privacy@[website] is probably an even better route, since I’ve seen it commonly used for the actual data privacy officer / department / etc.