Hedj privacy notice
About version 2
- What changed
- We now describe how we verify your business and the people connected with it: directors, owners and the person acting for your organisation. This covers the identity details, ID documents and selfie we collect, the checks against company registers, sanctions lists and politically exposed person (PEP) data, the adverse media search, the matching of bank account holder names, who we share it with, and how long we keep it.
- Why
- Before bank connections and Ebury services are opened to a business, we verify the business and its people, as our partners require and to prevent fraud and financial crime. You are entitled to know what that involves.
- What it means for you
- If you are a director, owner or user of a customer, we may process your name, date of birth, nationality, ID document and selfie, and screen you against public lists. Your selfie video is deleted once our reviewer decides, and we keep the other evidence for 5 years after the customer relationship ends. Nothing here asks you to accept anything, and your rights in section 10 are unchanged.
This notice explains how Hedj Financial Risk Management Limited ("Hedj", "we", "us", "our") collects, uses, shares and protects personal data when organisations and their people use the Hedj platform at app.hedj.eu and our websites.
1. Who we are
Hedj Financial Risk Management Limited is a company registered in Ireland (registered no. 803831). Registered address: 2 Southwood Park, Blackrock, Co. Dublin, A94 D2C1, Ireland.
For any question about this notice or your personal data, email support@hedj.eu with "Data protection" in the subject line, or write to us at our registered address.
Our lead supervisory authority is the Data Protection Commission in Ireland.
2. Whose data this notice covers
- People who visit our websites.
- People who use Hedj for an organisation (our customer), including admins and other users.
- Directors, owners and other people connected with a customer, where we check who the customer is.
- People named in a customer's bank transactions, payment details or beneficiary details ("third parties named in transactions"). We usually cannot contact these people directly, so this notice is how we inform them.
3. Our role for each kind of data
| Data and purpose | Hedj's role | Partner's role |
|---|---|---|
| Accounts, users, organisations and the treasury data customers enter in Hedj | Controller | Not applicable |
| Bank data: the bank data service that reads it from the bank | Yapily Connect provides that service. In the UK, Hedj acts as Yapily Connect Ltd's agent once registered with the FCA; in the EEA, Hedj is not its agent | Yapily Connect Ltd (UK) or Yapily Connect UAB (EEA) is an independent controller |
| Bank data once Hedj receives it, to provide Hedj's features | Controller | Yapily Ltd processes it for Hedj, as our processor |
| Business verification and screening for bank connections and Ebury services | Controller | Not applicable |
| Ebury onboarding information, payment instructions and beneficiary details | Processor, acting on Ebury's instructions | Ebury is the controller |
| Ebury client profile criteria and joint marketing | Joint controller with Ebury | Joint controller with Hedj |
| Hedj's own records of its customers and its relationship with them, including records of FX contracts | Independent controller | Ebury is an independent controller of its own records |
4. The personal data we collect
| Category | Examples | Where it comes from |
|---|---|---|
| Account and user data | Name, email address, job title, role, permissions, authority limits, sign-in records | You or your organisation's admin |
| Organisation data | Organisation name, country, plan, users and access requests | You or your organisation's admin |
| Treasury data | Exposures, forecasts, hedges, scenarios, cash, debt, investments and counterparties | You or your organisation |
| Bank data | Account details, balances, transactions, standing orders and direct debits, and the account holder's name | Your bank, through Yapily Connect, when you connect an account |
| Third parties named in transactions | Names, references and account details that appear in transaction descriptions, payment details or beneficiary details | Your bank, Ebury or you |
| Derived data | Patterns, categories and forecasts built from your data (forecasts are assumptions, not facts) | Created by Hedj |
| Business verification data: the business | Company name, registration number and country, and extracts from the company register (for example Companies House) with its officers and persons with significant control, or the register evidence you upload | You, public registers |
| Business verification data: people | For the person acting for the organisation, each director and each owner of 25% or more: name, date of birth (or only the month and year of birth where the register gives only that), nationality, country of residence, e-mail address, roles and percentage ownership, and the owner declaration you make | You, the person themselves, public registers |
| Identity documents | Image of the ID document (such as a passport or identity card), the data read from it including its machine-readable zone (MRZ: name, date of birth, document number, expiry), a challenge selfie video and a still frame taken from it | The person, from their own device or browser |
| Link recipients | The e-mail address a director-confirmation link is sent to, and the acting user's e-mail address for the outcome | The user who sends the link |
| Screening results | Matches and reviewer decisions from sanctions checks (EU, UK and UN lists), politically exposed person checks, the adverse media search, register change alerts and bank account holder name checks. They can include information about offences or sanctions | Public lists, OpenSanctions and our reviewers |
| Verification audit records | What was done, when and by whom, with the IP address of a person using a director link or making an owner declaration | Automatically |
| Ebury data | FX contracts, quotes, currency accounts and balances, beneficiaries, payments and invoices | Ebury and you |
| Terms acceptance records | Which version of which terms a person accepted or was shown, when, from which IP address and browser, and the authority statement they gave | You |
| Technical data | IP address, device and browser details, logs and diagnostics | Automatically, when you use Hedj |
A Hedj reviewer compares the ID document image with the selfie by eye. We do not use automated face matching or create biometric templates. The text on the ID document is read in your own browser and checked for consistency, and the image is not sent to any other service for that purpose.
When a bank account is connected, we compare the account holder names the bank gives with the customer's legal name, to confirm the account belongs to the customer. We keep the match score and any mismatch for review.
We do not ask for special category data, such as health or religious information. It may appear incidentally in bank transaction descriptions. We do not use it for any purpose of its own.
Identifiers that appear in the free text of bank transactions are redacted where we can detect them.
5. Legal bases for using your data
| Purpose | Whose data | Legal basis |
|---|---|---|
| Providing Hedj to a sole trader or partnership | The sole trader or partners | Contract |
| Providing Hedj to a company | Its staff and other users | Legitimate interests: delivering the service the company has contracted for |
| Connecting bank accounts and using bank data to show cash, forecast, reconcile and categorise | Sole traders and partners | Contract |
| The same, for companies | Company staff and account holders | Legitimate interests: delivering the service the company asked for |
| Holding and using data about third parties named in transactions or beneficiary details | Third parties named in transactions | Legitimate interests: giving customers complete and accurate records of their own transactions and payments |
| Sharing data with Yapily Connect and Ebury so they can provide the services a customer chooses | Users, account holders, directors and owners | Contract (sole traders and partners); legitimate interests (everyone else) |
| Verifying the business and its people before bank connections and Ebury services, including ID checks and register checks | Users, directors and owners | Legitimate interests: preventing fraud and financial crime and meeting the requirements of our partners Yapily and Ebury |
| Sanctions screening and monitoring, daily against the EU, UK and UN lists | Users, directors and owners | Legal obligation, where sanctions law binds Hedj; otherwise legitimate interests in not dealing with sanctioned persons |
| PEP checks, the adverse media search, yearly re-screening and register change monitoring | Users, directors and owners | Legitimate interests: managing financial crime risk and meeting our partners' requirements |
| Matching bank account holder names to the customer | Account holders | Legitimate interests: confirming that connected accounts belong to the customer |
| Processing Ebury onboarding, payment and beneficiary data | Everyone in that data | We act on Ebury's instructions; Ebury decides the legal basis as controller |
| AI-enhanced categorisation, when an admin switches it on | Third parties named in transactions | Legitimate interests: categorising transactions accurately, with personal details stripped first |
| Security, fraud prevention, support and improving the service | All users | Legitimate interests |
| Keeping records of terms accepted and defending legal claims | Users who accept terms | Legitimate interests; legal obligation where a law requires the record |
| Tax and accounting records | Customers and their contacts | Legal obligation |
| Telling customers about Hedj's products | Customer contacts | Legitimate interests (you can opt out at any time) |
We rely on legal obligation only where a law binds Hedj itself.
We do not rely on consent as the legal basis for sharing your data with Yapily Connect or Ebury. When you press Confirm to connect a bank, you give the explicit consent that payment services law requires for the bank data service. That is a step under payment services law. It is not consent under data protection law.
Where e-privacy law requires your permission before we set non-essential cookies or send certain marketing emails, we ask for it first. Our Cookie Policy explains our cookies.
Where we rely on legitimate interests, we have weighed those interests against your rights, and you can object (see section 10).
6. Who we share data with
We do not sell personal data. We share it only as follows.
- Yapily Connect Ltd and Yapily Connect UAB provide the bank data service as independent controllers. Your data will be shared with Yapily and may be used in connection with Yapily's value-added services. See Yapily's Privacy Notice and Yapily Connect's End User Terms.
- Yapily Ltd provides the technology that connects Hedj to banks, as our processor.
- Ebury (Ebury Partners UK Limited and Ebury Partners Belgium NV/SA) provides FX and payment services. Ebury's privacy notice is at privacy.ebury.com.
- Amazon Web Services (AWS) hosts the platform, stores identity evidence encrypted, scans uploaded files for malware (Amazon GuardDuty), sends our emails and runs AI models for us, as our processor.
- OpenSanctions checks whether a person is a politically exposed person (PEP). We send it only the name, date of birth and nationality, and it processes them for us as our processor. See opensanctions.org.
- Companies House (and other company registers) is a public source. We send it a company number or company name and receive the register's officers. We do not send it personal data about individuals. It is not our processor.
- Ebury receives a verification pack for the customer when a customer applies for Ebury services. It has the ID document type, country and expiry, with the document number masked to its last 3 characters, and no images or selfies. Yapily and Ebury are also told if we suspend a service for a customer: the customer's name and our reference, and not our reasons.
- Professional advisers, auditors, regulators, law enforcement and courts, where the law requires it or to protect our rights.
Before any other company processes personal data for us, such as a different identity verification provider, we will add it to this notice.
7. Where your data is processed
Hedj hosts its platform with AWS in the EU, in the Stockholm (eu-north-1) region. Identity evidence is stored there. AI models run in AWS Bedrock in the EU.
When a person captures an ID document, the text on it is read in their own browser, using a text-recognition library that the browser downloads from a public content delivery network (jsDelivr). That network sees the person's IP address and browser details, as for any web page. It does not receive the image or any data from it.
Our PEP checks go to OpenSanctions over the internet. We will confirm its location and the safeguard for any transfer outside the EEA in our records.
Yapily Ltd and Yapily Connect Ltd are in the United Kingdom, and Ebury Partners UK Limited is in the United Kingdom. Transfers from the EEA to the UK rely on the European Commission's adequacy decision for the UK. Transfers from the UK to the EEA rely on the UK's adequacy regulations.
Some of Yapily's sub-processors are in the United States. Those transfers are covered by the European Commission's Standard Contractual Clauses, with the UK addendum where UK law applies. Yapily's Privacy Notice gives more detail.
8. How long we keep data (retention)
| Category | How long we keep it |
|---|---|
| Account, user and organisation data | While the organisation's account is open, then 6 years |
| Treasury data | While the organisation's account is open, then deleted or anonymised as set out in the Master Terms |
| Bank data, including data about third parties named in transactions | While the organisation is a customer, then 6 years. It is kept after a bank authorisation lapses or is withdrawn, unless an admin uses the Delete bank data action or asks us to delete it |
| Ebury records | 5 years, or longer only where Ebury or the law requires. Where we act as Ebury's processor, we keep, return or delete data on Ebury's instructions |
| Business verification evidence and screening results: ID document image, selfie still frame, extracted identity data, register extracts, owner declarations, reviewer decisions and screening hits | 5 years after the customer relationship ends (when the organisation is closed), then deleted, or longer only where Ebury or the law requires. Nothing is deleted while the organisation is open |
| Selfie video | Deleted when our reviewer decides on the ID check, or after 30 days if a retake is abandoned |
| Director confirmation link e-mail addresses | With the verification record: 5 years after the relationship ends |
| IP addresses in the verification audit record | Cleared at the 5-year deletion above. The record that the action happened is kept |
| Uploads not yet submitted | Removed automatically after 1 day |
| Terms acceptance records, including the IP address and browser details recorded with each acceptance and authority statement | While the organisation exists in Hedj, then 6 years. They are kept when the person who accepted leaves the organisation or closes their account, and they cannot be changed or deleted while they are kept |
| Technical logs | Up to 12 months |
| Marketing preferences | Until you opt out, and then a record of the opt-out |
When a retention period ends, we delete the data or anonymise it so that it no longer identifies anyone.
9. AI
9.1 Transaction categorisation is rules-only by default for every organisation.
9.2 AI-enhanced categorisation is available on paid plans, if an admin of the organisation switches it on. Before any transaction text reaches the AI model, we strip personal details such as names, references and account identifiers. Only that stripped text is sent. The model runs in AWS Bedrock in the EU.
9.3 Any other AI-assisted features in Hedj also run in AWS Bedrock in the EU. Your data is not used to train the providers' models.
9.4 We do not make decisions with legal or similarly significant effects about anyone based solely on automated processing. Screening alerts are reviewed by a person.
10. Your rights
You have the right to:
- access the personal data we hold about you;
- have inaccurate data corrected;
- have your data erased, except records we must keep to establish, exercise or defend legal claims, such as terms acceptance records, for the period in section 8;
- restrict how we use your data;
- object to our use of your data where we rely on legitimate interests, and to direct marketing at any time;
- receive data you gave us in a portable format;
- withdraw any permission you gave under e-privacy law; and
- complain to a supervisory authority (section 12).
For bank data you can also:
- withdraw bank access at any time, by disconnecting the bank in Hedj or directly with your bank;
- let an authorisation lapse by not reconfirming it when it expires after 90 or 180 days, depending on the bank; and
- ask an admin of your organisation to remove bank data with the Delete bank data action.
You can exercise your rights over the processing Yapily Connect or Ebury does as controllers directly with them. Where we act as Ebury's processor, we pass your request to Ebury within 5 business days and help it respond.
To exercise a right, email support@hedj.eu. We respond within one month, which can be extended for complex requests.
11. Security
We use encryption in transit, access controls, least-privilege access, network isolation, logging and monitoring. Identity documents and selfies are stored in a private, encrypted store, scanned for malware when uploaded, and viewed only by authorised Hedj reviewers through links that expire after 5 minutes, with each view recorded. Director confirmation links are single-use and expire after 7 days. Access to customer data within Hedj is limited to people who need it to provide and support the service.
12. Complaints
If you are unhappy with how we handle your data, please contact us first at support@hedj.eu. You can also complain to a supervisory authority:
- Ireland (our lead authority): the Data Protection Commission, www.dataprotection.ie;
- United Kingdom: the Information Commissioner's Office, www.ico.org.uk.
13. Children
Hedj is a service for businesses and is not intended for children. We do not knowingly collect children's data.
14. Changes to this notice
We may update this notice. A new version takes effect when we publish it. We will tell you about it in Hedj and, for significant changes, by email, with a short summary of what changed, why, and what it means for you. Each version stays published, so you can see the text that applied at any time.
Hedj Financial Risk Management Limited is registered in Ireland, company number 803831. Registered office: 2 Southwood Park, Blackrock, Co. Dublin, A94 D2C1, Ireland.