That's because Odido violates the GDPR by retaining data of ex-customers. The hack also included data from people who stopped using their services several years ago.