What 4hosting does as your data processor
When you host personal data with 4hosting, you are the controller and we act as your processor under Article 28 of Regulation (EU) 2016/679 (GDPR). That split decides who answers for what: you choose why and how personal data is used, and we process it only on your documented instructions and keep it secure. We do not move data to a third country without your explicit agreement. Where a transfer ever became necessary, it would rest on standard contractual clauses. For a company this matters twice: customers expect GDPR terms in writing, and a parent group will ask for the DPA and the sub-processor list during every vendor review. This page explains what we commit to as a processor. It is not legal advice; your lawful basis and your own obligations as a controller stay with you and your legal adviser.
A DPA ready to sign
Download the data processing agreement from the client panel, in English, and sign it electronically before personal data moves to us.
Named sub-processors
We keep a current list of the sub-processors involved in your hosting (data centre, CDN, DDoS protection), with the place of processing for each. Any change is announced 30 days before it takes effect.
Security aligned with ISO 27001
Our security practice is aligned with ISO 27001: access control, patching, backup and logging. That is an alignment, not a certificate, and we never present it as one.
Compliance work from your included hours
Protecting systems that hold personal data is engineering work: hardening servers and containers, managing access, secrets and keys, anti-ransomware backup and mail authentication with SPF, DKIM and DMARC. You request it from the client panel and it is drawn from the hours in your plan: 1 h a month on cPanel from Advanced up, 1–8 h on VPS, 5–10 h on dedicated servers depending on the plan, and 10 h on GPU servers. Hours do not carry over, and extra hours are accepted and billed separately.
A named data protection contact
We have designated a data protection officer, reachable by every customer at dpo@4hosting.net. Questions about the agreement, the sub-processors or the technical measures go to the same address.
Data processing agreement under Article 28 GDPR
Every business customer can sign a ready-made data processing agreement that follows Article 28 GDPR. It covers the subject matter and duration of the processing, the categories of personal data, the security measures we apply, your right to audit and the way we tell you about a security incident, so that you can meet your own notification duties. It is available in English, and your legal team can go through the wording with our data protection contact before you sign.
Sub-processors by function and where they operate
Requests from the people whose data you hold
People whose data is processed can ask for access, rectification, erasure, restriction, portability or objection, and we honour such requests within 30 days at most. Send a request through the form in the client panel or by e-mail to dpo@4hosting.net. Anyone can also turn to the competent supervisory authority.
Need something for your DPO or auditor?
Write to our data protection officer with your questions about the agreement, the sub-processors or the technical measures. We can sign a confidentiality agreement before sharing audit material, and support is available in English.
Write to the data protection officer →