They may have said that process was related to GDPR, but that was either a lie or someone with so little understanding for basic laws that I wonder about their

They may have said that process was related to GDPR, but that was either a lie or someone with so little understanding for basic laws that I wonder about their capability to conduct business at all. Everything about this is prohibited and discouraged under GDPR.