I don't think GDPR covers people who have an actual written and signed financial contract with the service in question. How could any business function without the information needed on who to pay?
Keeping data which you are legally required to keep is certainly allowed by the GDPR.
Although it wouldn't be surprising to have two (or more) laws contradict each other.
GDPR has explicit provisions for "keep what you're legally required to keep".
Especially if that was a way to "accidentally" kill an objectionable industry.