GDPR likely does not define maximum retention periods. The purpose relates to the legal basis required for lawful processing — for example, processing is necessary for the performance of a contract.
Purposes may cease to exist over time, which does not necessarily mean that personal data must be deleted. Deletion occurs only when the controller no longer has any legal basis for processing that data.