I recommend reading https://jacquesmattheij.com/gdpr-hysteria/ https://jacquesmattheij.com/gdpr-hysteria/ for a more detailed understanding of how you might be

I recommend reading https://jacquesmattheij.com/gdpr-hysteria/ https://jacquesmattheij.com/gdpr-hysteria/ for a more detailed understanding of how you might be exposed, and what your obligations are. Some of your notes have been addressed by other commenters in the thread, but overall many of your points directly contradict what is discussed by Jacques. You probably want to evaluate your risk of exposure with your current approach.