The person selling the cat house, a hobbyist called Mike, would also be a data controller.

This is because Mike needs Jane’s personal data (like her name and address) to ship the item she bought.

Data controllers have to be very careful with the information of their data subjects.

If there’s a personal data breach, or they break the GDPR, they could be given a huge fine.