Well, GDPR requires that you do those things. A clear EULA that says we don't do any of those things so if you don't like it don't use our service would still be illegal under GDPR, right?