The Polygon One platform stores its customers' data with Amazon Web Services (AWS) in the Frankfurt am Main region (eu-central-1), in Germany.
Polygon One is the compliance software of HRG Polygon One GmbH, Düsseldorf, for the EU Deforestation Regulation (EUDR) and the EU Packaging and Packaging Waste Regulation (PPWR). This page sums up where the platform's data is held, which certifications the data centre has and which contracts apply. The website's full privacy policy (in German) is at Datenschutz.
| Area | Where the data is stored | Basis |
|---|---|---|
| Platform (web app): data you and your suppliers enter | Amazon Web Services, Europe (Frankfurt) region, eu-central-1 | Processing on your behalf, agreement under Art. 28 GDPR |
| EUDR due diligence statements, once submitted | The European Commission's information system (TRACES) | Art. 33 of Regulation (EU) 2023/1115 |
| AI assistant on the product pages (EUDR and PPWR chat) | Amazon Web Services, Frankfurt am Main region (eu-central-1) | Data processing agreement with AWS, privacy policy section 7 |
| Meeting booking and customer management | HubSpot, generally data centres in the EU; a transfer to the US cannot be ruled out | Data processing agreement, EU-US Data Privacy Framework and standard contractual clauses, privacy policy section 6 |
| Website polygon-one.com | External hosting provider | Data processing agreement, privacy policy section 3 |
The Polygon One platform stores its data with Amazon Web Services in the Europe (Frankfurt) region, identifier eu-central-1. This includes what you and your suppliers enter in the platform, such as product data and CN codes, suppliers, geodata of the plots of production, documents and declarations.
The web app's interface (app.polygon-one.com) is delivered by Vercel Inc.
According to AWS, it is certified to ISO/IEC 27001:2022 (information security) and to ISO/IEC 27017:2015 and ISO/IEC 27018:2019 (cloud security, protection of personal data in the cloud); the certification is audited by EY CertifyPoint. The Frankfurt region (eu-central-1) is within the scope of the ISO/IEC 27001 certificate (AWS ISO/IEC 27001).
For the Frankfurt region, AWS also holds an attestation under the Cloud Computing Compliance Criteria Catalogue (C5) of Germany's Federal Office for Information Security (BSI) (AWS C5).
These certifications and attestations cover the AWS infrastructure. They are not a certification of HRG Polygon One GmbH.
If Polygon One processes personal data on your behalf, for example contact details of your contact persons at suppliers, Art. 28 GDPR requires a data processing agreement. Please contact us about it before the contract starts: kontakt@polygon-one.eu.
For the EUDR, Polygon One generates the due diligence statement from the data collected and submits it through the interface to TRACES, the European Commission's information system under Art. 33 of Regulation (EU) 2023/1115. The content of the statement under Annex II is then held there as well; the reference number comes back into the record in Polygon One.
The web app app.polygon-one.com can only be reached encrypted over HTTPS; unencrypted requests are redirected to HTTPS. In a test on 29 Sep 2026 the connection used TLS 1.3.
With Amazon Web Services (AWS) in the Frankfurt am Main region (eu-central-1), in Germany. This includes what you and your suppliers enter in the platform, such as product data, suppliers, geodata, documents and declarations.
Yes. AWS is certified to ISO/IEC 27001:2022, ISO/IEC 27017 and ISO/IEC 27018; the Frankfurt region is within the scope of the ISO/IEC 27001 certificate. For Frankfurt there is also a C5 attestation under the BSI criteria catalogue. The certifications cover AWS, not Polygon One as a company.
If Polygon One processes personal data on your behalf, for example contact details of your contact persons at suppliers, Art. 28 GDPR requires a data processing agreement. Please contact us about it before the contract starts.
To TRACES, the European Commission's information system. Polygon One submits the statement through the interface, and the reference number comes back into the record.
Also with AWS in the Frankfurt am Main region (eu-central-1). You do not need to include personal data in your messages to ask about the regulations. After the first answer the chat asks for a business email address; from the fourth message it is required to continue chatting.
In Düsseldorf, Germany. Polygon One is the software of HRG Polygon One GmbH, Kasernenstraße 67, 40213 Düsseldorf, registered at the Düsseldorf Local Court under HRB 112666.
As of 29 Sep 2026