We, Hygraph GmbH, Dircksenstraße 47, 10178 Berlin, Germany (hereinafter "we/our"), take the protection of your personal data very seriously and strictly adhere to all applicable laws and regulations on data protection, in particular the General Data Protection Regulation (GDPR), the German Data Protection Act (Bundesdatenschutzgesetz - BDSG), and the German Telemedia Act (Telemediengesetz - TMG). The following explanations provide an overview of how we ensure this protection, the data we process, and the purposes for which we process it.

1. Name and address of the Controller

The Controller within the meaning of Art. 4 No. 7 of the GDPR is:

Hygraph GmbH, Dircksenstraße 47, 10178 Berlin, Germany

Phone: +49 641 580 988 14, Email: info@hygraph.com

2. Name and address of the data protection officer

The data protection officer of the person responsible is: Will Robinson

3. Your rights as the data subject

You have the following rights towards us regarding your personal data:

• Right to information
• Right to correction or deletion
• Right to restrict processing
• Right to object to the processing
• Right to data transferability

Please send an email to support@hygraph.com to exercise one or more of the aforementioned rights. If you believe that the processing of personal data concerning you violates the GDPR, you have the right of appeal to a supervisory authority, without prejudice to any other remedies.

4. General information regarding the data processing

When using the website for information purposes only, i.e., if you do not register or otherwise provide us with information, we only collect the personal data that your browser transmits to our server. If you wish to view our website, we collect the following data, which are technically necessary for us to display our website to you and to provide stability and security (legal basis is Art. 6 para. 1 s. 1 lit. f GDPR):

• IP address
• date and time of the request
• time zone difference to Greenwich Mean Time (GMT)
• content of the request (specific page)
• access status/HTTP status code
• the amount of data transferred in each case
• website from which the request comes
• Browser
• operating system and its surface
• language and version of the browser software.

In addition to the aforementioned data, cookies are stored on your computer when you use our website. Cookies are small text files stored on your hard disk by the browser you use. Through these cookies, we receive certain information from you. Cookies cannot run programs or transmit viruses to your computer. They help make the website more user-friendly and more effective overall.

We process and store your personal data only for the period necessary to achieve the purpose of storage or as required by applicable laws. If the storage purposes no longer apply, or if a storage period stipulated by applicable law has expired, the personal data is routinely blocked or deleted in accordance with the applicable statutory provisions.

The criterion for the duration of the storage of your personal data is the respective legal retention period. After this period expires, the corresponding data will be routinely deleted, provided that they are no longer required for contract fulfilment, contract initiation, or other legitimate interests.

5. Use of cookies

a. This website uses the following types of cookies, the scope and functioning of which are explained below:

• Transient cookies (see b),
• Persistent cookies (see c).

b. Transient cookies are automatically deleted when you close your browser. This includes, in particular, the session cookies. These stores a so-called session ID, which allows different requests from your browser to be assigned to the same session. This will ensure your computer is recognized when you return to our website. Session cookies are deleted when you log out or close your browser.

c. Persistent cookies are automatically deleted after a specified period, which may vary depending on the cookie. You can delete cookies at any time in your browser's security settings.

d. You can configure your browser settings according to your wishes and, for example, refuse the acceptance of third-party cookies or all cookies. Please note that you may not be able to use all functions of this website.

e. We use cookies to identify you for follow-up visits if you have an account with us. Otherwise, you will have to log in again for each visit.

f. The purpose of using technically required cookies is to simplify the use of our website for your benefit. Several features of our website cannot be provided without cookies. For these functionalities, it is required to re-identify the browser. The use of analytical cookies is intended to improve the quality of our website and its content. These cookies track website use to help us optimize our offering.

g. The legal basis for the use of cookies is Art. 6 Par. 1 S. 1 lit. f GDPR. Our legitimate interest is covered in lit. g above.

6. Use of Google Analytics

This website uses Google Analytics, a web analysis service provided by Google Inc. ("Google"). Google Analytics uses cookies to help the website analyze how users interact with it. The information generated by the cookie about your use of this website is usually transferred to a Google server in the USA and stored there. However, if IP anonymization is activated on this website, Google will mask your IP address within Member States of the European Union or other states party to the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and shortened there. On our behalf, Google will use this information to evaluate your use of the website, compile reports on website activity, and provide us with additional services related to website and Internet use.

The IP address your browser transmits in the context of Google Analytics is not merged with other Google data.

You may refuse the use of cookies by selecting the appropriate settings in your browser; however, please note that if you do so, you may not be able to use the full functionality of this website. You can also prevent Google from collecting the data generated by the cookie and relating to your use of the website (including your IP address) and from processing this data by Google by downloading and installing the browser plug-in available under the following link: https://tools.google.com/dlpage/gaoptout?hl=en.

This website uses Google Analytics with the extension "_anonymizeIp()". As a result, IP addresses are further processed in abbreviated form to rule out identification. As a result, insofar as the data collected about you enables an identification, such a possibility will be excluded immediately.

We use Google Analytics to analyze and regularly improve our website's performance. We can improve our offer and make it more interesting for you as a user. For the exceptional cases in which personal data is transferred to the USA, Google has submitted to the EU-US Data Privacy Framework, https://www.edpb.europa.eu/our-work-tools/our-documents/other-guidance/eu-us-data-privacy-framework-faq-european-businesses_en. The legal basis for the use of Google Analytics is Art. 6 Par. 1 S. 1 lit. f GDPR.

Third-party information: Google Dublin, Google Ireland Ltd, Gordon House, Barrow Street, Dublin 4, Ireland. Fax: +353 (1) 436 1001.

Terms of Use: https://www.google.com/analytics/terms/de.html, Privacy overview: https://www.google.com/intl/de/analytics/learn/privacy.html, and Privacy policy: https://www.google.de/intl/de/policies/privacy.

7. Use of chat function

We offer chat as an additional option for our users to communicate with us on our website. The information outlined in section 4 is processed in connection with your use of the chat function. Legal basis is Art. 6 para. 1 s. 1 lit. f GDPR.

We use the external service provider Intercom, Inc. to provide the chat function. The processing of your personal data by Intercom, Inc. is based on an agreement on data protection and data security that complies with legal requirements. Intercom, Inc. has submitted to the EU-US Data Privacy Framework, https://www.edpb.europa.eu/our-work-tools/our-documents/other-guidance/eu-us-data-privacy-framework-faq-european-businesses_en.

Third-party information: Intercom, Inc., 55 2nd Street, 4th Floor, San Francisco, CA 94105, USA, https://www.intercom.com/. Privacy policy:https://www.intercom.com/legal/privacy.

8. Use of our service “Hygraph.”

If you want to use our service “Hygraph”, you have to sign up with your email address, a password, and your name. We use the so-called double opt-in procedure for sign-up, i.e., your registration is not complete until you have previously confirmed your registration via a confirmation e-mail sent to you for this purpose by clicking on the link contained therein. If you do not receive a confirmation, your registration will be automatically deleted from our database.

Providing the above data is mandatory. Any further personal data you provide is voluntary, and by providing it, you consent to its processing in accordance with this privacy policy.

We process the personal data only for and in connection with the provision of Hygraph.

We use your email address to provide you with information about updates to Hygraph via our regular newsletter. You can revoke your consent to receive our newsletter at any time by using the respective link in the newsletter or sending an email to support@hygraph.com.

The legal basis for the processing of mandatory personal data in relation to the use of Hygraph is Art. 6 para. 1 s. 1 lit. b GDPR; the legal basis for voluntary personal data is Art. 6 para. 1 s. 1 lit. a GDPR.

We use the services and storage systems of external service providers to provide Hygraph. These service providers have access to the personal data you upload to Hygraph. The processing of your personal data by the respective service provider is based on an agreement on data protection and data security that complies with legal requirements.

These service providers are categorized as follows:

• Hosting service providers,
• Subscription management and invoicing tool providers,
• Payment processing tool providers,
• Authentication tool providers,
• Communication tool providers,
• Error analysis tool providers.

Last updated: 19.03.2025