[TheRealPomax]

technically, they do not need your creditcard details. That's transient information that is only relevant at the time of purchase, as it needs to be forwarded to a financial institution to process the payment. Immediately after forwarding, the credit card information becomes entirely irrelevant (the financial institution's clearance or rejection is the ultimate goal here, to enable a transfer of funds).

And technically (at least in terms of "if it comes to litigation") your name is equally irrelevant: there is no reason to store it, there only needs to be an agreement on which label markings the buyer specifies are to be used. While the name is common, any sequence of letters or even emoji would work just fine, as long as the recipient can recognize the shipping label as being "theirs" rather than "we don't know who this package is for".

The only truly required information is the address, without which delivery cannot be made. That information will have to be stored for a longer period of time (as delivery is almost never an in-house affair), at which point it is subject to GDPR.

(But of course, in the real world, people typically consent to their information being stored in a profile locked behind some kind of login. Sometimes, though, once a case goes to trial, the real world becomes less important than the unrealistic ideal one based on requirements imposed by law)

[vertex-four]

Processing data, even ephemerally, is subject to GDPR. GDPR is not primarily about storage. The fact of the matter, though, is that most ephemerally-processed data is necessary to perform a contract, and thus legal under GDPR.