With regards to GDPR - I think ill change the name of the thread :D
Under Article 5 paragraph 1 (purpose Limitation) of GDPR you must be clear in what you intend to use the data for and from then on it can only be used for this, unless you get consent, of have a clear basis in law. (there are...