I was thinking the same but maybe if they're UK based they can't legally guarantee a certain level of data protection. Customer trust could be eroded even if you tell them you'll follow the GDPR standards.