GDPR isn't a blanket deletion. Organizations can still retain personal information about customers for situations where they deem the data is still necessary for the original purpose.

e.g. purchase history, legal agreements, etc.