I would contact your bank and ask them about this. Banks (as quiltsRfun stated) have to provide you with disclosures regarding non-public personal information (NPI) and disclosure to a third party and provide you with Opt-Out information. NPI is considered to be any data or information considered to be personal and not subject to public availabilty, which an email address would be. I would also contact the bakery and ask them how they got your address; it may be that your card/email are conected through some type of rewards program at another retailer. I work for a bank in the compliance department and I would be making calls to both to get an answer.