Hosting, SSL and Email: What a Business Actually Needs
Key takeaways
- Your host processes personal data — a data processing agreement under Article 28 GDPR is mandatory.
- A server location in the EU spares you the complicated question of transfers to third countries.
- An SSL certificate is free today and automatic with most hosts — without it, the browser shows a warning.
- Fonts loaded from Google's servers transmit the IP address on every visit; a Munich court awarded damages for it.
- Domain, hosting and email should be in your name, not a contractor's.
Hosting, encryption and email are among the things almost nobody thinks about — until something goes wrong. Then a technical side issue suddenly becomes a legal or business one.
The good news: all three can be set up properly once and then largely forgotten. This article shows what matters, with a focus on running a business site in Germany.
Contents
Where your site lives
Every website sits on a server run by a provider — the host. That sounds purely technical, but it has legal consequences.
Whenever someone visits your site, the server processes data: at minimum the visitor's IP address, which ends up in logs. If someone submits a contact form, their name, email address and message come too. That's personal data, and the host processes it on your behalf.
The contract that's almost always missing
This leads to an obligation that's surprisingly often overlooked.
Because the host processes data on your behalf, you need a data processing agreement under Article 28 GDPR with them. That's mandatory, not optional.
Reputable providers supply this agreement as standard, usually to accept with a few clicks in your account. You just have to do it. And that's exactly what often doesn't happen — because nobody thinks of it, or because a contractor set up the hosting and never raised the question.
The same applies to every other service that processes data on your behalf: the email provider, a booking service, an analytics tool. Each needs its own agreement. What belongs in your privacy policy about this is in the article on Impressum and GDPR.
Why an EU server location is simpler
Where the server physically stands isn't a side issue.
If data sits on servers within the EU, it falls directly under European data protection law. Things stay manageable.
If data is transferred to a third country such as the US, additional requirements apply. That isn't forbidden, but it complicates the legal position and demands more care in contracts and privacy policy.
For a small business there's rarely a good reason to take on that complexity. A host with a data centre in the EU is the simpler route.
SSL: free, but essential
SSL — more precisely TLS today — is the encryption between browser and server. You recognise it by "https" in the address and the padlock icon.
A few years ago a certificate cost money and had to be renewed yearly. That's over. Let's Encrypt provides certificates for free, and most modern hosts set them up and renew them automatically.
If encryption is still missing, there are three consequences:
The browser warns. Sites without HTTPS are marked "Not secure". For a visitor about to trust you with their data, that's a reason to leave.
Forms become insecure. Anyone transmitting personal data through a contact form must protect it appropriately. Article 32 GDPR requires suitable technical measures — and unencrypted transmission of form data doesn't meet that.
Google favours HTTPS. Encryption is a signal for ranking, if a weak one.
So "do I need SSL?" has only one answer. The real question is whether your host sets it up automatically — and a good one does.
The font trap
A point that surprised many and set off a wave of warning letters in Germany.
Many websites load fonts directly from Google's servers. It's convenient, but has a consequence: on every page view, the visitor's browser connects to Google and transmits their IP address.
In January 2022 the Munich Regional Court I ruled that such embedding without consent breaches the GDPR, and awarded the affected visitor 100 euros in damages (case 3 O 17493/20). The sum sounds small. But the ruling triggered a wave of warning letters that hit many small businesses.
The fix is simple: host the fonts on your own server. Then the browser loads them from your site, not from Google, and no connection to a third party is made. It also removes a common reason for a cookie banner — more in the article on cookie banners.
Email on your own domain
info@your-company.de rather than company1985@gmail.com. That's more than cosmetics.
A business address on your own domain looks professional. A quote sent from a free address makes the sender seem provisional — especially in German business culture, where such signals are noticed.
Then there's control. The address is yours as long as the domain is yours. Switch providers and the address stays the same.
Email on your own domain costs little — usually a few euros a month or a year, depending on provider and scope. And here too: you need a data processing agreement with the email provider.
Everything in your name
A principle that saves a lot of trouble: domain, hosting and email should be in your name — not a contractor's.
Your contractor can manage everything technically. They can be listed as technical contact. But you should be the contracting party and the owner.
People who miss this often only notice when the contractor can no longer be reached. What to do then is covered in the article on missing access credentials.
Backups
One last point that also only matters when it's too late.
Many hosts create backups automatically. Check how often, how long they're kept and how you access them in an emergency. A backup stored on the same server as the website does little against a ransomware attack.
More important still: test once whether restoring actually works. A backup that can't be restored isn't a backup. How to proceed in an emergency is in the article on hacked websites.
Hosting and speed
The host also affects how fast your site loads. An overloaded budget server can slow down a well-built site.
For simple business sites that's rarely a problem, especially if the site is served as static files. Why load time matters to visitors and Google is explained in the article on Core Web Vitals.
Frequently asked questions
Do I need a data processing agreement with my host? Yes. The host processes personal data on your behalf, such as IP addresses and form data. Under Article 28 GDPR a data processing agreement is mandatory. Reputable providers offer one in your account.
Does an SSL certificate cost money? Usually not any more. Let's Encrypt provides certificates for free, and most modern hosts set them up and renew them automatically.
Does my server have to be in Germany? Not necessarily Germany, but an EU location is considerably simpler. With servers in third countries such as the US, additional requirements for data transfers apply.
Can I use Google Fonts? Yes, but load the fonts from your own server rather than Google's. The Munich Regional Court I ruled in 2022 that embedding via Google's servers without consent breaches the GDPR.
Is an email address on my own domain worth it? Yes. It looks more professional than a free address, belongs to you, and stays the same if you change providers. The cost is low.
Whose name should the domain and hosting be in? Yours. A contractor can manage everything technically, but you should be the contracting party and owner — otherwise you're left without access if they can no longer be reached.
In short
A host with EU servers, a signed data processing agreement, automatic SSL and fonts on your own server — that puts the technical foundation on a clean legal footing.
Add an email address on your own domain, everything in your name and working backups. Set up properly once, these things barely need attention again.