Privacy Policy
1. Who we are
This Privacy Policy explains how HEDj Financial Risk Management Ltd ("HEDj", "we", "us", "our") collects, uses, shares and protects personal data when you use our treasury risk management platform at app.hedj.eu and related websites and services (the "Service"). We are the data controller for the personal data described here.
- Registered company: HEDj Financial Risk Management Ltd, registered in Ireland, company no. 803831
- Registered office: 2 Southwood Park, Blackrock, Co. Dublin, A94 D2C1, Ireland
- Data Protection Officer: Gearoid Keegan, support@hedj.eu
HEDj is a software and analytics provider. We are not a regulated financial institution. Where the Service involves regulated activities, such as accessing your bank account data, initiating payments, executing FX, or providing investment, deposit or lending products, those activities are carried out by authorised third-party partners (see "Who we share with"), and your relationship for those activities is with the relevant partner.
2. Scope
This policy applies to visitors to our public websites, registered users of the HEDj platform and their organisations, and individuals whose personal data we receive from our customers or partners in the course of providing the Service.
Our use of cookies is described in our separate Cookie Policy. Our internal governance arrangements are described in our Data Protection Policy.
3. The personal data we collect
| Category | Examples | Source |
|---|---|---|
| Identity & account data | Name, email address, username, password (hashed), role, job title | You / your administrator |
| Organisation data | Company name, organisation membership, access requests and approvals | You / your administrator |
| Profile & preferences | Risk profile and survey responses, hedging policy settings, language, consent choices | You |
| Treasury & trading data | Exposures, forecasts, hedge trades, potential trades, scenarios, valuations, counterparty data, cash/liquidity, debt/facilities, investments and deposits | You / your organisation / partners |
| Financial account data | Where you connect an account: account identifiers, balances and transaction data | Connected partner, with your authorisation |
| Locally stored data (planned) | Files or records on your own systems that you choose to make available to HEDj | You, with explicit approval |
| Usage & technical data | IP address, device/browser information, pages viewed, feature usage, diagnostics, logs | Automatically, via the Service and cookies |
| Marketing data | Login identifiers, campaign and page-usage signals, marketing preferences | Automatically (with consent) / you |
We do not intentionally collect special category data. Please do not submit it through the Service unless specifically requested.
4. How and why we use your data
| Purpose | Legal basis (EU/UK GDPR) |
|---|---|
| Create and administer your account and organisation, authenticate you, and provide the core Service | Performance of a contract |
| Calculate valuations, exposures, risk metrics and reports you request | Performance of a contract |
| AI-assisted features: generating analysis and assistant responses by sending your data to large language models | Consent (a non-AI equivalent is available) |
| Improving our models and analytics | Consent, using anonymised/aggregated data only |
| Research into hedging trends and patterns using anonymised trading data | Consent (opt-in) |
| Accessing data stored on your own systems | Consent / explicit approval |
| Sharing with AISP/PISP and account-platform partners to deliver functionality you request | Performance of a contract / your request |
| Sharing with ancillary product partners (payments, FX execution, investments, deposits, lending) | Consent / your specific request |
| Security, fraud prevention, diagnostics, service monitoring and improvement | Legitimate interests |
| Marketing communications and marketing cookies/pixels | Consent |
| Meeting legal, regulatory, accounting and record-keeping obligations | Legal obligation |
| Establishing, exercising or defending legal claims | Legitimate interests |
Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing before withdrawal. Where we rely on legitimate interests, we have balanced those interests against your rights; you may object (see "Your rights").
5. Access to data stored on your own systems (planned feature)
We are developing functionality that will allow HEDj to access customer data held locally on your own systems. This will only ever happen with your explicit, informed approval, will be limited to the data and scope you authorise, and can be revoked by you at any time. Data accessed this way is used only to provide the functionality you have requested and is subject to the same protections as the rest of your data.
6. Artificial intelligence and automated processing
Some features use artificial intelligence (large language models), currently Anthropic's Claude, and potentially other models, to analyse your data and generate insights, summaries and assistant responses.
- AI is optional. For substantially all functionality there is a non-AI equivalent you can use if you do not want your data processed by an AI agent.
- Where AI processing happens. AI inference is performed within the European Economic Area (EEA) using AWS Bedrock in an EU region. Your data is not transferred outside the EEA for AI processing.
- No third-party model training on your data. Our AI providers do not use your data to train their foundation models. Any improvement of HEDj's own analytics uses anonymised or aggregated data only, and only where you have consented.
- No solely automated decisions with legal or significant effects. AI outputs are decision-support tools. We do not make decisions producing legal or similarly significant effects about you based solely on automated processing without a lawful basis and appropriate safeguards. You may request human review of any such decision.
7. Research using anonymised trading data (opt-in)
If, and only if, you opt in, we use anonymised trading data to research hedging trends and patterns. Anonymised data does not identify you or your organisation. You can opt out at any time; opting out stops further use of your data for research from that point.
8. Who we share your data with
We share personal data only as needed to run the Service and as described below. We do not sell your personal data.
- Hosting and infrastructure: Amazon Web Services (AWS), in the EU (Stockholm, eu-north-1) region. Our data is hosted within the EEA.
- AISP/PISP and account-platform partners: where you use account-information or payment-initiation functionality, we share data with the relevant authorised partners as necessary to provide the service you have requested, and as those partners require to deliver it.
- Ancillary product partners (payments, FX execution, investments, deposits and lending): we share data with these partners only at your request / with your consent, when you choose to use one of those products.
- Service providers acting on our instructions (e.g. email delivery, error monitoring), under data processing agreements.
- Professional advisers, auditors, and authorities where required by law or to protect our rights.
All processors act under written contracts requiring appropriate security and confidentiality.
9. Your rights
Subject to conditions and exemptions under EU and UK data protection law, you have the right to: access your data; rectify inaccurate data; erase your data; restrict or object to processing (including objecting to direct marketing at any time); data portability; withdraw consent; not be subject to solely automated decision-making with legal or similarly significant effects, where applicable; and lodge a complaint with a supervisory authority.
To exercise any right, contact our Data Protection Officer at support@hedj.eu. We respond within one month (extendable for complex requests).
10. International transfers
Our data is hosted and our AI processing is performed within the EEA. Where any transfer outside the EEA/UK becomes necessary (for example, a sub-processor), we put in place an appropriate safeguard such as an adequacy decision or Standard Contractual Clauses (with the UK Addendum where relevant), and we will update this policy accordingly.
11. Data retention
We retain personal data for as long as your account is active and, after closure, for a further six (6) years to meet financial, tax, accounting and legal record-keeping obligations and to defend legal claims. We delete or anonymise data when it is no longer needed. Anonymised research data may be retained indefinitely as it no longer identifies you.
12. Security
We use technical and organisational measures appropriate to the risk, including encryption in transit, access controls, least-privilege access, network isolation, logging and monitoring.
13. Children
The Service is intended for business users and is not directed at children under 16. We do not knowingly collect children's data.
14. Changes to this policy
We may update this policy. Material changes will be notified through the Service or by email. The "Last updated" date shows the latest version.
15. Contact and complaints
Data Protection Officer: Gearoid Keegan, support@hedj.eu
Post: HEDj Financial Risk Management Ltd, 2 Southwood Park, Blackrock, Co. Dublin, A94 D2C1, Ireland
If you are not satisfied, you may complain to a supervisory authority:
- Ireland (lead authority): Data Protection Commission (DPC), www.dataprotection.ie
- United Kingdom: Information Commissioner's Office (ICO), www.ico.org.uk