> For the complete documentation index, see [llms.txt](https://support.limy.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://support.limy.ai/limy-custmer-dpa-apm-18.5.26-1.md). # Limy Custmer DPA APM 18.5.26 (1) ## DATA PROCESSING AGREEMENT *\[Last Updated May 2026]* This Data Processing Agreement (“**DPA**”) is governed and hereby attached to any other services agreement (“**Agreement**”) executed by and between Limy Analytics Ltd., (collectively with its subsidiaries and affiliated companies, including without limitation, Limy AI Inc., “**Limy**” or the “**Company**”), and you as a customer (“**Customer**”). All capitalized terms not defined herein shall have the meaning set forth in the Agreement. **WHEREAS**, Limy is a provider of AI search visibility, Generative Engine Optimization (GEO), and AI traffic analytics solutions that help brands measure and improve their visibility and performance across AI-driven platforms and large language models (collectively, “**Services**”). **WHEREAS**, The Services may involve the Processing of Personal Data by Limy on behalf of the Customer in connection with the provision of the Services; and **WHEREAS**, the Parties desire to supplement this DPA to achieve compliance with any applicable Data Protection Laws and agree on the following: ### 1. DEFINITIONS 1. “**Adequate Country**” is a country that received an adequacy decision from the European Commission or other applicable data protection authority. 2. “**CCPA**” means the California Consumer Privacy Act (Cal. Civ. Code §§ 1798.100 – 1798.199) of 2018, including as modified by the California Privacy Rights Act (“**CPRA**”) as well as all regulations promulgated thereunder from time to time. 3. “**Customer Data**” means any Personal Data processed by Limy in its capacity as a Data Processor on behalf of the Customer during the provision of the Services, all as detailed in **Annex I** attached herein. 4. **“Data Privacy Framework**” means the EU-U.S. Data Privacy Framework operated by the U.S. Department of Commerce; as may be amended, superseded or replaced from time to time. 5. "**Israel Privacy Law**" means Israeli Privacy Protection Law, 5741-1981, the regulations promulgated thereunder, including the Israeli Privacy Protection Regulations (Data Security), 5777-2017, and any other Israeli privacy-related regulations and amendments. 6. The terms “**Personal Data**”, “**Controller**”, “**Processor**”, “**Data Subject**”, “**Processing**” (or “**Process**“), “**Personal Data Breach**”, “**Special Categories of Personal Data**” and “**Supervisory Authority**”, shall all have the same meanings as ascribed to them in the EU Data Protection Law. The terms “**Business**”, “**Business Purpose**”, “**Consumer**”, “**Service Provider**”, “**Contractor**”, “**Third Party Business**”, “**Sale**”, “**Sell”** and“**Share**” shall have the same meaning as ascribed to them under US Data Protection Laws. “**Data Subject**” shall also mean and refer to “**Consumer**”, and “**Personal Data**” shall include “**Personal Information**” under this DPA. 7. “**Data Protection Law**” means any and all applicable privacy and data protection laws and regulations (including, where applicable, Israel Privacy Law, EU Data Protection Law, and US Data Protection Laws) as may be amended or superseded from time to time. 8. “**EEA**” means the European Economic Area. 9. “**EU Data Protection Law**” means the (i) EU General Data Protection Regulation (Regulation 2016/679) (“**GDPR**”); (ii) Regulation 2018/1725; (iii) the EU e-Privacy Directive (Directive 2002/58/EC), as amended (**e-Privacy Law**); (iv) any national data protection laws made under, pursuant to, replacing or succeeding (i) and (ii); (v) any legislation replacing or updating any of the foregoing; and (vi) any judicial or administrative interpretation of any of the above, including any binding guidance, guidelines, codes of practice, approved codes of conduct or approved certification mechanisms issued by any relevant Supervisory Authority. 10. “**Security Incident**” means any accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data. Any Personal Data Breach will comprise a Security Incident. 11. “**Standard Contractual Clauses**” or “**SCC**” mean the standard contractual clauses for the transfer of Personal Data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council adopted by the European Commission Decision 2021/914 of 4 June 2021, which may be found [here](https://eur-lex.europa.eu/eli/dec%5Fimpl/2021/914/oj?uri=CELEX:32021D0914\&locale=en): [Standard Contractual Clauses](https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32021D0914\&from=EN). 12. "**US Data Protection Laws**" means any U.S. federal and state privacy laws effective as of the Effective Date of this DPA and applies to Limy Processing of Customer Data, including the CCPA, as amended or superseded from time to time and including any implementing regulations and amendments thereto. Any other terms that are not defined herein shall have the meaning provided under the Agreement or applicable Law. A reference to any term or section of Data Protection Laws means the version as amended. ### 2. ROLES AND DETAILS OF PROCESSING 1. The parties agree and acknowledge that under the performance of their obligations set forth in the Agreement, and with respect to the Processing of Customer Data, Limy is acting as a Data Processor and Customer is acting as a Data Controller. For the purpose of the CCPA, Customer is the Business and Limy is the Service Provider. Each party shall be individually and separately responsible for complying with the obligations that apply to such a party under the applicable Data Protection Law. As between the Parties, it is acknowledged and agreed that Limy is not in a position to, nor can, be responsible for ensuring the lawfulness of Customer Data, including the manner and means by which it was collected, and any disclosure or consent required for such collection. 2. The subject matter and duration of the Processing carried out by the Processor on behalf of the Controller, the nature and purpose of the Processing, the type of Personal Data and categories of Data Subjects are described in **Annex I** attached hereto. ### 3. REPRESENTATIONS AND WARRANTIES 1. Limy represents and warrants that it shall Process Customer Data, on behalf of the Customer, solely for the purpose of providing the Service, all in accordance with Customer’s written instructions under the Agreement and this DPA. For the avoidance of doubt, Limy may collect and use aggregated or de-identified data derived from the use of the Services for analytics, benchmarking, service improvement, and product development. Notwithstanding the above, in the event Limy is required under applicable laws, including Data Protection Laws or any union or member state regulation, to Process Customer Data other than as instructed by the Customer, Limy shall make its best efforts to inform the Customer of such requirement prior to Processing such Customer Data, unless prohibited under applicable law. 2. Limy shall, taking into account the nature of the Processing and the information available to it, provide reasonable assistance to the Customer in connection with the Customer’s obligations under applicable Data Protection Laws to carry out data protection impact assessments and, where required, prior consultations with competent supervisory authorities, solely in relation to the Processing of Customer Data under this Agreement. 3. Limy shall take commercially reasonable steps to ensure: * The reliability of its staff and any other person acting under its supervision who may come into contact with, or otherwise have access to and Process Customer Data. * That persons authorized to process the Customer Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality. * That such personnel are aware of their responsibilities under this DPA and any applicable Data Protection Laws. 4. The Customer is solely responsible for ensuring the lawfulness of Customer Data which is uploaded to the Services, including without limitation any consent or disclosure required for that. ### 4. DATA SUBJECTS RIGHTS AND REQUEST It is agreed that where Limy receives a request from a Data Subject or an applicable authority in respect of Customer Data, where applicable, Limy will direct the Data Subject or the applicable authority to the Customer in order to enable the Customer to respond directly to the Data Subject’s or the applicable authority’s request, unless otherwise required under applicable laws. Parties shall provide each other with commercially reasonable cooperation and assistance in relation to the handling of a Data Subject’s or applicable authority’s request, to the extent permitted under Data Protection Law. Such assistance may be provided through the implementation of relevant features and interfaces to the Products, enabling the Customer to handle such inquiries directly. ### 5. SUB-PROCESSING 1. The Customer acknowledges that Limy uses third party data Processors for the processing of Customer Data as part of the provision of the Services (“**Sub-Processor**”). The Customer hereby authorizes Limy to engage and appoint such Sub-Processors as listed in **Annex III**, to Process Customer Data, as well as permit each Sub-Processor to appoint a Sub-Processor on its behalf. Limy may continue to use those Sub-Processors already engaged by Limy, as listed in **Annex III**, or to engage an additional or replace an existing Sub-Processors to process Customer Data, subject to the provision of a thirty (30) day prior notice of its intention to do so to the Customer. In case the Customer has not objected to the adding or replacing of a Sub-Processor within five (5) days of Limy notice, such Sub-Processor shall be considered approved by the Customer. In the event the Customer objects to the adding or replacing of a Sub-Processor, Limy may, under Limy sole discretion, suggest the engagement of a different Sub-Processor for the same course of services, or otherwise terminate the Agreement. 2. Limy shall, where it engages any Sub-Processor, impose, by way of a legally binding contract between Limy and such Sub-Processor, data protection obligations that are no less protective than those set out in this DPA, including, in particular, providing sufficient guarantees to implement appropriate technical and organizational measures, in a manner that ensures that the Processing will meet the requirements of applicable Data Protection Laws. 3. Limy shall remain responsible to the Customer for the performance of the Sub-Processor’s obligations in accordance with this DPA. Limy shall notify the Customer of any failure by the Sub-Processor to fulfill its contractual obligations pertaining to Customer Data. ### 6. TECHNICAL AND ORGANIZATIONAL MEASURES 1. Taking into account the state of the art, the costs of implementation and the nature, scope, context, and purposes of Processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, and without prejudice to any other security standards agreed upon by the parties, Limy hereby confirms that it has implemented and will maintain appropriate physical, technical and organizational measures to protect the Customer Data as required under Data Protection Laws to ensure lawful processing of Customer Data and safeguard Customer Data from unauthorized, unlawful or accidental processing, access, disclosure, loss, alteration or destruction. The parties acknowledge that security requirements are constantly changing, and that effective security requires frequent evaluation and regular improvement of outdated security measures. The security measures implemented by Limy are detailed under **Annex II**. 2. The Customer shall be responsible for maintaining secure credentials, access permissions, network settings, devices and integrations under its control. Limy shall not be responsible for any Security Incident, loss, unauthorized access or non-compliance to the extent caused by Customer’s failure to implement such updates or maintain such measures, or by Customer’s misuse, misconfiguration or unauthorized modification of the Products or Services. ### 7. SECURITY INCIDENT 1. Limy shall notify the Customer without undue delay and no later than 48 hours upon becoming aware of any confirmed Security Incident involving the Customer Data in Limy possession or control. Limy notification regarding or response to a Security Incident under this Section 7 shall not be construed as an acknowledgment by Limy of any fault or liability with respect to the Security Incident. 2. Limy will: * **(i)** take necessary steps to remediate, minimize any effects of and investigate any Security Incident and to identify its cause; * **(ii)** co-operate with the Customer and provide the Customer with such assistance and information as it may reasonably require in connection with the containment, investigation, remediation or mitigation of the Security Incident; * **(iii)** notify the Customer in writing of any request, inspection, audit or investigation by a supervisory authority or other authority; * **(iv)** keep the Customer informed of all material developments in connection with the Security Incident and execute a response plan to address the Security Incident; and * **(v)** co-operate with the Customer and assist Customer with its obligation to notify the affected individuals in the case of a Security Incident. ### 8. AUDIT RIGHTS 1. Limy shall maintain written records of the Processing of Customer Data carried out on behalf of Customer as required under applicable Data Protection Laws and shall make such records available to Customer or competent supervisory authorities upon reasonable written request. Any information or documentation provided under this Section shall be deemed Limy Confidential Information and subject to the confidentiality obligations under the Agreement. 2. Upon reasonable prior written request and no more than once in any twelve (12) month period, Limy shall make available to Customer reasonable information and documentation necessary to demonstrate compliance with this DPA. To the extent reasonably possible, verification of Limy compliance shall be satisfied through the provision of existing audit reports, certifications, or other documentation maintained by Limy. Where such documentation is not sufficient for Customer to reasonably verify compliance, Limy shall permit an audit by Customer or an independent reputable auditor appointed by Customer, limited solely to the Processing of Customer Data under the Agreement and only to the extent reasonably necessary to verify compliance with this DPA (the “**Audit**”). 3. Any Audit shall be conducted upon reasonable advance notice, during normal business hours, and in a manner that minimizes disruption to Limy business operations. Audits shall be limited to relevant records and shall not include access to Limy production systems, networks, source code, or confidential infrastructure unless otherwise agreed in writing by Limy and subject to Limy reasonable security requirements. Penetration testing, vulnerability scanning, or similar technical testing shall not be conducted without Limy prior written approval. The auditor shall be subject to customary confidentiality obligations and the confidentiality provisions of this DPA. Limy may object to an auditor if it reasonably believes the auditor is not suitably qualified or independent, is a competitor of Limy, or otherwise unsuitable, in which case Customer shall appoint an alternative auditor or conduct the Audit itself. 4. Customer shall bear all costs and expenses related to the Audit (excluding Limy internal costs) and shall ensure that the Audit does not cause damage, injury, or material disruption to Limy premises, systems, personnel, or business operations. Any findings or conclusions arising from the Audit shall be treated as Limy Confidential Information and promptly shared with Limy. 5. Nothing in this DPA will require Limy to either disclose to Customer or its third-party auditor, or to allow Customer or its third-party auditor to access: * Any data of any other Limy 's customer; * Limy internal accounting or financial information; * Any trade secret of a Limy or its Affiliates; * Any information that, in Limy reasonable opinion, could compromise the security of any Limy systems or cause any breach of its obligations under applicable law or its security or privacy obligations to any third party; or * Any information that Customer or its third-party auditor seeks to access for any reason other than the good faith fulfillment of Customer’s obligations under the Data Protection Laws. ### 9. CROSS BORDER PERSONAL DATA TRANSFERS 1. Limy will not transfer Customer Data originating from the EU (which for the purpose of this Section 9 shall be referred as “**Customer Data**”), to any country or recipient not recognized as providing an adequate level of protection for such Personal Data by Limy (or by a Sub-Processor) includes transfer of Personal Data (either directly or through an onward (within the meaning of the applicable Data Protection Law), unless it first takes all such measures as are necessary to ensure the transfer) to a third country outside the EEA is in compliance with applicable Data Protection Laws. Such measures may include (without limitation): * Transferring such data to a recipient that is not covered by a suitable framework or other legally adequate transfer mechanism recognized by the relevant authorities or courts as providing an adequate level of protection for Personal Data, including to an Adequate Country, such transfer shall only occur if an appropriate safeguard approved by or in compliance with the Data Privacy Framework; * To a recipient that has achieved binding corporate rules authorization in accordance with applicable Data Protection Law; or * To a recipient that has executed the SCCs. 2. When Customer and Limy, or Limy and or its Sub-processor relies on the Standard Contractual Clauses to facilitate transfer to a third country that is not an Adequate Country, then transfer of Personal Data from the EEA the terms set forth in **Annex IV** shall apply. ### 10. US DATA PROTECTION LAWS INCLUDING CCPA 1. Limy agrees to notify the Customer if Limy makes a determination that it, or receives such a message from any of its Sub-Processors that it, can no longer meet its obligations under US Data Protection Laws. 2. Limy acknowledges and confirms that it does not receive any monetary goods, payments or discounts in exchange for Processing Customer Data. 3. For CCPA purposes: 1. Limy shall Process Customer Data on behalf of the Customer as a Service Provider under the CCPA and shall not: * Sell or Share the Customer Data; * Retain, use or disclose the Customer Data for any purpose other than for a Business Purpose specified in the Agreement; or * Combine the Customer Data with other Personal Data that it receives from, or on behalf of, another customer, or collects from its own interaction with California residents, except as otherwise permitted by the CCPA. 2. If, and to the extent applicable, Limy shall assist Customer in respect of a Consumer request to limit the use of its Sensitive Personal Information (“SPI”) by Limy. 4. Each party will comply with the requirements set forth under US Data Protection Laws with regards to processing of de-identified data, as such term is defined under the applicable US Data Protection Law. ### 11. TERM AND TERMINATION 1. This DPA shall be effective as of the Effective Date, as defined in the Agreement, and shall remain in force until the Agreement terminates. 2. Limy shall be entitled to terminate this DPA or suspend or terminate the Processing of Customer Data if Limy reasonably determines that Processing Customer Data under the Customer’s instructions or this DPA infringes, or is likely to infringe, applicable legal requirements. 3. Following the termination of this DPA, Limy shall, at the choice of the Customer, delete all Customer Data processed on behalf of the Customer and certify to the Customer that it has done so, or return all Customer Data to the Customer and delete existing copies, unless applicable law or regulatory requirements require Limy to continue to store Customer Data. Until the Customer Data is deleted or returned, the Parties shall continue to ensure compliance with this DPA. ### 12. GENERAL In the event of a conflict between the terms and conditions of this DPA and the Agreement, this DPA shall prevail. For the avoidance of doubt, where the Standard Contractual Clauses apply to the Processing of Customer Data, the terms of the Standard Contractual Clauses shall prevail over this DPA. Any term of the Agreement not expressly modified by this DPA shall remain unchanged and in full force and effect. IN WITNESS WHEREOF, this Addendum is entered into and becomes a binding part of the Agreement. | **\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ ("Customer")** | **Limy Analytics Ltd.** | | -------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------ | | Signature \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ | Signature\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ | | | \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ | | Name | Name | | | \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ | | Title | Title | | | \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ | | Date Signed | Date Signed | ## ANNEX I ### DETAILS OF PROCESSING This Annex includes certain details of the Processing of Personal Data as required by Article 28(3) GDPR. #### Categories of Data Subjects Customer personnel and authorized users interacting with the Services. #### Categories of Personal Data processed User account and authentication information (including name, email address, and credentials), online identifiers, network activity data, and technical usage data generated through the use of the Services. The Services primarily process Customer’s website, analytics, brand, content, product, marketing, AI traffic, and visibility data, which is generally not personal by nature but may contain limited account or user identifiers. As part of providing the Services, Limy may analyze such information using external AI/ML models, such as OpenAI and Anthropic. Customer Personal Data is not used to train such models. #### Special Categories of Personal Data None. #### Nature of the processing Collection, storage, organization, communication, transfer, analysis, presentation, host and other uses in performance of the Services as set out in the Agreement. #### Purpose(s) of Processing To provide the Services. #### Retention Period For as long as is necessary to provide the Services by Limy; provided there is no legal obligation to retain the Personal Data past termination or unless otherwise requested by the Customer. #### Process Frequency Continuous basis ## ANNEX II ### TECHNICAL AND ORGANIZATIONAL MEASURES #### Risk-based security measures Implement and maintain technical and organizational measures, aligned to the assessed risks and the sensitivity of Customer Data, to guard against accidental or unlawful processing, loss, destruction, damage, alteration, disclosure or access. #### Confidentiality and personnel controls Request all employees, contractors and agents with access to Customer Data to sign confidentiality obligations. Apply background screening, role-based access approvals and annual security and privacy training to all personnel and subcontractors. #### Logging and monitoring Log access and activities on systems and facilities that store or process Customer Data. Upon request and subject to applicable laws and retention policies, provide Customer with a report of authorized users, privileges, account status and activity history. #### Access control and least privilege Grant access to Customer Data only to personnel who require it to perform their duties. Enforce least privilege principles, conduct access-right reviews upon personnel changes, and promptly revoke access when no longer needed. #### Authentication and password policies Apply industry-standard password policies for both standard and privileged accounts. Protect all accounts with multi-factor authentication where Customer Data is accessible. #### Encryption in transit and at rest Use strong, industry-standard cryptographic protocols to protect Customer Data in transit (e.g., TLS) and, where applicable, at rest. #### Physical security Operate physical security controls, such as code-based access locks, surveillance and environmental protections. #### Secure media handling and disposal Ensure that all storage media (magnetic, optical, solid-state, paper or otherwise) containing Customer Data are securely erased or destroyed before reuse or disposal. These measures are reviewed at least annually (or upon significant change) to maintain alignment with evolving threats, business requirements and legal obligations. ## ANNEX III ### LIST OF SUB-PROCESSORS | **Name** | **Address** | **Description of the processing** | **DPA/SCC Executed** | | -------- | ----------- | ---------------------------------------------------- | ---------------------------------------------------- | | AWS | US | Cloud infrastructure, hosting, and support services. | | | Posthog | US | User behavior tracking. | | | Signoz | US | System logs monitoring. | | | Hubsopt | US | CRM and marketing communications | | | Sentry | US | Code error monitoring. | | ## ANNEX IV ### EU INTERNATIONAL TRANSFERS AND SCC 1. The parties agree that the terms of the [Standard Contractual Clauses](https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32021D0914\&from=EN) are hereby incorporated by reference and shall apply to transfer of Personal Data from the EEA to other countries that are not deemed Adequate Countries. 2. Module Two (Controller to Processor) of the [Standard Contractual Clauses](https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32021D0914\&from=EN) shall apply where the transfer is effectuated by Customer as the data controller of the Personal Data and the Company is the data processor of Personal Data. 3. The Parties agree that for the purpose of transfer of Personal Data between Customer (as Data Exporter) and the Company (as Data Importer), the following shall apply: 1. Clause 7 of the Standard Contractual Clauses shall not be applicable. 2. In Clause 9, option 2 (general written authorization) shall apply and the method for appointing and time period for prior notice of Sub-processor changes shall be as set forth in the Sub-Processing Section of the DPA. 3. In Clause 11, the optional language will not apply, and data subjects shall not be able to lodge a complaint with an independent dispute resolution body. 4. In Clause 17, option 1 shall apply. The parties agree that the Standard Contractual Clauses shall be governed by the laws of the EU Member State in which the Customer is established (where applicable). 5. In Clause 18(b) the parties choose the courts of the Republic of Ireland, as their choice of forum and jurisdiction. 4. **Annex I.A** of the Standard Contractual Clauses shall be completed as follows: 1. "**Data Exporter**": Customer 2. "**Data Importer**": Company 3. Roles: (A) With respect to Module Two: (i) Data Exporter is a data controller and (ii) Data Importer is a data processor. 4. Data Exporter and Data Importer Contact details: As detailed in the Agreement. 5. Signature and Date: By entering into the Agreement and DPA, Data Exporter and Data Importer are deemed to have signed these Standard Contractual Clauses incorporated herein, including their Annexes, as of the Effective Date of the Agreement. 5. **Annex I.B** of the Standard Contractual Clauses shall be completed as follows: 1. The purpose of the processing, nature of the processing, categories of data subjects, categories of personal data and the parties’ intention with respect to the transfer of special categories are as described in **Annex I** (Details of Processing) of this DPA. 2. The frequency of the transfer and the retention period of the personal data is as described in **Annex I** (Details of Processing) of this DPA. 3. The sub-processors which personal data is transferred are listed in **Annex III**. 6. **Annex I.C** of the Standard Contractual Clauses shall be completed as follows:the competent supervisory authority in accordance with Clause 13 is the supervisory authority in the Member State stipulated in Section 3 above. 7. **Annex II** of this DPA (Technical and Organizational Measures) serves as **Annex II** of the Standard Contractual Clauses. 8. **Annex III** of this DPA (List of Sub-processors) serves as **Annex III** of the Standard Contractual Clauses.