Hi all. Posting in AIBU for traffic. I am really concerned, I emailed Very (Shop Direct) for a subject access request. Im currently going through the Ombudsman re a complaint with Very anyway, and wanted all information they hold on me. For context, my Very account was closed in 2019. The SAR response includes a copy of my October bank statement. This is a personal bank account and I have no idea how they have accessed my bank statement. I believe this is a huge GDPR breach, what right do Very have to access my own bank account? Am i being unreasonable or is this something they are able to do??