In regards to the GDPR, you can allow your users to download all their data from the profile page / widget on the front-end of your site.
You can track the clicks in your emails with AcyMailing, and/or Google analytics.
You can also choose if AcyMailing should also collect data on clicks for links not leading to your own website or only internal ones.
Example of an external link: https://www.google.com
This parameter allows you to manage the user that you store by deleting it after a period of your choice. By default, this parameter is disabled in AcyMailing so you won't have any data deleted by mistake. This deletion is made every day on the cron job.
Note that if you delete these data you won't be able to access them in any way.