""" “The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay” if one of a number of conditions applies. “Undue delay” is considered to be about a month.
"""
The only issue here is HelloFresh not properly telling its customers how long it takes for them to actually delete the data.
For accounting/tax purposes, you need data up to typically 7-ish years ago, but isn’t that data typically online nowadays so that it will end up in today’s backup?
Even if they still have the bits from an old backup, they should have thrown away its encryption key.
If you're keeping data for years, it's an archive and not a backup.