Art. 37

Controller and Processor

The controller and the processor shall keep records of personal data processing operations carried out by them, especially when based on legitimate interest