This English version is provided for convenience. Only the German version is legally binding.
The controller within the meaning of the General Data Protection Regulation (GDPR) and other data protection provisions is:
HRG Polygon One GmbH
Kasernenstraße 67
40213 Düsseldorf
Germany
Represented by the managing directors: Alexander Rütjes, Niklas Glienke, Yannik Hampe
Email: kontakt@polygon-one.eu
If you have any questions about the processing of your personal data or about exercising your rights, you can contact us at any time using the contact details above.
As a rule, we process our users' personal data only to the extent necessary to provide a functional website and our content and services. Processing generally takes place only with the user's consent. An exception applies in cases where obtaining prior consent is not possible for factual reasons and the processing is permitted by law.
We process your personal data on the basis of:
We process and store personal data only for the period necessary to achieve the respective purpose of processing, or for as long as statutory retention periods apply (in particular retention periods of six or ten years under commercial and tax law). Once the purpose no longer applies or a period expires, the data is routinely erased or its processing is restricted.
Our website is hosted by an external service provider. The data collected on the website is processed on the host's servers. We have concluded a data processing agreement with the host in accordance with Art. 28 GDPR. The legal basis is our legitimate interest in providing our online services securely, quickly and efficiently (Art. 6(1)(f) GDPR).
Each time our website is accessed, our system automatically collects data and information from the computer system of the accessing device. The following data is collected:
This data is stored in our system's log files. It is not combined with other data sources.
The purpose of the processing is to ensure the smooth operation of the website, to ensure system security and stability and to investigate cases of misuse or attacks. The legal basis is Art. 6(1)(f) GDPR. The log files are deleted or anonymised after 30 days.
Our website uses cookies. Cookies are small text files that are stored on your device. They do no harm and contain no viruses. Cookies serve to make our services more user-friendly, effective and secure.
Technically necessary cookies are required to provide basic functions of the website (for example, storing your cookie settings). The legal basis is Section 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG) in conjunction with Art. 6(1)(f) GDPR.
We use all other cookies and comparable technologies (for example for statistical or marketing purposes) only if you have given your prior consent via our consent banner. The legal basis is Section 25(1) TDDDG in conjunction with Art. 6(1)(a) GDPR. You can withdraw your consent at any time with effect for the future by opening the cookie settings on our website again.
You can change or withdraw your choice at any time with effect for the future: the “Cookie settings” link in the footer of every page opens the consent banner again, and you can adjust your decision.
You can also configure your browser so that you are informed when cookies are set, allow cookies only in individual cases or exclude them in general. If cookies are deactivated, the functionality of our website may be limited.
If you contact us by email or via a contact form, we process the data you provide (in particular your name, email address, where applicable your company and telephone number, and the content of your message) to handle your enquiry and for any follow-up questions.
The legal basis is Art. 6(1)(b) GDPR where your enquiry relates to the initiation or performance of a contract, and otherwise our legitimate interest in responding to enquiries addressed to us (Art. 6(1)(f) GDPR).
The data is deleted as soon as it is no longer required for the purpose for which it was collected and no statutory retention obligations prevent deletion.
For booking meetings online and for managing contact and prospect data (CRM), we use HubSpot, a service of HubSpot Ireland Limited, Ground Floor, Two Dockland Central, Guild Street, Dublin 1, Ireland.
If you book a meeting via our website or via a link provided by us, HubSpot processes the data you enter on our behalf (in particular your name, email address, where applicable your company and telephone number, and the selected appointment). In addition, we store contact details and communication histories in our CRM system in the course of initiating and conducting business.
The legal basis is Art. 6(1)(b) GDPR where the processing serves the initiation or performance of a contract, and otherwise our legitimate interest in managing our business contacts efficiently (Art. 6(1)(f) GDPR).
We have concluded a data processing agreement with HubSpot in accordance with Art. 28 GDPR. Processing generally takes place in data centres within the European Union. A transfer to HubSpot, Inc., based in the USA, cannot be completely ruled out. In that case, the transfer is based on the European Commission's adequacy decision on the EU-US Data Privacy Framework and, in addition, on standard contractual clauses. Further information can be found in HubSpot's privacy policy: https://legal.hubspot.com/privacy-policy
The booking calendar is only loaded after you have given your consent (two-click solution): either via “Accept all” in the consent banner or via the “Load calendar” button directly at the booking form. The “Load calendar” button gives your consent solely to loading HubSpot's booking calendar and the cookies it sets (Art. 6(1)(a) GDPR, Section 25(1) TDDDG); Google Analytics, Leadfeeder and HubSpot's site-wide tracking script are not loaded as a result. You can withdraw this consent at any time via “Cookie settings” in the footer. Before you give your consent, no data is exchanged with HubSpot.
In addition, we use HubSpot's site-wide analytics and tracking script on our website. It uses cookies (including hubspotutk, __hstc, __hssc, __hssrc) to recognise returning visitors, to evaluate the use of the website statistically and to assign interactions to our CRM. This script is only loaded after you have given your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG); without consent, no tracking takes place. You can withdraw your consent at any time via “Cookie settings” in the footer. Processing takes place via HubSpot's EU infrastructure; a transfer to the USA is based on the adequacy decision on the EU-US Data Privacy Framework and, in addition, on standard contractual clauses.
On our product pages we offer an AI-powered assistant that answers general questions about the EU Deforestation Regulation (EUDR) or the EU Packaging and Packaging Waste Regulation (PPWR). The assistant can be used without registration and only becomes active when you send a message yourself; no cookies are set in the process.
When you ask a question, your chat entries, the previous conversation history, a randomly generated session ID and technically necessary connection data (in particular your IP address) are transmitted to our servers and processed there to generate the answer. Hosting is provided by Amazon Web Services (AWS EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg) in the Frankfurt am Main region (eu-central-1); a data processing agreement in accordance with Art. 28 GDPR is in place with AWS.
Please do not enter any personal data in your chat messages; such information is not required to answer your subject-matter questions. We use the chat histories to answer your enquiry and for quality assurance of the assistant. We store them only for as long as is necessary for the purposes stated in this section (section 2.3).
After the first answer, we ask you to provide your business email address on a voluntary basis; you can skip this request. From the fourth message onwards, providing a business email address is a prerequisite for continuing the chat. We do not accept private email addresses (for example from Gmail or GMX). We store the address together with the session ID and the topic of the chat (EUDR or PPWR) on our servers at Amazon Web Services in the Frankfurt am Main region (eu-central-1) and use it to contact you about your enquiry and about our services relating to the EUDR and PPWR. The address is linked to the conversation history of that session via the session ID. It is not used for any other purpose.
The legal basis for processing your chat entries is Art. 6(1)(f) GDPR (legitimate interest in an efficient information service that is available at all times) or Art. 6(1)(b) GDPR where your enquiry serves the initiation of a contract. We process an email address you provide voluntarily on the basis of your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time with effect for the future, for example by email to kontakt@polygon-one.eu. We process the address required from the fourth message onwards on the basis of Art. 6(1)(f) GDPR (legitimate interest in focusing the free information service on business prospects and approaching them about our services) or Art. 6(1)(b) GDPR where your enquiry serves the initiation of a contract. You can object to this processing at any time, and to its use for approaching you about our services also without giving reasons (section 14). After an objection or withdrawal, we delete the address unless statutory retention obligations prevent this; otherwise we store it only for as long as is necessary for the stated purposes (section 2.3).
In the EUDR chat, after an assessment you can provide your name, business email address and company in order to receive a checklist by email. We process this information together with the assessment and the session ID on the basis of your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time with effect for the future. After a withdrawal, we delete this information unless statutory retention obligations prevent this; otherwise section 2.3 applies.
For consistent display, we use fonts that are partly loaded locally from our own server (no data is transferred to third parties in this case) and partly embedded via Bunny Fonts, a service of BunnyWay d.o.o., Cesta komandanta Staneta 4A, 1215 Medvode, Slovenia (EU).
When the font files are retrieved, your IP address is transmitted to Bunny Fonts for technical reasons; according to the provider, however, it is neither stored nor logged (zero-log CDN within the EU). No connection to Google servers (Google Fonts) is established. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in a consistent and high-performance display of our website).
On our pages on the EU Deforestation Regulation, you can subscribe to the EUDR newsletter. We write when something changes in the EUDR that affects companies' obligations. Your email address is all you need to subscribe.
Subscription uses the double opt-in procedure: after submitting the form, you receive an email with a confirmation link. We add you to the mailing list only after you have confirmed. To be able to prove the subscription, we store the time of subscription and of confirmation, the page on which you subscribed and the wording of your consent.
For subscription, management of the mailing list and sending, we use HubSpot (see section 6) on the basis of a data processing agreement. The subscription form sends your details directly to HubSpot; for technical reasons, your IP address is transmitted in the process. For the form, the page does not load any HubSpot script and does not set any cookies. When sending, HubSpot records whether an email was delivered and opened and which links in it were clicked. We use this evaluation to see which topics matter to our readers.
The legal basis for sending and evaluation is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). Logging the subscription is based on our legitimate interest in being able to prove consent (Art. 6(1)(f) in conjunction with Art. 7(1) GDPR). You can withdraw your consent at any time with effect for the future, via the unsubscribe link in every email or by sending a message to kontakt@polygon-one.eu.
We use your email address for the newsletter until you unsubscribe. After you unsubscribe, we keep it on a block list so that you no longer receive the newsletter, and we retain proof of your earlier consent for as long as we need it to defend against claims (Art. 6(1)(f) GDPR). If you do not confirm the subscription, you will not receive the newsletter; section 2.3 applies to the stored information.
We use Google Analytics 4, a web analytics service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”), to evaluate the use of our website statistically and to improve our services. Google Analytics uses cookies and similar technologies that enable an analysis of your use of the website. IP addresses are truncated before processing; this rules out any direct link to an individual.
It is used exclusively on the basis of your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG), which you give via our consent banner and can withdraw at any time with effect for the future (“Cookie settings” in the footer). Without consent, Google Analytics is not loaded. The data collected through Google Analytics is generally deleted after 14 months. Personal data may be transferred to the USA in the process; such a transfer is based on the adequacy decision on the EU-US Data Privacy Framework and, in addition, on standard contractual clauses. Further information: https://policies.google.com/privacy
We use Leadfeeder, a service of Liidio Oy (Dealfront), Mikonkatu 17 C, 00100 Helsinki, Finland, to identify which companies visit our website. For this purpose, Leadfeeder analyses the truncated IP address and the visit behaviour (pages accessed, duration of the visit) and assigns the IP address to a company. We do not create personal profiles of individual visitors in the process; the analysis serves to approach companies in a business context (B2B).
It is used exclusively on the basis of your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG), which you give via our consent banner and can withdraw at any time with effect for the future (“Cookie settings” in the footer). Without consent, Leadfeeder is not loaded. Processing takes place within the European Union. Further information can be found in Dealfront's privacy policy: https://www.leadfeeder.com/privacy/privacy-notice/
We use Google Ads, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, to draw attention to our services and to measure the success of our ads (conversion tracking). If you reach our website via a Google ad, a cookie may be set that allows Google and us to track whether certain actions were carried out on our website. We use conversion measurement to recognise whether a demo appointment is booked after a click on an ad; for this purpose, the booking event is transmitted to Google Ads via Google Analytics 4. We do not use personalised advertising or remarketing; the associated consent signal (ad_personalization) remains permanently deactivated.
It is used exclusively on the basis of your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG), which you give via our consent banner and can withdraw at any time with effect for the future. Without consent, no conversion measurement takes place. Personal data may be transferred to the USA in the process. Such a transfer is based on the adequacy decision on the EU-US Data Privacy Framework and, in addition, on standard contractual clauses. Further information: https://policies.google.com/privacy
As a rule, your personal data is not transferred to third parties. Exceptions apply only where:
In addition, we use carefully selected service providers to deliver our services (in particular for hosting, CRM and email communication), who process personal data exclusively on our behalf and on the basis of data processing agreements in accordance with Art. 28 GDPR.
Where we transfer personal data to countries outside the European Union or the European Economic Area (in particular to the USA), we do so only if there is an adequacy decision of the European Commission (Art. 45 GDPR, for example the EU-US Data Privacy Framework for certified providers), if appropriate safeguards such as standard contractual clauses have been agreed (Art. 46 GDPR) or if an exception under Art. 49 GDPR applies.
You have the following rights against us with regard to the personal data concerning you:
Where processing is based on your consent, you can withdraw it at any time with effect for the future (Art. 7(3) GDPR). This does not affect the lawfulness of the processing carried out before the withdrawal.
To exercise your rights, an informal message to kontakt@polygon-one.eu is sufficient.
You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The supervisory authority responsible for us is:
Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW)
(State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia)
Kavalleriestraße 2-4
40213 Düsseldorf
https://www.ldi.nrw.de
Where we process your personal data on the basis of Art. 6(1)(f) GDPR (legitimate interest), you have the right to object to the processing at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.
If your personal data is processed for the purpose of direct marketing, you have the right to object to processing for this purpose at any time and without giving reasons.
We use TLS encryption on our website. You can recognise an encrypted connection by the padlock symbol in your browser's address bar and by the address bar beginning with “https://”. In addition, we use technical and organisational measures in accordance with Art. 32 GDPR to protect your data against accidental or intentional manipulation, loss, destruction and unauthorised access. Our security measures are continuously improved in line with technological developments.
No automated decision-making, including profiling within the meaning of Art. 22 GDPR, takes place on our website.
The provision of personal data is neither required by law nor by contract. Without certain data, however, we may not be able to handle your enquiry or conclude a contract.
We reserve the right to amend this privacy policy so that it always complies with current legal requirements or in order to implement changes to our services, for example when introducing new services. The privacy policy in force at the time of your next visit then applies.
As of October 2026