Data Processing Addendum
Last updated: 2026-11-04
1. Definitions
The customer business is the controller. Parroquial.app S.A. is the processor for personal data the customer submits to Turnos Parroquiales.
2. Subject matter and duration
We process customer personal data for the duration of the customer’s subscription and any legally required retention period.
3. Nature and purpose
Processing includes hosting, storing, retrieving, securing and transmitting data to provide the Service and support the customer.
4. Data subjects and data categories
Data subjects include business customer staff, end customers, leads and service recipients. Data categories are derived from the configured inventory below.
| Data | Purpose | Retention |
|---|---|---|
| Responsible adult name and email | Manage reservations and service messages; contact encrypted at rest | Deleted automatically 24 months after the appointment, or sooner if the parish sets a shorter period |
| Reservation, parish, service, schedule, status and holder capability | Reserve availability and let the holder manage a booking; service choice may reveal religious beliefs | Unconfirmed holds expire after 10 minutes; booking records stay for the parish schedule history, with contact details removed 24 months after the appointment |
| Staff identifier, hashed network identifiers, consent and delivery audit events | Authorize staff access, prevent abuse and track reservation messages | Deleted automatically after 24 months |
| Analytics and advertising cookie identifiers, pages visited (parish and service removed) and booking steps; no contact details | Measure visits and the booking funnel, and campaign results on the home and legal pages, only after consent | Google Analytics keeps event and user data for 2 months; Microsoft Clarity keeps session recordings for 30 days and heatmap totals for up to 13 months; Meta applies its own retention; withdrawing consent stops further collection |
5. Processor obligations
- Process personal data only on documented customer instructions.
- Bind personnel to confidentiality.
- Maintain appropriate technical and organisational security measures.
- Use listed sub-processors and give 30 days’ notice of material changes.
- Assist with data-subject requests and privacy impact assessments where required.
- Notify breaches within 5 business days to PRODHAB and the affected persons (Costa Rica).
- Delete or return customer personal data at the end of the Service unless law requires retention.
- Allow one reasonable audit per year on written request.
6. International transfers
International transfers use adequacy decisions, standard contractual clauses or an equivalent lawful transfer mechanism.
7. Liability and governing law
Liability follows the Terms of Service. This DPA is governed by Costa Rica.
8. Annex A: sub-processors
| Sub-processor | Purpose | Category | Region | Policy |
|---|---|---|---|---|
| Resend | Booking confirmations and reminders with calendar attachments, when email delivery is enabled | Communications | United States | https://resend.com/legal/privacy-policy |
| Amazon Web Services | Staff sign-in through Amazon Cognito | Authentication | United States (us-east-2, Ohio) | https://aws.amazon.com/privacy/ |
| Vercel | Hosting and delivery of the website | Hosting | United States and global edge network | https://vercel.com/legal/privacy-policy |
| Fly.io | Hosting of the booking service and its database | Hosting | United States (Ashburn, Virginia) | https://fly.io/legal/privacy-policy |
| Cloudflare Turnstile | Abuse protection on reservation forms | Abuse protection and other | Global | https://www.cloudflare.com/privacypolicy/ |
| Google Analytics (Google LLC) | Aggregate visit and booking-step measurement after analytics consent; page addresses and titles are sent with the parish and service removed, and no names or emails are sent | Analytics | United States | https://policies.google.com/privacy |
| Microsoft Clarity (Microsoft Corporation) | Usability heatmaps and masked session replays on the home and legal pages only, after analytics consent; never on parish, booking, holder or staff pages | Analytics | United States | https://privacy.microsoft.com/privacystatement |
| Meta Pixel (Meta Platforms) | Ad campaign measurement on the home and legal pages only; it does not load at all without marketing consent and never on parish, booking, holder or staff pages | Marketing | United States | https://www.facebook.com/privacy/policy/ |