Data Privacy Statement
protagx UTM Builder — Information on the processing of personal data
pursuant to Art. 13 & 14 GDPR (EU Regulation 2016/679)
Identity and Contact Details of the Controller
GDPR Art. 13(1)(a)The data controller within the meaning of the General Data Protection Regulation (EU) 2016/679 ("GDPR") and other applicable national data protection laws is:
protagx Consulting
Christian Schappeit
Website: www.protagx.com
Contact: www.protagx.com/en/contact
Email for data protection enquiries: [email protected]
Scope of This Statement and Purpose of Processing
GDPR Art. 13(1)(c)This Data Privacy Statement applies to all personal data processed in connection with the protagx UTM Builder, a free web-based tool made available by protagx at the URL on which this document is published, as well as to the associated gate form through which access to the tool is granted.
protagx offers the UTM Builder — and its associated educational resources — free of charge to users, customers, partners, and anyone interested in digital marketing attribution and CRM best practices. The sole purposes for which personal data is collected are:
- To provide access to the UTM Builder tool and associated protagx resources;
- To send relevant tool updates, CRM guides, and educational content to registered users who have expressly consented to receiving such communications;
- To understand the aggregate interest in the tool for product development purposes;
- To offer protagx consulting services to interested parties who have indicated their interest through the registration form.
protagx does not use data collected through this tool for any advertising, profiling, or re-targeting purposes beyond the communication of its own services and educational content.
Personal Data Collected via the Registration Form
GDPR Art. 13(1)(d)To unlock access to the protagx UTM Builder, users are required to complete a one-time registration form. This form is provided and processed by HubSpot, Inc. (see Article 7 on third-party processors). The following categories of personal data may be collected through this form:
The collection of this data is voluntary. However, submission of at least a valid email address is required to gain access to the UTM Builder, as the gate mechanism relies on form completion to verify user registration.
Data Processed by the UTM Builder Tool Itself
Browser-onlyThe following table summarises every category of data processed by the UTM Builder tool, together with its processing location and transmission status:
localStorage on the user's own device only. Deleted when the user clears their browser data or uses the "clear log" function. localStorage onlyptx_utm_unlocked=1) is set on the user's browser after form submission to avoid repeat form display. This cookie contains no personal data. Local cookieCategorical confirmation: No campaign data, URL data, keyword data, domain data, or any content entered into the UTM parameter fields of the UTM Builder is, or will ever be, transmitted to protagx's servers, to HubSpot, or to any other third party. This is an unconditional commitment and a technical property of the tool's architecture.
Legal Basis for Processing
GDPR Art. 6 & Art. 7Processing of personal data collected through the registration form is carried out on the following legal bases under Article 6 GDPR:
- Art. 6(1)(b) GDPR — Performance of a contract / pre-contractual measures: The processing of the email address and name fields is necessary to fulfil the user's request for access to the UTM Builder tool. The submission of the form constitutes a request for a service, and granting access constitutes fulfilment of that request.
- Art. 6(1)(a) GDPR — Consent: Where the registration form includes an opt-in for marketing communications (e.g. newsletters, guides, or protagx service updates), processing of contact data for such communications is carried out exclusively on the basis of the user's freely given, specific, informed, and unambiguous consent. Consent may be withdrawn at any time without detriment by contacting protagx at the address in Article 10 or by clicking the unsubscribe link in any communication.
- Art. 6(1)(f) GDPR — Legitimate interests: Processing of anonymised or aggregated usage data (e.g. form submission counts) for the purpose of understanding tool adoption and improving protagx's free resource offering constitutes a legitimate interest that does not override the data subject's fundamental rights and freedoms.
Processing of data entered into the UTM Builder tool fields themselves does not constitute personal data processing by protagx, as such data is never received or accessed by protagx. It is processed solely on the user's own device.
Retention Periods
GDPR Art. 5(1)(e)Personal data collected through the registration form is retained in protagx's HubSpot CRM for as long as it is necessary to fulfil the purposes described in Article 2, subject to the following criteria:
- Contact records of registered users are retained for a period of up to 3 years from the date of last meaningful interaction (e.g. last email open, last tool access, or last direct communication).
- Where a user has consented to marketing communications, data is retained until consent is withdrawn or until 3 years of inactivity have elapsed, whichever is earlier.
- Where a user requests deletion of their data under Art. 17 GDPR ("right to erasure"), protagx will action the deletion within 30 calendar days of receiving a verifiable request.
Data entered into the UTM Builder tool (URL log, campaign data) is retained exclusively in the user's own browser storage and is subject solely to the user's control. It is deleted automatically when the user clears browser data, or manually via the "Clear log" button in the tool. protagx has no access to, and no ability to delete, this data.
Recipients and Third-Party Processors
GDPR Art. 13(1)(e)protagx does not sell, rent, or otherwise commercially disclose personal data to third parties. The following processors have access to personal data solely to the extent required to provide the services described, and are bound by data processing agreements in accordance with Art. 28 GDPR:
Campaign and URL data entered into the UTM Builder is not shared with any of the above processors or with any other party. The tool architecture is strictly client-side for all UTM-related functionality.
No data is transferred to recipients in third countries outside the European Economic Area (EEA) except where the transfer is covered by an adequacy decision of the European Commission, standard contractual clauses, or an equivalent safeguard under Chapter V GDPR (as in the case of HubSpot's EU–US Data Privacy Framework certification and EU1 data residency).
Your Rights as a Data Subject
GDPR Art. 15–22You have the following rights with respect to personal data processed by protagx. These rights may be exercised at any time by contacting protagx at the address in Article 10:
Cookies and Local Storage
ePrivacy Directive / TTDSGThe protagx UTM Builder uses the following cookies and browser storage mechanisms:
1 after the user completes the registration form, to prevent the gate modal from displaying on subsequent visits. Contains no personal data. Legal basis: necessary for the provision of the requested service (ePrivacy Directive Art. 5(3) / TTDSG §25(2)).__hstc, hubspotutk, __hssc, __hssrc). These cookies are used by HubSpot to track page visits and associate form submissions with contact records. They are governed by HubSpot's Privacy Policy and the protagx–HubSpot data processing agreement.No advertising, tracking, or profiling cookies from third-party ad networks are placed by protagx in connection with the UTM Builder. The tool does not use Google Analytics or any equivalent session-analytics service.
Contact for Data Protection Enquiries
GDPR Art. 13(1)(a)All data subject requests, questions, or complaints relating to this Data Privacy Statement or to protagx's processing of personal data should be addressed to:
protagx Consulting — Data Protection
Email: [email protected]
Web: www.protagx.com/en/contact
protagx will respond to all verifiable data subject requests within 30 calendar days of receipt, in accordance with Art. 12(3) GDPR. Where a request is complex or numerous, the response period may be extended by a further 60 days, of which the data subject will be notified within the initial 30-day period.
If you are dissatisfied with the response received, you have the right to lodge a complaint with the competent supervisory authority. For users based in Germany, the relevant authority is the respective Landesbeauftragter für den Datenschutz. For users in Austria, the Datenschutzbehörde (DSB). For users in other EU member states, the authority in your country of residence.
This Data Privacy Statement was last reviewed and updated on 17 March 2026. protagx reserves the right to update this statement to reflect changes in applicable law or processing activities. Material changes will be communicated to registered users by email prior to taking effect.