This company sounds like it is working (or at least did work, hard to say how long ago it was, pre-GDPR, so a while) in a really unethical manner. If we want the market and freedom-of-association to fix this sort of problem we need to learn who to avoid, right?