They have to provide the data on request. I also think they aren’t allowed to delete any data they have when you request it before providing it (although you can of course also request deletion).

https://gdpr-info.eu/art-15-gdpr/