GoMarketMe SDK 6.0.2+ — Attribution Method: Referral Codes
Last updated: October 14, 2026
This Data Processing Agreement ("DPA") forms part of the GoMarketMe Terms and Conditions. By accepting those Terms, the app developer or business identified through the GoMarketMe account ("Customer") also accepts this DPA. No separate signature is required.
This DPA applies to GoMarketMe SDK version 6.0.2 and later with Attribution Method set to Referral Codes.
For personal data processed under this DPA ("covered data"), the Customer is the controller and GoMarketMe Technology, LLC ("GoMarketMe") is the processor. Both parties will comply with applicable data protection laws, including the GDPR and UK GDPR where applicable.
GoMarketMe processes data relating to users of the Customer's app to validate referral codes, attribute eligible purchases and subscriptions, verify transactions, calculate affiliate commissions, provide reports, and prevent fraud.
Covered data includes referral codes, app, campaign and affiliate identifiers, purchase and subscription records, transaction identifiers, and timestamps.
With Attribution Method set to Referral Codes, GoMarketMe SDK version 6.0.2 and later does not use fingerprinting or collect device information or network information. It does not collect IDFV, Android ID, or IDFA and does not request App Tracking Transparency (ATT) permission.
Processing includes collecting, transmitting, storing, verifying, associating, and reporting this data. Relevant transaction information is sent directly to Apple or Google for verification.
Processing continues while the Customer uses the covered services and until data is deleted under this DPA.
GoMarketMe will use covered data only to provide the instructed services. This DPA, the Customer's service settings, and written requests constitute the Customer's documented instructions, including instructions concerning international transfers.
If applicable law requires different processing, GoMarketMe will inform the Customer before processing unless legally prohibited. GoMarketMe will immediately inform the Customer if it believes an instruction violates applicable data protection law.
For processing subject to the EU GDPR, legal requirements overriding Customer instructions or deletion must arise under EU or Member State law. For UK GDPR processing, they must arise under UK law. Other government requests are handled in accordance with applicable data protection and international-transfer rules.
The Customer is responsible for a lawful basis for processing, appropriate privacy notices, and any required consent.
GoMarketMe will not sell covered data or use it for unrelated advertising or profiling.
GoMarketMe will ensure that personnel authorized to process covered data are subject to confidentiality obligations.
GoMarketMe will maintain security measures appropriate to the processing risks and applicable legal requirements, including restricted access, protection of data during transmission and storage, measures to maintain and restore service availability, and regular assessment of security measures.
The Customer authorizes GoMarketMe to use Amazon Web Services ("AWS") for hosting and data storage. All covered data stored by GoMarketMe is stored in AWS region us-west-2, United States of America.
GoMarketMe will impose equivalent data protection obligations on its subprocessors through written agreements and remains responsible for their compliance.
GoMarketMe will give advance notice of additional or replacement subprocessors and allow reasonable objections on data protection grounds. If a reasonable objection cannot be resolved, the Customer may discontinue the affected services before the new subprocessor begins processing its data.
Taking account of the processing and information available, GoMarketMe will help the Customer respond to individual rights requests and meet obligations concerning security, breach notifications, data protection impact assessments, and consultations with supervisory authorities.
GoMarketMe will forward individual requests concerning covered data to the Customer unless legally prohibited. It will respond on the Customer's behalf only on instructions or as required by law.
GoMarketMe will notify the Customer without undue delay after becoming aware of a personal data breach affecting covered data and provide available information, updates, and cooperation.
GoMarketMe is based in the United States of America, where covered data stored by GoMarketMe is located.
International transfers will comply with applicable data protection law and use legally required safeguards.
GoMarketMe will retain covered data only as needed to provide the instructed services.
The Customer may request deletion of covered data at any time by contacting legal@gomarketme.co. GoMarketMe will carry out the request in accordance with the Customer's instructions and applicable data protection law.
By accepting this DPA, the Customer instructs GoMarketMe to delete covered data and existing copies without undue delay when the covered services end, unless retention is legally required under the rules in Section 3. The Customer may instead instruct GoMarketMe to provide a copy before deleting the data.
Backup copies awaiting deletion will remain protected, be placed beyond use pending deletion, and be deleted through the regular backup deletion cycle.
GoMarketMe will provide information necessary to demonstrate compliance with this DPA and allow and contribute to audits and inspections by the Customer or its appointed auditor, subject to confidentiality and protection of other customers' data.
This DPA remains effective while GoMarketMe processes covered data. If this DPA conflicts with the Terms, this DPA governs the processing covered by it. Applicable transfer safeguards take precedence where they require otherwise. Nothing in this DPA limits rights or obligations imposed by applicable data protection law.
Contact: legal@gomarketme.co