gdpr privacy terms-of-service service
Are terms of use considered a contract from GDPR point of view?
<p>If service terms of use doesn’t talk about setting up a contract between the company and the user, can you use «execution of contract» as the lawfulness for GDPR processing ?</p>
<p>If signup data is required to provide the service, do you need consent or does mentioning «by signing up you agree to the terms of use and privacy policy» enough ?</p>

<p>Your confusion might be caused by the fact that even with a contract, only the data necessary for that contract is covered under the GDPR. So yes, while there might be an &quot;execution of contract&quot; under the T&amp;C, this would only cover necessary data.</p>
<p>That means you can't ask arbitrary signup data under the guise of a contract. If you need to deliver a physical product, you can store a physical address. If it's an online service, you can store an email address or similar handle. But you can't mix the two. A physical address is unnecessary for the execution of a contract that's not physical in nature.</p>
<p>Now, you mention &quot;consent&quot;. Under GDPR, this is a distinct justification besides &quot;execution of contract&quot;. You might have consent to store a physical address in addition to an online address, e.g. if you offer a customer to physically mail a password request form. This consent is additional to the contract.</p>
<p>Also note that the bit above only covers the lawful reasons for the processing of personal data (article 6). You also have to obey the other GDPR rules, e.g. fully inform the user, make sure that consent is freely given, etc.</p>
