I feel like this is an important thread to pull on and see what comes from it.

From my understanding GDPR would apply if you directly target EU citizens; even if your "service" is not based here.
(and by here I mean EU as I am in UK, which if/when Brexit happens businesses/services will still need to comply with GDPR as I understand it or actively not trade with EU