Person A is an employee of company B, which in turn is a customer of a SaaS platform from company C. Both companies are within the EU.
The B company uses the software to keep track of its customers, making the B company the data controller of that data. The C company is then obviously the data processor.
As a user of the software, person A is providing data about herself. Under the GDPR, who is the data controller of that data? Is it her employer, company B, or is it the SaaS provider company C?