Ask HN: GDPR for CMS SaaS app?

Let's say you have a SaaS where your customers can create mini-websites which have sign up pages, members area, etc.

MY question, what is the SaaS for the data of those users who sign up on the customers' "mini-portals"?

Is it a processor or a controller? The SaaS customer can customize pages, send emails etc...so it looks like the controller is the customer and the SaaS is just the processor, but after talking with some lawyers I'm not so sure about that.

What do you think?