No it's not. Because Payback has 30 million customers in Germany. Their whole business model is literally based around mining user data. In markets you'll see people paying with cash and then using the Payback card for the bonus points.
I guess it's 10 pages now.
If you as a consumer agree to your data being processed and shared as a business model, GDPR can't really do much for you.