Suppliers: category, lawfulness and purpose of data