the processing of the personal data of data subjects that are from the EU, by a controller or processor not set up while in the EU, where the processing relates to the supplying of products or products and services (regardless of whether free or compensated for), or even the checking of conduct whic