Under the terms of the GDPR, LibraryThing operates as either <b>data controller</b> or <b>data processor</b>, depending on whether the service is provided to users directly, or to organizations which have their own users.</p> <p>For TinyCat customers—excepting free, personal members—LibraryThing is assumed to be in the position of data processor, and the customer in the position of data controller, managing the data of their <b>data subjects</b>. The same may apply to LibraryThing customers using LibraryThing's "lending" feature or otherwise providing LibraryThing to others.</p> <p>