You can try a couple of things:
- First, ask them for a copy of your data (to check what sort of data they actually have “on you”). According to the GDPR they should provide you with information about the source of this data, the legal ground on which they are processing it and the purpose of such processing.
- If you are not convinced (you still believe that what they do is illegal or you simply do not like it), you can request that your data be deleted. But keep in mind that if there was any contract between you and this company in the past, they may be under legal obligation to keep your data for certain period of time.
- Finally, if you think that what they did with your data was illegal, you can file a complaint with your DPA.