My understanding is that GDPR primarily cares about location, not citizenship or residence. There are some subtleties around which location is the relevant one, for example when the delivery address is in a different country from the country the subject is in when they send the order.

> 3.2 This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union,...

(Plus companies in the EU have to comply with GDPR for all subjects)