What 4hosting does as your data processor
When you host personal data with 4hosting, you are the controller and we act as your processor under Article 28 of Regulation (EU) 2016/679 (GDPR). That split decides who answers for what: you choose why and how personal data is used, and we process it only on your documented instructions and keep it secure. Our servers, backups and operational copies are in the EU, in Frankfurt, and we do not move data to a third country without your explicit agreement. Where a transfer ever became necessary, it would rest on standard contractual clauses. In Romania, processing is also governed by Law no. 190/2018, which implements the GDPR nationally, and the supervisory authority is ANSPDCP. For a company in Romania this matters twice: Romanian customers expect GDPR terms in writing, and a foreign group headquarters will ask for the DPA and the sub-processor list during every vendor review. This page explains what we commit to as a processor. It is not legal advice; your lawful basis and your own obligations as a controller stay with you and your legal adviser.
Data stays in the EU
Servers, backups and operational copies are hosted in the EU, in Frankfurt. We do not transfer your data to a third country without your explicit agreement first.
A DPA ready to sign
Download the data processing agreement from the client panel, in Romanian or English, and sign it electronically before personal data moves to us.
Named sub-processors
We keep a current list of the sub-processors involved in your hosting (data centre, CDN, DDoS protection), with the place of processing for each. Any change is announced 30 days before it takes effect.
Security aligned with ISO 27001
Our security practice is aligned with ISO 27001: access control, patching, backup and logging. That is an alignment, not a certificate, and we never present it as one.
Compliance work from your included hours
Protecting systems that hold personal data is engineering work: hardening servers and containers, managing access, secrets and keys, anti-ransomware backup and mail authentication with SPF, DKIM and DMARC. You request it from the client panel and it is drawn from the hours in your plan: 1 h a month on cPanel from Advanced up, 1–8 h on VPS, 5–10 h on dedicated servers depending on the plan, and 10 h on GPU servers. Hours do not carry over, and extra hours are accepted and billed separately.
A named data protection contact
We have designated a data protection officer, reachable by every customer at [email protected]. Questions about the agreement, the sub-processors or the technical measures go to the same address.
Data processing agreement under Article 28 GDPR
Every business customer can sign a ready-made data processing agreement that follows Article 28 GDPR. It covers the subject matter and duration of the processing, the categories of personal data, the security measures we apply, your right to audit and the way we tell you about a security incident, so that you can meet your own notification duties. It is available in Romanian and English, and your legal team can go through the wording with our data protection contact before you sign.
Sub-processors by function and where they operate
Requests from the people whose data you hold
People whose data is processed can ask for access, rectification, erasure, restriction, portability or objection, and we honour such requests within 30 days at most. Send a request through the form in the client panel or by e-mail to [email protected]. Anyone can also turn to ANSPDCP, the Romanian supervisory authority.
Need something for your DPO or auditor?
Write to our data protection officer with your questions about the agreement, the sub-processors or the technical measures. We can sign a confidentiality agreement before sharing audit material, and support is available in English and Romanian.
Write to the data protection officer →