GDPR-compliant digital business card: provider comparison 2026

A digital business card is not GDPR-compliant simply because a provider claims it is. Four verifiable building blocks are decisive. First, the server location: if data is processed exclusively in Germany or the EU, the legally complex third-country transfer under Chapter V GDPR is not required.

Second, the data processing agreement (DPA) under Art. 28 GDPR, a legally binding contract between you (the controller) and the provider (the processor) that governs adherence to instructions, technical and organizational measures (TOM) as well as the handling of subcontractors. Without a signed DPA, using an external service for personal data is generally not permitted.

Third, the verifiability of security, for example through ISO 27001 certification of the data center. Fourth, organizational evidence such as an appointed (ideally external) data protection officer, documented deletion policies and a record of processing activities.

Only the interplay of these elements makes a product procurable for organizations sensitive to data protection.

A common misconception: "Server in Frankfurt" is not the same as "German hoster". What matters is who controls the operator. A genuine German hosting provider (for example an own data center in Germany or Hetzner) is subject exclusively to German and EU law.

If, on the other hand, a provider uses a US cloud such as AWS, even in the Frankfurt region (eu-central-1), a residual risk remains: under the US CLOUD Act, US authorities can access data controlled by a US company, regardless of the physical storage location. In practice this risk can be mitigated through encryption and EU subsidiaries, but not fully eliminated.

For our GDPR rating this means: oneVcard (a DE data center in Nürnberg) and Spreadly (Hetzner) count as genuine German hosters. Lemontaps and MyTAAG host on AWS Frankfurt, solid in GDPR terms and secured to ISO 27001, but subject to the described CLOUD Act residual risk.

For strictly regulated industries (public sector, finance, healthcare) this difference is a hard selection criterion.

oneVcard leads the GDPR category with 94/100. The provider hosts in an ISO 27001 certified data center in Nürnberg; hosting and development take place exclusively in Germany, without any transfer to third countries.

A DPA under Art. 28 GDPR is provided on request, and Prof. Dr. Eberhard Schott serves as the external data protection officer. In addition: daily backups, two-factor authentication (2FA) and regular penetration tests.

Spreadly follows as a strong alternative: HQ near München, customer data held according to the provider at Hetzner in Germany (CDN/Edge including Bunny among others), certified to ISO 27001:2022, comprehensive DPA, TLS 1.3 and AES-256, daily backups as well as a 72-hour notification deadline. Lemontaps (HQ Stuttgart) is likewise ISO/IEC 27001 certified (TÜV SÜD) and hosts exclusively in Germany, though on AWS Frankfurt, which is why the mentioned US cloud residual risk must be taken into account.

All three offer a DPA and German-language support. Conclusion: anyone prioritizing maximum data sovereignty without a US connection will find the most consistent setup with oneVcard and Spreadly.

From a certain team size onward, data protection becomes a question of identity and device management. Single Sign-On (SSO) via SAML 2.0 connects the business card platform to your central identity provider, with oneVcard for example to Microsoft Entra ID (formerly Azure AD) or Google Workspace.

This lets you manage access centrally, and departing employees automatically lose access. SCIM, or a SCIM-like provisioning (implemented at oneVcard via Entra ID / HR sync), automates the creation and deactivation of user accounts along the employee lifecycle, a central building block for data-protection-compliant user lifecycle management.

MDM (Mobile Device Management) via Microsoft Intune enables the controlled rollout of wallet cards and apps to managed devices; such an MDM device rollout is, however, not publicly documented for oneVcard and should be confirmed with the provider before signing a contract; what is documented here is the Entra ID / Azure connection for SSO and user provisioning. It is also relevant for data protection that personal data is only distributed as far as necessary.

Granular roles and permissions in the team/admin console technically implement the principle of data minimization.

Use these criteria as a short audit for each provider. 1) DPA under Art. 28 GDPR: is a signature-ready contract provided, and are subcontractors listed transparently? 2) Server location and hoster: exclusively Germany/EU, and a genuine German hoster or a US cloud?

Have this confirmed in writing. 3) ISO 27001: does the certificate relate to the specific data center operation, and is a valid certificate available? 4) TOM and encryption: encryption at rest (for example AES-256) and in transit (TLS 1.3), 2FA, daily backups, penetration tests.

5) Data protection organization: an appointed (external) data protection officer, a deletion policy, a notification process for data breaches (72-hour deadline under Art. 33 GDPR). 6) Enterprise control: SSO/SAML, automated de-provisioning, granular roles.

A provider that can substantiate all six points is procurable. oneVcard, Spreadly and Lemontaps meet the core of this list, oneVcard most comprehensively, because a DE data center plus ISO 27001 and a DPA without any third-country connection come together.