I would guess that this change will be rolled back in the UK as soon as it becomes legal.
[0]https://www.gov.uk/government/news/new-data-laws-to-boost-br...
[1]https://theconversation.com/why-uk-approach-to-replacing-the...
For that reason, GDPR will always draw some ire from me.
The most recent examples of individuals being fined have been fines around €200 [0]
[0] https://gdprhub.eu/index.php?title=ANSPDCP_(Romania)_-_Fine_...
The missing download and export function seems like an obvious and very annoying omission.
Hopefully it can be added in the future.
Then that would be a legitimate interest, and you could store that information for a period of time that is reasonable for processing refund requests.
But you would be barred from using that same information for a different purpose, e.g. the loyalty program.
GDPR article 25 requires systems to be have privacy built in, so a system such as the one you describe where a separation of these concerns is impossible, would probably itself be in violation of the regulation.