Did you correct them or do you wait until they get a warning letter from some shady law firm for violating GDPR?
This is beyond my paycheck and responsibility to be honest.