I think as long as you tell the user then you're ok. If the user wanted to find out what information the Vuforia guys have collected they would have to ask them, pay the £10 (in the UK), and then it would be up to the Vuforia people.

I use to be the "Data Protection Expert" at a firm a few years ago, but really all that happened was they sent me on a course and I read the rules. Never had to actually deal with a case.