Hopefully, they do. It's pretty weird how they themselves advice not to share the booking reference with other people and are leaking the same to the third-parties.
That was indeed quite ironic. I bet the PR person did not read their own privacy policy before pointing you towards it. Pretty sure they weren't expecting you to read volumes of vague jargon and pick their follies. Well done.