According to the GDPR

[Shishirgano9]

Imagine the following scenario, Peter Schmidt wants to do something for his fitness and start running. Up until now, however, he has not been very enthusiastic about sports and is therefore a complete beginner. What he does know, however, is that a good shoe is a must. But which one should it be?

This is where you come in. In our example, you are a marketer at RunningPoint GmbH and you want to convince Peter Schmidt about your company using the inbound marketing method.

data collection
As a first step, Peter Schmidt opens Google and searches lawyer database for running shoes that are particularly suitable for beginners. He comes across your blog, where you have published an article on exactly this topic. At the end of the blog post, you promote an e-book that has many more tips for running beginners. Before downloading, you must inform Mr. Schmidt exactly which of his personal data you want to save in exchange for the e-book and how you want to use it.

The GDPR requires that the so-called “data controller” (in this case you) inform the “data subject” (whose data is stored; in this case Mr. Schmidt) in clear language about how the data will be used.
only data that is appropriate for the respective processing purpose can be stored. Anything else is a violation of the regulation. In any case, the person concerned must give their consent to the data processing.