If their website is accessible from the EU then they are subject to GDPR.