UK Booksellers Association Special

If the data is not your organisation's data, your organisation is processing for someone else, and your organisation is a 'processor' in EU law. Otherwise you are a 'controller'. An organisation can be both a controller for its own data and a processor for another organisation. An obvious example of a 'processor' is a payroll service provider company. The data it is processing is not its own, it is data provided by its customer, the 'controller'.

You are given both choices by the GDPR. You can have information sent to us as your representative only, or you can have it sent to either your organisation or us. We recommend sending it only to us, as otherwise there may be confusion as to whether some communication was in fact sent.