3rd, A controller or processor not proven while in the EU will likely be matter to the GDPR if it procedures the personal info of data topics in the EU Which processing is connected with the “checking” while in the EU on the “habits” of information topics as their behavior https://bookmarkleader.com/story17670700/cyber-security-services-in-usa