The trick is to read through and understand what falls under "Legitimate Interest" (important note: it never involves giving other services access to it!).

A very common example is recording the IP address for technical (debugging, ensuring site functionality) and legal (security, audit logs) does fall under Legitimate Interest.

Worst case you have to mention it in privacy policy.

The thing you can't do is let your marketing team or others grab at it in any way, or sell it to other vendors, and arguably you should not move outside of safe countries.