POPI Act not followed

My ID is ***. I received a message from VVM (ref ***) on my given cellphone number. Which is expected. What is not expected is for my boss to receive the same message on her PRIVATE (not company) cellphone. I have never given VVM her contact information. Please advise which of my contact details you have? ***