If the customer is a company (Ltd., etc.), I may retain their data. GDPR does not apply to legal entities.
If the customer is a natural person and I have issued an invoice to that person, I am obligated to process their data in accordance with defined purposes (if no such purpose exists, I am obligated to ensure the deletion or anonymization of that data).