The question is - what legal basis are they processing information with third parties?
Then, if they use LI then please provide the written anaylsis that justifies LI. Once done how does a data subject object to processing or withdrawing consent?
Posted elsewhere what you should do under article 15