GDPR Browser-only tool data Effective 17 March 2026

Data Privacy Statement

protagx UTM Builder — Information on the processing of personal data
pursuant to Art. 13 & 14 GDPR (EU Regulation 2016/679)

Document: Data Privacy Statement — protagx UTM Builder | Version: 1.0 | Date: 17 March 2026 | Language: English
Your campaign data never leaves your device.
All UTM parameter values, destination URLs, campaign names, and generated links that you enter or create using the protagx UTM Builder are processed exclusively within your own browser and stored only in your browser's local storage on your own machine. None of this data is ever transmitted to protagx, any affiliated entity, or any third party — not now, not in future versions of this tool.
Art. 1

Identity and Contact Details of the Controller

GDPR Art. 13(1)(a)

protagx Consulting

Christian Schappeit
Website: www.protagx.com
Contact: www.protagx.com/en/contact
Email for data protection enquiries: [email protected]

Art. 2

Scope of This Statement and Purpose of Processing

GDPR Art. 13(1)(c)
Art. 3

Personal Data Collected via the Registration Form

GDPR Art. 13(1)(d)
First name
To address the user personally in follow-up communications
Last name
For identification purposes in the CRM record
Email address
Required. Used to grant access and send requested or consented communications
Company name
Optional context to personalise consulting outreach, if applicable
IP address / browser data
Automatically recorded by HubSpot's form infrastructure at time of submission for security and spam-prevention purposes
Form submission timestamp
Recorded to document consent and gate access logic
Art. 4

Data Processed by the UTM Builder Tool Itself

Browser-only
Technical guarantee: all UTM campaign data is local-only
The UTM Builder operates entirely within your web browser. No field value, generated URL, campaign name, utm_source, utm_medium, utm_campaign, utm_content, utm_term value, destination domain, or URL log entry is ever transmitted over a network connection to any server — including protagx's own servers. All state is maintained in browser memory (JavaScript variables) and, when you use the Save to Log feature, in browser localStorage — a storage area that is physically located on your own device and inaccessible to protagx or any other party.
Destination URL
Entered by user. Used only to construct the tagged URL in the browser. Browser only
utm_source
Selected from dropdown. Stored in browser memory during session. Browser only
utm_medium
Selected from dropdown. Stored in browser memory during session. Browser only
utm_campaign
Entered by user. Stored in browser memory during session. Browser only
utm_content
Entered by user (optional). Stored in browser memory during session. Browser only
utm_term
Entered by user (optional). Stored in browser memory during session. Browser only
URL Log
Saved entries stored in localStorage on the user's own device only. Deleted when the user clears their browser data or uses the "clear log" function. localStorage only
Brand label
Optional display-only field. Stored in browser memory during session. Not persisted. Browser only
Gate cookie
A single boolean cookie (ptx_utm_unlocked=1) is set on the user's browser after form submission to avoid repeat form display. This cookie contains no personal data. Local cookie
Registration form data
Submitted to HubSpot CRM via the embedded form. See Article 3 and Article 7. HubSpot CRM
Art. 5

Legal Basis for Processing

GDPR Art. 6 & Art. 7
Art. 6

Retention Periods

GDPR Art. 5(1)(e)
Art. 7

Recipients and Third-Party Processors

GDPR Art. 13(1)(e)
HubSpot, Inc.
Role: CRM and form processor. Processes registration form submissions on behalf of protagx. HubSpot is certified under the EU–US Data Privacy Framework. Data is stored in HubSpot's EU1 region. HubSpot Privacy Policy →
Google Fonts
Role: Web font delivery (Sora, DM Mono). Loading fonts from Google's CDN transmits the user's IP address to Google servers. Use of Google Fonts is governed by Google's Privacy Policy. Fonts may be self-hosted to eliminate this transfer.
jsDelivr CDN
Role: Delivery of the Tabler Icons icon font. Loading assets from jsDelivr may transmit the user's IP address. Governed by jsDelivr's Privacy Policy.
Art. 8

Your Rights as a Data Subject

GDPR Art. 15–22
Right of access (Art. 15)
You may request a copy of all personal data held about you, including the legal basis for processing.
Right to rectification (Art. 16)
You may request correction of inaccurate or incomplete personal data held by protagx.
Right to erasure (Art. 17)
You may request deletion of your personal data where no overriding legal obligation requires its retention.
Right to restriction (Art. 18)
You may request that processing is restricted while a dispute regarding accuracy or lawfulness is resolved.
Right to object (Art. 21)
You may object at any time to processing based on legitimate interests (Art. 6(1)(f)).
Right to portability (Art. 20)
Where processing is based on consent or contract, you may request your data in a structured, machine-readable format.
Right to withdraw consent (Art. 7(3))
Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
Right to lodge a complaint (Art. 77)
You have the right to lodge a complaint with the competent supervisory authority in your EU member state at any time.
Art. 9

Cookies and Local Storage

ePrivacy Directive / TTDSG
ptx_utm_unlocked
Type: Persistent cookie (365-day expiry) — Strictly necessary. Set to 1 after the user completes the registration form, to prevent the gate modal from displaying on subsequent visits. Contains no personal data. Legal basis: necessary for the provision of the requested service (ePrivacy Directive Art. 5(3) / TTDSG §25(2)).
utm_log_v2
Type: Browser localStorage key — Functional. Stores the user's saved URL log (campaign data entered by the user) in their own browser's localStorage. This data is never transmitted. The user may delete it at any time via the "Clear log" button or by clearing browser data.
HubSpot cookies
Type: First-party and third-party analytics/functional cookies set by the HubSpot tracking script (__hstc, hubspotutk, __hssc, __hssrc). These cookies are used by HubSpot to track page visits and associate form submissions with contact records. They are governed by HubSpot's Privacy Policy and the protagx–HubSpot data processing agreement.
Art. 10

Contact for Data Protection Enquiries

GDPR Art. 13(1)(a)

protagx Consulting — Data Protection

Email: [email protected]
Web: www.protagx.com/en/contact

protagx will respond to all verifiable data subject requests within 30 calendar days of receipt, in accordance with Art. 12(3) GDPR. Where a request is complex or numerous, the response period may be extended by a further 60 days, of which the data subject will be notified within the initial 30-day period.

If you are dissatisfied with the response received, you have the right to lodge a complaint with the competent supervisory authority. For users based in Germany, the relevant authority is the respective Landesbeauftragter für den Datenschutz. For users in Austria, the Datenschutzbehörde (DSB). For users in other EU member states, the authority in your country of residence.