Redirect 301 /privacy-statement https://example.com/privacy/
You should avoid using a mod_alias Redirect directive when you are already using mod_rewrite for other redirects. mod_alias runs after mod_rewrite, regardless of the apparent order of the directives in your .htaccess file, so it's possible to get unexpected conflicts. This should be converted to a mod_rewrite (RewriteRule) redirect instead:
RewriteRule ^privacy-statement$ /privacy/ [R=302,L]
Note that this redirects the specific URL /privacy-statement, nothing more (which is what I assume you require). The Redirect directive is prefix-matching so it potentially matches a lot more (but you have a slash mismatch on the source vs target URL, so this could have potentially broken something).
I assume you are redirecting from/to the same domain here, so I've not included the domain in the substitution.
Note also, that I've used a 302 (temporary) redirect here. It is a good idea to test with 302s, before changing to 301 (permanent) - if that is the intention - only once you have confirmed that everything works OK. 301s are cached persistently by the browser so can make testing problematic.
# Make sure these pages and their children aren't redirected
RewriteEngine on
RewriteCond %{REQUEST_URI}!^/about-us/(.*)
RewriteCond %{REQUEST_URI}!^/contact/
# Redirect the rest to the new subdomain
RewriteRule (.*) https://shop.example.com/$1 [R=301,L]
This looks mostly OK, however, you are missing spaces between the TestString and the CondPattern in both the RewriteCond directives - so this will fail.
The (.*) on the end of the CondPattern is superflous. Both regex match /about-us/<anything> and /contact/<anything> (or rather, "don't match", since the regex is negated).
You only need the RewriteEngine directive once in the file. It can actually go anywhere, even at the very end, although it is logical to include it at the top, before any mod_rewrite directives. (The WordPress front-controller - which you should not edit - already contains the RewriteEngine On directive, so you don't need to repeat it. But there is no harm if you do.)
And these redirects need to go before any WordPress front-controller that might follow.
In summary:
RewriteEngine on
# Redirect this one page to a new url
RewriteRule ^privacy-statement$ /privacy/ [R=302,L]
# Make sure these pages and their children aren't redirected
RewriteCond %{REQUEST_URI} !^/about-us/
RewriteCond %{REQUEST_URI} !^/contact/
# Redirect the rest to the new subdomain
RewriteRule (.*) https://shop.example.com/$1 [R=302,L]
Again, test with 302s.
I'm assuming that your main domain and the subdomain point to different areas on your filesystem (or even different filesystems), otherwise you'll need an additional condition that checks the requested Host before redirecting.
