Yep! It’s about where the data is processed rather than where the user is. So because Recon is UK-based, and processes data in the UK and EEA, they have to comply with GDPR.
This also means you can do a “subject access request” for the data they hold on you.
legal.t101.com/privacy/your...