1. When this DPA applies
This Data Processing Addendum applies when a business customer is a controller or processor under UK GDPR, EU GDPR or similar data protection laws and Rocket Domains processes personal data on that customer’s behalf as processor or subprocessor through the services.
If the customer is a processor for another controller, the customer warrants that its instructions and use of the services are authorised by the relevant controller and that the customer can bind the controller to terms required for lawful processing.
2. Processing details
Subject matter: provision, support, security, billing, renewal, migration and termination of Rocket Domains services. Duration: the term of the relevant services plus retention periods. Nature and purpose: hosting, storage, transmission, routing, backup, restore, scanning, filtering, support, analytics, security, administration and related processing. Data subjects: customer personnel, end users, website visitors, domain contacts, booking users, email correspondents and others whose data is processed through the services. Categories of data: account, contact, usage, communications, domain, technical, support, content, booking and other data submitted by or for customer. Sensitive data: not permitted unless expressly authorised by the service description and lawfully configured by customer.
3. Processor obligations
Rocket Domains will process customer personal data only on documented instructions, including these Terms, the order, service configuration and customer’s use of the service, unless law requires otherwise. Rocket Domains will ensure persons authorised to process customer personal data are subject to confidentiality obligations, implement appropriate technical and organisational measures, assist with data-subject requests and compliance obligations where reasonably possible, notify customer of personal data breaches without undue delay after becoming aware where required, and delete or return personal data after service end subject to legal retention, backups and technical limitations.
4. Customer obligations
Customer is responsible for lawful basis, notices, consents, instructions, data accuracy, minimisation, retention, access controls, user management, security configuration, 2FA, backups, data-subject requests, DPIAs, transfer assessments, end-user terms and lawful use of the services. Customer must not instruct Rocket Domains to process data unlawfully or in breach of third-party terms.
5. Subprocessors and private disclosure
Customer gives Rocket Domains general written authorisation to use subprocessors, suppliers and third-party providers to provide, support, secure, bill, migrate, renew and improve the services. Rocket Domains may keep its detailed supplier and subprocessor list private for security, commercial, resilience and supplier-confidentiality reasons, while publicly disclosing recipient categories and the request process. Business customers with a legitimate due-diligence or Article 28 need may request the current list or relevant extracts under reasonable confidentiality conditions by contacting legal@rocket.domains.
Rocket Domains will give reasonable notice of intended material new or replacement subprocessors where required by applicable data protection law, the DPA or an enterprise agreement. Customer may object on specific, reasonable data-protection grounds. If the objection cannot be resolved, the sole remedy is termination of the affected service before the change takes effect, subject to payment and non-refundable third-party fees. Emergency, security, continuity or legal replacements may occur before notice, with notice afterward where required and practicable.
6. International transfers
Where Rocket Domains transfers customer personal data internationally as processor, Rocket Domains will use an applicable transfer mechanism such as adequacy, SCCs, UK IDTA/Addendum or other lawful safeguard. Customer authorises such transfers as necessary to provide global services and agrees to complete any additional documents reasonably required.
7. Audits
Rocket Domains will make available information reasonably necessary to demonstrate compliance with this DPA. Audits must be reasonable, proportionate, confidential, limited to once annually unless a serious incident requires otherwise, conducted by qualified independent auditors, avoid disruption and security risk, and exclude information relating to other customers, trade secrets, supplier-confidential information and security-sensitive details. Customer must pay reasonable costs for audits unless mandatory law requires otherwise.
8. Liability under DPA
All DPA-related liability is subject to the exclusions and six-month fee cap in the Master Terms to the fullest extent permitted by law, unless a separate signed enterprise agreement expressly states a different cap.