It should be designed in such a way that even if it is breaking gdpr rules, they can't be enforced. Permanent record shouldn't be an issue however. There is a forum that won't delete users nor their posts, for the sake of being a public record. They are 20 years old and operate as a business within the EU and supposedly within the GDPR rules.