[rovek]

I had a similar experience with a company called RateSetter.

- They email me some marketing

- I respond with DSAR

- They acknowledge receipt of DSAR

- 6 months pass

- I bump the email thread

- They respond saying they have deleted my data as per my request (I requested access, not deletion)

- I point this out

- They apologise and offer £100 to drop the complaint

- I refuse and complain to ICO

- Obviously nothing happens

GDPR is toothless.