[RobAley]

Yes, but they're only allowed to use the data for the (legitimate) purpose it was retained. If you ask them not to retain/use it for marketing purposes, they can still retain it for statutory purposes but they can then only use it for that (not for sending you advertising emails etc.)

[dgroshev]

You are right, I misread the gp, my bad.