I would say in your web method. The web service should be the interface for calling the service layer. It should transform the incoming request into something the service layer understands and should transform the result into something the web service can send.
The service is, in general, a reusable part of your application and could be reused between your web service and web application (with controllers) or maybe by doing batch inserts. Basically everything calling the service (which contains the business logic) is a interfacing layer to your service.
Controllers provide access to the application behavior that you typically define through a service interface. Controllers interpret user input and transform it into a model that is represented to the user by the view. Spring implements a controller in a very abstract way, which enables you to create a wide variety of controllers. Reference Guide
For me this goes for every part of the application that interfaces with the service layer. It basically transforms from/to something the service layer understands. Here is a blog linking to some interesting information (on a broader architectural level).
Links: