I mean, fuck, you first emailed on 17 Feb 2018, and didn't get any response, haven't had any since. The sane and correct thing to do under GDPR would be do remove that data if you cannot prove you have meaningful consent to be holding it