Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
Cloudways is a managed cloud hosting platform that deploys and operates applications on underlying providers such as DigitalOcean, AWS, and Google Cloud. As hosting infrastructure it acts as a processor for the websites it runs and does not add marketing cookies or tracking to those sites by default. The main compliance considerations are the data processing agreement, the choice of server region, and any strictly necessary cookies used for load balancing or security.
Cloudways is a managed cloud hosting platform. Rather than running its own data centres, it provisions and manages servers on underlying providers such as DigitalOcean, AWS, Google Cloud, Vultr, and Linode, and adds a management layer for deployment, scaling, backups, and security. It is popular for hosting WordPress, WooCommerce, and other applications.
As infrastructure, Cloudways processes whatever data your hosted application sends through it, including visitor IP addresses in server logs and any personal data the application stores. It does not inject marketing cookies or analytics into the sites it hosts. Any cookies a visitor sees come from the application itself, although load balancing or security layers may use a strictly necessary cookie.
For the website owner, Cloudways acts as a processor under Article 28 of the GDPR, and the underlying cloud provider is a sub processor. This means you need a data processing agreement, you remain the controller for visitor data, and you should ensure appropriate security and a clear chain of responsibility down to the infrastructure provider.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
Hosting itself does not normally require consent, because serving the website the visitor requested and the strictly necessary cookies that support it are exempt under the ePrivacy Directive. Consent obligations arise from the analytics and marketing tools your application adds, not from Cloudways as the host.
Because Cloudways sits on top of global providers, the data location depends on the region you select when you create a server. Choosing an EU region keeps hosting within the European Economic Area, while a non EU region means transfers that must rely on Standard Contractual Clauses or the EU US Data Privacy Framework.
Sign the Cloudways data processing agreement, select an EU region if your users are European, and record the underlying provider as a sub processor. Configure backups and security, set log retention, and focus your consent efforts on the analytics and marketing tools running inside your application rather than on the hosting layer.
Websites using Cloudways must obtain user consent under GDPR regulations.
DPIA considerations
As a hosting processor, the key questions are the server region, the data processing agreement and sub processors, the security measures, and any transfers outside the EEA when a non EU region is chosen. A DPIA is rarely needed for hosting alone unless the hosted application is high risk.
Sample consent text
Our website is hosted on Cloudways. Hosting uses only strictly necessary technologies to deliver the site securely and does not track you for marketing.
Third-party domains contacted
cloudways.comcloudwaysapps.comCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| cw_lb | Functional | Session | Strictly necessary load balancing cookie that keeps a visitor on a consistent server during the visit. |
| cloudways_session | Functional | Session | Strictly necessary session cookie used by the hosting layer to deliver the site reliably. |
This service may collect user data. Ensure GDPR compliance with FlowConsent.
Cloudways does not add marketing or analytics cookies to the sites it hosts. Any cookies a visitor sees come from your application, although a load balancing or security layer may use a strictly necessary cookie that does not require consent.
No, not for hosting itself. Serving the requested website and its strictly necessary cookies are exempt from consent. Consent is needed only for the analytics and marketing tools your application loads.
Cloudways is a processor under Article 28 of the GDPR, acting on your instructions, and the underlying cloud provider is a sub processor. The relationship is governed by a data processing agreement rather than visitor consent.
It depends on the region you choose. Selecting an EU region keeps hosting in the European Economic Area. A non EU region means transfers that must rely on Standard Contractual Clauses or the EU US Data Privacy Framework.
A DPIA is rarely required for hosting alone. It may be relevant if the application you host carries out high risk processing, in which case the assessment covers the application rather than the hosting layer.
Sign the data processing agreement, select an EU region where appropriate, record the underlying provider as a sub processor, and set log retention and security controls. Manage consent at the application level for any analytics or marketing.
Alternatives include managed hosts such as Kinsta and SiteGround, or going directly to a provider like Hetzner, OVH, or Scaleway for EU only hosting. EU based providers can simplify the transfer analysis.
You generally list Cloudways as a hosting processor in your privacy notice rather than in the cookie banner, because it does not set non essential cookies. Document the region and sub processor, and list your application cookies separately.