Magento is the data processor. In fact, this role falls to you. However, the developers are not completely free of responsibility. You must provide the technological basis so that you can work in compliance with the law. Magento must also keep its own system GDPR-compliant. For example, you must be informed about which cookies are running when you use the shop system.