Their own privacy policy acknowledges their obligations under the GDPR.