Companies should insist that you backup your data and recover your PC before sending it into the hands of strangers...
On the other hand, some companies say, it's your personal data, you look after it.
Most repair companies will say their only concern is for the PC, not your data... You don't have to agree, verbally or otherwise for a company to replace certain parts.
You agreed by sending the PC in that they could do basically anything they wanted with it.
The company should destroy your hard drive under data protection, though, on the otherhand, as you have asked for the original HDD back, they should send it to you, if they still have it in one piece.