None of this violates the GDPR. So long as they clearly allow opt in to what data is being processed, and why, and a way to delete it, you are mostly ok. As t

None of this violates the GDPR. So long as they clearly allow opt in to what data is being processed, and why, and a way to delete it, you are mostly ok. As the site might need to deal with issues of fraud, you are allowed a little more leeway in storing personal data.