Under the EU GDPR, a data controller determines the purposes and means of personal-data processing. The role depends on actual decision-making, not merely who pays for the software.[1]
A shop may determine which customer data its ordering process requires. A supplier may separately act as controller for another activity. Assess roles per processing operation rather than automatically treating every supplier as a processor.
Content updated:
Sources
Compiled with AI assistance using public sources. General explanation, not individual legal or tax advice. Describing a concept does not mean Zoloo offers it as a feature.