Comment by martin8412

Your contract is irrelevant. If you process data of EU subjects, then you're bound by the rules of GDPR regardless of what your contract contains. You can't sign away your rights in the EU, so I can lie and say that I'm in the US, and that's entirely your problem.