Tell a Friend is designed around privacy-by-design principles and does not require personal customer data, email addresses or account registration for the core sharing flow. The exact GDPR responsibilities still depend on the retailer’s implementation, integrations and campaign setup.