The vast, vast majority of spam that I get is from otherwise perfectly reasonable companies who don't understand the law.
To that end, my steps are:
1. Try their unsubscribe, give them a few days for it to "take effect" (which is nonsense, but, so it goes)
2. Send a polite, but direct email to `postmaster@`, and usually cc `webmaster@` - it usually goes to somebody.
3. If none of the above works, pull the full email headers and `dig` around some to find their MX provider, and file a claim with `abuse@` on the provider.
That being said, again usually it's an ignorance problem. I have a friend who helps run a company that does escape rooms, and I had only provided my email on a release form. However a few months later, I started getting marketing spam from them to that email - oops. A lot of small companies don't understand the regs around marketing emails and treat them the same as all other emails.