According to gdpr it is not allowed to use people's data for purposes other than the ones they agreed to.
I had an e-mail discussion with them and I filed a complaint with my countries gdpr enforcement agency.
They take a while to investigate and react, but hopefully if enough people complain they will take it seriously.