Roles
When you use utm.coupons to run promotions, you are the data controller and we are the data processor for the personal data of your customers.
What we process
- Share identifiers and referral metadata
- Verified order events tied to a code
- Support communications
Sub-processors
We use a small set of vetted sub-processors for hosting, email and analytics. A current list is available on request.
Security
- Encryption in transit and at rest
- Role-based access controls
- Regular penetration testing
- SOC 2 Type II controls
Breach notification
We will notify affected controllers without undue delay after becoming aware of a personal data breach.
International transfers
Where data is transferred outside its origin region, we rely on Standard Contractual Clauses or equivalent safeguards.
Deletion
On termination we delete or return personal data within 30 days, except where we must retain it to comply with law.