3rd, A controller or processor not set up while in the EU will likely be subject matter for the GDPR if it procedures the personal facts of knowledge subjects while in the EU and that processing is related to the “monitoring” inside the EU of your “behavior” of data subjects https://wavesocialmedia.com/story3150624/cyber-security-consulting-in-usa