[TomK32]

Simple advise: If ever anyone asks: Be active and responsive.

But remember: The GDPR protects people's data. Companies aren't people (at least in the EU).