Ah, then in that case, it's not against the GDPR, but if it was accessible from the EU, then it would be. In a way, this is the sort of thing the GDPR is designed to prevent.