Let’s consider a particular hypothetical application XYZ. Data that is coming from user interactions with XYZ is collected by the company XYZ.

In practical terms, ownership of user data collected by the company XYZ is usually retained by the company. When users interact with XYZ, the company collects data about their interactions, such as their usage patterns, location data, and preferences. This data is usually stored on servers owned or controlled by the company, and the company may use it to improve their service, target advertising, or share with third-party partners.

While users may be able to access some of their own data through the application or through data subject access requests, the ownership and control of the data ultimately rests with the company. The company is responsible for protecting the data and ensuring that it’s collected and used in accordance with relevant laws and regulations, as well as any terms and conditions agreed upon with users.