21 AUG 2025
Institution response 02
The second response referred to contractual legal basis, described the service provider as a processor acting on behalf of the controller, stated that consent was not required for processing necessary for the stated purpose, and again referred to access controls.
Public notes
The complainant questioned whether the response addressed the actual use of Product B information during the specific interaction.