Ah, yeah you're right, I got jumbled.

The GDPR applies to:

1. a company or entity which processes personal data as part of the activities of one of its branches established in the EU, regardless of where the data is processed; or

2. a company established outside the EU and is offering goods/services (paid or for free) or is monitoring the behaviour of individuals in the EU.

Yup! Something needs to be in the EU for the law to apply. It (sadly, imo) doesn't apply to EU citizens resident in, say, Texas.