They are totally shit, and I don't trust the safety of my data with them either.
I had an issue where they kept sending me emails with 2 different advantage card numbers on them, but when I tried to sort it out with them, they said they had no record of an account for me.
I sent them a photo of my card (which doesn't match the card number on the account anyway), every address I have ever lived at since I was 4 years old, my email, my telephone number, my full name which hasn't ever changed, my DOB etc.
We went round in circles for days - first they said they'd located my account but the address didn't match. Then they said they'd located it but the full name, DOB and address, and email didn't match what I'd given them (despite the fact my full name is actually printed on the card and I'd sent a screenshot of my Boots account which the card is linked to!)
They also couldn't explain how I received emails and offers through the post if all of my details were wrong.
I wrote to their DPO and asked what data they had on me, but they wouldn't tell me because as far as they are concerned, I don't have an Advantage Card. they refused to understand that they have clearly made an error with my data, and basically told me to bugger off!
Phew, sorry, that was long and completely unrelated to the original OP.