Am I a processor or a controller?

Whoever determines the purpose is the controller

The role follows from the question of who decides why and how data is processed, not from who actually enters or stores the data. A business that itself determines which customer data it collects, for what purpose, and how long it retains it, is the controller of that data. A party that processes that same data solely on behalf of another — following instructions from another, without adding its own purpose — is a processor. A bookkeeping package that processes invoices according to the user's settings is typically a processor; the business that uses the package and determines which customer data goes into it is the controller.

In practice, one business is often both at the same time, depending on which data flow you look at. A payroll administration office is a processor for the personnel data it processes on behalf of its clients, and at the same time is a controller for the data of its own employees. The role is therefore tied to the specific processing, not to the type of organization or the sector in which it operates. That distinction then determines which obligations apply: a controller bears primary responsibility for lawfulness and accountability, a processor operates within the boundaries of a data processing agreement and the instructions in it.

Where that is in Article 4 and 28 GDPR

Article 4 of the GDPR provides the definitions of both roles: the controller is whoever determines the purpose and means of processing, the processor is whoever processes personal data on behalf of the controller. Article 28 of the GDPR builds on this and describes what is specifically expected of a processor, including working under a data processing agreement. The guidelines of the EDPB develop this distinction further with practical examples, precisely because the dividing line in practice is not always immediately clear.