Data processing agreement
Last updated 9 November 2026
This data processing agreement applies when GE4 processes personal data on behalf of a customer, for example in hosting, email, backup or IT support. It meets the requirements of Article 28 of the General Data Protection Regulation (GDPR) and is part of the agreement on our services.
1. Parties and basis
This agreement is between the customer as controller and GE4, CVR 42128309, as processor. It takes effect when the customer orders or starts using a service in which GE4 processes personal data on the customer's behalf. If the customer would like a signed copy, we will send one on request to kontakt@ge4.dk.
If this agreement conflicts with our terms of trade, this agreement takes precedence in matters of personal data processing.
2. The processing
The purpose, nature, types of personal data and categories of data subjects are described in Annex A. GE4 processes the personal data only to deliver the services the customer has ordered.
3. Instructions
GE4 processes personal data only on documented instructions from the customer. The instructions are this agreement, the agreement on the services, and the choices the customer makes in the control panel or gives us in writing, for example in a support request. If GE4 believes an instruction breaks data protection law, we tell the customer immediately.
GE4 may process the data without instructions where EU or Danish law requires it. In that case we tell the customer first, unless the law forbids it.
4. Confidentiality
Only people who need it to deliver the services get access to the personal data. They are bound by confidentiality, and their access is removed when it is no longer needed.
5. Security
GE4 implements appropriate technical and organisational measures under GDPR Article 32, so that security matches the risk. The measures are described in Annex C. The customer is responsible for security in what the customer controls, such as passwords, users, software and plugins on its websites.
6. Sub-processors
The customer gives GE4 general authorisation to use sub-processors. The current ones are listed in Annex B.
GE4 gives at least 30 days' notice of new or replaced sub-processors by email or in the control panel. The customer may object before then. If we cannot find a solution, the customer may cancel the affected services to the date the change takes effect, without paying for the period after.
GE4 imposes the same data protection obligations as in this agreement on its sub-processors and is liable to the customer for their compliance.
7. Transfers to third countries
The personal data is processed in Denmark and the EU. GE4 does not transfer personal data to countries outside the EU/EEA without the customer's instructions and a valid transfer mechanism under Chapter V of the GDPR.
8. Assistance to the controller
As far as possible, GE4 helps the customer with:
- answering requests from data subjects who want to use their rights. If we receive such a request directly, we pass it on to the customer without undue delay.
- security, breach notification, impact assessments and prior consultation of the supervisory authority under GDPR Articles 32 to 36.
Assistance beyond what follows from the services is billed by time spent.
9. Personal data breaches
If GE4 discovers a personal data breach at GE4 or at a sub-processor, we notify the customer without undue delay and no later than 48 hours after becoming aware of it. This gives the customer time to notify the Danish Data Protection Agency within 72 hours.
As far as possible, the notification includes what happened, the types and approximate number of data subjects and records involved, the likely consequences, and what we have done and propose to limit the damage.
10. Deletion and return
Until the agreement ends, the customer can retrieve its data through the control panel, SFTP or an email client, or ask us for help. No later than 30 days after the end, GE4 deletes the personal data. Copies in backups are deleted as the backups expire, and after 6 months at the latest. GE4 may keep the data longer only where the law requires it.
11. Audits and inspections
GE4 gives the customer the information needed to show that this agreement is complied with. On request, once a year, we send a written statement on our security and compliance with this agreement.
The customer, or an independent auditor appointed by the customer, may carry out an inspection with at least 30 days' notice. The inspection is at the customer's expense and must not put other customers' data at risk. The Danish Data Protection Agency always has access as provided by law.
12. Term, liability and changes
This agreement applies for as long as GE4 processes personal data on the customer's behalf. The duties of confidentiality and deletion continue after it ends.
The parties' liability to each other follows the terms of trade, unless mandatory GDPR rules provide otherwise. The limitation of liability does not apply towards data subjects.
GE4 may update this agreement and its annexes with at least 30 days' notice, for example when the law or our sub-processors change. Changes must not lower the protection of the personal data.
This agreement is also available in Danish. If the versions differ, the Danish version applies.
Annex A: The processing
| Service | What GE4 does with the data |
|---|---|
| Web hosting and databases | Stores and runs the customer's websites, files and databases. |
| Email and webmail | Receives, stores and sends the customer's email and contacts. |
| Backup | Makes daily, encrypted copies of hosting accounts and restores them on request. |
| DNS and domains | Stores the customer's DNS settings and registrant details for domains. |
| IT support, operations and remote support | Accesses the customer's computers, Microsoft 365 and other systems when the customer asks for help. |
Categories of data subjects: the customer's employees, customers, suppliers, users, website visitors and others the customer corresponds with.
Types of personal data: the data the customer chooses to store, typically contact details, communications, user accounts and orders. If the customer processes special categories of data (GDPR Article 9) or data on criminal offences (Article 10), the customer must tell us, so we can assess whether special measures are needed.
Duration: for as long as the agreement on the services runs, and then until deletion under section 10.
Location: GE4's own servers in Denmark. Secondary DNS and backup mail server at the sub-processor in Annex B.
Annex B: Sub-processors
| Sub-processor | Service | Location |
|---|---|---|
| Hetzner Online GmbH Industriestr. 25, 91710 Gunzenhausen, Germany |
Secondary DNS server and backup mail server. The backup mail server knows the list of customers' email addresses and only holds email temporarily if our main mail server cannot be reached, for at most 5 days. | EU |
Annex C: Security measures
- Servers and network: own servers in a data centre in Denmark. The servers are connected by a private network, and the database and backup servers cannot be reached from the internet. A firewall on each server allows only the connections needed.
- Encryption: HTTPS with certificates on websites, control panel and webmail. File transfer by SFTP or FTPS. Backups are encrypted.
- Separation: each website runs as its own user and can only access its own files.
- Backup: daily backup of files and databases to a separate backup server. We keep 7 daily, 4 weekly and 6 monthly copies.
- Access control: administration through named user accounts; direct root login is disabled. Passwords and keys are kept in a password manager. The control panel supports two-factor login and logs logins and important actions.
- Protection against attacks: automatic blocking of repeated failed logins, malware scanning on the web server and automatic security updates of the operating system.
- Monitoring: servers and services are monitored automatically every 5 minutes.