On one hand, its nice that they actually responded, because even that can't be taken for granted nowadays.
On the other hand, they spent more text on telling you they're holding onto your data (and trying to milk you for more) than they did telling you the thing the email was about!!
I'm only surprised that all these other companies aren't sending me messages that they're holding on to my data. That seems like a GDPR violation. Might be okay for companies that only operate inside the UK, but I know a lot of the ones I have applied for aren't like that.
The UK has a domestic law identical to the GDPR (usually referred to as UK GDPR if the distinction is needed). It was implemented before we actually left the EU
If they kept data without telling you, yes. If they just deleted it after rejecting or ignoring your application then I don't think they need to say anything