edit: here's a source: https://gdpr-info.eu/art-2-gdpr/
This Regulation does not apply to the processing of personal data:
(c) - by a natural person in the course of a purely personal or household activity;
Purely personal activities is not really interpreted as "I have a personal blog" sense, but in "I need to call my friends" sense. If you are indiscriminately processing data of possibly hundreds of people (note that at least on cases in Austria, it can be as low as 50 individuals), it is no longer purely personal and is now partially commercial, and unless you have other reasons to collect the data (research or you have actively obtained consent), you cannot simply do this.
Probably shouldn't have tacked on the company bit.
If you have a bootstrapped web startup project that you want to launch (e.g. collecting "pre-sales" signups from a minimum viable product), then it's definitely not purely personal or household activity even before you have registered a company.
A person without a company can act outside of the personal bounds.