GE4

GDPR at GE4

Last updated 9 November 2026

When you put your website, email or systems with GE4, you also trust us with your customers' and employees' data. Here is an overview of how we comply with the General Data Protection Regulation (GDPR), and where to find the documentation.

Two roles

  • GE4 is the controller for data about our own customers, such as contact details and invoices. That is covered by our privacy policy.
  • GE4 is the processor for the data you as a customer keep with us, such as the content of your website, your databases and your email. That is covered by our data processing agreement, which applies automatically to all customers.

Your data stays in Denmark

Hosting, control panel, email and backup run on GE4's own servers in a data centre in Denmark. We do not use American cloud services for your data. Our only sub-processor is Hetzner in the EU, which runs our secondary DNS and backup mail server.

How we protect data

  • Encrypted connections (HTTPS) on websites, control panel and webmail
  • Daily, encrypted backup on a separate server
  • Firewalls, a private network between the servers, and databases that cannot be reached from the internet
  • Each website is separated from the others
  • Two-factor login in the control panel and a log of logins and actions
  • Automatic blocking of attacks, malware scanning and security updates
  • Monitoring around the clock

The full measures are in Annex C to the data processing agreement.

Your responsibility as controller

As controller, you decide what data you keep and why. Some good advice:

  • Keep WordPress, plugins and other software up to date.
  • Use strong, unique passwords and turn on two-factor login in the control panel.
  • Remove users who should no longer have access.
  • If your website has cookies or contact forms, it needs its own privacy policy.
  • Don't keep data longer than necessary.

We are happy to help review your setup. Contact us.

If something goes wrong

If we discover a security breach that affects your data, we notify you no later than 48 hours after becoming aware of it, so you have time to notify the Danish Data Protection Agency within 72 hours. We help limit the damage and find the cause.

Requests from data subjects

If one of your customers asks for access to or deletion of their data, we help you find and delete it in your systems with us. If we receive a request directly, we pass it on to you.

Documents

Questions about GDPR? Write to kontakt@ge4.dk.

Back to the homepage