Pretty concerning. Even if a service is EU-based, a foreign acquisition can expose sensitive data to other jurisdictions.

Or even if they have any operations outside the EU, as the recent case where a Canadian court requested data from OVH showed.