If they have a data protection officer then send him an email. Else if you're in the EU get the Data Protection Authority (DPA) of your country in the loop.