This Data Processing Agreement ("DPA") forms part of the agreement between limit.md, Inc. ("limit.md", "we", "us" or "Processor") and the customer entity that has accepted our Terms of Service(the "Customer", "you" or "Controller") (together, the "Agreement") governing the provision of the limit.md platform, which issues Visa virtual cards for AI agents with network-level spend controls (the "Services"). This DPA reflects the parties' agreement on the Processing of Personal Data in connection with the Services.
Where there is any conflict between this DPA and the Agreement on the subject of data protection, this DPA prevails. This DPA supplements, but does not replace, the commitments described in our Privacy Policy.
This DPA applies to the Processing of Personal Data by limit.md on your behalf where such Processing is subject to Data Protection Laws, including Regulation (EU) 2016/679 (the "GDPR"), the GDPR as incorporated into the law of the United Kingdom (the "UK GDPR"), the Swiss Federal Act on Data Protection, and the California Consumer Privacy Act as amended by the California Privacy Rights Act (collectively, the "CCPA" and, together with the foregoing, the "Data Protection Laws").
For the purposes of the Services, the parties acknowledge that you act as the Controller (or business) and limit.md acts as the Processor (or service provider) with respect to Customer Personal Data. Each party will comply with its respective obligations under the Data Protection Laws. Where limit.md determines the means and purposes of Processing in its capacity as a regulated card program manager and a Visa program participant — for example, to meet its own legal, anti-money-laundering, network-rule, and fraud-prevention obligations — limit.md acts as an independent controller, and such Processing is governed by our Privacy Policy rather than this DPA.
Capitalized terms not defined here have the meaning given in the Agreement or the Data Protection Laws. In this DPA:
You are responsible for the lawfulness of the Customer Personal Data you provide to limit.md and for ensuring that you have a valid legal basis and any necessary notices, consents, or authorizations to disclose that data to us and to instruct us to Process it for the purposes contemplated by the Agreement.
limit.md is responsible for Processing Customer Personal Data only as described in this DPA and your documented instructions, and for implementing and maintaining the technical and organizational measures set out in Section 6. Each party will appoint a point of contact for data protection matters and respond to the other party's reasonable requests in connection with this DPA.
limit.md will Process Customer Personal Data only to provide, maintain, secure, and support the Services and as otherwise instructed by you in writing. The details of the Processing are set out in the Annex to this DPA, which forms an integral part of it.
Your complete instructions for the Processing of Customer Personal Data are contained in the Agreement, this DPA, your configuration and use of the Services (including the spend policies, card controls, and limits you define), and any subsequent written instructions you give. limit.md will notify you if, in its opinion, an instruction infringes the Data Protection Laws, unless prohibited from doing so by law.
Taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of Processing, limit.md implements and maintains appropriate technical and organizational measures designed to ensure a level of security appropriate to the risk, including:
You provide a general authorization for limit.md to engage Sub-processors to Process Customer Personal Data in connection with the Services. limit.md's current Sub-processors include providers of cloud infrastructure and hosting, the card-issuing processors and bank partners that operate the Visa card program, transactional email delivery, and customer support tooling.
limit.md imposes data protection obligations on each Sub-processor that are no less protective than those set out in this DPA and remains liable for the acts and omissions of its Sub-processors. limit.md maintains an up-to-date list of Sub-processors and will give you at least thirty (30) days' prior notice of any intended addition or replacement of a Sub-processor, giving you the opportunity to object on reasonable data protection grounds. To request the current Sub-processor list or to register an objection, contact privacy@limit.md.
limit.md primarily Processes and stores Customer Personal Data in the United States. Where the provision of the Services involves a transfer of Customer Personal Data from the European Economic Area, the United Kingdom, or Switzerland to a country that has not received an adequacy decision, such transfer will be governed by the Standard Contractual Clauses, which are hereby incorporated into this DPA by reference and completed with the information set out in this DPA and its Annex.
For transfers subject to the UK GDPR, the UK International Data Transfer Addendum applies. limit.md will implement supplementary measures where necessary to ensure a level of protection essentially equivalent to that guaranteed within the EEA.
Taking into account the nature of the Processing, limit.md will provide reasonable assistance through appropriate technical and organizational measures to help you respond to requests from Data Subjects exercising their rights of access, rectification, erasure, restriction, portability, and objection under the Data Protection Laws. If limit.md receives a request directly from a Data Subject relating to Customer Personal Data, it will, unless legally required to act, promptly forward the request to you and will not respond except on your documented instructions.
limit.md will notify you without undue delay, and in any event within seventy-two (72) hours, after becoming aware of a Personal Data Breach affecting Customer Personal Data. Such notice will describe, to the extent known, the nature of the breach, the categories and approximate number of Data Subjects and records concerned, the likely consequences, and the measures taken or proposed to address it and mitigate its effects. limit.md will cooperate with you and take reasonable steps to assist in your investigation, mitigation, and remediation of the breach.
limit.md will make available to you the information necessary to demonstrate compliance with this DPA and will allow for and contribute to audits, including inspections, conducted by you or an independent auditor mandated by you. To minimize disruption, limit.md may satisfy audit requests by providing its PCI-DSS attestation of compliance, its SOC 2 Type II report once the audit (in progress) is complete, and responses to a reasonable data protection questionnaire. Where these are insufficient to address a specific, documented compliance concern, the parties will agree on the timing, scope, and conduct of an on-site audit, no more than once per year (absent a Personal Data Breach or regulatory requirement), conducted on reasonable prior notice and subject to confidentiality obligations.
Upon termination or expiry of the Agreement, limit.md will, at your choice, delete or return all Customer Personal Data and delete existing copies, unless applicable law — including financial recordkeeping, anti-money-laundering, and card network rule requirements — requires continued retention. Where data must be retained, limit.md will retain it only for the period and purpose required by law and will protect it in accordance with this DPA. You may export your data through the Services during the applicable retention window described in our Privacy Policy.
Each party's liability arising out of or related to this DPA is subject to the limitations and exclusions of liability set out in the Agreement, and any reference in the Agreement to the liability of a party means the aggregate liability of that party under the Agreement and this DPA together. Nothing in this DPA limits any liability that cannot be limited under the Data Protection Laws.
For any questions about this DPA, to exercise data protection rights, or to contact our privacy team, email privacy@limit.md or hello@limit.md, or write to limit.md, Inc., San Jose, California, USA.
The Services are not intended for the Processing of special categories of Personal Data. You agree not to provide such data to limit.md for Processing under this DPA.
Provision of the limit.md Services, including issuing and managing virtual cards for AI agents, evaluating transactions against your configured spend limits and policies, authorizing or declining transactions at the network level, maintaining audit logs, and providing related security, support, and reporting functions.
For the duration of the Agreement, plus any period during which limit.md is required to retain Customer Personal Data under applicable law or card network rules, after which the data is deleted or returned in accordance with Section 12.