But for that it does not matter that much where the servers are located, more where the company controlling them is located.

There are quite a few factors that matter. The place where data processing and storage takes place is one of them.

It matters who can physically take control of the servers. It matters where the encryption keys are stored. The storage and processing location also matters for compliance with data residency laws.

But it's not the only thing I mentioned. Having physical offices and staff in a jurisdiction usually goes along with setting up some sort of legal and taxable entity that has personally responsible directors.

The whole issue is very complicated.