doing that would be flat out unlawful under the GDPR, regardless of whatever crap they put into their EULA

and enough to get that company into rather expensive trouble