Dan Europe has a flow as discussed in the article and both the foundation and the regulated insurance branch is registered in Malta.

EU GDPR has very little enforcement. So while the regulation in theory prevents that, in practice you can just ignore it. If you're lucky a token fine comes up years down the line.