Ceteris paribus, not having the data is strictly, mathematically more private and secure than having the data but being contractually obliged not to distribute it around. Contracts change, laws change, accidental leaks and targeted attacks happen, there's FISA, and there's a non-zero probability that Cloudflare suddenly decides that half of Europe is Nazis and don't deserve their contractual protections anymore (I'm sorry, but Cloudflare walked into that one themselves).

It's as simple as this. Now I do prefer a society of trust over excessive technological means, but let's not pretend like sending data to an additional third party is somehow more or even just as private as not sending it in the first place.