[croemer]

This is almost definitely against GDPR, there's no indication whatsoever of which legal entity is holding the data and how long it is stored on which servers where.