Typically the CCO, the 'Chief Compliance Officer' of the company, and if that doesn't work escalate to the local data protection authority or equivalent.
Note that quite often privacy policies get 'lost' in website updates so usually companies will be quite happy if you point this out to them.