I don't think GDPR covers people who have an actual written and signed financial contract with the service in question. How could any business function without the information needed on who to pay?