More than that -- the person must be in the EEA and the company must either (1) be in the EEA, or (2) be targeting the EEA. Targeting: say you are sitting in P

More than that -- the person must be in the EEA and the company must either (1) be in the EEA, or (2) be targeting the EEA. Targeting: say you are sitting in Paris and buy from a book store in the US. If that book store does not have a site in French, show prices in euros, or advertise in the EU; the fact that it is willing to, on a limited basis, ship to France almost certainly means it is not subject to GDPR. Even the fact of offering prices in Euros is the subject of an active court case as to whether that counts as targeting.