Under GDPR an EU citizen has right to request the details of how their personal data is collected and processed. This and, for example, checking the traffic wit

Under GDPR an EU citizen has right to request the details of how their personal data is collected and processed. This and, for example, checking the traffic with your data (eg IP address of sender of an email from CRM) would be enough.