I'm not sure about the legality. Pretty sure that GDPR says you have to inform people before you process (store, transmit, etc.) their personal data (like IP+timestamp), but in practice it's often afterwards or not at all. The speed camera doesn't have to tell you what data will be collected and what your rights are before giving you a ticket and the trajectcontrole doesn't tell you anything at all (if you didn't drive too fast) despite processing your license plate.

I'm not sure why that is legal, so then perhaps collecting this without a legal basis (consent, fulfillment of a contract, vital interest of the data subject, etc.) is also legal, but that doesn't exempt the site from the right to view your data or the right to object to having your data processed if there is no grounds for it.

Of course, there are no repercussions if the domain is registered and hosted in a country that doesn't tell the EU who's behind it or doesn't do extradition and there are no European assets to cease. Worst they can do then is block the site from Europe like they did with The Pirate Bay and similar sites.