According to the European Commission’s GDPR guidelines, the sentences below are not clear enough for processing purposes. (We took these examples directly from the document.)
“We may use your personal data to develop new services” (because it is not clear what the “services” are or how the data will help develop them);
“We may use your personal data for research purposes” (because it is not clear what kind of “research” this refers to)
“We may use your personal data to offer personalized services” (because it is not clear what “personalization” includes)
On the other hand, sentences like this are much better:
“We will retain your purchase history and use details of products you have previously purchased to make recommendations to you about other products we believe may be of interest to you.” (It is clear what kind of data will be processed, that data subjects will be subject to targeted advertising for products and that their data will be used to enable it)
“We will retain and review information about your recent visits to our website and how you move around different parts of our website for analytical purposes to understand how people use our website. “How do we use it so we can make it more intuitive” (it’s clear what kind of data is going to be processed and the kind of analysis that the controller is going to do)
“We will keep a record of the articles on our website that you have clicked on and use this information to target advertisements on the website that are relevant to your interests, which we have identified from you. based on the subjects read by” (this is to clarify what is included in personalization and how the interests attributed to the data subject are identified)