[mytailorisrich]

Indeed, there is a legitimate interest in keeping everything relevant to payments and execution of contracts for the time period that contract exists and for the time period a party can sue.

For instance, in the UK one can sue on a civil matter for up to 6 years after the issue arose (and I believe same period for taxman to come after you) so it is perfectly valid to retain data for 6 years even if the user asks you to delete them. That does not mean keeping all the data you may have, though, but certainly names, addresses, payment details, order and shipping details (if relevant), complaint/support correspondence, can and should be kept. Then it gets trickier because arguably you can be sued over anything so there has to be a reasonable judgment call.