>Any EU citizen in our out of country has their PII protected by EU law

If GDPR applies, it applies not only to citizens, but also to residents at the time of the transaction.