The websites we build run in a data centre in the EU, at a host certified to ISO/IEC 27001. Here is what that means, how we handle your data, and the GDPR in plain words.
We host the websites we build at Hostinger, in one of its data centres in the EU: France, Germany or Lithuania. So your site, and the data it collects, falls under European privacy law: the GDPR.
What the host does, in six facts. Each one is Hostinger's own statement, so you can check it.
Hostinger is certified to ISO/IEC 27001:2022, the international standard for information security.
In France, Germany and Lithuania. We put your site in one of them.
Floods of traffic meant to take a site down are stopped, and a web application firewall blocks known attacks.
Your site is backed up automatically, so it can be put back if something goes wrong.
Every site gets an SSL certificate that renews by itself, so everything between your visitor and your site is encrypted.
Hostinger processes data under a data processing agreement that covers the GDPR. We sign one with you as well.
Source: Hostinger's Trust Center, its support pages and its data processing agreement, checked in November 2026.
Six rules we keep to in every job, whichever solution you choose.
We collect and keep only the data a job needs. No special categories, such as health data.
Our reports and process maps do not name your customers or your staff.
Data from one client never ends up with another.
We do not change your systems ourselves. We write down what has to change; your people make the change.
Where AI does a step, a person checks the result before it counts.
It comes before the business case. Where a legal question comes up, we flag it and refer you to a specialist.
Any information about a person who can be identified: a name, an email address, a phone number, an IP address. GDPR, article 4
The organisation that decides why and how personal data is used. For the data on your website, that is you. GDPR, article 4
An organisation that handles personal data on behalf of the controller. When we build and host your website, that is us, and Hostinger works for us as a sub-processor. GDPR, articles 4 and 28
The contract between the controller and the processor about what may happen to the data. The GDPR requires one. GDPR, article 28
Every use of personal data needs one of six grounds, such as consent, a contract or a legitimate interest. GDPR, article 6
Collect only the data you need for your purpose, and nothing more. GDPR, article 5
How long data is kept: no longer than the purpose requires. GDPR, article 5
Privacy built in from the start, with the most private setting as the default. GDPR, article 25
A data protection impact assessment: a risk check before you start processing that is likely to be high-risk. GDPR, article 35
Personal data may only leave the EU with safeguards, such as an adequacy decision or standard contractual clauses. GDPR, articles 44 to 49
People can ask to see, correct or delete their data, object to its use, or take it with them to someone else. GDPR, articles 15 to 22
Personal data that ends up where it should not. If it puts people at risk, the controller reports it to the supervisory authority within 72 hours: in the Netherlands, the Autoriteit Persoonsgegevens. GDPR, article 33
An explanation, not legal advice.
Ask us a question