What should you do with personal data that has already fulfilled its purpose?
As already mentioned (verlinken), you are obligated to indicate in your privacy policy the purpose for which you are collecting and processing data. As soon as the indicated purpose has been achieved, you must delete the data, provided longer storage periods are not prescribed by law. However, you can continue to use the data if you have anonymized it. Pseudonymization is sufficient if no key for encoding the data is available and it is thus not possible to identify the original data subjects. In addition, such continued use in view of the originally indicated purpose is normally deemed to be compatible since it is not considered to be unexpected, unsuitable, or objectionable. If you process data in an anonymized and pseudonymized form, we recommend mentioning this in your privacy policy.
Make absolutely sure that with regard to deletion, pseudonymization, or anonymization that a process is defined and then also complied with.