Hedj privacy notice
About version 1
- What changed
- First published version
- Why
- This notice replaces Hedj's earlier draft privacy policy. It now names our partners and our role for each kind of data, the legal basis for each use, where data goes and how long we keep it.
- What it means for you
- It explains how Hedj handles personal data, including bank data received through Yapily Connect and data used for Ebury's FX and payment services, and how to use your rights.
This notice explains how Hedj Financial Risk Management Limited ("Hedj", "we", "us", "our") collects, uses, shares and protects personal data when organisations and their people use the Hedj platform at app.hedj.eu and our websites.
1. Who we are
Hedj Financial Risk Management Limited is a company registered in Ireland (registered no. 803831). Registered address: 2 Southwood Park, Blackrock, Co. Dublin, A94 D2C1, Ireland.
For any question about this notice or your personal data, email support@hedj.eu with "Data protection" in the subject line, or write to us at our registered address.
Our lead supervisory authority is the Data Protection Commission in Ireland.
2. Whose data this notice covers
- People who visit our websites.
- People who use Hedj for an organisation (our customer), including admins and other users.
- Directors, owners and other people connected with a customer, where we check who the customer is.
- People named in a customer's bank transactions, payment details or beneficiary details ("third parties named in transactions"). We usually cannot contact these people directly, so this notice is how we inform them.
3. Our role for each kind of data
| Data and purpose | Hedj's role | Partner's role |
|---|---|---|
| Accounts, users, organisations and the treasury data customers enter in Hedj | Controller | Not applicable |
| Bank data: the bank data service that reads it from the bank | Yapily Connect provides that service. In the UK, Hedj acts as Yapily Connect Ltd's agent once registered with the FCA; in the EEA, Hedj is not its agent | Yapily Connect Ltd (UK) or Yapily Connect UAB (EEA) is an independent controller |
| Bank data once Hedj receives it, to provide Hedj's features | Controller | Yapily Ltd processes it for Hedj, as our processor |
| Business verification and screening for bank connections and Ebury services | Controller | Not applicable |
| Ebury onboarding information, payment instructions and beneficiary details | Processor, acting on Ebury's instructions | Ebury is the controller |
| Ebury client profile criteria and joint marketing | Joint controller with Ebury | Joint controller with Hedj |
| Hedj's own records of its customers and its relationship with them, including records of FX contracts | Independent controller | Ebury is an independent controller of its own records |
4. The personal data we collect
| Category | Examples | Where it comes from |
|---|---|---|
| Account and user data | Name, email address, job title, role, permissions, authority limits, sign-in records | You or your organisation's admin |
| Organisation data | Organisation name, country, plan, users and access requests | You or your organisation's admin |
| Treasury data | Exposures, forecasts, hedges, scenarios, cash, debt, investments and counterparties | You or your organisation |
| Bank data | Account details, balances, transactions, standing orders and direct debits, and the account holder's name | Your bank, through Yapily Connect, when you connect an account |
| Third parties named in transactions | Names, references and account details that appear in transaction descriptions, payment details or beneficiary details | Your bank, Ebury or you |
| Derived data | Patterns, categories and forecasts built from your data (forecasts are assumptions, not facts) | Created by Hedj |
| Business verification data | Company register data, directors, owners, ID documents, and ID and selfie images | You, public registers |
| Screening results | Results of sanctions, politically exposed person and adverse media checks | Public lists and our checks |
| Ebury data | FX contracts, quotes, currency accounts and balances, beneficiaries, payments and invoices | Ebury and you |
| Terms acceptance records | Which version of which terms a person accepted or was shown, when, from which IP address and browser, and the authority statement they gave | You |
| Technical data | IP address, device and browser details, logs and diagnostics | Automatically, when you use Hedj |
ID and selfie images are compared manually by a Hedj reviewer. We do not use automated biometric matching.
We do not ask for special category data, such as health or religious information. It may appear incidentally in bank transaction descriptions. We do not use it for any purpose of its own.
Identifiers that appear in the free text of bank transactions are redacted where we can detect them.
5. Legal bases for using your data
| Purpose | Whose data | Legal basis |
|---|---|---|
| Providing Hedj to a sole trader or partnership | The sole trader or partners | Contract |
| Providing Hedj to a company | Its staff and other users | Legitimate interests: delivering the service the company has contracted for |
| Connecting bank accounts and using bank data to show cash, forecast, reconcile and categorise | Sole traders and partners | Contract |
| The same, for companies | Company staff and account holders | Legitimate interests: delivering the service the company asked for |
| Holding and using data about third parties named in transactions or beneficiary details | Third parties named in transactions | Legitimate interests: giving customers complete and accurate records of their own transactions and payments |
| Sharing data with Yapily Connect and Ebury so they can provide the services a customer chooses | Users, account holders, directors and owners | Contract (sole traders and partners); legitimate interests (everyone else) |
| Business verification and screening | Users, directors and owners | Legitimate interests: preventing fraud and financial crime and meeting our partners' requirements; legal obligation where a law binds Hedj, such as sanctions law |
| Processing Ebury onboarding, payment and beneficiary data | Everyone in that data | We act on Ebury's instructions; Ebury decides the legal basis as controller |
| AI-enhanced categorisation, when an admin switches it on | Third parties named in transactions | Legitimate interests: categorising transactions accurately, with personal details stripped first |
| Security, fraud prevention, support and improving the service | All users | Legitimate interests |
| Keeping records of terms accepted and defending legal claims | Users who accept terms | Legitimate interests; legal obligation where a law requires the record |
| Tax and accounting records | Customers and their contacts | Legal obligation |
| Telling customers about Hedj's products | Customer contacts | Legitimate interests (you can opt out at any time) |
We rely on legal obligation only where a law binds Hedj itself.
We do not rely on consent as the legal basis for sharing your data with Yapily Connect or Ebury. When you press Confirm to connect a bank, you give the explicit consent that payment services law requires for the bank data service. That is a step under payment services law. It is not consent under data protection law.
Where e-privacy law requires your permission before we set non-essential cookies or send certain marketing emails, we ask for it first. Our Cookie Policy explains our cookies.
Where we rely on legitimate interests, we have weighed those interests against your rights, and you can object (see section 10).
6. Who we share data with
We do not sell personal data. We share it only as follows.
- Yapily Connect Ltd and Yapily Connect UAB provide the bank data service as independent controllers. Your data will be shared with Yapily and may be used in connection with Yapily's value-added services. See Yapily's Privacy Notice and Yapily Connect's End User Terms.
- Yapily Ltd provides the technology that connects Hedj to banks, as our processor.
- Ebury (Ebury Partners UK Limited and Ebury Partners Belgium NV/SA) provides FX and payment services. Ebury's privacy notice is at privacy.ebury.com.
- Amazon Web Services (AWS) hosts the platform, sends our emails and runs AI models for us, as our processor.
- Professional advisers, auditors, regulators, law enforcement and courts, where the law requires it or to protect our rights.
Before any other company processes personal data for us, such as an identity verification provider, we will add it to this notice.
7. Where your data is processed
Hedj hosts its platform with AWS in the EU, in the Stockholm (eu-north-1) region. AI models run in AWS Bedrock in the EU.
Yapily Ltd and Yapily Connect Ltd are in the United Kingdom, and Ebury Partners UK Limited is in the United Kingdom. Transfers from the EEA to the UK rely on the European Commission's adequacy decision for the UK. Transfers from the UK to the EEA rely on the UK's adequacy regulations.
Some of Yapily's sub-processors are in the United States. Those transfers are covered by the European Commission's Standard Contractual Clauses, with the UK addendum where UK law applies. Yapily's Privacy Notice gives more detail.
8. How long we keep data (retention)
| Category | How long we keep it |
|---|---|
| Account, user and organisation data | While the organisation's account is open, then 6 years |
| Treasury data | While the organisation's account is open, then deleted or anonymised as set out in the Master Terms |
| Bank data, including data about third parties named in transactions | While the organisation is a customer, then 6 years. It is kept after a bank authorisation lapses or is withdrawn, unless an admin uses the Delete bank data action or asks us to delete it |
| Ebury records | 5 years, or longer only where Ebury or the law requires. Where we act as Ebury's processor, we keep, return or delete data on Ebury's instructions |
| Business verification evidence and screening results | 5 years after the customer relationship ends, or longer only where Ebury or the law requires |
| Terms acceptance records, including the IP address and browser details recorded with each acceptance and authority statement | While the organisation exists in Hedj, then 6 years. They are kept when the person who accepted leaves the organisation or closes their account, and they cannot be changed or deleted while they are kept |
| Technical logs | Up to 12 months |
| Marketing preferences | Until you opt out, and then a record of the opt-out |
When a retention period ends, we delete the data or anonymise it so that it no longer identifies anyone.
9. AI
9.1 Transaction categorisation is rules-only by default for every organisation.
9.2 AI-enhanced categorisation is available on paid plans, if an admin of the organisation switches it on. Before any transaction text reaches the AI model, we strip personal details such as names, references and account identifiers. Only that stripped text is sent. The model runs in AWS Bedrock in the EU.
9.3 Any other AI-assisted features in Hedj also run in AWS Bedrock in the EU. Your data is not used to train the providers' models.
9.4 We do not make decisions with legal or similarly significant effects about anyone based solely on automated processing. Screening alerts are reviewed by a person.
10. Your rights
You have the right to:
- access the personal data we hold about you;
- have inaccurate data corrected;
- have your data erased, except records we must keep to establish, exercise or defend legal claims, such as terms acceptance records, for the period in section 8;
- restrict how we use your data;
- object to our use of your data where we rely on legitimate interests, and to direct marketing at any time;
- receive data you gave us in a portable format;
- withdraw any permission you gave under e-privacy law; and
- complain to a supervisory authority (section 12).
For bank data you can also:
- withdraw bank access at any time, by disconnecting the bank in Hedj or directly with your bank;
- let an authorisation lapse by not reconfirming it when it expires after 90 or 180 days, depending on the bank; and
- ask an admin of your organisation to remove bank data with the Delete bank data action.
You can exercise your rights over the processing Yapily Connect or Ebury does as controllers directly with them. Where we act as Ebury's processor, we pass your request to Ebury within 5 business days and help it respond.
To exercise a right, email support@hedj.eu. We respond within one month, which can be extended for complex requests.
11. Security
We use encryption in transit, access controls, least-privilege access, network isolation, logging and monitoring. Access to customer data within Hedj is limited to people who need it to provide and support the service.
12. Complaints
If you are unhappy with how we handle your data, please contact us first at support@hedj.eu. You can also complain to a supervisory authority:
- Ireland (our lead authority): the Data Protection Commission, www.dataprotection.ie;
- United Kingdom: the Information Commissioner's Office, www.ico.org.uk.
13. Children
Hedj is a service for businesses and is not intended for children. We do not knowingly collect children's data.
14. Changes to this notice
We may update this notice. A new version takes effect when we publish it. We will tell you about it in Hedj and, for significant changes, by email, with a short summary of what changed, why, and what it means for you. Each version stays published, so you can see the text that applied at any time.
Hedj Financial Risk Management Limited is registered in Ireland, company number 803831. Registered office: 2 Southwood Park, Blackrock, Co. Dublin, A94 D2C1, Ireland.