So they seem to be confirming they're processing personal data. The UK ICO "at a glance" guidance for that includes:
* You must identify valid grounds under the UK GDPR (known as a ‘lawful basis’) for collecting and using personal data.
* You must use personal data in a way that is fair. This means you must not process the data in a way that is unduly detrimental, unexpected or misleading to the individuals concerned.
* You must be clear, open and honest with people from the start about how you will use their personal data.
* You must identify valid grounds under the UK GDPR (known as a ‘lawful basis’) for collecting and using personal data.
* You must use personal data in a way that is fair. This means you must not process the data in a way that is unduly detrimental, unexpected or misleading to the individuals concerned.
* You must be clear, open and honest with people from the start about how you will use their personal data.