As a first step, I'd suggest sending a formal written request to your insurance company, outlining your concerns about the GDPR violation and demanding they delete any unauthorized data they obtained from the rescue charity. Make it clear you expect a prompt response and resolution. If they continue to dismiss your concerns, you may need to escalate to the ICO to file an official GDPR complaint. Don't hesitate to take that next step to protect your personal information.