A retail company collects customer email addresses and decides how they will be used for marketing campaigns. It hires an external email service provider that sends the campaigns strictly according to the retailer's written instructions and does not use the data for any other purpose. Under data privacy roles, how should the email service provider be classified?