Skip to main content

    LimeSpot Data Processing Agreement

    Last Updated: October 10, 2026

    This Data Processing Agreement ("DPA") forms part of the agreement between LimeSpot Solutions Inc. ("LimeSpot", "we", "us", or "our") and the Client ("you" or "Client") for the provision of LimeSpot services. This DPA sets out the terms governing the processing of personal data by LimeSpot on behalf of the Client.

    1. Definitions

    "Personal Data" means any information relating to an identified or identifiable natural person that is processed by LimeSpot in connection with providing services to the Client.

    "Processing" means any operation performed on Personal Data, including collection, recording, organization, storage, adaptation, retrieval, consultation, use, disclosure, or erasure.

    "Data Controller" means the Client, who determines the purposes and means of processing Personal Data.

    "Data Processor" means LimeSpot, who processes Personal Data on behalf of the Data Controller.

    "Data Subject" means an identified or identifiable natural person whose Personal Data is processed.

    "Sub-processor" means any third party engaged by LimeSpot to process Personal Data on behalf of the Client.

    2. Scope and Purpose

    LimeSpot processes Personal Data solely to provide personalization and recommendation services to the Client. The types of Personal Data processed may include:

    • Shopper browsing behavior and product interactions
    • Purchase history and order information
    • Email addresses (for personalization purposes)
    • Device and browser information
    • Geographic location data

    The Data Subjects are the Client's shoppers and customers, and the Client's staff and other people who use the services on the Client's behalf.

    LimeSpot processes Personal Data for the term of the agreement between LimeSpot and the Client and, after it ends, only for the deletion or return period in Section 10.

    3. Client Obligations

    The Client agrees to:

    • Ensure lawful collection and processing of Personal Data
    • Obtain necessary consents from Data Subjects
    • Provide appropriate privacy notices to Data Subjects
    • Notify LimeSpot of any changes affecting data processing
    • Respond to Data Subject requests in a timely manner

    4. LimeSpot Obligations

    LimeSpot agrees to:

    • Process Personal Data, including any transfer of it to another country, only on documented instructions from the Client, unless a law LimeSpot is subject to requires otherwise, in which case LimeSpot informs the Client of that requirement before processing unless that law prohibits the notice
    • Ensure personnel are bound by confidentiality obligations
    • Implement appropriate technical and organizational security measures
    • Assist the Client in responding to Data Subject requests
    • Assist the Client, taking into account the nature of the processing and the information available to LimeSpot, with data protection impact assessments and prior consultations with a supervisory authority that concern the services
    • Inform the Client without delay if LimeSpot believes an instruction infringes data protection law
    • Delete or return Personal Data upon termination of services
    • Make available information necessary to demonstrate compliance

    5. Data Subject Rights

    LimeSpot will assist the Client in fulfilling obligations to respond to Data Subject requests, including requests for:

    • Access to Personal Data
    • Rectification of inaccurate data
    • Erasure of Personal Data
    • Restriction of processing
    • Data portability
    • Objection to processing

    Data Subjects may contact LimeSpot's Data Protection Officer at [email protected] for any inquiries.

    6. Sub-processors

    LimeSpot may engage Sub-processors to assist in providing services, and the Client gives general authorization for that. LimeSpot keeps the list of current Sub-processors on this page and posts every addition or replacement here, with the date of the change, before or as soon as the new Sub-processor begins processing Personal Data. Posting here is LimeSpot's notice of the change. Because LimeSpot's services change often, the Client is responsible for reviewing this page periodically and before each new use of the services. If the Client objects to a change on reasonable data protection grounds within 30 days of its posting, the parties will work in good faith to resolve the objection, and if they cannot, the Client may terminate the affected service. Continued use of the services after that period is acceptance of the change. Sub-processors are bound by written contract to the same data protection obligations as those in this DPA.

    Current Sub-processors (list last changed October 10, 2026):

    • Microsoft Azure (cloud infrastructure and data storage)
    • Invero Inc. (Microsoft cloud solution provider through which LimeSpot's Azure subscription is managed; Canada)
    • Cloudflare, Inc. (hosting and storage for limespot.com and LimeSpot's AI service, bot protection, and Workers AI model hosting, where content is not kept after the request unless LimeSpot stores it; United States)
    • Twilio Inc., SendGrid (transactional and service email delivery; United States)
    • Anthropic, PBC (AI model provider for LimeSpot's AI and agentic features, such as auditing a store, generating recommendations and content, and carrying out tasks a Client asks for; API content kept up to 30 days; United States)
    • OpenAI, L.L.C. (AI model provider for LimeSpot's AI and agentic features, such as auditing a store, generating recommendations and content, and carrying out tasks a Client asks for; API content kept up to 30 days; United States)
    • Google LLC, Gemini API, paid tier (AI model provider for LimeSpot's AI and agentic features, such as auditing a store, generating recommendations and content, and carrying out tasks a Client asks for; API content kept up to 55 days; United States)
    • Intercom, Inc. (customer support and messaging; United States)

    For the LimeSpot browser extension and the store audits it runs, LimeSpot decides the purposes and means of processing and acts as controller; that processing is governed by the Privacy Policy, not by this DPA, which covers Personal Data LimeSpot processes on the Client's behalf.

    7. Security Measures

    LimeSpot implements appropriate technical and organizational measures, including:

    • Encryption of Personal Data in transit and at rest
    • Access controls and authentication mechanisms
    • Regular security assessments and audits
    • Incident response and breach notification procedures
    • Employee training on data protection

    8. Data Breach Notification

    In the event of a Personal Data breach, LimeSpot will notify the Client without undue delay and provide information about the nature of the breach, categories of data affected, and measures taken to address it.

    9. International Data Transfers

    Personal Data may be transferred to and processed in the United States, Canada, or Europe. LimeSpot ensures appropriate safeguards are in place for international transfers, including Standard Contractual Clauses where required and, for data subject to UK law, the ICO International Data Transfer Addendum.

    10. Data Retention

    LimeSpot retains Personal Data only for as long as necessary to provide services or as required by law. Upon termination of services, LimeSpot will delete or return Personal Data within 90 days unless retention is required by law.

    11. Audit Rights

    Upon reasonable request and subject to confidentiality obligations, LimeSpot will make available information necessary to demonstrate compliance with this DPA and allow for audits conducted by the Client or an appointed auditor.

    12. Contact Information

    For questions about this DPA or data protection practices:

    Data Protection Officer: [email protected]

    Legal inquiries: [email protected]

    Related Documents: Privacy Policy | Terms of Service