We operate on the basis of either consent or legitimate interest (see our impact assessment for more details), and keep data safe by storing as little as possible and pseudonymising any data sent to our servers.