We are developing software that are sold to and used by other companies. In the software, certain types of personal data, like name, email and phone number, can be stored when a user registers. The data is stored on a server owned by our customer. Our customer owns all the data. Our software shows this data in certain places within our software itself, but does not share it with any other third parties, or store it on our own servers, or use it in any other way.
What are our requirements when it comes to providing a privacy policy for our software, to be compliant with GDPR? Will our software only be considered a tool used by our customer in which they collect personal data, and hence not require us to have our own privacy policy accepted by the users in addition, or will we have to have a privacy policy explaining what personal data which our customer is able to collect through our software?
All users of the software will be employees of our customer, if that makes a difference. They will therefore have their own privacy policy agreement with our customer (their employer) already.