A. It must solicit informed consent through a notice on its website GDPR Article Reference: Article 22(1): The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her. Article 22(2): This shall not apply if the decision is based on the data subject’s explicit consent, among other exceptions. Article 7: Conditions for consent – Consent must be informed, specific, and unambiguous, and data subjects must be provided with clear information about the processing activities, including profiling and the sharing of their data with third parties.

must be able to demonstrate preview relations with the customer to be able to use Legitimate interest as a legal basis.