Hmmm...
(g) send you marketing communications relating to our business (or the businesses of carefully-selected third parties) which we think may be of interest to you, by post or, where you have specifically agreed to this, by email or similar technology (you can inform us at any time if you no longer require marketing communications);
That technically says that post is non-negotiable, and only email (or similar) is opt-in. That sounds like it's against the GDPR.
(h) provide third parties with statistical information about our users (but those third parties will not be able to identify any individual user from that information);
That's got to be opt-in too, as it's not strictly necessary for the provision of the service.
6.2 Information that we collect may be transferred to the following countries which do not have data protection laws equivalent to those in force in the European Economic Area: The United States of America, Russia, Japan, China and India.
Is that really legal? I thought EU businesses had to respect EU data protection laws.
Did you get the Ts&Cs checked for GDPR compliance?