[iamtew]

You don't have to be a customer for GDPR to apply to you, they just have to collect PII from you to be considered the data subject and now the organization need to follow GDPR.

If you collect data from me when I visit your website, even without me buying anything, you have now collected data and you need to comply.

The use of the word "customer" in this context is incorrect.