Effective date: September 1, 2026
This Data Processing Addendum ("DPA") forms part of the Flooring OS Terms of Service or other written agreement (the "Agreement") between Flooring OS LLC, 5200 Tennyson Pkwy #350, Plano, TX 75024 ("Flooring OS") and the Customer named in the Agreement or Order ("Customer"). It applies automatically when the Customer accepts the Agreement; no separate signature is needed. A Customer that requires a signed copy may request one at legal@flooringos.com.
1. Definitions
Capitalised terms not defined here have the meanings given in the Agreement.
- "Data Protection Law" means all laws on privacy and the processing of personal information that apply to a party's processing of Customer Personal Data. These include the California Consumer Privacy Act as amended by the California Privacy Rights Act and its regulations ("CCPA"); other U.S. state comprehensive privacy laws; Canada's Personal Information Protection and Electronic Documents Act ("PIPEDA"); Quebec's Act respecting the protection of personal information in the private sector ("Quebec Privacy Act"); the Alberta and British Columbia Personal Information Protection Acts; and, only to the extent they apply, the EU General Data Protection Regulation 2016/679 ("GDPR") and the UK GDPR.
- "Customer Personal Data" means personal data or personal information in Customer Data that Flooring OS processes on the Customer's behalf in providing the Services.
- "Controller", "Processor", "Data Subject", "Personal Data", "Processing" and "Supervisory Authority" have the meanings given in the GDPR. "Business", "Service Provider", "Consumer", "Sell" and "Share" have the meanings given in the CCPA. Where other Data Protection Law uses equivalent terms, they apply as the context requires.
- "Security Incident" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data held by Flooring OS or its Sub-processors.
- "Sub-processor" means any third party Flooring OS engages to process Customer Personal Data.
2. Roles and scope
2.1 Roles. Customer is the Controller (and Business) of Customer Personal Data, and Flooring OS is its Processor (and Service Provider). Where Customer itself processes Customer Personal Data as a processor for a third party, Flooring OS is Customer's sub-processor, and Customer is responsible for obtaining any authorisations its controller requires.
2.2 Scope. This DPA applies only to Customer Personal Data. It does not apply to personal information that Flooring OS processes as a Controller for its own business — such as Customer's account, billing and business-contact information — which is governed by the Flooring OS Privacy Policy.
2.3 Details of processing. The subject matter, nature, purpose and duration of the processing, and the types of personal data and categories of Data Subjects, are described in Annex I.
3. Customer's responsibilities
Customer is responsible for: (a) the accuracy, quality and lawfulness of Customer Personal Data and the means by which it was obtained; (b) providing all notices and obtaining all consents, and having a lawful basis, required by Data Protection Law for Flooring OS to process Customer Personal Data under this DPA; (c) its communications with its own customers, including compliance with marketing and telephone-consumer-protection laws; and (d) ensuring its instructions comply with Data Protection Law. Customer will not store in the Services special-category or sensitive personal information (such as health information, government identification numbers or full payment-card numbers) except in fields designed for that purpose.
4. Processing on instructions
4.1 Flooring OS will process Customer Personal Data only on Customer's documented instructions, unless Union, Member State or other applicable law requires otherwise. In that case Flooring OS will inform Customer of the legal requirement before processing, unless that law prohibits it. The Agreement, this DPA, Customer's configuration and use of the Services, and support requests submitted by Customer's authorised users together form Customer's complete instructions. Additional instructions require written agreement.
4.2 Flooring OS will promptly inform Customer if, in its opinion, an instruction infringes Data Protection Law. It may then suspend that processing until the instruction is confirmed or changed.
5. Service Provider commitments (CCPA and U.S. state law)
With respect to Customer Personal Data, Flooring OS will not:
- (a) sell or share it;
- (b) retain, use or disclose it for any purpose other than the business purposes specified in the Agreement and Annex I, including for any commercial purpose of its own such as marketing, profiling or advertising, or outside the direct business relationship between Flooring OS and Customer;
- (c) combine it with personal information that Flooring OS receives from or on behalf of any other person, or collects from its own interactions with a Consumer, except as the CCPA regulations expressly permit for a Service Provider; or
- (d) use it to train or improve artificial-intelligence models that are made available to anyone other than Customer.
Flooring OS will comply with the CCPA and other applicable U.S. state privacy laws, and will provide the same level of privacy protection they require. It will notify Customer if it determines it can no longer meet its obligations under them. Customer may take reasonable and appropriate steps to stop and remediate any unauthorised use of Customer Personal Data, including by exercising its rights under Section 11. Flooring OS certifies that it understands and will comply with the restrictions in this Section 5.
6. Confidentiality and personnel
Flooring OS will ensure that everyone it authorises to process Customer Personal Data is bound by a written or statutory duty of confidentiality, has received appropriate privacy and security training, and has access only to the extent needed to provide the Services, resolve Customer's support requests, maintain security, or comply with law. Flooring OS personnel access Customer Personal Data only for those purposes, and that access is logged.
7. Security
7.1 Flooring OS will implement and maintain appropriate technical and organisational measures to protect Customer Personal Data against Security Incidents, taking into account the state of the art, the costs of implementation, and the nature, scope, context and purposes of the processing and the risks to Data Subjects. Those measures include at least those in Annex II.
7.2 Flooring OS may update its security measures over time, provided the updates do not materially reduce the overall protection of Customer Personal Data.
8. Sub-processors
8.1 General authorisation. Customer gives general authorisation for Flooring OS to engage Sub-processors. The Sub-processors in use on the Effective Date are listed in Annex III and at https://www.flooringos.com/subprocessors.
8.2 Notice of changes. Flooring OS will give Customer at least 30 days' notice before a new Sub-processor begins processing Customer Personal Data. It will do so by updating the sub-processor page and emailing the account administrator, and anyone who has asked to receive change notices by writing to privacy@flooringos.com.
8.3 Right to object. Customer may object on reasonable data-protection grounds by writing to privacy@flooringos.com within the notice period. The parties will discuss the concern in good faith. If Flooring OS cannot offer a reasonable alternative, Customer may terminate the affected Services by written notice and receive a refund of prepaid fees for the unused remainder of the term. Termination and refund are Customer's sole remedy for the objection.
8.4 Flow-down and liability. Flooring OS will bind each Sub-processor by a written contract imposing data-protection obligations no less protective than those in this DPA. It remains liable to Customer for each Sub-processor's performance of those obligations.
8.5 Emergency replacement. If Flooring OS must replace a Sub-processor urgently for security, reliability or legal reasons, it will give notice as soon as practicable. The objection right in Section 8.3 then applies from the date of that notice.
9. Assistance with Data Subject requests
9.1 Taking into account the nature of the processing, Flooring OS will help Customer meet its obligations to respond to Data Subjects' requests to exercise their rights under Data Protection Law — access, correction, deletion, restriction, portability, objection, and opt-out. Where possible it will do this through features of the Services that let Customer find, export, correct and delete Customer Personal Data itself.
9.2 If Flooring OS receives a request directly from a Data Subject relating to Customer Personal Data, it will not respond, except to tell the Data Subject to contact Customer. It will forward the request to Customer without undue delay, and in any event within 5 business days, unless law prohibits it.
9.3 Flooring OS will provide reasonable assistance, at Customer's request and cost where the effort goes beyond the features of the Services, with data-protection impact assessments and prior consultations with Supervisory Authorities that relate to the Services.
10. Security Incidents
10.1 Notification. Flooring OS will notify Customer without undue delay, and in any event within 48 hours, after becoming aware of a Security Incident. It will send notice to the account administrator's email on file and any security contact Customer has designated.
10.2 Content. The notice will describe, to the extent then known: the nature of the Security Incident, including the categories and approximate number of Data Subjects and records concerned; the likely consequences; the measures taken or proposed to address it and mitigate its effects; and a contact point for more information. Where not all of this is available at once, Flooring OS will provide it in phases as it becomes available.
10.3 Response. Flooring OS will promptly take reasonable steps to contain, investigate and remediate the Security Incident. It will reasonably cooperate with Customer so that Customer can meet any obligation to notify Supervisory Authorities, Data Subjects or regulators. Notifying Customer is not an admission of fault or liability.
10.4 Customer's role. Customer is responsible for deciding whether to notify, and for notifying, its own customers and any regulator, unless law places that obligation on Flooring OS directly. Flooring OS will not notify Customer's customers directly unless Customer asks it to or the law requires it.
11. Audits
11.1 Documentation. On written request, no more than once in any 12-month period, Flooring OS will provide information reasonably necessary to show compliance with this DPA. That may include completing a reasonable security questionnaire, and providing summaries of its security policies and, where available, any third-party audit reports or certifications.
11.2 Further audits. If the information in Section 11.1 does not reasonably satisfy Customer's audit obligations under Data Protection Law, or a Supervisory Authority or regulator requires it, Customer may audit Flooring OS's compliance with this DPA, subject to the following conditions:
- (a) on at least 30 days' written notice;
- (b) during normal business hours;
- (c) no more than once in any 12-month period, unless a Security Incident or a regulator requires otherwise;
- (d) through Customer or an independent auditor bound by confidentiality who is not a competitor of Flooring OS;
- (e) without access to other customers' data or to information that would compromise the security of the Services; and
- (f) at Customer's cost.
11.3 Audit reports and findings are Flooring OS confidential information.
12. Return and deletion
On termination or expiry of the Agreement:
- (a) Customer may request an export of Customer Personal Data in a standard format for 30 days;
- (b) Flooring OS will then delete Customer Personal Data from production systems within 90 days, and from backups as they age out under its backup schedule, within no more than 35 further days; and
- (c) Flooring OS may retain Customer Personal Data where Union, Member State or other applicable law requires it. In that case this DPA continues to apply to the retained data, which Flooring OS will keep confidential and process only for the purpose of that legal requirement.
On request, Flooring OS will confirm the deletion in writing.
13. International transfers
13.1 Location. Customer Personal Data is stored and hosted only in the United States. Support personnel located outside the United States may access it remotely, as listed in Annex III, solely to resolve Customer's support requests. Customer authorises that remote access, which is covered by the transfer safeguards in this Section 13.
13.2 Canada. Where Customer is subject to Canadian privacy law:
- (a) Customer remains accountable for Customer Personal Data, and Flooring OS will protect it, by the terms of this DPA, at a level comparable to the protection Customer must provide;
- (b) Customer is responsible for telling the individuals concerned that their personal information may be stored in the United States and accessed from the locations in Annex III, and may be subject to the laws of those countries;
- (c) for Customers subject to the Quebec Privacy Act, this DPA is the written agreement required by sections 17 and 18.3 of that Act, and Flooring OS will provide the information Customer reasonably needs to complete the privacy impact assessment that the Act requires before personal information is communicated outside Quebec; and
- (d) a Security Incident includes a "breach of security safeguards" under PIPEDA and a "confidentiality incident" under the Quebec Privacy Act, and Flooring OS will notify Customer of it under Section 10.
13.3 Other jurisdictions. The Services are not offered for processing personal data of individuals in the European Economic Area, the United Kingdom or Switzerland. If Customer becomes subject to the GDPR or UK GDPR in respect of Customer Personal Data, Customer will notify Flooring OS before that data is processed in the Services, and the parties will agree in writing any additional terms the law requires. Until then, Flooring OS will process any such data as a processor under the terms of this DPA.
13.4 Onward transfers. Flooring OS will make any onward transfer to a Sub-processor in accordance with Data Protection Law.
14. General
14.1 Precedence. If there is a conflict between the documents, this DPA takes precedence over the rest of the Agreement.
14.2 Liability. Each party's liability under this DPA is subject to the limitations and exclusions of liability in the Agreement, except where Data Protection Law prohibits such a limitation.
14.3 Duration. This DPA lasts for as long as Flooring OS processes Customer Personal Data.
14.4 Changes. Flooring OS may update this DPA to reflect changes in Data Protection Law, a decision of a competent authority, or changes to the Services, provided the update does not materially reduce the protection of Customer Personal Data. It will give at least 30 days' notice of material changes.
14.5 Governing law. Except as Data Protection Law requires otherwise, this DPA is governed by the law that governs the Agreement: Texas law, with the courts of Collin County, Texas.
Annex I — Details of processing
A. Parties
| Customer | Flooring OS | |
|---|---|---|
| Name | Customer, as named in the Agreement or Order | Flooring OS LLC |
| Address | As in the Agreement or Order | 5200 Tennyson Pkwy #350, Plano, TX 75024 |
| Contact | Customer's account administrator | privacy@flooringos.com |
| Activities | Operating a floorcovering business using the Services | Providing the Flooring OS ERP software and related support |
| Role | Controller, business or accountable organisation (or a processor acting for a third party) | Processor and service provider |
| Signature and date | By accepting the Agreement | By making the Services available |
B. Description of the processing
| Categories of Data Subjects | Customer's own customers and prospects, including homeowners, builders, contractors and commercial clients, and their site contacts; Customer's employees, installers and subcontractors; and the contacts at Customer's suppliers and vendors |
| Categories of personal data | Names; postal, billing and job-site addresses; phone numbers; email addresses; project, measurement, quote, order, invoice and payment records; installation schedules and notes; photographs of job sites; communications logged in the Services; and, for Customer's staff, user IDs, roles and activity logs. Payment-card numbers are tokenised by Clover or Fiserv and not stored by Flooring OS (see Annex III) |
| Sensitive / special-category data | None intended. Customer should not store such data (DPA §3). Any processing is subject to Annex II |
| Frequency of transfer | Continuous, for the term of the Agreement |
| Nature of processing | Hosting, storage, backup, retrieval, organisation, transmission at Customer's direction (for example, emailing quotes and invoices), reporting, support and deletion |
| Purpose | Solely to provide, maintain, secure and support the Services for Customer under the Agreement |
| Retention | For the term of the Agreement, then as described in DPA §12 |
| Sub-processor transfers | As listed in Annex III, for the same nature, purpose and duration |
Annex II — Technical and organisational security measures
- Encryption. Data in transit is encrypted with TLS 1.2 or higher. Data at rest, including backups, is encrypted with AES-256 or equivalent.
- Access control. Multi-factor authentication is required for all Flooring OS staff access to production systems and administrative consoles. Staff access is role-based and follows least privilege, and each staff member has a unique named account; shared logins are not permitted. Staff access rights are reviewed at least quarterly and revoked promptly when staff leave. Customer users sign in to the Application through Customer's own identity provider (Microsoft Entra ID or Google Workspace). Customer controls its users' authentication policies, including multi-factor authentication, password rules and conditional access, and is responsible for configuring and enforcing them in its own tenant. Flooring OS does not store passwords for Customer users.
- Tenant isolation. Each Customer's data is stored in a separate, dedicated database.
- Logging and monitoring. Administrative and privileged access is logged, and logs are retained for 35 days. Security events are monitored and generate alerts.
- Availability and resilience. Customer Data is backed up daily, and backups are retained for 35 days. Restores are tested quarterly. Recovery objectives are a recovery point of no more than 24 hours of data and restoration of service within 4 hours of starting a restore.
- Vulnerability management. Security patches are applied according to severity: critical vulnerabilities within 14 days, high within 30 days, and medium and low within the normal release cycle. The Application, its APIs and its supporting infrastructure are scanned for vulnerabilities at least monthly by an independent automated scanning service, including authenticated web-application scanning. A summary of recent scan results is available to Customers on request under DPA §11.1.
- Secure development. Code changes are reviewed and tested before release. Development, test and production environments are separated, and production Customer Personal Data is not used in development or testing.
- Physical security. The Services are hosted in Microsoft Azure data centres. Microsoft maintains the physical and environmental controls, which are independently audited under ISO/IEC 27001 and SOC 2 Type II. Flooring OS operates no data centres of its own.
- Personnel. Staff and contractors with access to Customer Personal Data are bound by written confidentiality agreements. They receive security and privacy training on hire and annually.
- Incident response. A documented incident-response plan covers detection, escalation, containment, notification under DPA §10, and post-incident review.
- Vendor management. Sub-processors are assessed for security before engagement and bound by written data-protection terms under DPA §8.4.
- Data deletion. Data is deleted on the schedule in DPA §12, using deletion methods appropriate to the storage medium.
Annex III — Sub-processors
| Sub-processor | Purpose | Location of processing |
|---|---|---|
| Microsoft Corporation | Cloud hosting, storage and backups (Microsoft Azure); email delivery of quotes, invoices and notifications at Customer's direction (Microsoft 365) | United States (Azure Central US and South Central US regions) |
| Intelegencia Technologies Corp. (Philadelphia, PA) | Customer support, including access to Customer Data when resolving support requests | Customer Data remains stored in the United States. Support personnel in India and the Philippines access it remotely, through Flooring OS-controlled access, only to resolve support requests |
| Plaid Inc. | Connecting bank accounts and retrieving bank transaction and account information at Customer's direction | United States |
| Clover Network, LLC (a Fiserv company) | Card-present and card-not-present payment acceptance and card tokenisation | United States |
| Fiserv, Inc. | Card payment processing and settlement | United States |
Payment and banking providers. Plaid, Clover and Fiserv also act as independent controllers for some of the data they handle. Examples include their fraud-prevention, regulatory and card-network obligations, and the bank credentials an end user gives Plaid directly. That processing is governed by their own terms and privacy notices. Payment-card numbers are entered directly into Clover or Fiserv systems and tokenised there. Flooring OS receives and stores only tokens, never full card numbers.