I really hope OP also contacted their relevant national privacy authority, this is a giant violation