Version 1.0 | Effective [October 15, 2026] | Last updated [October 15, 2026]
This Data Processing Agreement ("Agreement") forms part of the customer agreement ("Customer Agreement") between the Customer and FORT Robotics, Inc. The Customer Agreement is the OEM Supply and License Agreement or any other written agreement under which FORT Robotics provides products and services to the Customer, including the FORT Manager cloud device management platform. This Agreement is made between:
The customer identified in the Customer Agreement, acting on its own behalf and on behalf of its affiliates, at the address set out in the Customer Agreement
(the "Customer" or "Data Controller")
and
FORT Robotics, Inc., a Delaware corporation, with an office at 1608 Walnut St., 12th Floor, Philadelphia, PA 19103, United States; phone 1-267-515-5880; support@fortrobotics.com
("FORT" or the "Data Processor")
(together as the "Parties")
No separate signature is required. This Agreement takes effect automatically from the date the Customer accepts or executes the Customer Agreement. Customers that require a countersigned copy may request one at support@fortrobotics.com.
The Customer acts as a Data Controller.
The Customer wishes to subcontract certain Services, which imply the processing of personal data, to the Data Processor.
The Parties seek to implement a data processing agreement that complies with the requirements of the current legal framework in relation to data processing and with the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).
IT IS AGREED AS FOLLOWS:
Unless otherwise defined herein, capitalized terms and expressions used in this Agreement shall have the following meaning:
"Agreement" means this Data Processing Agreement and all Schedules;
"Customer Personal Data" means any Personal Data Processed by a Contracted Processor on behalf of the Customer pursuant to or in connection with the Customer Agreement, as further described in Schedule 1;
"Contracted Processor" means the Processor or a Subprocessor;
"Data Protection Laws" means EU Data Protection Laws and, to the extent applicable, the data protection or privacy laws of any other country, including the UK GDPR, the UK Data Protection Act 2018, the Swiss Federal Act on Data Protection, and the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA");
"EEA" means the European Economic Area;
"EU Data Protection Laws" means EU Directive 95/46/EC, as transposed into domestic legislation of each Member State and as amended, replaced or superseded from time to time, including by the GDPR and laws implementing or supplementing the GDPR;
"GDPR" means EU General Data Protection Regulation 2016/679;
"Data Transfer" means:
a transfer of Customer Personal Data from the Customer to a Contracted Processor; or
an onward transfer of Customer Personal Data from a Contracted Processor to a Subcontracted Processor, or between two establishments of a Contracted Processor,
in each case, where such transfer would be prohibited by Data Protection Laws (or by the terms of data transfer agreements put in place to address the data transfer restrictions of Data Protection Laws);
"Services" means the FORT Manager cloud device management platform (including the FORT Manager web app, the FORT Manager Desktop App, and the FORT Manager API) and the FORT customer support services the Processor provides to the Customer under the Customer Agreement;
"Subprocessor" means any person appointed by or on behalf of Processor to process Personal Data on behalf of the Customer in connection with the Agreement;
"Data Processor" means FORT Robotics, Inc.;
"Standard Contractual Clauses" or "SCCs" means the standard contractual clauses for the transfer of personal data to third countries set out in the Annex to European Commission Implementing Decision (EU) 2021/914;
"UK Addendum" means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner;
"UK GDPR" means the GDPR as it forms part of the law of England and Wales, Scotland, and Northern Ireland; and
"Applicable Laws" means Data Protection Laws and any other law to which a Contracted Processor is subject.
The terms, "Commission", "Controller", "Data Subject", "Member State", "Personal Data", "Personal Data Breach", "Processing" and "Supervisory Authority" shall have the same meaning as in the GDPR, and their cognate terms shall be construed accordingly. Where the CCPA applies, "Controller" includes "business", "Processor" includes "service provider", and "Personal Data" includes "personal information".
Data Processor shall:
comply with all applicable Data Protection Laws in the Processing of Customer Personal Data; and
not Process Customer Personal Data other than necessary to comply with its obligations under the Customer Agreement or the relevant Customer's documented instructions.
The Customer instructs Data Processor to process Customer Personal Data as necessary to provide the Services in accordance with the Customer Agreement, this Agreement, and the Customer's use and configuration of FORT Manager. Any additional instructions require the written agreement of the Parties. Data Processor shall promptly inform the Customer if, in its opinion, an instruction violates Data Protection Laws.
Roles. The Customer decides who receives a FORT Manager account and which role each person holds, which makes the Customer the Controller of Customer Personal Data and Data Processor the processor. Where the Customer is itself a processor acting on behalf of a third-party controller, Data Processor is a Subprocessor to the Customer, and the Customer warrants that its instructions have been authorized by that controller.
Processing required by law. Where Processing is required by applicable law to which Data Processor is subject, Data Processor shall, to the extent permitted by that law, inform the Customer of that legal requirement before the Processing.
No sale or secondary use. Data Processor shall not sell or share Customer Personal Data (as those terms are defined under the CCPA), and shall not retain, use, or disclose Customer Personal Data for any purpose other than providing the Services, including for advertising, profiling, or combining it with Personal Data from other sources, except as permitted by Data Protection Laws.
Customer responsibilities. The Customer is responsible for the accuracy of Customer Personal Data, for having a lawful basis for its collection and transfer to Data Processor, and for giving its users any notices that Data Protection Laws require. Pro Series devices do not hold FORT Manager account information; Personal Data reaches a device only through fields whose contents the Customer chooses, including configuration names, device names, and custom display text. The Customer shall not place Personal Data in those fields. In addition, the Customer remains responsible in its capacity as Controller for determining the purposes and general means, and the appropriate Services, of the processing of Customer Personal Data under the Agreement.
Website data. Personal Data FORT collects through fortrobotics.com, such as contact forms, mailing-list subscriptions, and the subprocessor notification list, is processed by FORT as a Controller under the FORT Robotics Privacy Policy and is not Customer Personal Data. The website is hosted on HubSpot, which processes that data on FORT's behalf under the HubSpot Data Processing Agreement.
Schedule 1 sets out the subject matter, duration, nature, and purpose of the Processing, the types of Customer Personal Data, the categories of Data Subjects, and the data flows through FORT Manager on Microsoft Azure and through fortrobotics.com on HubSpot.
Data Processor shall take reasonable steps to ensure the reliability of any employee, agent or contractor of any Contracted Processor who may have access to the Customer Personal Data, ensuring in each case that access is limited to those individuals who need to know / access the relevant Customer Personal Data, as strictly necessary for the purposes of the Customer Agreement, and to comply with Applicable Laws in the context of that individual's duties to the Contracted Processor, ensuring that all such individuals are subject to confidentiality undertakings or professional or statutory obligations of confidentiality.
Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of Processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, Data Processor shall in relation to the Customer Personal Data implement appropriate technical and organizational measures to ensure a level of security appropriate to that risk, including, as appropriate, the measures referred to in Article 32(1) of the GDPR.
In assessing the appropriate level of security, Data Processor shall take account in particular of the risks that are presented by Processing, in particular from a Personal Data Breach.
The technical and organizational measures Data Processor applies are described in Schedule 2. Data Processor may update them from time to time, provided that an update does not materially decrease the overall level of security of the Services.
The Customer is responsible for its own secure use of the Services, including assigning user and API key roles on a least-privilege basis, setting an expiry date on every API key, promptly removing the accounts of users who leave its organization, and reviewing attachments for unnecessary Personal Data before sending them to FORT support.
Data Processor may continue to use those Subprocessors already engaged as listed in Schedule 3. Data Processor shall not appoint (or disclose any Customer Personal Data to) any additional Subprocessor unless required or authorized by the Customer.
The Customer authorizes Data Processor to appoint the Subprocessors listed in Schedule 3, including Microsoft Corporation, which hosts FORT Manager on Microsoft Azure, and gives Data Processor general authorization to appoint further Subprocessors in accordance with this section 5.
Before Data Processor adds a new Subprocessor or replaces an existing one, Data Processor shall give the Customer at least ten days' notice through the subprocessor notification list on the FORT Robotics website, which the Customer can join at [https://www.fortrobotics.com/sub-processors/subscribe]. The current list of Subprocessors is published at [https://www.fortrobotics.com/sub-processors]. The Customer is responsible for subscribing to that list and for ensuring that notifications reach a person who can act on them, such as its data protection contact.
The Customer may object to a new Subprocessor on reasonable data protection grounds by notifying Data Processor in writing at support@fortrobotics.com within the notice period. The Parties shall discuss the objection in good faith. If Data Processor cannot reasonably accommodate the objection, the Customer may terminate the affected Services by written notice, without penalty, and receive a pro-rata refund of any prepaid fees for the period after termination.
Data Processor shall impose on each Subprocessor, by written contract, data protection obligations no less protective of Customer Personal Data than those in this Agreement, and remains liable to the Customer for each Subprocessor's performance of those obligations.
Taking into account the nature of the Processing, Data Processor shall assist the Customer by implementing appropriate technical and organisational measures, insofar as this is possible, for the fulfilment of the Customer obligations, as reasonably understood by the Customer, to respond to requests to exercise Data Subject rights under the Data Protection Laws.
Data Processor shall:
promptly notify the Customer if it receives a request from a Data Subject under any Data Protection Law in respect of Customer Personal Data; and
ensure that it does not respond to that request except on the documented instructions of the Customer or as required by Applicable Laws to which the Data Processor is subject, in which case Data Processor shall to the extent permitted by Applicable Laws inform the Customer of that legal requirement before the Contracted Processor responds to the request.
FORT Manager lets the Customer's administrators view, update, and remove user accounts directly, through the Users page of the FORT Manager web app or Desktop App, or through the FORT Manager API (DeleteAUser), as described in the "Agreements and Data Protection" appendix of the Pro Series User Guide. Where the Customer cannot fulfil a request using these tools, Data Processor shall provide reasonable assistance on request.
Data Processor shall notify the Customer without undue delay, and in any event within 72 hours, upon Data Processor becoming aware of a Personal Data Breach affecting Customer Personal Data, providing the Customer with sufficient information to allow the Customer to meet any obligations to report or inform Data Subjects of the Personal Data Breach under the Data Protection Laws.
Data Processor shall co-operate with the Customer and take reasonable commercial steps as are directed by the Customer to assist in the investigation, mitigation and remediation of each such Personal Data Breach.
The notification shall, to the extent known, describe the nature of the Personal Data Breach, the categories and approximate number of Data Subjects and records concerned, its likely consequences, and the measures taken or proposed to address it. Where Data Processor cannot provide all of this information at once, it shall provide it in phases as it becomes available.
Data Processor shall provide reasonable assistance to the Customer with any data protection impact assessments, and prior consultations with Supervising Authorities or other competent data privacy authorities, which the Customer reasonably considers to be required by article 35 or 36 of the GDPR or equivalent provisions of any other Data Protection Law, in each case solely in relation to Processing of Customer Personal Data by, and taking into account the nature of the Processing and information available to, the Contracted Processors.
Subject to this section 9 Data Processor shall promptly and in any event within [10 business days] of the date of cessation of any Services involving the Processing of Customer Personal Data (the "Cessation Date"), delete and procure the deletion of all copies of those Customer Personal Data.
Data Processor shall provide written certification to the Customer that it has fully complied with this section 9 within [10 business days] of the Cessation Date.
Before the Cessation Date, the Customer may request a copy of its Customer Personal Data in a commonly used, machine-readable format. When the Customer removes a user account from FORT Manager during the term, Data Processor shall delete the associated Personal Data from active systems within [30] days, and from backups in line with its standard backup rotation of no more than [90] days.
Data Processor may retain Customer Personal Data to the extent and for the period required by applicable law, provided that it keeps that data confidential and processes it only for the purposes required by that law.
Removing a user from FORT Manager does not affect data the Customer has already exported, such as downloaded log files, configuration files, and support ticket attachments.
Subject to this section 10, Data Processor shall make available to the Customer on request all information necessary to demonstrate compliance with this Agreement, and shall allow for and contribute to audits, including inspections, by the Customer or an auditor mandated by the Customer in relation to the Processing of the Customer Personal Data by the Contracted Processors.
Information and audit rights of the Customer only arise under section 10.1 to the extent that the Customer Agreement does not otherwise give them information and audit rights meeting the relevant requirements of Data Protection Law.
Data Processor shall first respond to audit requests by providing written answers to reasonable security and data protection questionnaires and, where available, summaries of independent third-party audit reports covering Data Processor or its Subprocessors (for example, the Microsoft Azure and HubSpot SOC 2 and ISO/IEC 27001 reports available through their trust portals). Questionnaires are limited to once per calendar year, unless a Supervisory Authority requires otherwise or a Personal Data Breach has occurred.
If that information is not sufficient to demonstrate compliance, the Customer may conduct an on-site audit on at least 30 days' written notice, during normal business hours, subject to reasonable confidentiality obligations, and at the Customer's expense.
The Data Processor may not transfer or authorize the transfer of Data to countries outside the EU and/or the European Economic Area (EEA) without the prior written consent of the Customer. If personal data processed under this Agreement is transferred from a country within the European Economic Area to a country outside the European Economic Area, the Parties shall ensure that the personal data are adequately protected. To achieve this, the Parties shall, unless agreed otherwise, rely on EU approved standard contractual clauses for the transfer of personal data.
The Customer consents to the Data Transfers described in Schedules 1 and 3. FORT Manager is hosted on Microsoft Azure in the Azure regions East US and East US 2 region, and FORT Robotics, Inc. is located in the United States.
The Standard Contractual Clauses are incorporated into this Agreement by reference, with Module 2 (controller to processor) applying where the Customer is a controller and Module 3 (processor to processor) applying where the Customer is a processor. For the purposes of the SCCs: the optional docking clause in Clause 7 applies; Option 2 of Clause 9(a) (general written authorization) applies, with the notice period in section 5.3; the optional language in Clause 11 does not apply; Clause 17 Option 1 applies with the law of Ireland; the courts of Ireland are chosen under Clause 18(b); and Annexes I, II, and III of the SCCs are completed by Schedules 1, 2, and 3 of this Agreement.
For Data Transfers subject to the UK GDPR, the SCCs apply as amended by the UK Addendum, which is incorporated by reference. For Data Transfers subject to the Swiss Federal Act on Data Protection, the SCCs apply with references to the GDPR read as references to that Act and the Swiss Federal Data Protection and Information Commissioner as the competent Supervisory Authority.
Onward Data Transfers to Subprocessors are protected by appropriate transfer mechanisms. Microsoft relies on the SCCs as its primary mechanism for Microsoft Azure, as described in the Microsoft Products and Services Data Protection Addendum, and also holds EU-U.S. Data Privacy Framework certification. HubSpot relies on its EU-U.S. Data Privacy Framework certification, the SCCs, and the UK Addendum, as described in the HubSpot Data Processing Agreement.
Confidentiality. Each Party must keep this Agreement and information it receives about the other Party and its business in connection with this Agreement ("Confidential Information") confidential and must not use or disclose that Confidential Information without the prior written consent of the other Party except to the extent that:
disclosure is required by law;
the relevant information is already in the public domain.
Notices. All notices and communications given under this Agreement must be in writing and will be delivered personally, sent by post or sent by email to the address or email address set out in the heading of this Agreement (for the Customer, the address set out in the Customer Agreement) at such other address as notified from time to time by the Parties changing address.
Order of precedence. If this Agreement conflicts with the Customer Agreement, this Agreement prevails in relation to the Processing of Customer Personal Data. If this Agreement conflicts with the SCCs, the SCCs prevail. Where the Pro Series User Guide or other FORT documentation differs from this Agreement, this Agreement governs.
Liability. Each Party's liability under this Agreement is subject to the limitations and exclusions of liability in the Customer Agreement, except where Data Protection Laws prohibit them.
Updates. FORT may update this Agreement to reflect changes in Data Protection Laws or the Services, provided that updates do not materially reduce the protection given to Customer Personal Data. FORT publishes the current version at [https://www.fortrobotics.com/dpa] and notifies subscribed Customers of material changes.
This Agreement is governed by the laws of Delaware.
Any dispute arising in connection with this Agreement, which the Parties will not be able to resolve amicably, will be submitted to the exclusive jurisdiction of the courts of Delaware.
| Data exporter | Data importer | |
|---|---|---|
| Name | The Customer identified in the Customer Agreement | FORT Robotics, Inc. |
| Address | As set out in the Customer Agreement | 1608 Walnut St., 12th Floor, Philadelphia, PA 19103, United States |
| Contact | As set out in the Customer Agreement | Sarah Keim, Chief People Officer; 1-267-515-5880; support@fortrobotics.com |
| Activities | Use of FORT Manager and FORT support to manage the Customer's fleet of FORT devices | Provision of FORT Manager and FORT customer support |
| Role | Controller (or Data Processor on behalf of a third-party Controller) | Data Processor (or Subprocessor) |
| Element | Description |
|---|---|
| Categories of Data Subjects | The Customer's employees, contractors, and other individuals the Customer authorizes to use FORT Manager; the Customer's personnel who contact FORT support. |
| Categories of Personal Data | FORT Manager account data: email address, user role (Admin, Config Manager, Device Manager, or Operator), organization membership, and, where provided, name and profile image. API key data: key names, roles, and expiry state. Technical data: authentication and audit log data, such as login timestamps and IP addresses. Support data: information the Customer chooses to send to FORT support, which may include screenshots showing account names or email addresses, device log files, configuration names, and device names. |
| Special categories of data | None. The Services are not designed to process special categories of Personal Data, and the Customer shall not submit them. |
| Frequency of transfer | Continuous for the term of the Customer Agreement. |
| Nature of processing | Collection, storage, organization, retrieval, use, transmission, and deletion as necessary to host and operate FORT Manager and to provide customer support. |
| Purpose of processing | Providing FORT Manager, including user authentication, role-based access control, device enrollment, and firmware and configuration management for the Customer's fleet of FORT devices; tracking acknowledgement of FORT's End-User Agreement and Privacy Policy; and providing customer support. |
| Duration of processing | The term of the Customer Agreement plus the deletion period in section 9. |
| Retention | As set out in section 9. |
| Subprocessor transfers | As set out in Schedule 3. |
| Data flow | FORT's role | Platform and location | Governing terms |
|---|---|---|---|
| FORT Manager (web app, Desktop App, and API) | Processor for the Customer | Microsoft Azure, Azure regions East US and East US 2 | This Agreement; Microsoft DPA between FORT and Microsoft |
| FORT customer support (Customer Support Portal and support@fortrobotics.com) | Processor for the Customer | Salesforce, United States | This Agreement; Salesforce DPA between FORT and Salesforce. |
| fortrobotics.com website (forms, mailing lists, subprocessor notification list, published agreements) | Controller | HubSpot, United States | FORT Privacy Policy; HubSpot DPA between FORT and HubSpot |
| Pro Series devices | Not applicable | On the Customer's machines; no FORT Manager account data is stored on devices | Customer controls any data placed in device fields (section 2.6) |
The Supervisory Authority of the EU Member State in which the Customer is established or, where the Customer is not established in the EU, the Supervisory Authority of the Member State in which its EU representative is appointed under Article 27 of the GDPR.
FORT implements the following measures to protect Customer Personal Data. FORT Manager inherits the physical, environmental, and infrastructure controls of Microsoft Azure, which are independently audited against standards including ISO/IEC 27001, ISO/IEC 27018, and SOC 2.
| Control area | Measures |
|---|---|
| Access control | Authentication is required for all access to FORT Manager. Role-based access control limits each user to the permissions of the Admin, Config Manager, Device Manager, or Operator role, and each API key to its assigned role (including Service and Key Manager roles). FORT personnel access to production systems is restricted to those who need it and is reviewed quarterly. |
| API credentials | API keys carry a role and an expiry state, displayed in FORT Manager so administrators can identify and revoke never-expiring keys. Expired keys stop working automatically. API traffic is routed through Microsoft Azure API gateway services. |
| Encryption | Customer Personal Data is encrypted in transit using TLS 1.2 or higher and encrypted at rest using Microsoft Azure storage encryption (AES-256). |
| Tenant separation | Each Customer's data is logically separated by organization within FORT Manager. |
| Logging and monitoring | Security-relevant events are logged and monitored for anomalies using Microsoft Azure monitoring services for 90 days. |
| Availability and resilience | FORT Manager runs on Microsoft Azure infrastructure with redundancy and backups. Backups are encrypted and rotated within 90 days. |
| Vulnerability management | FORT applies security patches on a risk-based schedule and performs regular vulnerability scanning and periodic penetration testing. |
| Incident response | FORT maintains an incident response process covering detection, escalation, containment, Customer notification under section 7, and post-incident review. |
| Privacy acknowledgement | FORT Manager requires users to acknowledge the FORT End-User Agreement and Privacy Policy at login and records the acknowledgement status in the user database. |
| Personnel | Personnel with access to Customer Personal Data are bound by confidentiality obligations and receive data protection and security training. |
| Data minimization | FORT Manager collects only the account data needed to operate the Services. Device-level fields are Customer-controlled, and FORT documentation instructs Customers not to place Personal Data in device names, configuration names, or custom display text, because those values travel over the machine's CAN bus or serial link. |
| Vendor management | Subprocessors are assessed before engagement and bound by written data protection terms under section 5.5. FORT replaced an API gateway vendor that did not meet its data protection requirements with Microsoft Azure gateway services. |
The Customer authorizes the following Subprocessors as of the effective date. FORT publishes the current list at https://www.fortrobotics.com/sub-processors and gives notice of changes under section 5.3.
| Subprocessor | Purpose | Location | Transfer mechanism |
|---|---|---|---|
| Microsoft Corporation (Microsoft Azure) | Cloud hosting and infrastructure for FORT Manager, including compute, storage, databases, and API gateway services | Azure regions East US and East US 2 | SCCs (primary); EU-U.S. Data Privacy Framework |
| Salesforce | Customer support ticketing for the Customer Support Portal | Salesforce, United States | Processor Binding Corporate Rules; Standard Contractual Clauses; EU-U.S. Data Privacy Framework (with UK Extension and Swiss-U.S. framework) |
| Google (Gmail) | Transactional email, such as FORT Manager invitations and notifications | Google, United States | Standard Contractual Clauses; EU-U.S. Data Privacy Framework |
| Functional Software, Inc. d/b/a Sentry | Error tracking, crash reporting, and performance monitoring | United States | EU-U.S. Data Privacy Framework (with UK Extension and Swiss-U.S. framework); Standard Contractual Clauses |
| Okta, Inc. (Auth0) | Secure identity, authentication, and user management services | United States | Standard Contractual Clauses (with UK Addendum and Swiss modifications) |
HubSpot, Inc. hosts the fortrobotics.com website. Because FORT acts as a Controller for website data (section 2.7), HubSpot is FORT's Processor for that data rather than a Subprocessor of Customer Personal Data.
The following summarizes the commitments FORT's principal service providers make to FORT under their own data processing terms, which underpin FORT's commitments in this Agreement.
| Commitment | Microsoft Azure | HubSpot |
|---|---|---|
| Governing terms | Microsoft Products and Services Data Protection Addendum (May 22, 2026) | HubSpot Data Processing Agreement (September 16, 2026) |
| Role | Processor to FORT | Processor to FORT for website and CRM data |
| Breach notification | Without undue delay, within 72 hours of discovery | Without undue delay, no later than 72 hours |
| Subprocessor change notice | At least 6 months for new subprocessors (30 days for certain AI subprocessors) | At least 30 days, with right to object |
| Transfer mechanism | SCCs, with EU-U.S. Data Privacy Framework certification | EU-U.S. Data Privacy Framework, SCCs, UK Addendum, Swiss modifications |
| Independent audits | ISO/IEC 27001, ISO/IEC 27018, SOC 2, and others; see Microsoft GDPR overview | SOC 2 Type II and ISO/IEC 27001; see trust.hubspot.com |
| Data subject request support | Tools for discovery, access, rectification, restriction, export, and deletion | In-product controls plus reasonable assistance |
| Deletion at end of service | Deletion following termination per the Microsoft DPA retention terms | Deletion or return of Customer Data on termination |
Copyright © 2026 FORT Robotics, Inc. All rights reserved.