FittingsOS Data Processing Agreement

Montes Software LLC

Version 2026.10.14-2 · Effective October 14, 2026

This Data Processing Agreement (this “DPA”) is entered into by and between Montes Software LLC, a California limited liability company doing business as FittingsOS (“Provider”), and the Customer organization on whose behalf the Software is used (“Customer”). Authorized Users are individuals who use the Software on Customer’s behalf. An Authorized User is not Customer and does not execute this DPA unless Customer has designated that individual as its DPA Signer.

This DPA forms part of the FittingsOS Terms of Service (the “Terms”). In case of conflict regarding Personal Data processing or information security, this DPA controls over the Terms. An executed Master Software License and Services Agreement (“MSA”) and any DPA attached to that MSA, if any, control as between Provider and that Customer legal entity to the extent of conflict with this public DPA.

Execution. This DPA is executed on behalf of Customer only by an individual Customer has designated as its authorized DPA signer ("DPA Signer"). The DPA Signer signs electronically in the Service by entering their full legal name and title. By signing, the DPA Signer represents that they are authorized to bind Customer. Customer's first DPA Signer is designated on the basis of a written authorization signed by an owner or officer of Customer, and is confirmed by a second individual at Customer. Acceptance of the Terms of Service by an individual user does not execute this DPA. Provider may rely on any signature made through a designated DPA Signer's account.

Provider is not SOC 2, ISO 27001, or HITRUST certified. This DPA is not an attestation report and does not claim AS9100, Nadcap, or ISO certification of any shop.

Effective date: October 14, 2026. DPA version: 2026.10.14-2. Related Privacy Policy version: 2026.10.14-1.

1. Definitions

“Applicable Data Protection Law” means privacy and data protection laws applicable to the processing of Personal Data under the Terms, including as applicable the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (Cal. Civ. Code § 1798.100 et seq.), and its implementing regulations (Cal. Code Regs. tit. 11, § 7000 et seq.) (together, “CCPA”), other U.S. state privacy laws, and, if applicable, the EU/UK GDPR.

“Business Purposes” means the purposes described in Section 3 of this DPA.

“Personal Data” means any Customer Data relating to an identified or identifiable natural person that Provider processes on behalf of Customer in connection with the Software. Personal Data includes “personal information” as defined in Cal. Civ. Code § 1798.140(v) to the extent contained in Customer Data.

“Process” or “Processing” means any operation performed on Personal Data, whether or not by automated means.

“Security Incident” means confirmed unauthorized access to, or acquisition of, Personal Data or Customer Data in Provider’s possession or control that compromises the confidentiality of such data, excluding unsuccessful attempts (for example, pings and port scans) and incidents solely within Customer-controlled infrastructure with no Provider involvement.

“Sell,” “share,” “service provider,” “contractor,” and “cross-context behavioral advertising” have the meanings given in Cal. Civ. Code § 1798.140.

“Subprocessor” means a third party engaged by Provider to Process Personal Data on behalf of Customer.

Other capitalized terms have the meanings in the Terms.

2. Roles of the parties

Customer as controller / business. Customer determines the purposes and means of Processing Personal Data that Customer stores in the Software. Customer is responsible for the accuracy of Personal Data, for providing notices, and for obtaining consents where required, including as an employer.

Provider as processor / service provider. Provider Processes Personal Data only: (a) to provide the Software and related support; (b) as documented in the Terms and this DPA; (c) as further reasonably instructed by Customer in writing, provided the instructions are consistent with the Terms; and (d) as required by law (in which case Provider will notify Customer unless legally prohibited).

Service provider, not contractor. To the extent CCPA applies, Provider acts as Customer’s “service provider” under Cal. Civ. Code § 1798.140(ag), and not as a “contractor” or “third party.” Customer discloses Personal Data to Provider only for the limited and specified Business Purposes in Section 3.

Customer-hosted / hybrid deployments. Where Software components run in Customer’s environment and Provider does not host Production Customer Data, Provider’s Processing of Personal Data is limited to incidental access during support (for example, screen shares or log snippets Customer chooses to provide). Customer remains primarily responsible for securing its environment.

Website inquiries. Personal information submitted on the public marketing form is collected by Provider as a business (see the Privacy Policy), not as a processor of Customer Data. That inquiry is not Customer Data in the Software until a Customer account stores it.

3. Nature, purpose, and duration of processing

Subject matter: provision of FittingsOS Software and support.

Duration: the term of Customer’s access under the Terms or MSA, plus limited transition, backup, and legal-hold retention as described herein.

Nature: storage, retrieval, transmission, structuring, backup (if hosted), support access, and security logging.

Business Purposes: to enable the Customer’s ERP, QMS, calibration, and related shop operations as configured by Customer; to provide support; to maintain the security and integrity of the Software; to debug and repair errors; and to comply with law. These are business purposes under Cal. Civ. Code § 1798.140(e).

Categories of data subjects: Customer employees, contractors, and Authorized Users; potentially suppliers’ or customers’ contact persons if Customer stores such data.

Categories of Personal Data: names, usernames, work email and phone, role and training records, audit-trail identifiers; optionally other HR-related fields Customer configures.

Sensitive data: not required for core ERP. Customer shall not submit government ID numbers, health data, or similar unless a written amendment and additional controls are agreed.

Export-controlled data: may appear in job or quality records Customer stores; classification and lawful handling are Customer’s responsibility. Provider is not the Empowered Official. Customer must keep controlled technical data and gold NC programs on the shop origin and off public uploads. Global CDN and edge points of presence may terminate TLS in transit and are not a designated controlled channel.

4. Provider obligations

Provider shall Process Personal Data only on documented instructions from Customer, including the Terms, this DPA, and Customer’s configuration of the Software.

Provider shall ensure persons authorized to Process Personal Data are bound by confidentiality obligations.

Provider shall implement the security measures described in Section 10 and on /security. Those descriptions are posture, not a certification.

Provider shall not engage Subprocessors except as provided in Section 7.

Taking into account the nature of Processing, Provider shall assist Customer by appropriate technical and organizational measures, insofar as possible, for Customer’s obligations to respond to data-subject requests. Provider will not respond directly to data subjects about Customer Data except to redirect them to Customer, unless legally required.

Provider shall assist Customer with data-protection impact assessments, CCPA risk assessments, and consultations with supervisory authorities, upon reasonable written request. Material effort may be charged at then-current professional-services rates if an MSA so provides; otherwise, Provider will provide commercially reasonable assistance.

Upon termination, Provider shall delete or return Personal Data in Provider’s hosted possession as set forth in Section 11, except for archival copies retained under legal hold or as required by law.

Provider shall make available information reasonably necessary to demonstrate compliance with this DPA and allow audits as set forth in Section 9.

Provider shall inform Customer if, in Provider’s opinion, an instruction infringes Applicable Data Protection Law, without obligation to provide legal advice.

5. CCPA service-provider terms

To the extent CCPA applies, and consistent with Cal. Civ. Code § 1798.100(d), § 1798.140(ag), and Cal. Code Regs. tit. 11, § 7051, Provider shall not:

(a) sell or share Personal Data;

(b) retain, use, or disclose Personal Data for any purpose (including any commercial purpose) other than the Business Purposes specified in this DPA, or as otherwise permitted by the CCPA;

(c) retain, use, or disclose Personal Data outside the direct business relationship between Provider and Customer; or

(d) combine Personal Data received from or on behalf of Customer with personal information Provider receives from or on behalf of another person, or collects from its own interactions with consumers, except as permitted by Cal. Code Regs. tit. 11, § 7050(a).

Provider further:

(e) shall comply with applicable obligations under the CCPA and provide the same level of privacy protection as is required of businesses by the CCPA;

(f) grants Customer the right to take reasonable and appropriate steps to help ensure that Provider uses Personal Data in a manner consistent with Customer’s obligations under the CCPA, including through the audit rights in Section 9;

(g) shall notify Customer if Provider determines that it can no longer meet its obligations under the CCPA;

(h) grants Customer the right, upon notice, to take reasonable and appropriate steps to stop and remediate unauthorized use of Personal Data, including by requiring Provider to cease the unauthorized Processing;

(i) shall cooperate with Customer in responding to consumer requests under the CCPA, including by deleting, correcting, or providing Personal Data as Customer instructs, and shall notify its Subprocessors of such requests where needed;

(j) shall bind each Subprocessor to a written contract that complies with the CCPA and its regulations; and

(k) to the extent Provider creates de-identified information from Personal Data, shall maintain it in de-identified form, shall not attempt to re-identify it except as permitted by law, and shall contractually obligate any recipient to do the same, consistent with Cal. Civ. Code § 1798.140(m).

Provider certifies that it understands and will comply with the restrictions in this Section 5.

6. Customer obligations

Customer shall not instruct Provider to Process Personal Data in violation of Applicable Data Protection Law.

Customer shall not upload export-controlled technical data, gold NC programs, or classified information to a public form or to a hosted surface that is not designated for that data.

Customer is solely responsible for its quality system, certificates, Empowered Official function, and employee notices (including biometric notices if Customer enables those features).

Customer shall configure roles and seats so that only Authorized Users have access, and shall promptly disable accounts of persons who leave. Isolation in the Software is between Customer organizations (tenants). Provider does not promise isolation between end-customers inside a single shop’s customer portal.

Customer shall not submit another person’s biometric identifiers without a lawful basis.

7. Subprocessors

Customer authorizes Provider to engage Subprocessors to deliver the Software. The current list is published at /subprocessors, summarized at /security, and includes, as applicable: Vercel (shop UI hosting, SSR region iad1), Cloudflare (DNS, WAF, API tunneling, Turnstile), GitHub (source control and CI), Tailscale (remote access as applicable), Resend (transactional email, in use), and, when a shop enables them, Intuit / QuickBooks Online (accounting sync) and Plaid (bank linking).

Provider shall impose written confidentiality and data-protection terms on Subprocessors no less protective of Personal Data than this DPA in all material respects, given the service each performs, including the restrictions in Section 5.

Provider remains responsible for Subprocessor performance as to Personal Data Processor obligations under this DPA.

Provider will keep the public /subprocessors list current and will post any addition of a Subprocessor that will Process Personal Data. Continued use of the Software after a posted Subprocessor update constitutes authorization of that Subprocessor, subject to Customer’s objection right. If Customer objects to a new Subprocessor on reasonable data-protection grounds in writing to security@fittingsos.com within fifteen (15) days of posting, the parties will discuss a commercially reasonable alternative; if none exists, Customer’s sole remedy is to stop using the affected feature or terminate the affected hosted service under the Terms.

8. Security incidents

Provider shall notify Customer without undue delay after discovery of a Security Incident affecting Personal Data Provider hosts, and in any event within seventy-two (72) hours from discovery (including suspected incidents), unless a shorter period is required by law. Notification is sent to the tenant owner or officer of record, at the primary address on file and at a backup address on a different email domain. The notice counts as given only when the incident record holds delivery proof of the recipient, the time sent, and the provider message ID. A bounced attempt is not delivery proof. Notification will describe, to the extent known: the nature of the incident, the categories of data and approximate number of data subjects affected, likely consequences, a point of contact at Provider, and measures taken or proposed. Provider will supplement the notification as further information becomes available.

Provider shall reasonably cooperate with Customer’s incident-response and notification obligations, including those under Cal. Civ. Code § 1798.82. Provider’s notification is not an admission of fault.

Customer is responsible for incidents originating in Customer-controlled infrastructure, shop-origin systems, or user credentials Customer failed to protect.

Customer should report suspected Security Incidents involving the Software to security@fittingsos.com.

9. Audits

Upon written request not more than once per twelve (12) months (unless a Security Incident or regulator requires more), Provider shall make available a written summary of relevant security controls. Because Provider is not currently SOC 2 certified, Provider does not promise an SOC 2 Type I or Type II report.

If Applicable Data Protection Law requires a further audit, Customer may conduct a remote audit of Provider’s relevant policies on reasonable notice, during business hours, subject to confidentiality, and without unreasonably disrupting operations. On-site audits, if required by law and not reasonably satisfied remotely, are at Customer’s expense and require a mutually agreed scope.

Provider may satisfy audit requests by providing current public posture information at /security plus confidential summaries under NDA.

10. Security measures

Provider maintains measures designed to protect Personal Data, including as applicable: TLS for public traffic (global CDN and edge points of presence may terminate TLS in transit); Content-Security-Policy and security headers on hosted surfaces; httpOnly session cookies on hosted sign-in; isolation between Customer organizations by organization identifier with row-level security on org-scoped tables (not a promise of per-customer isolation inside a shop portal); rate limiting and abuse controls; and product controls that refuse customer-portal uploads declared or named as ITAR/EAR controlled technical data so Customer can keep controlled technical data and gold NC on the shop origin.

These measures are described on /security. They may change as the product evolves, provided the overall level of protection is not materially reduced without notice via a DPA / TERMS_VERSION update where the change is material to Personal Data.

No measure guarantees absolute security. Customer remains responsible for endpoint security, account hygiene, and shop-origin systems.

11. Return and deletion

Upon termination of hosted access, Customer may export Customer Data then available through the Software’s ordinary export features, if any, during a commercially reasonable wind-down not to exceed thirty (30) days unless an MSA provides otherwise.

Thereafter Provider shall delete hosted Customer Data from production systems within a commercially reasonable period, except: (a) backup copies that expire on the backup rotation; (b) records Provider must retain by law; (c) Terms-acceptance and security logs Provider holds as a business; and (d) data on Customer-controlled shop-origin systems, which Customer deletes itself.

Provider is not obligated to delete data it does not host.

12. International transfers

Hosting and processing for the shop UI SSR and shop-origin API are oriented to the United States (including Vercel SSR region iad1 and API reach to the Customer/shop origin via Cloudflare Tunnel). Global CDN and edge points of presence may terminate TLS in transit. Provider does not claim United States–only data residency for all bytes in transit. Customer instructs Provider to Process Personal Data with United States–oriented hosting as described here and on /security. If GDPR applies to a transfer, the parties will execute standard contractual clauses or another lawful transfer mechanism upon reasonable request. Until then, Customer is responsible for assessing whether its use of the hosted service is lawful for its data.

13. Liability

Each party’s liability under this DPA is subject to the limitation of liability, warranty disclaimer, and indemnity in the Terms, except to the extent Applicable Data Protection Law prohibits that limitation as to a particular claim.

Provider’s processing of Customer Data does not make Provider the employer, the quality manager, or the Empowered Official.

14. Governing law; term

This DPA is governed by the governing-law and venue provisions of the Terms (laws of the State of California; state or federal courts located in Los Angeles County, California), except where Applicable Data Protection Law requires otherwise. This DPA remains in effect for as long as Provider Processes Personal Data on behalf of Customer, and Sections 5, 8, 11, and 13 survive for as long as Provider retains any Personal Data.

15. Updates

Updates. Provider may publish an updated version of this DPA. Until Customer's DPA Signer signs the updated version, the version Customer last signed remains in effect and governs all processing of Customer Personal Data. During that period, Provider may pause new ingestion of Customer mail and automated or third-party exports. Exports initiated manually by Customer's administrators, retention and deletion, legal holds, and disconnection continue under the version last signed. No update reduces Provider's obligations under a version Customer has signed unless Customer signs the update. Provider keeps a copy of each version, with its hash, and a record of who signed, their title, and when.

16. Contact

Data-protection contact and security reports: security@fittingsos.com. Provider: Montes Software LLC, doing business as FittingsOS, 5392 Corradi Ter, Acton, CA 93510, United States, operating fittingsos.com.

Do not send export-controlled technical data, prints, or NC programs to those mailboxes.

This DPA is the processing contract for Customer Data. It is not legal advice to Customer.

End of FittingsOS DPA v2026.10.14-2. English language controls. Incorporated into the Terms of Service.