Since you are causing Meetup to process personal data about attendees about your event, you and Meetup are likely joint data controllers for some of the occurring processing. This is not a particularly enviable position since you have no control over how Meetup subsequently uses the data. Thus, I believe that the only GDPR-compliant way of using Meetup is if the use of Meetup is entirely voluntary for all involved people, in particular if all relevant communication is also possible via some other mechanism. For example, it might be sensible if a prospective participant can also ask for sandwiches via a (publicly available) email address.
The GDPR applies regardless of whether you have any economic interest in this activity. It applies to any processing/storage/collection of personal data, with some exceptions such as police work or purely personal/household purposes. So even meetups and social clubs that aren't just a group of friends do have to comply. In practice this isn't enforced very heavily, but there is some liability involved when acting as an organizer. If you are running this meetup as part of a business (regardless of a profit motive) there might be some more attention to proper compliance.
Whether taking pictures is OK depends a lot on the local laws in your jurisdiction. From the GDPR perspective, you'd need a legal basis for taking pictures. This could be a legitimate interest that you have, but you'd have to balance your interest against theirs, notify people and enable them to opt out. Other aspects such as personality rights are vastly more important, especially if you would like to publish the pictures, e.g. to social media. In practice, you usually cannot use pictures without consent of the people in the foreground.