Operations & Maintenance
Hosting, Maintenance and GDPR: Who Is Responsible for What?
Key takeaways
- Hosting runs the technology, maintenance keeps the website, forms and consent up to date. These are two different jobs.
- Managed hosting alone often leaves content, plugins, forms and tracking unchecked.
- With Webflow the platform handles hosting and certificates, while integrations, consent and changes stay with you or your agency.
- Under section 25 TDDDG, tracking on a device generally requires consent, and the banner has to match what the site really loads.
- Put responsibilities in writing, including monitoring, backups and coordination with your data protection advisor.
Short answer: Hosting makes sure your website is technically reachable. A maintenance contract makes sure it stays current, functional and legally clean. Managed hosting alone is rarely enough, because content, forms, tracking and cookie banners are not part of hosting. Legal advice stays with your data protection officer or your law firm.
Many companies only find out after an outage or a warning letter that they had merely assumed who was responsible. This guide separates the roles. How a maintenance contract is structured and which response times are common is covered in our guide to the maintenance contract. Here we only look at who is responsible for what in hosting, maintenance and data protection. You can find Webwavers’ care offering under website maintenance.
Not legal advice This text explains responsibilities from the point of view of a web agency. It does not replace legal advice. Please clear statements on GDPR and TDDDG with your data protection officer.
Hosting, maintenance, support: separating the terms
Offers often list the three terms side by side, but they mean different jobs with different owners.
What hosting covers
Hosting runs the infrastructure: servers, network, certificates and delivery of pages. With Webflow, for example, Webflow states that SSL/TLS is included in every Site plan, along with a global CDN with DDoS protection and automatic backups with restore. A 99.99 percent uptime SLA is mentioned only for Enterprise customers.
What maintenance covers
Maintenance keeps the website running and current. Depending on the system, this includes updates to the platform and extensions, checking backups, monitoring, bug fixing, checking forms and interfaces, and looking after consent settings. With WordPress the effort is higher than with a hosted system, as our guide to WordPress maintenance shows.
What support and further development cover
Support answers questions and handles small changes. Further development adds something new: pages, features, tests, optimizations. Both are usually a separate allowance and not automatically part of hosting.
| Task | Hosting | Maintenance | Development |
|---|---|---|---|
| Servers, certificates, CDN | Yes | Oversight | No |
| Updates and bug fixing | Platform only | Yes | No |
| Checking content, forms, integrations | No | Yes | No |
| Looking after consent and tracking | No | Depends on contract | When changing |
| New pages and features | No | No | Yes |
Managed hosting alone or with a maintenance contract?
Managed hosting means the provider runs the server and system environment for you. Whether that is enough depends on what runs in that environment and who looks after it.
Typical gaps
- Content: nobody checks whether pages, links and downloads are still correct.
- Plugins and extensions: the host updates the server, not your theme and plugins.
- Forms: a broken contact form often goes unnoticed until enquiries stop arriving.
- Tracking: tag managers, pixels and events keep running even when they no longer match consent.
- Change requests: the host does not rebuild pages.
Decision by system type
With a self-hosted system such as WordPress, managed hosting alone almost never suffices, because the application itself needs care. With a hosted system such as Webflow, the platform runs the technology, while content, integrations, consent and changes remain open. The running costs of both routes are compared in our guide to running costs of Webflow and WordPress. If you are still choosing a system, see our guide to the best CMS for company websites and the detailed comparison Webflow vs WordPress.
| Situation | Is hosting alone enough? | Better |
|---|---|---|
| Static site, few changes | Usually yes | Hosting plus occasional checks |
| Webflow, team maintains content | Technology yes, the rest no | Light care for consent and integrations |
| WordPress with plugins | No | Maintenance contract with updates and backups |
| Forms, CRM, tracking, several languages | No | Maintenance with clearly named responsibilities |
Webflow: care through the host or the agency?
With Webflow, host and platform are one. That shifts the question: you do not need a server admin, but you still need someone who is responsible for the website as a whole.
What Webflow covers itself
Webflow runs hosting, certificates and delivery and maintains the platform. On its security page, the provider lists certifications such as ISO 27001. Plugin updates of the kind you know from WordPress do not exist in that form. If you are still weighing Webflow against Framer, our detailed comparison Framer vs Webflow helps, and the guide Framer agency puts the provider in context.
What still remains
- Maintaining content and the CMS, testing and publishing changes.
- Checking integrations such as CRM, newsletter, booking and payment providers when their interfaces change.
- Keeping consent, tracking and the privacy policy current.
- Your own backups and access rights, because platform backups do not replace an independent copy.
- Changes and further development.
| Task | Webflow | Agency | You |
|---|---|---|---|
| Hosting, SSL, CDN | Yes | Oversight | Book a plan |
| Platform updates | Yes | Watching | No |
| Testing integrations and forms | No | Yes | Feedback |
| Consent settings | No | Technical setup | Approval |
| Keeping content current | No | Optional | Yes |
With Webflow the decision is rarely “host or agency”. The host is a given. The question is who looks after everything on top of it: your team, an agency or both together. How to maintain the Webflow CMS yourself is explained in the guide maintain the Webflow CMS yourself.
GDPR and TDDDG in ongoing care
Data protection does not end at launch. New tools, changed providers and new features change which data flows. That is why the question belongs in ongoing care.
Cookie banner, consent and tracking
In section 25 TDDDG (the German telecommunications and digital services data protection act, formerly TTDSG), the law requires that storing information on a device, or accessing it, generally happens only with consent after the user has been clearly and comprehensively informed. Exceptions apply, among others, where access is strictly necessary to provide a service the user has expressly requested. In practice this means tracking and marketing tools may only load after consent. The consent banner has to match technically what the site really loads.
Technically this is more than a banner. With the Google tag, tags behave differently depending on consent. The consent mode documentation describes that default values must be set before any measurement and updated after the user chooses, and that the consent itself has to be stored by the banner. If you do not test this, you may be tracking before consent. More in our guide tracking and consent under TDDDG and in the blog article cookie banners and GDPR. The German supervisory authorities have summarized their expectations in the guidance on digital services (German).
Privacy policy: maintained by specialists
The privacy policy has to match the services actually in use. It should be written and reviewed by data protection officers or lawyers. The agency supplies the list of what technically runs: tools, scripts, forms, embedded content.
Legal note
Which tools you may use, when consent is needed and how your policy should read is decided case by case by your data protection officer. An agency implements technically what has been approved professionally.
Comparing maintenance offers: keep consent in view
Offers look similar at first glance. The difference is in the details, above all consent, tracking and response time.
| Criterion | What to look for | Question to ask |
|---|---|---|
| Updates | What is updated, how often, with testing? | Is there a log? |
| Consent and tracking | Checks after changes, not only setup | Who tests after new tools? |
| Monitoring | Availability and forms | Who is notified and how? |
| Response time | Deadlines stated in writing | Do they apply on working days or around the clock? |
| Scope | What is allowance, what costs extra? | What is explicitly not included? |
| Data protection | Data processing agreement where needed | Who is the processor? |
Checklist: questions for the provider
- Which systems and extensions are maintained, and which are not?
- How often is data backed up and where are the backups stored?
- Is checking the cookie banner and consent part of the package?
- Who tests tracking and forms after changes?
- Which response times apply in writing, and at what times?
- How are outages reported?
- Which services are allowance, which cost extra?
- Is there a data processing agreement?
- Who is the contact and who covers for them?
- How are term and cancellation regulated?
Hosting and tracking from one source: what that means
Many managing directors want a single point of contact for hosting, maintenance and further development after a relaunch. That is possible as long as it stays clear who is responsible for what.
Data processing and hosting region
If a service provider processes personal data on your behalf, Article 28 GDPR requires a written contract. Among other things it covers the subject matter and duration of processing, instructions, confidentiality, security measures, the use of sub-processors and deletion after the end of the contract. Webflow offers a Data Processing Addendum for this. It includes, among other things, the EU standard contractual clauses and regulates the use of sub-processors. You should check for every tool where data is stored and which providers are involved.
Tracking with and without consent
Tracking that stores or reads information on the device generally needs consent under section 25 TDDDG. Whether and how you may measure without consent is a legal question for your data protection advisor.
What an agency offers and what partners handle
An agency can bundle hosting, setup and care. Legal review, the privacy policy and contracts with third-party providers sit with you and your data protection advisor. Which hosting options we offer and what is in the package we clarify in the first call. What matters is that the offer states in writing who is responsible for outages, backups and consent.
Fast website with a cookie banner: aviation example
Especially for companies with international customers, for example in aviation, the site should load fast and be legally clean at the same time. Both can be combined if you plan for them from the start.
According to web.dev, Google gives these thresholds for good Core Web Vitals: 2.5 seconds or less for Largest Contentful Paint, 200 milliseconds or less for Interaction to Next Paint and 0.1 or less for Cumulative Layout Shift. Scripts from tracking and consent providers are a typical drag. So: load only the tools you need, load scripts only after consent, and build the banner so that it does not shift the page. After every change to tracking or the banner, speed and consent should be tested again.
How we think about websites for aviation companies is described on the page aviation industry. We do not promise specific measurements, as they depend on structure, content and tools.
Who does what: the responsibility matrix
It is best to put responsibilities in writing. That way everyone knows who acts when something goes wrong. This also applies when a website was offline several times and nobody felt responsible: then there is almost always no named owner for monitoring and availability.
| Task | Host | Agency with maintenance | You and data protection |
|---|---|---|---|
| Servers and availability | Operation | Monitoring, reporting | Contract |
| Updates and bug fixing | Platform | Website and integrations | Approval for larger changes |
| Cookie banner, consent technology | No | Setup and testing | Professional requirements |
| Privacy policy | No | List of tools in use | Text and review |
| Data processing agreements | Provides contract | Points out required contracts | Signing and documentation |
| Content | No | Optional | Responsibility |
Typical mistakes
- The host is held responsible for things it never promised.
- New tools go live without the banner and privacy policy being adjusted.
- Nobody is named for monitoring, so outages are noticed late.
- Access sits with one person or a former service provider.
Costs of hosting, maintenance and consent
What hosting and maintenance cost depends mainly on the system, the scope and the response times.
Price factors
- System: hosted platform or self-operated CMS.
- Number of integrations, languages and pages.
- Response time and service hours.
- Scope of consent and tracking care.
- Included allowances for changes.
Some providers bundle hosting, licenses and care in a monthly package. That can be clear, as long as the offer states separately what applies to what and how long the term is. At Webwavers, care starts in the Care package from €500 per month net. What it contains for your website we define in the first call.
How we put this into practice at Webwavers
Webwavers is a Webflow Premium Partner and looks after websites after launch as part of website maintenance. Besides Webflow we work with WordPress, TYPO3 and headless setups. Which tasks sit with us in your case and which with your host or data protection officer we clarify in the first call and put in writing. We check consent and tracking technically, and the legal assessment stays with your data protection advisor.
Frequently asked questions
Is managed hosting enough on its own, or do we also need a maintenance contract?
Hosting alone is usually not enough. The host runs the technology, but nobody checks content, forms, extensions and consent. With a hosted platform, light care may be enough. With WordPress and plugins, a maintenance contract makes sense.
What covers more on a Webflow website: the agency or the host?
They cover different things. Webflow takes care of hosting, certificates and platform upkeep. The agency looks after integrations, changes, testing and the technical implementation of consent. It is not an either-or question.
Which agencies handle GDPR adjustments as part of website care?
That differs by provider. Ask whether checking the banner, consent and tracking is in the package and who gives the legal approval. The legal assessment belongs to your data protection advisor, not the agency. With us, we clarify the scope in the first call.
Who keeps the cookie banner and privacy policy up to date under TDDDG?
The company that operates the website is responsible. Technically the agency often maintains it, while the data protection advisor decides on the substance. What matters is that after every change to tools or scripts, someone checks whether the banner and policy still fit.
Are there web agencies that offer GDPR-compliant hosting and tracking?
Yes, many agencies bundle hosting, setup and care. Make sure a data processing agreement is in place, the providers involved are named and tracking loads only after consent. Whether a solution is compliant is assessed by your data protection advisor.
Which agency delivers a fast aviation website with a GDPR-compliant cookie banner?
We build websites for aviation companies and consider speed and consent from the start. Concrete values depend on the project. More on our page about the aviation industry.
How do I compare maintenance offers with GDPR services?
Compare scope, response time, consent checks, monitoring, allowances and contract terms. Ask what is explicitly not included. The table and checklist above help with that.
Which web agencies offer hosting, maintenance and further development from one source?
Several agencies do. What matters is that the contract states who is responsible for outages, backups and changes and which response times apply. We are happy to discuss this in the first call.
Conclusion
Hosting, maintenance and data protection are three jobs with three owners. If you name them clearly, you avoid the typical gaps around outages, forms and consent. Do you want to clarify who is responsible for what on your website? In the first call we go through hosting, maintenance and consent and suggest a package. Request a project
Sources
More guides
All guides
PHP2Shell: Is your TYPO3 or WordPress website affected? What you need to do now
Oct 21, 2026
Read more
Branding Agency, Freelancer or In-House: What Pays Off for Mid-Sized Companies?
Oct 31, 2026
Read more
GEO for B2B Industries: How Expert Content Gets Cited in ChatGPT and Perplexity
Oct 31, 2026
Read more
Wix, Squarespace, Jimdo or Webflow: Which Platform Can Carry a Company Website?
Oct 31, 2026
Read more
