According to guidance from the European Data Protection Board, in which of the following cases would a controller established outside of the EU not be subject t...