How CDR processes personal data