I don’t even use @CRED_club , but when I’m making online payments at merchants I get a CRED SMS &amp; WhatsApp knowing how much I spent and offers some cashback 

How is this legal ? What kind of data privacy does this follow ?