GDPR principles related to the lifetime of personal data:
This principle indicates that only those minimum data necessary to provide the service demanding or necessary for the business should be collected
The interested party must know the purpose and / or purposes for which their personal data is being collected.
The organization that collects the data should only use it for those purposes or purposes for which it is authorized by the interested party.
Therefore, they may not be processed or kept (which is still a type of treatment on a personal data), subsequent to its collection, for other purposes other than those for which the data subject and owner has granted your consent, except for what is known as further purposes (for public interest, or for scientific and historical research, or statistical purposes)