As a technology provider, Branch enables software developers and, in particular, mobile app developers to implement deep linking and attribution. We process data on behalf of your company and are directly involved in the digital chain of consumer data tracking. But rather than looking at GDPR as a burden, we have approached the new regulations as an opportunity to innovate in the field of user experiences and privacy. Hear us out!
Let’s use a real-life example to illustrate what that innovation is all about: your country’s Postal Service. We will mirror this example in the digital world to reflect on the user experience benefits and potential data privacy concerns associated with sharing personal information online, from a consumer perspective. We will also use this example to highlight the role of each actor in a world where every interaction step can leave a digital trace.
To bring letters to and from mailboxes, the Postal Service needs to orchestrate many actors and processes in a way that ensures the privacy of correspondence throughout the whole chain. Achieving privacy of correspondence is the result of years of regulatory adjustments as new communication methods have emerged. Imagine what our democracies would be if your letter carrier had the right to know the details of your private correspondence, and had the potential to use it for nefarious or monetary purposes. Branch views GDPR as an ambitious attempt to regulate data exchanges across actors in the highly fragmented and admittedly opaque digital chain of Internet data tracking. Let’s now use this example to describe the role played by GDPR-compliant data processors such as Branch, in the data exchange orchestration of the Internet era. Assume this letter is a claim to your insurance company (Insurance Co.) inserted into an envelope as seen below.
The trusted flow of information between all actors is that this envelope will be securely and confidentially delivered to Insurance Co.’s office by the Postal Service and then routed by the internal mail service from department to department, as needed, for processing.
Consumers need to trust that everyone throughout the whole chain, whether employees or subcontractors, is bound by privacy of correspondence. Consumers should also assume that relevant Insurance Co. employees will process their personal information only for the purpose of satisfactorily handling their claim. This may require Insurance Co.’s processors to append additional information to the routing envelope so the letter can get to the correct department, with the relevant information so that the claim can be fulfilled diligently.
In the digital world, the Postal Service represents the Internet, Insurance Co. represents the GDPR data controller, and Branch is the data processor or subcontractor operating the internal mail service for Insurance Co.
Branch, the internal courier service, helps Insurance Co. in several ways:
- Branch efficiently routes consumer mail across departments. In GDPR terms, this translates to routing user interactions from one device or browser to another.
- Branch tracks and analyzes the flow of information between Insurance Co.’s departments, to optimize the claims process. In GDPR terms, this translates to providing analytics and attribution information to Insurance Co., to help optimize the routing process between devices or browsers.
- As an internal courier, Branch is bound by privacy of correspondence, and has limited access to personal data as defined and controlled by Insurance Co. In GDPR terms, this means Branch is processing first-party data as to which the data controller has obtained consent from the consumer or otherwise has a legal basis for processing that data.
The primary benefit for consumers comes into play as Branch assists the two internal departments of Insurance Co. as they coordinate and optimize their work. Assume your letter does not contain your Zip Code or the Policy ID necessary for processing. As a consumer, you will appreciate when employees of Insurance Co. can fill-in those blanks on your behalf so that your claim gets processed in a timely manner. You can think of “Zip Code”, “Policy ID”, and “Claim Type” being added to the internal Branch envelope to route your call to the correct desk.
But without that information being added and short of relying on the implicit approval from consumers to access their personal information and share it across departments, Insurance Co. will have no choice but to return your letter and ask you for more information, thus delaying the processing of your claim. You can think of Branch as a service that is only exposed to the added piece of information needed to optimize the delivery process, but which does not have or require access to the internal system of Insurance Co. to operate.
GDPR forces companies to be transparent with consumers about the actors involved in the data processing chain. This is a highly complex and fragmented chain of actors, and most consumers typically don’t realize that, due to the proprietary nature of Internet-enabled devices and software platforms (such as mobile phones, desktop computers, browsers, or social platforms), it is extremely difficult for the two departments of Insurance Co. (in this case, their website and their mobile app) to unequivocally identify consumers in real-time across those different systems. Without Branch, consumers would experience the user experience frustration described in our claim example—they would have to re-enter the same information on the mobile website and in the mobile app.
How many times have you entered a map address in the desktop version of an application and then re-entered it in the mobile version of the same app once on the go? With Branch, consumers can access content either on the mobile app or on the mobile website as they please without entering the information twice. This is the type of user interaction optimization Branch powers for its customers.
Ultimately, Branch as a service provider helps companies optimize consumer interactions by routing them from their websites to their mobile applications, and by extension routing them from any application on a device to any other application on another device. During this process, Branch is exposed to some high-level consumer personal data such as user cookies, IP addresses, and device and advertising identifiers, which it obtains from the Internet as a data transport mechanism. What Branch does for its customers is the equivalent of passing (processing) consumer identity labels from one department to another. Our access to consumer personal information is controlled and limited by our customers (acting as GDPR data controllers) based on their respective consumer policies. To go back to our example, Branch sees the information on the outside of the envelope, but does not have access to personal information beyond that. Branch is bound by consumer expectations of data privacy associated with personal data, and uses advanced pseudonymization techniques and stringent data retention policies to support its service.
Branch’s Innovation in Data Privacy and User Experiences
Beyond the fact that we maintain rigorous controls and manage any personal data of our customers’ users in a GDPR-compliant manner (as the law requires), Branch is first and foremost an innovator in cross-device, cross-platform, and cross-channel user experiences. As such, we ensure our customers can offer unique and delightful user experiences to their consumers, while maintaining an industry-leading level of privacy. While some vendors have simply pushed out new Privacy Policies in response to GDPR, we wanted to respond with something truly innovative in the data privacy space.
To support this innovation, Branch released new versions of its App and Web SDKs with a Do-Not-Track flag that enables deep linking and restricted attribution even for the most privacy-conscious consumers. Similarly to eCommerce sites that enable consumers to check out as guests, Branch now enables companies to handle cross-device consumer interactions without any exchange of personal information.
Once programmatically set by way of our SDK, this Do-Not-Track flag is like stamping the envelope with a ‘confidential’ tag on a per-consumer basis. When present, everyone in the chain knows not to write anything extra on the outside of the envelope, and all will know that this particular customer is willing to accept a processing delay in exchange for this increased level of data privacy.
Branch then guarantees that this Do-Not-Track flag will propagate through the whole chain of actors with which your Branch application integrates. As such, Branch will not export any such data to other third-parties on our behalf—the buck stops here!
Finally, and from an attribution viewpoint, we also take data privacy to heart—our attribution reports will not account for any consumers flagged as Do-Not-Track. These consumers are, for all intents and purposes, treated anonymously, as reflected in the image below.
Our objective through this highly simplified example is to illustrate how companies can use personal data to optimize user experiences while honoring GDPR compliance and respecting data privacy. We hope this example will inspire marketers and developers to articulate similar innovations in the contexts of their own businesses so that they can implement personalized and innovative user experiences while complying with all GDPR requirements. Our experience is that the most successful Branch customers are those who gain the trust of consumers, so they are comfortable sharing certain personal data in exchange for frictionless and enjoyable user experiences. We would be happy to discuss any and all of the topics explored here in greater detail. Please feel free to reach out to with any questions!