Art. 22 (2) DGA:

"the data collected with respect to any activity of a natural or legal person for the purposes of the provision of the data intermediation service, including the date, time and geolocation data, duration of activity and connections to other natural or legal persons established by the person who uses the service, may be used only for the development of that service, which may entail the use of data for the detection of fraud or cybersecurity, [...]"