Are Visa/MC really able to store and use data for that purpose wrt to e.g the GDPR? Advertising/marketing certainly isn’t necessary for what they are doing so i

Are Visa/MC really able to store and use data for that purpose wrt to e.g the GDPR? Advertising/marketing certainly isn’t necessary for what they are doing so it would be requiring specific consent?