On our website we collect an awful lot of personal information. People upload their CVs, and when they use their social networks to log in, we collect information from there too.

We use this information for marketing, and may sell access to this data to 3rd parties.

These are covered in the T&C's of our website. We say that if you sign up, you accept the T&C's (no checkbox, it just says that). That's it.

What's the best way on making sure everything is done legitimately?