What happens to the data and how does it work with GDPR?