> Data collection is still data collection, it doesn't matter whether I am the one processing that data or a third party

It absolutely matters who collects or processes for who must be GDPR compliant.