It's annoying that people treat GDPR like a magic word that lets them do whatever they want. It only covers personal data -- as in, your name, address, phone number, email, any other identifiable information, etc.