I agree with you, but to be honest, I think nowdays with the state of GDPR not even a lawyer can guarantee something is or not GDPR compliant, as the law is still vague and contains broad words like "necessary".
Thank you for the comment. GDPR does indeed have vague elements in it. But, as an advice to those who ventures into a similar industry, I'd advice consulting with a lawyer.