Okay, I had another look. I think I have found out. It is really [deliberately?] not sign-posted at all.
It is Mobile Usage -> Detail -> Active Package(s) -> Then each package has lots of info but also a dustbin symbol.
I assume by clicking the dustbin symbol, i.e. delete, it would bin the package and hopefully stop the auto-renew which is the goal.
However as this cycle has 29 days to run, I will not click it now. I have made a note in my diary to end the package just before it renews.