11.3 As a “Controller” after the GDPR, the MERCHANT is, inter alia, obliged to fulfill the statutory transparency obligations towards data subjects and, as far as required in the context of the services ordered (e.g. in the context of credit worthiness checks at credit agencies), to obtain consents from data subjects. 12.