My understanding is that GDPR primarily cares about location, not citizenship or residence. There are some subtleties around which location is the relevant one, for example when the delivery address is in a different country from the country the subject is in when they send the order.

> 3.2 This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union,...

(Plus companies in the EU have to comply with GDPR for all subjects)

I believe GDPR applies to EU residents. I believe the complication is that it also applies if they are travelling outside of the EU, but not if they become resident outside of the EU.

Not only residents (in the sense of having a permanent home in the EU):

https://eur-lex.europa.eu/legal-content/EN/TXT/?qid=15288746...

For example, it also applies to people which are traveling and are currently located in EU territory (provided that a service is intended to be used by EU residents).