The contract based exemption applies only to contracts the private person is a party in. If company X signs some contract with company Y, that has no bearing o

The contract based exemption applies only to contracts the private person is a party in. If company X signs some contract with company Y, that has no bearing on any consent exemptions. source: https://gdpr.eu/gdpr-consent-requirements/ https://gdpr.eu/gdpr-consent-requirements/ on other legal bases for processing: Processing is necessary to satisfy a contract to which the data subject is a party. The legitimate interest one is pretty fuzzy, what would the legitimate interest be here? "I want their data" isn't enough, I'm pretty sure.