I don't care who you buy it from ... You should not assume that the vendor you are buying from is to be trusted. You should carry out your privacy impact assessment.