1)Since the agreement is about processing of this data it really doesn't matter whether you have a contract with CF 2)You don't need any contractual relationshi

1)Since the agreement is about processing of this data it really doesn't matter whether you have a contract with CF 2)You don't need any contractual relationship to have GDPR apply to processing your data. If you're a European data subject then GDPR applies to any processing of your personally-identifiable data whoever is processing it and wherever they're doing it. If you're not a European data subject then GDPR would only apply if the company was a European company or if the processing was happening in Europe.