Which of the following would MOST likely trigger the extraterritorial effect of the GDPR, as specified by Article 3?