Data Processing Addendum
Last updated: 2026-09-24
1. Definitions
The customer business is the controller. Rocket Platform LLC is the processor for personal data the customer submits to RocketFactura.
2. Subject matter and duration
We process customer personal data for the duration of the customer’s subscription and any legally required retention period.
3. Nature and purpose
Processing includes hosting, storing, retrieving, securing and transmitting data to provide the Service and support the customer.
4. Data subjects and data categories
Data subjects include business customer staff, end customers, leads and service recipients. Data categories are derived from the configured inventory below.
| Data | Purpose | Retention |
|---|---|---|
| Issuer account email and name | Create, secure, and manage the issuer account | While the account is active, then as required for legal records |
| Issuer legal name, cedula, and fiscal address | Configure Costa Rica electronic invoicing and fiscal records | Retained per Costa Rica fiscal law for 5 years |
| Customer name, identification, and email on invoices | On behalf of the business: issue and deliver legally required invoice records | Retained per Costa Rica fiscal law for 5 years |
| Invoice line items and amounts | On behalf of the business: calculate, submit, and retain electronic invoices | Retained per Costa Rica fiscal law for 5 years |
| Issuer signing certificate and Hacienda credentials | Sign invoices and authenticate required submissions to Hacienda | While the account is active |
| Webhook endpoint URLs configured by the business | Deliver invoice and certificate lifecycle events | While the webhook subscription is active |
| Technical logs | Security, debugging, fraud prevention, and service reliability | Up to 90 days unless needed for security investigation |
5. Processor obligations
- Process personal data only on documented customer instructions.
- Bind personnel to confidentiality.
- Maintain appropriate technical and organisational security measures.
- Use listed sub-processors and give 30 days’ notice of material changes.
- Assist with data-subject requests and privacy impact assessments where required.
- Notify breaches within 5 business days to PRODHAB and the affected persons (Costa Rica); without unreasonable delay under applicable state breach laws (United States).
- Delete or return customer personal data at the end of the Service unless law requires retention.
- Allow one reasonable audit per year on written request.
6. International transfers
International transfers use adequacy decisions, standard contractual clauses or an equivalent lawful transfer mechanism.
7. Liability and governing law
Liability follows the Terms of Service. This DPA is governed by United States.
8. Annex A: sub-processors
| Sub-processor | Purpose | Category | Region | Policy |
|---|---|---|---|---|
| Amazon Web Services (AWS) | Authentication through Cognito and database hosting in RDS | auth | United States (us-east-2) | https://aws.amazon.com/privacy/ |
| Ministerio de Hacienda de Costa Rica (TRIBU-CR / ATV) | Receives issued electronic invoices by Costa Rican legal obligation | other | Costa Rica | https://www.hacienda.go.cr |
| Sentry | Error monitoring, performance traces, and diagnostics | support | United States | https://sentry.io/privacy/ |
| Vercel | Web application hosting and edge delivery | hosting | United States | https://vercel.com/legal/privacy-policy |
| Fly.io | API hosting for RocketFactura services | hosting | United States | https://fly.io/legal/privacy-policy/ |