A private company has establishments in France, Poland, the United Kingdom and, most prominently, Germany,...

 According to the GDPR, the lead supervisory authority (LSA) is the one located in the EU member state where the controller or processor has its main establishment or single establishment. The main establishment is the place where the decisions on the purposes and means of the processing of personal data are taken. In this case, the SaaS service was defined and implemented by the Polish establishment, so the decisions on the processing of personal data for this service are taken in Poland. Therefore, the LSA for the SaaS service is the supervisory authority of the Republic of Poland.

References:

GDPR Article 4(16): Definition of main establishment

GDPR Article 56: Competence of the lead supervisory authority

GDPR Recital 36: Determination of the main establishment

IAPP CIPP/E Study Guide, Chapter 5, Section 5.1: Lead Supervisory Authority