controller in the sense of the EU General Data Protection Regulation (GDPR) who individually or jointly makes decisions on the purposes and means of the processing of personal data, hereafter referred to as "data"