Atlantis,
Afaik there's nothing wrong here from the legal point of view.
Under GDPR, hourglass is responsible for keeping the data stored with them safe without sharing it with other parties, but it's the congregations that collect the data and have it stored at their behalf. So the congregations are responsible for maintaining, deleting, etc.
As long as the congregations properly inform their victims where their data is stored, how, and why, gdpr is followed.
Compare this with web server providers: the providers are responsible for keeping any data stored with them safe, but they are not expected (or even allowed) to honor data removal requests for any of the websites their customers are running on their servers.
Or email: you can't ask microsoft to remove any data from my email box that I may have collected on you. You have to ask me.
From a JW POV this site is highly questionable of course.