This is likely to be done within the scope clearly stated in HF’s privacy policy. There is also a dedicated contact address.
Well, personally, I think that as long as data is exchanged online, there are potential risks, regardless of whether there is a strict contract or not.