Customers: category, lawfulness and purpose of data