You can file a complaint with any EU supervisory authority, even if you’re not personally an EU citizen, as long as the company you’re complaining about does operate specifically and targeted in the EU. It is better if you are a citizen though. But as long as they’re mishandling EU citizens data, doesn’t matter who tells the authorities.

For companies, GDPR applies to people in European Economic Area whose data is used by companies, or companies that have an office in EEA or another stable arrangement in EEA and process personal data of people located anywhere.