Correct inaccurate information.
Request data deletion.
Restrict processing where legally permissible.
Receive their data in a portable format when technically and legally feasible.

5. Data Retention and Deletion

Mandatory deletion occurs when:

A user requests deletion formally.
The account is closed or inactive.
No legitimate reason for retention exists.
Service operations cease.
Meta requests deletion.
Legal obligations require it.
Platform APIs are unused for 28+ days.

6. Security Controls

Technical, administrative, and physical safeguards include:

End-to-end encryption where supported.
TLS protocol for data transmission.
Multi-factor authentication.
Regular penetration testing.
Principle of least privilege access.
Encryption of data at rest.

7. Incident Response

Security incidents are handled with:

Immediate containment and scope assessment.
Formal Meta notification within 24 hours.
Comprehensive investigation documentation.
Corrective action implementation.
User notification per PDPL requirements.

8. Audit and Compliance

Meta retains the right to audit compliance with:

Platform terms and developer policies.
Data processing practices and security measures.
User consent and transparency requirements.
Data retention and deletion policies.
Service-provider oversight.

9. Service Termination

Upon termination of access to Meta platform APIs:

All Meta data processing ceases immediately.
Secure deletion is performed within 30 days per Meta requirements.
Affected users are notified where applicable.
Service-provider coordination ensures complete deletion.
Termination procedures are documented for audit.

10. Saudi Regulatory Alignment

Full compliance is maintained with:

Personal Data Protection Law (PDPL).
Saudi Data and AI Authority (SDAIA) regulations.
Commercial registry requirements.
Cross-border data transfer controls.
Sector-specific privacy requirements.

Meta Compliance Officer: [email protected] · +966 920 012 888

Data Protection Officer: [email protected] · +966 920 012 888

Legal Department: [email protected] · Dalmar Center, Riyadh, Saudi Arabia

Governing Law: Saudi Arabian regulations and Meta Developer Platform Terms.