You need to make sure you're happy with how you're using peoples data and that it falls within the legitimate interest justification (https://ico.org.uk/for-org

You need to make sure you're happy with how you're using peoples data and that it falls within the legitimate interest justification (https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/a-guide-to-lawful-basis/lawful-basis-for-processing/legitimate-interests/ https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-re...) IP addresses can be considered personal data. edit - make sure you've actively made this decision and documented the assessment.