I had a similar experience with a company called RateSetter. - They email me some marketing - I respond with DSAR - They acknowledge receipt of DSAR - 6 mon

I had a similar experience with a company called RateSetter. - They email me some marketing - I respond with DSAR - They acknowledge receipt of DSAR - 6 months pass - I bump the email thread - They respond saying they have deleted my data as per my request (I requested access, not deletion) - I point this out - They apologise and offer £100 to drop the complaint - I refuse and complain to ICO - Obviously nothing happens GDPR is toothless.