Yes you can keep session logs, it is a 'legitimate interest'. Are you just trying to see which deals interest people (zero issue, but you could annonymise this

Yes you can keep session logs, it is a 'legitimate interest'. Are you just trying to see which deals interest people (zero issue, but you could annonymise this) or profiling the customer based on the logs and offering different prices (you are going to have to be more careful and transparent). > Can you even legally do a customer churn analysis under the GDPR without explicit consent There a lots of ways to look at churn with anonymised data. I do it with account ID's. If you are looking at churn rate of Asian people vs Afro-Caribbean then GDPR is going to be amongst your problems,