If they have a way to recover the data... they may not want to do admit they do... or put in the effort for individual users. Surely database backups exist and data is not completely lost for 6 months or whatever their backup strategy is to keep backups... GDPR or not.