GDPR roles and user rights
GDPR may apply when goods or services are offered to people in the EU or their behaviour is monitored. Controller and processor responsibilities must reflect the real processing.
Implementation: Document purposes, lawful basis, minimisation, notices, Article 28 processor terms, providers, retention, user rights, security, breach responsibilities and DPIA needs.
European Commission privacy guidance