If I understand GDPR correctly, and I probably don’t, under EU rules a company must have a justifiable reason to retain such records¹ and you have the right to request them if held or request to have them deleted (and taken to court for illegally holding them).

I found some details here if anyone’s interested.

[1]: After a specified period of time.