​​​​​​​Disclaimers: I am not a lawyer, this is not legal advice. Also, I work in digital privacy at a large tech company, let that color your biases as it may

GDPR breach: assuming you're a UK citizen, the UK-GDPR (not the European regulation) is what would grant you rights in this case. The rights of data subjects here are substantially similar to the EU version though, but your regulator is the Information Commissioner's Office (ICO). I believe it would be a relatively easy argument to make to the company that finding out how they obtained your data is aligned with the key right to be informed. If you want to follow up this process, you may want to talk to staff at the ICO. There are also many handy form letters out there on the internet that you could send to the legal contact address for the firm you're receiving solicitations from. You may also want to request that the firm delete your information; if they refuse, that's another piece of evidence you could take to the ICO.

Phones listening to you: this isn't the case, at least in the passive "I talked about flight delays therefore I'm being advertised to" sense. Ad targeting and predictive analytics are simply good enough that the digital trail you leave gives the impression that "they could only figure that out if they were listening to me" - but it's just your data trail. Whether this is a good state of affairs is a debate that I'll leave for another time and forum.

Credit cards and taxis: oftentimes this happens through a payment processor, not a CC company. For example, the Square credit card reader and point-of-sale solution will link your CC # to your email or phone number (if you request a digital receipt on the tablet) unless you opt out at the time of linking. So, if you pay for a coffee at a cafe using Square, request an email receipt, then later use the same card in a taxi that uses Square, you'll likely receive an email.