Depends on how its structured, but if the SaaS is purely a B2B service for specific things likely not. The data controller is still X, they merely use Z as a da

Depends on how its structured, but if the SaaS is purely a B2B service for specific things likely not. The data controller is still X, they merely use Z as a data processor for their operations, and as such X has the obligation towards you to answer access requests. Whereas if its a LinkedIn-type thing of "create profile on our site, apply to many companies through it", it likely would look different.