I have a free. They even asked me for the transaction details to make a refund and I sent it to them and they still charged me again, hahaha. In the worst case I will have to change the card, I think, ugg.
so if i visiting xy.com and they trigger a cloudfalre challenge before showing me the data privacy rules and allow me to opt out they are violating the GDPR
the hoster of the website is allwoed to store the ip adress if: - the owner of the site has a "avv" (dont find the english term, data protection agreement)