Under the GDPR, consent is not the only legal basis that allows processing of your personal data. Other legal bases such as legitimate interest exist as well. So the question is: does the company have a legitimate interest to send you these emails?
The answer is that this case is more about direct marketing, less about personal data. The circumstances under which direct marketing emails can be sent are covered by the ePrivacy directive, which is implemented in the UK via PECR (Privacy and Electronic Communications (EC Directive) Regulations 2003).
PECR and ePrivacy introduce a concept known as soft opt-in:
where a natural or legal person obtains from its customers their electronic contact details for electronic mail, in the context of the sale of a product or a service, in accordance with Directive 95/46/EC, the same natural or legal person may use these electronic contact details for direct marketing of its own similar products or services provided that customers clearly and distinctly are given the opportunity to object, free of charge and in an easy manner, to such use of electronic contact details when they are collected and on the occasion of each message in case the customer has not initially refused such use.
(ePrivacy Directive, Art 13(2))
In plain language, they are allowed to send unsolicited marketing emails to existing customers, under the following restrictions:
- this only applies to customer relationships
- the marketing must be for similar products or services
- you must be able to object to further messages, i.e. unsubscribe
- upon collection of contact details you were given the opportunity to opt out