PECB DPO Exam Practice Questions (P. 2)

Scenario 2: Soyled is a retail company that sells a wide range of electronic products from top European brands. It primarily sells its products in its online platforms (which include customer reviews and ratings), despite using physical stores since 2015. Soyled's website and mobile app are used by millions of customers. Soyled has employed various solutions to create a customer-focused ecosystem and facilitate growth.
Soyled uses customer relationship management (CRM) software to analyze user data and administer the interaction with customers. The software allows the company to store customer information, identify sales opportunities, and manage marketing campaigns. It automatically obtains information about each user's IP address and web browser cookies. Soyled also uses the software to collect behavioral data, such as users' repeated actions and mouse movement information.
Customers must create an account to buy from Soyled's online platforms. To do so, they fill out a standard sign-up form of three mandatory boxes (name, surname, email address) and a non-mandatory one (phone number).
When the user clicks the email address box, a pop-up message appears as follows:
"Soyled needs your email address to grant you access to your account and contact you about any changes related to your account and our website. For further information, please read our privacy policy."
When the user clicks the phone number box, the following message appears:
"Soyled may use your phone number to provide text updates on the order status. The phone number may also be used by the shipping courier."
Once the personal data is provided, customers create a username and password, which are used to access Soyled's website or app. When customers want to make a purchase, they are also required to provide their bank account details.
When the user finally creates the account, the following message appears:
"Soyled collects only the personal data it needs for the following purposes: processing orders, managing accounts, and personalizing customers' experience. The collected data is shared with our network and used for marketing purposes."
Soyled uses personal data to promote sales and its brand. If a user decides to close the account, the personal data is still used for marketing purposes only. Last month, the company received an email from John, a customer, claiming that his personal data was being used for purposes other than those specified by the company. According to the email, Soyled was using the data for direct marketing purposes. John requested details on how his personal data was collected, stored, and processed.
Based on this scenario, answer the following question:
When completing the sign-up form, the user gets a notification about the purpose for which the company collects their email address. Is Soyled required by the GDPR to do so?

The GDPR indicates that the processing of personal data should be based on a legal contract with the data subject. Based on scenario 2, has Soyled fulfilled this requirement?

Based on scenario 2, Soyled only has three mandatory fields in its sign-up form. On which principle is this decision based?

Based on scenario 2, is John's request eligible under the GDPR?

Based on scenario 2, Soyled's customers are required to provide their bank account details to buy a product. According to the GDPR, is this data processing lawful?