That sounds like a clear GDPR violation, but I guess you are not in the EU?