Point d is not true. If you hire Salesforce you generally disclose to your users that you use Salesforce. But you don't tell them all of Salesforce's processor

Point d is not true. If you hire Salesforce you generally disclose to your users that you use Salesforce. But you don't tell them all of Salesforce's processors, and all of their professors, and so on down the infinite loop. Edit: also the original comment was seeking consent, presumably affirmative. The GDPR system is a model that only provides (some but not all) notice, not affirmative consent.