In your scenario are you suggesting that HelloFresh start sending people refunds unprompted? That doesn't exactly sound likely, but sure, they could stick a "Disclaimer: If you delete your details it may make it more difficult for us to refund you if we suddenly lose our minds and start inexplicably sending refunds to people unprompted".

In general, it’s not that strange to sell something then realize you can’t actually deliver it and make a refund. I guess HelloFresh is a little bit different from the average e-commerce business because they sell perishable food. But probably there’s some case where they would take some money then later decide to give it back.

They could mail a check.. oops now they need your mailing address

Or they could call you and ask.. oops now they need your phone number

etc

you only need the transaction details to call your payment gateway to do the refund, unless you are the payment gateway.

Encrypted archival of PII for a limited time, say a year. GDPR allows the storage for legal reasons.

A one way hash of PII, salted, stretched, this is enough to verify identity but also doesn't keep the PII directly (I know only 8 billion people on earth is not enough entropy. Still you make a legal effort and segregate it from your network)