Also, anyone can figure out if you’re using Proton by the email address or DNS on the domain name.

SimpleLogin/ProtonPass also let’s you reply to any email from your alias, but you need to set up a reverse alias if you aren’t replying.

You can login to the SimpleLogin.io interface and setup reverse aliases even if you create them in proton pass. They don’t have the integration fully down yet so it’s clunky but it works.

Agreed it’s not acceptable. Unfortunately I don’t think GDPR is taken seriously enough. Hopefully at some point the consequences will get better

It seems plausible to me that their GDPR process probably missed some email communication system where the name and email was stored, like a hubspot or something custom. Most places I’ve seen have a ton of systems with name and email in it, and GDPR processes aren’t maintained well across all of the teams using that data.

Not saying it’s right, just saying it’s possible an account was mostly deleted and the remnants remain in some other tool, and the person you spoke with only knows about their main systems.