> "we consider logs of payments made in a store a legitimate interest"

That sounds like the kind of get-out I'd expect from a US company, or any other company with no significant assets under GDPR jurisdiction. The GDPR defines "legitimate interest", and that isn't one of them.