The data controller, in this case the "original" company is responsible for collecting an informed concent to use your data for that specific use unless the use

The data controller, in this case the "original" company is responsible for collecting an informed concent to use your data for that specific use unless the use is a requirement to do business (i.e. invoicing, not advertising). It does not carry over to another company by shifting this to the processor. The intermediary is just a data processor, and while they also have to follow gdpr it's the data controller who is responsible that the intermediary actually follows the laws. As far as I can tell facebook will just tell you who is uploading your data but then you can pursue them if you do not believe they have your concent to do so.