Of course they have that data - you have chosen to send it to their website. It would be physically impossible for that website to run if the data could not be read. Obviously, it's preferable if only 'the right people' can read it, but it's much safer to assume that isn't the case.

If you're concerned about the outbound link issue, disable javascript. A cursory look at the page source should convince you that that's the only way they can track outbound clicks.