[Xelbair]

they can write whatever they want when asking user to 'waive' GDPR rights.

That isn't legally binding at all.