According to gdpr it is not allowed to use people’s data for purposes other than the ones they agreed to. I had an e-mail discussion with them and I filed a complaint with my countries gdpr enforcement agency. They take a while to investigate and react, but hopefully if enough people complain they will take it seriously.