@annaboleyn As i understand GDPR, you have to state how you will use data at the point of collection. This could be something in your T&Cs .
You also have to have a basis for processing (in this case probably legitimate interest), and a few other things like the length of time you'd keep the...