We are working on a website that will be an authentication only site, i.e. only users who are invited and accept the invitation by logging into our site will have access to it. We will also have a few European users and those users will be representing the company they work for. So for example, if user John from Ireland works at Company XYZ, they will be getting an invite on john@xyz.com and will be able to log in using that email address only. The total number of such European users is expected to be less than 100.
Our website uses email authentication and stores the users Name and email address on the database to provide certain functionalities. Neither the user's name or email address will be used for any marketing purposes through marketing mass emails since our company business representatives are already in touch with the user/company representative via email communications (typical B2B). The website will not use any cookies. Now since we will be storing their name and company email address, my question is what is required for us to be GDPR compliant in this scenario?
