Hosting and network
GDPR Hetzner
In an indie stack, Hetzner is used for Servers and cloud, often in Germany. Entity cited: Hetzner Online GmbH. The sections repeat what the vendor publishes, without filling a gap. Last update of the facts: October 4, 2026. Verified on October 4, 2026.
Translation of the French sheet. The facts do not change. The date is the date the official pages were read.
DPA Hetzner
Yes. Public PDF in English. Conclusion is also done from the account (accounts.hetzner.com).
Stated role
The customer is the controller (Article 4(7) GDPR). Hetzner Online GmbH is the processor. The Article 28 contract is not formed automatically: the customer concludes it in the account.
Personal data
The categories are specified by the customer in the contract. Fixed list published by Hetzner: not disclosed.
Sub-processors of Hetzner
Public URL of a sub-processor list: not disclosed.
Public URL of a list: not disclosed on this sheet.
Transfers outside the EU
Hosting / location
The terms state that standard contractual clauses may be added if ordered products have their site in a third country. The Cloud documentation publishes six locations: Falkenstein and Nuremberg (Germany), Helsinki (Finland), Ashburn (Virginia), Hillsboro (Oregon), and Singapore. Hetzner states that it operates its own data center parks in Germany and Finland, and colocation in the United States and Singapore.
EU–United States Data Privacy Framework
Official search for “Hetzner” and “Hetzner Online”: no participant. Not registered.
Cookies
not disclosed
Typical use, written by StackLégal and not by the vendor: Servers and cloud, often in Germany.
History
Last update: October 4, 2026.
Hosting: Cloud locations published in the documentation, in place of "not disclosed" on this point.
First publication. The facts come from the official pages cited in the sources. Anything not stated there remains "not disclosed".
Clause to paste
Place it in the sub-processor section of your privacy policy. Review it: a “not disclosed” field must be completed before publication.
Sub-processor clause
Sources
Verified on October 4, 2026.
Frequently asked questions
Is Hetzner a processor within the meaning of the GDPR?
The customer is the controller (Article 4(7) GDPR). Hetzner Online GmbH is the processor. The Article 28 contract is not formed automatically: the customer concludes it in the account.
What DPA does Hetzner publish?
Yes. Public PDF in English. Conclusion is also done from the account (accounts.hetzner.com). https://www.hetzner.com/AV/DPA_en.pdf
Which further sub-processors does Hetzner publish?
Public URL of a sub-processor list: not disclosed.
Where does Hetzner state that it processes data, including outside the EU?
The terms state that standard contractual clauses may be added if ordered products have their site in a third country. The Cloud documentation publishes six locations: Falkenstein and Nuremberg (Germany), Helsinki (Finland), Ashburn (Virginia), Hillsboro (Oregon), and Singapore. Hetzner states that it operates its own data center parks in Germany and Finland, and colocation in the United States and Singapore.
Is Hetzner registered under the EU–United States Data Privacy Framework?
Official search for “Hetzner” and “Hetzner Online”: no participant. Not registered.
Which personal data does Hetzner mention?
The categories are specified by the customer in the contract. Fixed list published by Hetzner: not disclosed.
Often in the same stack
These sheets come up in searches for a Next.js SaaS. Next.js itself is not a processor: GDPR Next.js.
Related tools
Full pack, from 39 € incl. VAT
The clause above covers only one tool. StackLégal generates the legal notices, terms of use, terms of sale, privacy policy, Article 28 DPA, and the public list, naming only the boxes that are checked. One-time payment via Gumroad. This is not legal advice.