Businessman Bob was "shocked" to receive a promotional email from a restaurant he recently dined at in Brussels. When calling to complain that his personal data was processed without his permission, he was told that he surely provided consent to such processing, as he left his business card in a bowl marked "stay in touch with us." With specific reference to the GDPR, was Bob's personal information processed legitimately?