Well, I goofed. Nonetheless, Threema is claiming GDPR-complaince:
Excerpt from their main web page:
Threema is 100% Swiss Made, hosts its own servers in Switzerland*, and, unlike US services (which are subject to the CLOUD Act, for example), it is fully GDPR-compliant.