LENDPLUS AND BLDS POPI act ****mers

I was just contacted by this company via WHATSAPP offering me a loan. Upon enquiry where they got my details, I was told from BLDS. I informed them that they have no right to contact me as it is an infringement of the POPI act - they blocked me. Who gives companies the right to sell your information without any consent?