GDPR Compliance in Fintech: Defining Roles and Contractual Liabilities