Under GDPR they'll still have to comply. If they have a data protection officer then send him an email. Else if you're in the EU get the Data Protection Author

Under GDPR they'll still have to comply. If they have a data protection officer then send him an email. Else if you're in the EU get the Data Protection Authority (DPA) of your country in the loop.