As you know your personal details are subject to data protection and GDPR, as information there clearly personally identify you.
However, you must also be aware that as a contractor or supplier to you, they have the right to use your personal details in the delivery of those arrangements. ie. If the dog walker collects the dog from your home, then they must have your home address, in some sort of filing system. It’s expected that your contractor should advise you that your personal details will be retained and used for the delivery of said service. You would have to inspect their original paperwork with you to see where that is or isn’t mentioned. If not, and not mentioned subsequently, then that’s the measure of your complaint which holds water at this stage. Also it’s likely that because there’s a financial transaction somewhere along the line, the details of customers forms part of the 7 year rule for financial transactions under HMRC.
In terms of which app, how secure, that it’s old unmaintained data, it’s impossible to quantify at this stage. Which app? What measures are in place around it? The fact it’s been forgotton about isn’t really of much consequence, as your data is accurate and you have suffered no loss or injury. You’d be surprised just how many companies forget how much data they are holding and barely maintain it, or do so badly. But i suspect that your dog walker isn’t being particularly negligent.
I’ve tried to be fair with you and explain in fairly basic terms, and you may have a point which is the original paperwork should have explained their right to process. However at the end of the day if we are talking about a very small dog walking business, rather than a multi national, so clearly they may not have access to the same level of expertise and focus on delivery and accounts, rather than the basics and nuances of GDPR.
That doesn’t exscuse them, but i would ask, what loss have you suffered?
If nothing, and they have disclosed they are keeping the data to you in an app, thus giving you the opportunity to discuss and request deletion, i fail to really see why you are upset and have started bandying GDPR legislation around with your nose out of joint.
Fron what i’ve seen from your posts - you don’t actually understand GDPR (you aren’t alone in this - i know a lot of tech people who don’t - and i doubt myself as a dabbler rather than an expert).
So is it just a fear of your data being stolen?
If so, ask for deletion. You can also ask how they are storing your information now…. Chances are that it’s on invoices, seen by 3rd parties, open to theft there too and there’s legal requirements on how long that’s kept too and thus they won’t be able to delete.
Ultinately if you are dealing with a very small organisation you won’t get multi national expertise. But there’s costs associated with that’s. So choice is upto you.