That depends. It probably is, to some extent, but you either consented to this or it qualifies as essential to deliver the service. I suspect you could get it from the vendor by sending them a strongly worded letter, but a DSAR (data subject access request) isn't exactly an API call. GDPR cares about how your data is being collected and processed, not about interoperability. We need separate regulation to force service interoperability and a separation between hardware and services, so that they can be interchangeable.