The first of the GDPR principles is lawfulness, fairness, and transparency. You must have a lawful basis, treat people fairly, and explain what you are doing in a way a normal human can understand, rather than hiding behind dense policy text - ico.org.uk 