I’m not in the EU, so I wouldn’t have seen that. They’re stupid for doing that if that’s the case. If they’re accepting EU currencies, then you are correct that they have subjected themselves to GDPR. Go file a complaint, I assume your country will tag them for millions of euros in a hurry.