So much shit here against GDPR which is basically:
1. if you want your data removed, companies HAVE to remove your data
2. if you don't want your data stored, companies CANNOT store your data
and then a bunch of if-when-then-else-must-cannot-time-dependent-legal-stuff