How do I prove it?
You can refer to these pages:
There is no "the" GDPR compliant. The technical and organizational compliance depends a lot on the data that is actually processed. If you ask for a person's medical history, there are higher standards than for a which-is-you-favorite-film poll.
I am not collecting personal information
Well, then the GDPR does not apply, by law.
If you're collecting names, then collect them separately (there's a question for that in SoSci Survey) and use a filter to only offer this question if they uploaded an image. But please also note that images may be personal information.
Finally, it's the data prtectino officer of your institution who must tell you, if you need a CP contract. But please note, that this is only possible for the pro-server s2survey.net that cannot be used for free.
More information (not yet translated to English) is available here: https://www.soscisurvey.de/help/doku.php/de:general:dsgvo