The simple answer is the client, Kezzler acts only as the data processor regarding GDPR rules, and all data use and transfer is regulated through Data Processing Agreements (DPA's). Kezzler simply collects the data and stores it on behalf of our client.