When retailers indicator a contract with a payment processor, they comply with be topic to fines should they are unsuccessful to take care of PCI DSS compliance. Your organization is service company dependent outside the EU. It offers services to consumers outside the EU. Its consumers can use its services https://www.nathanlabsadvisory.com/infrastructure-security-testing.html