GDPR says you are not allowed to store my data just because. If you have a good enough reason, everything is allowed.