In short, under GDPR a company isn't obligated to offer you services if you refuse to allow them access to information they require.

GDPR defers to data retention laws for all other purposes.