Hetzner: DPA, subprocessors and data center locations

Where to find the Hetzner DPA and subprocessor list, how much notice you get of new subprocessors, where data is stored and how it leaves the EU. Each fact has a source link and the date we checked it. Typical use: servers and cloud hosting. The table is the short version; the sections below add detail.

Hetzner at a glance

Notes on Hetzner

Hetzner signs no individual DPAs. You conclude its standard DPA in your customer account by ticking a checkbox, and you can hold up to six at once.

Where your data goes depends on the location you pick. Hetzner's page says EU locations (Falkenstein, Nuremberg, Helsinki) keep data in the EU, while Ashburn, Hillsboro and Singapore are third-country locations. For those, section 3 of the DPA requires your prior consent and names no single transfer mechanism.

Section 7 gives no notice period for new subcontractors, only notice "in good time". You then have a reasonable period of 14 days to object, and Hetzner can shorten it in special circumstances (section 7(4)).

Hetzner DPA: where to find it and how it is accepted

Read the DPA on docs.hetzner.com. Hetzner does not sign individual DPAs. You conclude its standard DPA in your customer account by ticking a checkbox, after stating the data types and data subject groups for Appendix 1. No handwritten signature is needed. English sample: DPA_en.pdf, version 1.1, February 10, 2025..

Hetzner subprocessors: the list and how change notices reach you

Hetzner's subprocessor list (6 entries on the check date).

Appendix 3 (German PDF, version 1.0, 06.08.2024) lists six subcontractors: Hetzner Finland Oy, Hetzner US LLC, NTT Global Data Centers Americas, QTS Investment Properties Hillsboro, Hetzner Singapore Pte. Ltd. and NTT Global Data Centers SG1.

How changes are announced: "In good time and in an appropriate way" (section 7(3)); the method is not specified.

Not stated in the source we checked (2026-10-17).

Section 7(3) says Hetzner informs you "in good time and in an appropriate way" before it engages or replaces a subcontractor. No number of days is stated for the notice.

You can object within 14 days. If you have a good data protection reason to object and the parties cannot agree, you get special rights to terminate your main contract (section 7(3)).

Section 7(3): you can exercise your data protection rights within a reasonable period of 14 days after a change. If you do not object in that period, you are assumed to agree. Section 7(4) lets Hetzner shorten the 14 days to a reasonable period in special circumstances.

Where Hetzner stores data

• Germany (Falkenstein, Nuremberg)
• Finland (Helsinki)
• USA (Ashburn, Hillsboro)
• Singapore

You can choose the region.

Hetzner's data protection page says non-cloud products are processed and stored only within the EU, while cloud product storage depends on the product location you choose. It names the EU locations Falkenstein, Nuremberg and Helsinki, and Ashburn (Virginia), Hillsboro (Oregon) and Singapore as locations outside the EU. Appendix 3 adds that if you choose an EU server location your server data is processed only in the EU.

How Hetzner moves data outside the EU and UK

• Your prior consent to the third-country location
• Art. 45-46 GDPR safeguards (no specific one named)

DPA section 3(1) to 3(4): processing is in the EU or EEA, a third-country transfer needs your prior consent, and protection is ensured by one of the listed measures (adequacy decision, binding corporate rules, standard data protection clauses and others). The DPA does not say which measure applies to the US or Singapore locations. The data protection page says the transfer rests on the express consent you give when selecting the product location.

Is Hetzner a processor or a controller?

Processor: it handles your customers' data on your instructions.

The DPA names you as controller and Hetzner Online GmbH as processor within the meaning of the GDPR (Article 28).

Is Hetzner GDPR compliant?

We don't give a compliance verdict, and no vendor can be 'GDPR compliant' on its own; compliance depends on how you use it. Here is what Hetzner's own documents say:

• A DPA is published: Hetzner does not sign individual DPAs. You conclude its standard DPA in your customer account by ticking a checkbox, after stating the data types and data subject groups for Appendix 1. No handwritten signature is needed. English sample: DPA_en.pdf, version 1.1, February 10, 2025.
• A subprocessor list is published.
• Transfer mechanisms named: Your prior consent to the third-country location, Art. 45-46 GDPR safeguards (no specific one named).
• Data locations named: Germany (Falkenstein, Nuremberg), Finland (Helsinki), USA (Ashburn, Hillsboro), Singapore.

What stays with you: accepting or signing the DPA where it needs that, choosing and setting the region, your own records of processing, and any consent or notices your own users need.

Add Hetzner to your own subprocessor list

This row uses the facts above. Change the purpose to match how you use Hetzner, then paste it into your list, or open it in the generator to add your other vendors.

| Vendor | Purpose | Data location | Transfer mechanism | Vendor DPA | Vendor subprocessor list |
| --- | --- | --- | --- | --- | --- |
| Hetzner | Servers and cloud hosting | Germany (Falkenstein, Nuremberg); Finland (Helsinki); USA (Ashburn, Hillsboro); Singapore | Your prior consent to the third-country location; Art. 45-46 GDPR safeguards (no specific one named) | [DPA](https://docs.hetzner.com/general/company-and-policy/data-protection-at-hetzner) | [Subprocessors](https://www.hetzner.com/AV/subunternehmer.pdf) |

Add to my list

If you add or replace Hetzner: what to tell your customers

Under Art. 28(2) GDPR, a processor that engages another processor needs its customer's authorisation. Where that authorisation is general, the processor must tell the customer about intended additions or replacements and give it a chance to object. The GDPR sets no fixed number of days. Customer DPAs usually set one, so check the number you agreed to.

In the source we checked, Hetzner doesn't state a notice period in days, so you may learn of a change later than your own notice period requires; plan for that.

Use the subprocessor list template for the list itself. Tell customers before the change takes effect: what changes, the new vendor's purpose and location, the date, and how to object.

What changed

2026-10-17

First check: facts recorded from Hetzner's data protection page, English DPA (version 1.1, February 10, 2025) and subcontractor appendix (version 1.0, 06.08.2024).

Related vendors

• Hosting and deployment
• Vercel Application hosting and deployment
• Supabase Database hosting and authentication
• Cloudflare CDN, DNS, security and edge platform
• Railway Application hosting and deployment
• All vendors

Sources and method

• https://www.hetzner.com/AV/DPA_en.pdf checked 2026-10-17
• https://docs.hetzner.com/general/company-and-policy/data-protection-at-hetzner checked 2026-10-17
• https://www.hetzner.com/AV/subunternehmer.pdf checked 2026-10-17

Headquarters country: Germany. The DPA names Hetzner Online GmbH, Industriestrasse 25, 91710 Gunzenhausen, Germany.

Facts come from Hetzner's own public pages, read by hand, and can change. Read the source before relying on it. The facts and templates here are not legal advice. How we check: methodology, which also says where to report an error. Official site: www.hetzner.com.