How to choose a web agency in Europe: hosting, GDPR and ownership questions

To choose a web agency in Europe, look past the portfolio and price and ask four sets of questions: where your site and its data will be hosted, whether the agency will sign a GDPR data processing agreement, how cookie consent and accessibility will be handled, and who will own the code, design, content and domain when the project ends. A good agency answers all of them in writing before you sign. A vague answer on any of them is a warning sign, because these are the things that become expensive to fix after launch.

Here is what to ask, why each question matters, and what a good answer looks like.

Start with the usual basics

The EU-specific questions come on top of the normal ones, not instead of them:

• Have they built sites for businesses like yours, in your language?
• Can you speak to two recent clients?
• Who will actually work on your project, and are they employees or subcontractors?
• What is included in the quote, and what is billed extra?
• What happens after launch: support, updates, response times?

If an agency fails these, the rest doesn't matter.

Hosting and data location

Where will the site and its data live?

Your website collects personal data the moment someone fills in a contact form, books an appointment or buys something. Ask:

• In which country are the servers?
• Which hosting company is used, and does the agency resell it or do you hold the account?
• Where are backups stored?
• Which other services touch visitor data: form tools, email delivery, chat widgets, analytics, booking systems?

Hosting inside the EU or EEA is the simplest option for GDPR, but hosting elsewhere is not forbidden. Personal data can flow from the EU to US companies certified under the EU-US Data Privacy Framework, which the European Commission found adequate in July 2023. The EU General Court rejected a challenge to that decision in September 2025, though a further appeal is possible. If a provider relies on it, ask for confirmation that the company is certified.

Who controls the hosting account?

Ideally the hosting account is in your company's name, with the agency given access. If the agency hosts on its own account, get in writing that it will hand over a full copy of the site and database, in a usable format, when you leave.

GDPR: the data processing agreement

When an agency hosts your site, maintains it or has access to your form submissions, it processes personal data on your behalf. Under GDPR you are the controller and the agency is a processor. Article 28 says the relationship must be covered by a binding contract, usually called a data processing agreement (DPA).

The DPA must set out the subject, duration, nature and purpose of the processing, the types of data and the categories of people concerned. It must also oblige the agency to:

• process data only on your documented instructions;
• keep staff bound by confidentiality;
• apply appropriate security measures;
• use sub-processors (hosting, email, backup providers) only with your prior written authorisation, and pass the same obligations on to them;
• help you respond to requests from people exercising their rights;
• delete or return the data at the end of the contract;
• give you the information you need to check compliance, including audits.

Ask to see the agency's standard DPA before you sign the main contract. An agency that has never been asked for one is telling you something. The European Data Protection Board's guidelines on controllers and processors are the reference document if you want to go deeper.

Why this matters

GDPR fines can reach €20 million or 4% of worldwide annual turnover, whichever is higher, for the most serious infringements. Small businesses rarely face figures like that, but complaints from customers, data breaches through a poorly maintained site and investigations do happen. The DPA is what shows you chose your processor carefully.

Cookies and third-party services

How will consent be handled?

Under the ePrivacy rules, storing or reading information on a visitor's device (cookies, local storage, pixels) requires consent, unless it is strictly necessary for a service the visitor asked for. France's regulator, the CNIL, spells out what valid consent looks like in practice: refusing must be as easy as accepting, consent must come before the cookies are set, and it must be possible to withdraw it at any time just as easily.

Ask the agency:

• Which consent management tool will you use, and what does it cost per month?
• Will analytics and ad tags be blocked until consent is given?
• Is Google consent mode set up correctly if we plan to run Google Ads?
• Can you show me the site's cookie list before launch?

Fonts, maps and embedded content

Third-party services load from other companies' servers and send them the visitor's IP address. A German court made this concrete in January 2022: the Munich Regional Court ordered a site operator to stop passing visitors' IP addresses to Google through Google Fonts and to pay the claimant €100 in damages, noting that the fonts could have been hosted on the site's own server. Ask whether fonts are self-hosted and whether maps and videos load only after consent or a click.

Accessibility

The European Accessibility Act has applied since 28 June 2025. It covers e-commerce services, among others, meaning websites and apps used to sell to consumers. Microenterprises providing services (fewer than 10 people and annual turnover or balance sheet of €2 million or less) are exempt. Ask the agency which accessibility standard it builds to (WCAG 2.2 level AA is the common target), and whether it tests with a keyboard and a screen reader. Even if you are exempt, accessible sites are easier for everyone to use.

Ownership: code, design, content and domain

This is the area that causes the most trouble when a relationship ends.

Copyright doesn't move to you automatically

In the EU, copyright generally belongs to the person who created the work. For software, EU law gives the employer the economic rights when an employee writes code as part of their job, but there is no equivalent rule for an outside agency. In practice, unless your contract says otherwise, the agency or its staff can keep the rights to the design and code it made for you. National rules differ, so the contract is what counts.

Your contract should state clearly that, on full payment:

• you own, or receive an assignment of the economic rights to, the custom design, code and content created for you;
• the agency keeps the right to reuse its general tools and components, with you receiving a licence to use them on your site;
• third-party licences (themes, plugins, fonts, photos) are listed, with who pays for renewals;
• the agency may show the project in its portfolio, if you agree.

The domain must be in your name

Registering a domain doesn't create a property right in the name, but the registrant is the person in control of it and responsible for it. If the agency registers your domain under its own name, it controls your website address and email. Ask for the domain to be registered in your company's name, with your email as the owner contact, and for you to have the registrar login.

Can you leave?

Ask the exit question directly: "If we stop working together, what exactly do we receive, in what format, and how fast?" A good answer includes a full site backup, database export, admin access, all licence keys and handover of hosting and domain within a set number of days.

Watch for proprietary site builders that can't export a working site. They can be fine, but you are renting, not owning, and you should price them that way.

A checklist to send to shortlisted agencies

1. Where will the site, database and backups be hosted, and by whom?
2. Which third-party services will process visitor data?
3. Will you sign a GDPR data processing agreement? Please send your standard version.
4. Which consent tool will you use, and will tags wait for consent?
5. Are fonts self-hosted?
6. Which accessibility standard do you build to, and how do you test?
7. Who will own the design, code and content after payment?
8. Will the domain and hosting accounts be in our name?
9. What do we receive if we end the contract, and within how many days?
10. What does maintenance cost per month, and what does it include?

Where PNE fits

PNE Solutions designs and builds websites for small businesses in Canada and Europe. If you are comparing agencies, us included, send each one the checklist above and compare the written answers. Our website design page shows what a project includes, and our guide to website costs in Europe covers budgets by country.

Sources

• Regulation (EU) 2016/679, Article 28 — legislation.gov.uk
• Regulation (EU) 2016/679, Article 83 (as adopted) — legislation.gov.uk
• Guidelines 07/2020 on the concepts of controller and processor in the GDPR — European Data Protection Board
• EU-US data transfers — European Commission
• Press Release No 106/25, Latombe v Commission — Court of Justice of the European Union
• Cookies et traceurs : que dit la loi ? — CNIL
• LG München I, 3 O 17493/20 (Google Fonts) — Bayern.Recht
• Europe Frequently Asked Questions — European IP Helpdesk