Hosted in Germany
Data Processing Agreement (Art. 28 GDPR)
If you run a website, shop or application with personal data on our servers, we process that data on your behalf.
The GDPR requires a data processing agreement for this under Art. 28 (in German: Auftragsverarbeitungsvertrag, AVV).
A data processing agreement (DPA) is available on request.
What the DPA covers
Subject matter and duration
of the processing: hosting your website, application or server for the term of your contract
Types of data and data subjects
Everything you store on your hosting, for example customer data, orders, emails and form submissions
Instructions
We process your data only on your instructions, never for our own purposes
Technical and organisational measures (TOMs)
How we protect your data, see below
Subprocessors
Who we use and how we inform you about changes
Support with data subject requests
and with personal data breaches
Deletion and return
of your data when the contract ends
Technical and organisational measures in brief
| Area | What we do |
|---|---|
| Data centre | Tier III data centre in Falkenstein whose operator runs an ISO 27001 certified information security management system |
| Customer separation | every website in its own container (namespaces and cgroups); Windows plans as separate virtual machines |
| Encryption | TLS/SSL for every domain |
| Backups | daily backup to a separate location in Nuremberg, kept for 7 to 30 days depending on the plan |
| Updates | security patches for the operating system and packages by our team |
The full TOMs are attached to the DPA.
Does my hosting have to be in Germany?
The GDPR does not require servers in Germany. It requires that data is processed in the European Economic Area or that there is a legal basis for transfers to third countries. A German location makes many things simpler, but it does not replace the DPA. More in the guide GDPR-compliant hosting.
This page is general information, not legal advice.
Questions about data protection?
Write to us at admin@gb-hosting.de. We reply within 24 hours.