Thank you for the comment. GDPR does indeed have vague elements in it. But, as an advice to those who ventures into a similar industry, I'd advice consulting with a lawyer.