I came across a company in the UK (I was just a consumer) whereby they were handling sensitive information in an insecure way. Who would be the best people to notify about problems with security?
Your first port of call should be to notify the company themselves - they may not realise and it may be a genuine mistake. This would give them the opportunity to rectify the problem, which is the best outcome.
If they have no contact information on their website and they are a limited company, you can try to find their details from Companies House, though it will likely only provide postal address information.
If you still have concerns you could try contacting the Information Commissioner's Office which handles failures to comply with Data Protection legislation.