Giving out previous clients bank details without permission

In March I cancelled my contract with Nepic, this was just before their move over to Supersonic. They then proceeded, without my consent, to hand over my bank account details to Supersonic for them to debit my account for services that I had already cancelled and won't use as I have moved to New Zealand. I have requested Nepic to explain to me who gave them permission to give my bank details to Supersonic without my consent, but no reply.

I am now battling to get Supersonic to refund my money to me which they didn't have permission to take in the first place. I question the legality of all of this.

Thanks for nothing Nepic