Almost every website collects personal data: a contact form with a name and phone number, an order with a delivery address, a customer account, an email address left for a newsletter. From that moment on, the General Data Protection Regulation (GDPR) applies to your website too — and the company that hosts it becomes part of the picture.
This article explains the concepts in plain terms; it is not legal advice. For your company's specific situation, ask a data protection specialist.
In short
- For your visitors' data, you are the controller; the hosting company that stores it on its servers is usually a processor.
- There must be a Data Processing Agreement between you (Article 28 GDPR).
- If data leaves the European Economic Area, GDPR requires additional safeguards for the transfer.
- EU servers make things simpler, but they don't release you from your other obligations: a privacy policy, data security, a proper cookie banner.
Controller and processor
GDPR splits the roles in two. The controller decides why and how data is processed — your company, which puts the form on the website. The processor processes data on the controller's behalf, following its instructions — for example the hosting company, whose servers hold the store's database and the mailboxes.
The roles matter because the obligations follow from them: the controller is answerable to visitors, while the processor must protect the data and use it only as instructed.
The Data Processing Agreement
Article 28 GDPR requires a contract between the controller and the processor, stating what data is processed, for what purpose, for how long, with what security measures and what happens to it at the end. For NBT Host customers, the agreement is published on the Data Processing Agreement page and applies to the data you host on our servers.
Why server location matters
GDPR does not prohibit hosting outside the Union, but transferring personal data outside the European Economic Area is allowed only under the conditions in Chapter V of the regulation: a European Commission adequacy decision for that country, or appropriate safeguards such as standard contractual clauses. That means extra paperwork and a check of the provider.
When the servers are in the EU, the data stays under the same rules from end to end. NBT Host's servers are in the European Union, rented from a German data center provider and managed by our team, and the encrypted backup copy is also in the EU. All the providers your data passes through are listed in our Privacy Policy. Details about the infrastructure are on About NBT Host.
Watch the services you add to the website yourself: a form sent through an external service, a chat widget, an analytics tool or an advertising pixel can send data outside the EU, no matter where the website is hosted.
What stays your responsibility
EU servers are one part of the solution. As the controller, you still have a few things to do:
- A privacy policy on the website: what data you collect, why, how long you keep it, who you share it with and what rights people have.
- Cookies: analytics and marketing cookies start only after consent, and refusing is as easy as accepting. The rules come from GDPR and from the legislation on privacy in electronic communications (in Romania, Law No. 506/2004).
- Security: an encrypted connection through an SSL certificate, good passwords, two-factor authentication in the panel, timely updates.
- Backups and a restore plan — more on that in the 3-2-1 rule.
- Only the data you need: a contact form doesn't need a personal identification number or a date of birth.
Where to find the sources
The full text of the regulation is on EUR-Lex, and the authority in Romania is the Romanian data protection authority (ANSPDCP), which publishes guidance and answers to frequently asked questions.