Data Protection, GDPR and Data Processing Agreement (DPA)
As a Swiss provider, Green is subject to the applicable Swiss data protection regulations. Depending on the use case, the requirements of the European Union General Data Protection Regulation (GDPR) may also apply.
Whether the GDPR or a Data Processing Agreement (DPA agreement) is required for you depends on your specific use case, the personal data being processed and your role under data protection law.
Data Protection at Green
Customer, connection and access data are retained in accordance with legal requirements. Legally required connection and access data are stored for six months.
These data, in particular log files and email data, are only disclosed in the following cases:
- with the consent of the affected customer
- based on a court order to the competent authority
Green's privacy policy applies generally. Individual statements cannot therefore be transferred unchanged to every product or service.
Further information on data protection can be found in Green's privacy policy and on the website of the Swiss Federal Data Protection and Information Commissioner.
https://www.green.ch/fileadmin/user_upload/Rechtliches/Datenschutzrichtlinie_Green.pdf
https://www.edoeb.admin.ch/edoeb/de/home.html
Log Data and Log Files for Web Hosting Products
For web hosting products, web server logs are stored. From the second day onwards, the IP address is anonymised.
The web server logs contain, among other things, the following information:
- the accessed URL
- browser and browser version
- operating system and operating system version
- HTTP status code
Logging serves technical security, error analysis and platform operation.
Backups and Retention
Self-backups are retained for 14 days.
In addition, there is a geo-redundant disaster recovery backup with a maximum retention period of three months. This backup may only be restored in the event of a catastrophic incident. This includes, for example, the physical destruction of servers by fire, earthquake or sabotage, as well as digital destruction by ransomware.
The data in these backups are encrypted. Access is only permitted in such an event to reduce potential data loss. Every access is logged. Without such an event, there is no access to the contents of these backups.
The geo-redundant disaster recovery backup is used for Web Hosting, including Windows Hosting, WordPress Hosting, Email Hosting and Surfmail. It was introduced following a risk assessment as a response to the major OVH fire in March 2021. The probability of such an event occurring was assessed as very low, while the potential impact of data loss was considered critical.
Data Protection for Your Website
Which personal data is processed through your website depends on the website technology used as well as the services, plugins, forms and tracking solutions implemented.
Green does not automatically activate services such as Google Analytics, Hotjar or social media plugins on web hosting products. References to such services in Green's privacy policy relate to the Green.ch AG websites and cannot automatically be applied to your website.
Therefore, check yourself which services and functions are actually used on your website and whether they collect or transmit personal data.
In particular, you should consider:
- the website software used
- installed plugins and extensions
- contact and registration forms
- analytics and tracking solutions
- cookies
- embedded content from external providers
- social media functions
Which information is required in your privacy policy depends on the specific implementation of your website. There is no universal template suitable for every website and all features used.
Further information about data protection law and the possible impact on your website can be found in the following articles:
For questions about privacy policies for SMEs, the following services are available, among others:
https://www.datenschutzpartner.ch/angebot-datenschutz-generator/
Note: If you are unsure which information your privacy policy must contain or which data protection regulations apply to your website, consult a qualified data protection specialist or have the requirements legally reviewed.
Data Processing and DPA Agreement
A Data Processing Agreement governs the processing of personal data by a service provider on behalf of a customer. It clarifies the responsibilities between the controller of a website or application and the hosting provider acting as processor.
Since 01.09.2023, Green has offered a Data Processing Agreement.
If the GDPR applies to your website or company, a DPA agreement may be required. Whether this applies to your use case depends on your specific data processing activities and your role under data protection law.
Finding the DPA Agreement in the Customer Portal
- Sign in to my.green.ch.
- Open the "Customer Area".
- Open "Data Protection / DPA / Security".
- Access the DPA agreement there.
Further information about data processing and the DPA agreement can be found in the following articles:
https://www.green.ch/de/auftragsdatenverarbeitung
https://www.green.ch/en/data-processing-agreement-dpa
Difference Between Privacy Policy, DPA Agreement and Terms and Conditions
The privacy policy, the DPA agreement and the General Terms and Conditions serve different purposes.
- The privacy policy describes how personal data is handled.
- The DPA agreement governs data processing between the customer and the provider.
- The General Terms and Conditions govern the general contractual conditions.
Further information on the interaction between DPA and GTC can be found in the following article:
https://www.green.ch/en/dpa-and-gtc
Further information on customer obligations can be found here:
https://www.green.ch/en/gtc-and-customer-obligations