Using the EU office of a US corporation and assuming they will actually act in your best interest without them having been forced to in the past (and even then.

Using the EU office of a US corporation and assuming they will actually act in your best interest without them having been forced to in the past (and even then...) is very unwise, as multiple examples have already show us in the past. Please just use an EU lab (they exist, and they already removed your data before the GDPR if you asked) and accept that it's maybe a hundred euros more expensive. At least you can be a lot more certain you will not be invasively data mined later on.