That is not how gdpr works. If you have a legitimate reason to hold the data. You can. Ensuring people have access to purchases is a very legitimate reason.