3rd, a controller or processor not founded in the EU will likely be subject matter to your GDPR if it procedures the personal information of data subjects within the EU and that processing is associated with the “monitoring” in the EU on the “actions” of data subjects as their habits https://thesocialdelight.com/story3065320/cyber-security-consulting-in-saudi-arabia