Presumably, given that you also operate in the EU, you would have asked for their explicit consent before you did, so you could just check for that?