GDPR

Hello

At my work, which is a school, we use GoToMeeting. In recent times GDPR have been a serious topic, and I have a task to find out what kind of Information gets gathered. I have some questions and appreciate if anyone has any answers: 

Which basis of treatment is used?

Treatment sites where the information is located? 
For how long is stored information kept? (does it gets deleted eventually?)
Is the treatment covered by preservation provisions according to the Archives Act?

If you know anything else regarding GDPR, let me know.

Thanks.