We process the data legitimately and it is held by our Amazon Web Services (AWS) data center in Frankfurt, Germany. In turn, AWS themselves are fully GDPR compliant.