I’m not a lawyer, but as far as I know GDPR only applies between a private individual and a company, not between two companies.