1. See what data they hold.
2. Have it deleted.
3. Formally withdraw consent to the collection of future data.
4. Follow it up in 6-12 months with a subject access request.