Data Processing Addendum

Roles

You are the Controller of your end users' personal data. We act as Processor, processing that data solely on your documented instructions as configured through the Service.

Subject matter and duration

The processing covers the correction of UTM tracking parameters within your Google Tag Manager server-side container, for the duration of your subscription to Inflight.

Nature and purpose

Inflight inspects and, where it matches a rule you've configured, rewrites UTM parameter values in real time before the event reaches your GA4 property, so your campaign taxonomy stays consistent. A limited slow path also uses submitted values to serve your ruleset and to improve fuzzy-match suggestions.

Categories of data subjects

Visitors to the website(s)/properties you configure in Inflight.

Categories of personal data

UTM parameter values (utm_source, utm_medium, utm_campaign, utm_content, utm_term) and IP address.

Processor obligations

We will:

• Process personal data only on your documented instructions.
• Ensure personnel with access are bound by confidentiality.
• Implement appropriate technical and organizational security measures.
• Assist you in responding to data subject requests and in meeting your own GDPR obligations, to the extent relevant to our processing.
• Notify you without undue delay of any personal data breach affecting your data.
• Delete or return personal data at the end of the engagement, except where retention is required by law.

Sub-processors

We use Google Cloud Platform to host the infrastructure that serves your ruleset and supports Inflight's learning loop. We will notify you of any change to this list.

International transfers

Where personal data is transferred outside the EEA, we rely on Google Cloud Platform's Standard Contractual Clauses or an equivalent safeguard.

Audit

On reasonable request, we will provide the information necessary to demonstrate compliance with this DPA.

Contact

Questions about this DPA: legal@utm-assistant.ai