Onepage
Partially CompliantGerman landing-page, funnel and link-in-bio builder from Onepage GmbH in Frankfurt, with EU-located servers and an unusually specific Article 28 processor list in its privacy policy.
Subject to the US CLOUD Act: a US provider in this tool's processing chain can be compelled to disclose data it holds, including data stored in the EU. The vendor itself is European-owned.
Freemiumfrom Free, Essential from €19.90/month
GDPR Compliance Data
Not independently verified| GDPR Status | Partially Compliant |
| HQ Country | Germany |
| Ownership | European-owned |
| Foreign Disclosure Exposure | US CLOUD Act / FISA 702 |
| Data Hosting Location | European Union"Various applications from Amazon Web Services EMEA SARL (Luxembourg - EU) are used ... The transfer of data to a third country (in this case to Amazon Web Services Inc., USA), which cannot be ruled out, is justified in the case of employee data in accordance with Article 46 GDPR and in the case of all other data in accordance with Article 45 GDPR", and separately "Google Cloud Platform (Hosting)" contracted via Google Ireland Ltd. under the same Article 45/46 reasoning (Onepage GmbH Data Privacy Information, Sep 2025, PDF, read raw 2026-09-07). The pricing page (onepage.io/pricing) also lists "EU-located servers" as a plan feature. |
| EU Servers Available | |
| Data Processing Agreement | Not verified |
| Sub-processor List | Not verified |
| Schrems II Risk | Medium Risk |
| SCCs in Place | |
| Last Verified | 7 September 2026 |
How we reached this
German legal entity: Onepage GmbH, Hanauer Landstraße 172, 60314 Frankfurt am Main, Commercial Register HRB 194510 B (District Court of Charlottenburg), VAT ID DE319914761, managing director Marcel Knopf, confirmed via onepage.io/impressum, read raw 2026-09-07; an external DPO (STANHOPE Rechtsanwaltsgesellschaft mbH) is also named in the privacy PDF. The privacy notice is a detailed, German-standard Article 28 processor list naming Amazon Web Services EMEA SARL (Luxembourg), Google Ireland Ltd / Google Cloud Platform, Slack Technologies Ireland Limited, Zoom, Datev eG (Germany) and others, each with the specific GDPR article relied on for any onward transfer (Article 45 adequacy for most data, Article 46 safeguards for employee data via AWS). dataHostingLocation EU on the Luxembourg/Ireland contracting entities and the pricing page's explicit 'EU-located servers' claim. extraterritorialExposure US_CLOUD_ACT because the ultimate infrastructure owners (Amazon Web Services Inc., Google LLC) are US companies reachable under the CLOUD Act regardless of the EU entity contracted or the hosting region, consistent with this directory's treatment of AWS/Google Cloud elsewhere (Doodle, SEO.AI). sccInPlace true on the explicit Article 46 citation for employee-data transfers. gdprStatus PARTIAL rather than COMPLIANT specifically because, despite the unusually thorough processor-level detail, no customer-facing DPA document was located at any public URL and the term 'DPA' does not appear in the privacy notice at all, so dpaEvidence is NOT_LOCATED. schremsIIRisk MEDIUM: transfers are specifically reasoned per processor (better than most vendors in this directory) but still route through US parent companies.
About Onepage
A German Website Builder Built for Agencies
Onepage positions itself as a broad website and funnel builder rather than a single-purpose landing-page tool, competing with Unbounce on the funnel and conversion side while also covering full websites, link-in-bio pages and quizzes in one product.
What It Does
- Website & landing page builder with a visual, no-code editor
- Forms & Funnels add-on: multi-step forms, quizzes and conversion funnels for lead generation
- Redirects and analytics: import/export, redirect analytics, UTM capture, Conversion API
- Team collaboration: folder grouping, access management, multiple editors on paid tiers
- AI features: an AI writer, AI SEO tooling, and "vibe coding" via MCP on higher tiers
- Integrations via Zapier (5,000+ apps) and Make (1,000+ apps), plus native HubSpot, Telegram, KlickTipp and Quentn connectors
Pricing
Free covers one website, three pages, and 20 AI credits. Essential is €19.90/month (custom domain, 7 pages). Standard is €39.90/month. Advanced is €69.90/month. Expert is €179.90/month, with roughly a 17% discount for annual billing across all paid tiers. The pricing page lists EU-located servers explicitly as a security feature alongside HTTPS, GDPR cookie notification, DDoS protection and a GDPR consent solution.
A Privacy Policy That Names Its Processors
Onepage's privacy notice is unusually specific for a company of its size. Rather than the generic boilerplate common in this category, it lists each Article 28 GDPR processor by name and jurisdiction:
Various applications from Amazon Web Services EMEA SARL (Luxembourg - EU) are used, which has been commissioned in accordance with Article 28 GDPR. The transfer of data to a third country (in this case to Amazon Web Services Inc., USA), which cannot be ruled out, is justified in the case of employee data in accordance with Article 46 GDPR and in the case of all other data in accordance with Article 45 GDPR.
Hosting also runs through Google Cloud Platform, contracted via Google Ireland Ltd., with the same Article 45/46 transfer reasoning applied. Other named processors include Slack (Ireland), Zoom, Datev (Germany, for accounting) and an external German tax consulting firm.
The Company
Onepage GmbH, Hanauer Landstraße 172, 60314 Frankfurt am Main, Germany. Commercial Register HRB 194510 B, District Court of Charlottenburg, VAT ID DE319914761, managing director Marcel Knopf, with an external data protection officer named (STANHOPE Rechtsanwaltsgesellschaft mbH).
What's Missing
For all the specificity on individual processors, no customer-facing Data Processing Agreement document was located at a public URL, and the term "DPA" does not appear anywhere in the privacy notice, even though Article 28 agreements are clearly referenced for Onepage's own vendors. A prospective B2B customer wanting to sign their own DPA with Onepage would need to ask directly.
Where It Fits
Against Unbounce, Onepage is a smaller, German-run alternative that trades some conversion-optimisation depth for broader scope (full site building, link-in-bio, quizzes) and explicit EU hosting. See also landing pages.
Key Features
Pros & Cons
Categories
Replaces
Company Info
| Founded | 2018 |
Onepage GDPR & data protection: common questions
Is Onepage GDPR compliant?
Partly. Onepage meets some of the requirements, with caveats worth reading before you commit. Onepage is a European company headquartered in Germany, data is hosted within the European Union.
Where does Onepage store data?
Onepage states: ""Various applications from Amazon Web Services EMEA SARL (Luxembourg - EU) are used ... The transfer of data to a third country (in this case to Amazon Web Services Inc., USA), which cannot be ruled out, is justified in the case of employee data in accordance with Article 46 GDPR and in the case of all other data in accordance with Article 45 GDPR", and separately "Google Cloud Platform (Hosting)" contracted via Google Ireland Ltd. under the same Article 45/46 reasoning (Onepage GmbH Data Privacy Information, Sep 2025, PDF, read raw 2026-09-07). The pricing page (onepage.io/pricing) also lists "EU-located servers" as a plan feature.". Data is hosted within the European Union.
Does Onepage offer a Data Processing Agreement (DPA)?
We could not locate a published DPA for Onepage. That does not mean one is unavailable. Many vendors provide it on request or inside the account area rather than publishing it. Ask before you sign.
What a DPA has to cover →Is Onepage a European company?
Yes. Onepage is headquartered in Germany and, as far as we can establish, European-owned.
Is Onepage subject to the US CLOUD Act?
Indirectly. Onepage itself is European-owned and headquartered in Germany, so the company is not subject to US jurisdiction. The exposure runs through a US provider in its processing chain, a host, CDN or other sub-processor, which can be compelled to disclose data it holds even when that data sits on EU servers. That is a narrower exposure than a US-owned vendor, and the compliance notes above say which provider it is. Standard Contractual Clauses are in place for transfers, which is the required safeguard but does not override a lawful US order.
Schrems II compliance checklist →Related Tools
GetResponse
All-in-one email marketing and automation platform from Poland.
Landingi
Polish landing page builder with 400+ templates, A/B testing, and conversion analytics.
Heyflow
German no-code platform for interactive lead funnels and multi-step conversion pages.
Spotted something wrong?
Martech moves fast. Vendors change hosting regions, get acquired, publish a new DPA or rewrite their pricing, and they rarely announce it. We check what we publish and date every compliance review, but some of what you see here will be out of date before we catch it.
If you work at Onepage and something on this page is wrong, tell us and we will fix it. Readers, same invitation. Pointing us at the page that proves it gets it changed fastest.