It's also probably a legitimate interest to retain data for marketing and analytics purposes, so long as that retention meets the same sort of guidelines. Marketing is explicitly highlighted as one of the applicable uses for legitimate interest.
"The processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest."
It's also mentioned in Article 21 describing the right to object to processing using legitimate/public interest:
"Where personal data are processed for direct marketing purposes, the data subject shall have the right to object at any time… etc."
The ICO has some useful guidance on when it is an appropriate basis: https://ico.org.uk/for-organisations/guide-to-data-protectio...