Other marketing activities.
Resale to third parties.
You at any point requested to be added to their mailing list and that's linked to purchase history.
Web analytics linked to purchase history.
Corporate policy is not to delete data.
Laziness.
So there's seven reasons of various legitimacy off the top of my head.
especially are great examples of why the GDPR was created, even once we ignore the advertising industry.
Other marketing activities.
Resale to third parties.
You at any point requested to be added to their mailing list and that's linked to purchase history.
Web analytics linked to purchase history.
Corporate policy is not to delete data.
Laziness.
So there's seven reasons of various legitimacy off the top of my head.