I requested the DPO of a company to delete all my data under GDPR.
After a step of "account ownership" verification, it replied that:
XXXX has deleted all of your personal data except where we are required by law to keep the data or have a legitimate interest in maintaining such data.`
Can I ask them to specify exactly which data they have deleted and which one they have retained?
Moreover, for the data that they retained, can I ask them to specify why they retained it? To provide a reason?