What kind of notes? I am not an expert in GDPR law since I don't track people, hopefully someone here would explain exactly what is PI and what is tracking and if will apply in this exact case.