On the 5th of December I received a parcel from John Lewis containing another persons invoice, they had a near identical order to mine. I can only presume that they have had my invoice with my name and address. I raised this issue along with a complaint about missing items and damaged packaging with John Lewis on the 5th of December. They have credited my account with £5 allowance for the damaged goods and said they would forward my concerns to the Data Protection department. I have not heard anything back regarding the GDPR issue and have since emailed them again 2 days ago to request some clarification. What are my rights?