Even with GDPR, you can easily keep that data around for a few months or a year unless the customer requests deletion.