Data Privacy on the GRAJ protocol. One fee. 195 countries. Join the protocol.
The moment you sell to a consumer you are processing personal data, and the rules follow the person rather than your address. A brand in one country selling to a customer in another is subject to the customer's law, which is the part that surprises people.
The details differ by jurisdiction; the shape does not. Collect what you need, say what you are doing with it, keep it safe, and let people see and delete it.
Moving personal data out of the EU or the UK needs a specific legal mechanism. Using a US-hosted tool for European customer data is a transfer, whether or not it feels like one.
Business contacts are still people. A buyer's name, work email and phone number are personal data in most regimes, and a marketing list built without a basis is the most common enforcement case.
Know what you hold and why, do not collect what you will not use, and be able to find everything about one person when they ask. Most of the cost of compliance is retrofitting it onto data you never mapped.