Regarding your first statement: It depends if you have a valid contract with the user and the data processing is sufficiently related to the performance of that contract.