I noticed in the source code of our community you push username and user's actual name as custom dimensions to Google Analytics. Username and real name are personally identifiable information and cannot be tracked in Google Analytics, which means you're in breach of their terms of service.

Since you're passing PII to Google Analytics without proper agreement in place, this means you're also in breach of GDPR in accordance with your Data Processing Agreement, section IV:

IV. Sub-Processing Tribe shall not share, transfer, disclose, make available or otherwise provide access to any Personal Data to any third party, or contract any of its rights or obligations concerning Personal Data, unless Tribe has entered into a written agreement with each such third party that imposes obligations on the third party that are substantively similar as those imposed on Tribe under this Addendum. Tribe shall only retain third parties that are capable of appropriately protecting the privacy, confidentiality and security of the Personal Data.

To pass PII to Google Analytics (a third party) you would need to have an agreement in place with Google. You don't have it since Google Analytics doesn't allow PII on it's platform.

The following screenshot was taken from the source code of the page I'm writing this on:

 

Please hash and salt userId and remove dimensions 1 and 2.

Please review this information about Google Analytics, userId and PII to make sure you comply:

https://support.google.com/analytics/answer/6366371?hl=en

Since we host communities with Tribe, not only is Tribe in breach of Google Analytics ToS and GDPR, but also every community owner (meaning we're liable too). 

Please fix this ASAP.