Money is money. Why is it a GDPR risk for one bank account paying for your proposed use case of toy projects and not another? I don't see how that changes the trust relationship for the team to do the right thing.