Theft of Personal Information by Vodacom

I received a call from a consultant from ********** and she stated that they are affiliated to Vodacom, REWARDSCO South Africa which is based in Umhlanga Ridge, KZN, regarding Vodacom Rewards. She had all my personal information, ID, Address, Vodacom Contract, etc. If this company is NOT part of Vodacom, HOW is it possible for these people to have all my personal information as I never heard of them NOR did I ever had contact with them??? They even send me a SMS . My only conclusion is that Vodacom leaked/sold my personal information to 3rd parties which is TOTALLY against the POPI Act!! This is not what one expect from a so called Blue Chip Company! If I'm going to suffer any financial losses, I will hold Vodacom responsible for it.