Does Umami Cloud require a DPA to be GDPR compliant (in Germany)?

[lscheibel]

I wanted to use Umami as a managed service for analytics but looking into the privacy laws in Germany (but should be applicable to all GDPR countries), it seems that a data processing agreement (DPA) is necessary in order to be juristically safe. I'm using this site as a source which explains privacy laws in relation to Plausible analytics. They present two cases in which institutions were fined for not signing a DPA ("VA contract"). Plausible's DPA is entered upon agreeing to their terms of service and therefore seems safe, however I could not find any reference to a DPA in Umami's TOS.

Can Umami Cloud be used safely within the EU without a DPA? Any self-hosted instance should be fine, because the data is never send to a third party, but even if the data is stored on EU servers, a DPA is necessary for Umami Cloud from my understanding.