How do I correctly assign legal bases when multiple purposes are involved in a single process?

Consistently separate purposes. A process can have multiple purposes, e.g., contract fulfillment, security, analysis, marketing. Assign the appropriate legal basis for each purpose and document which data is necessary for it. If consent is required, describe consent gating and proof of consent. This way, you avoid contradictory documentation and impermissible mixing of purposes. Support: /mein-shop/p/datenschutzrechtliche-verarbeitung