doing that would be flat out unlawful under the GDPR, regardless of whatever crap they put into their EULA and enough to get that company into rather expensive

doing that would be flat out unlawful under the GDPR, regardless of whatever crap they put into their EULA and enough to get that company into rather expensive trouble