https://www.pivotpointsecurity.com/data-controller-vs-data-processor-are-we-neither-either-or-both/