Privacy Policy
Effective from: 2026-11-09. This is a translation of the Polish version, which prevails in case of any discrepancy.
1. Data controller
The controller of personal data provided through hetmancapital.com is JDN Justyna Dawidowicz, Moderska 12A, 62-062 Strykowo, NIP 7773356501, trading as Hetman Capital (the “Controller”). For any matter related to personal data, contact kontakt@hetmancapital.com (ideally with “GDPR” in the subject).
2. What data we process and why
- Contact form: full name, e-mail address, optionally phone number, topic, market experience and the message. Purpose: replying to your enquiry and further correspondence. Legal basis: your consent (Art. 6(1)(a) GDPR) and the Controller’s legitimate interest in handling correspondence (Art. 6(1)(f) GDPR). The form is protected by Cloudflare Turnstile: once you start filling it in, your browser connects to Cloudflare, which checks that a human is filling in the form (using, among other things, your IP address and technical browser data). Turnstile does not set cookies. Legal basis: the Controller’s legitimate interest in protection against spam and abuse (Art. 6(1)(f) GDPR).
- Contact via WhatsApp, Telegram, Messenger or e-mail: the data you share in your message. Purpose and legal basis as above. These services operate under their providers’ own terms and privacy policies.
- Hetman Capital Club (club.hetmancapital.com): account data (name or nickname, e-mail address, profile photo if you add one), content you post in the community, activity information and details of your purchased plan. Purpose: creating and running your account, providing the Membership, billing and handling complaints. Legal basis: performance of a contract (Art. 6(1)(b) GDPR), legal obligations including tax and accounting (Art. 6(1)(c) GDPR) and legitimate interests such as community safety and pursuing claims (Art. 6(1)(f) GDPR).
- Newsletter and marketing messages: e-mail address, first name and language. Purpose: sending the newsletter (weekly plan, lessons and Club offers). Subscribing requires confirmation via a link sent to the address you provide (double opt-in). Legal basis: your consent (Art. 6(1)(a) GDPR and Art. 398 of the Polish Electronic Communications Law). Consent is voluntary, is not a condition of buying a Membership, and can be withdrawn at any time via the “unsubscribe” link in every e-mail. Service e-mails related to your account and Membership (e.g. purchase confirmation, changes to the Terms) are sent on the basis of the contract, regardless of marketing consent. Newsletter data is kept until consent is withdrawn, and proof of consent until any claims become time-barred.
- Membership administration: after a purchase we send an automated welcome message in the Club with access details for your package (e.g. a Terminal link, a journal key). Information about purchases, renewals, cancellations, failed payments, the progress of the Hetman package challenge and joining the affiliate programme is sent to the Controller as notifications via the Telegram messenger. A notification may include your name or nickname, e-mail address, package, amount and period. We keep a copy of the member list (name or nickname, e-mail address, package, membership dates) on the Controller’s computer as a backup and for member support. Legal basis: performance of a contract (Art. 6(1)(b) GDPR) and the Controller’s legitimate interest in efficient member support (Art. 6(1)(f) GDPR).
- ♛ Hetman Terminal (panel.hetmancapital.com, formerly the “order flow panel”): a personal link assigned to your account (name or nickname and Club member number), your IP address and information about active connections (to enforce the device limit and for security), Terminal settings stored in your browser, questions and messages sent in the Terminal chat together with your nickname, and attendance at broadcasts. The Terminal server runs on the Controller’s hardware in Poland and connections pass through the Cloudflare network. Legal basis: performance of a contract (Art. 6(1)(b) GDPR) and the Controller’s legitimate interest in protecting access and the exchange data licence (Art. 6(1)(f) GDPR).
- Request to connect your own data source to the Terminal (the “Data” page in the Terminal): the broker or data provider you choose (e.g. Rithmic, dxFeed, Interactive Brokers), the package or type of link you send the request from, your name or nickname, and any contact details and comments you enter. Purpose: preparing and enabling the Terminal to work on your own data and contacting you about it. We do not collect passwords or broker account login details and will never ask for them. You conclude the data agreement directly with the chosen provider or broker, which processes your data under its own privacy policy. Legal basis: steps taken at your request before entering into a contract and performance of the contract (Art. 6(1)(b) GDPR). We keep the request until the feature is enabled for you or you withdraw it, at most for as long as your Club account exists.
- Trading journal: the trades, results, notes and risk rules you record in the journal yourself. The data is stored on the Controller’s server and is used only for your learning and, in the Hetman and King packages, for reviewing your trades. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
- Hetman and King packages: your 12-week goal, trades, charts, statements and session recordings that you send for review, the content of conversations in the private channel and, in the King package, one-on-one calls held via a video call tool agreed with you, together with their summaries, which we send you in a private message in the Club (not in a space visible to other members). We do not ask for account login details or full account numbers: please cover them before sending a statement. We do not record one-on-one calls without your consent. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
- Broadcasts and recordings: broadcasts in the Club are recorded and made available to members in the archive (Vimeo). Your questions and messages sent during a broadcast, together with your name or nickname, may be visible or read out in the recording, and short clips may appear in the Club space “Hetman’s best moments”, available to members of paid plans. Legal basis: the Controller’s legitimate interest in providing recordings to members and showing what the sessions look like (Art. 6(1)(f) GDPR). You may object: on request we will remove or blur a clip showing your message or nickname.
- Free broadcasts on social media (YouTube, TikTok, Twitch, Kick, Facebook, Instagram): if you write in a broadcast chat, your nickname, profile picture and message may be shown on screen, read out loud and remain in the recording published on those platforms. We read messages from the public chat on the Controller’s computer and do not link them to your Club account. These platforms process your data as separate controllers under their own terms and privacy policies. Legal basis: the Controller’s legitimate interest in running interactive educational broadcasts (Art. 6(1)(f) GDPR). You may object: on request we will remove or blur the part of a recording showing your message, where the platform allows it.
- Voice room: your name or nickname and your voice and video if you turn on your microphone or camera yourself (both are off at the start). Conversations are transmitted live through the Controller’s server and are not recorded. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
- Protection of paid content: paid content may contain marks (e.g. a watermark) that identify the account from which it was shared. In case of unauthorised distribution we compare them with account data. Legal basis: the Controller’s legitimate interest in protecting copyright and pursuing claims (Art. 6(1)(f) GDPR).
- Affiliate programme: name, e-mail address, bank account number or phone number for BLIK transfers, data about people who joined via your link (nickname, package, payment date and amount), commissions accrued and paid, and data needed for tax settlements. Legal basis: performance of a contract (Art. 6(1)(b) GDPR) and tax and accounting obligations (Art. 6(1)(c) GDPR).
- Hetman studies for Sierra Chart (form at hetmancapital.com/en/sierra-account): the e-mail address you use in the Club, your Sierra Chart account name (Account Name; we never collect the password), your previous account name if any, and the date of the submission. Purpose: granting, maintaining and removing access to the Hetman Studies in Sierra Chart. The submission is stored on the server outside the public part of the website, and a copy is sent by e-mail to the Controller. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
- Review requests: we may send paying members one message in the Club asking for an honest review on Trustpilot. We do not share your data with Trustpilot; if you post a review, you do so yourself, under Trustpilot’s rules and privacy policy. Legal basis: the Controller’s legitimate interest in collecting feedback about its services (Art. 6(1)(f) GDPR).
- Payments: payment data is processed by the payment provider Stripe. The Controller receives payment status information and has no access to full card details.
- Server logs: IP address, date and time, browser type and the page visited. Purpose: security and proper operation of the website. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).
Providing data is voluntary, but without an e-mail address we cannot reply to a contact form message.
3. How long we keep data
Club account data is kept for as long as the account exists, and billing records for the period required by tax law (usually 5 years from the end of the year). Correspondence data is kept for as long as needed to handle it, and then until any claims become time-barred or until you withdraw consent. Server logs are kept by the hosting provider according to its settings, usually no longer than several dozen days. Terminal, journal and Hetman and King package data is kept for the duration of the membership; on request we can export your journal before deleting it. Broadcast recordings remain available in the archive for as long as the Club operates. Affiliate programme data and payout records are kept for the period required by tax law (usually 5 years from the end of the year). Your Sierra Chart account name is kept for the duration of the membership and 30 days after it ends.
4. Recipients
Data may be shared with providers of technical services to the Controller: website and e-mail hosting (Hostinger International Ltd.), domain services, bot protection for forms and anonymous visit statistics (Cloudflare, Inc.), the Club community platform (Circle.so, Inc.), newsletter delivery (UAB “MailerLite”, Vilnius, Lithuania), payments (Stripe Payments Europe, Ltd.), video hosting (Vimeo.com, Inc.), connections to the Terminal and the voice room (Cloudflare, Inc.) and, in the King package, the provider of the video call tool agreed with the Participant. They process data only on the Controller’s instructions. We pass your Sierra Chart account name (only the name, without your e-mail address) to Sierra Chart Engineering (USA) solely to grant access to the Hetman Studies; Sierra Chart processes it under its own rules as the provider of the software you have an agreement with. Notifications for the Controller (name or nickname, e-mail address, package, amount, period) are sent via the Telegram messenger, which processes them under its own privacy policy.
5. Cookies and third-party content
hetmancapital.com does not use analytics or marketing cookies and does not track visitors. That is why there is no cookie banner.
Visit statistics. We measure visits to hetmancapital.com and the Club (club.hetmancapital.com) with Cloudflare Web Analytics (Cloudflare, Inc.). It sets no cookies, uses no browser storage and creates no profiles or identifiers of individual people. We see only aggregate data: the number of visits and page views, pages viewed, the referring site, country, and device and browser type. To produce them, Cloudflare processes technical connection data (including IP address and browser headers), which we do not receive. Legal basis: the Controller’s legitimate interest in understanding which content is useful and improving the website (Art. 6(1)(f) GDPR).
The preview of our latest YouTube, Instagram and TikTok posts consists of cover images stored on our own server, so viewing the page does not connect you to those services. Only clicking a post, or the “Show posts” button (when the preview is unavailable), connects your browser to Meta Platforms (Instagram) or TikTok servers, which may set their own cookies and process your data under their privacy policies. Social media links lead to external services.
Hetman Capital Club runs on the Circle platform at club.hetmancapital.com. The platform uses its own cookies that are necessary for logging in and running your account, and the Vimeo player in the Club may store cookies needed for playback. Club use is governed by the Terms.
The ♛ Hetman Terminal (panel.hetmancapital.com) stores Terminal settings and data needed to maintain the connection in your browser’s storage (localStorage). They are necessary for the service you request, so no separate consent is required. We do not use them for statistics or advertising. You can delete them in your browser settings; the Terminal will then restore its default settings.
6. YouTube API Services
We use the tool “Hetman Media Publisher”, which uses YouTube API Services, to publish our own videos to the Hetman Capital YouTube channel and to read that channel’s statistics. By using it we are bound by the YouTube Terms of Service; data processed by Google is subject to the Google Privacy Policy. The tool only accesses our own channel and does not collect or store data of other YouTube users. Channel statistics (views, watch time, retention) are stored locally on the owner’s computer for no longer than 30 days. Access can be revoked at any time at security.google.com/settings/security/permissions.
7. Transfers outside the EEA
Some providers (e.g. Circle, Stripe, Vimeo, Cloudflare, Google (YouTube), Meta (Facebook, Instagram), TikTok, Twitch, Kick, WhatsApp, Telegram) may process data outside the European Economic Area. Such transfers are based on a European Commission adequacy decision (EU-US Data Privacy Framework) or standard contractual clauses. Your Sierra Chart account name is transferred to Sierra Chart Engineering in the USA under Art. 49(1)(b) GDPR – the transfer is necessary for the performance of a contract at your request (granting access to the Studies you request in the form).
8. Your rights
You have the right to access your data, rectify it, erase it, restrict processing, data portability, object to processing based on legitimate interests and withdraw consent at any time (without affecting the lawfulness of processing before withdrawal). To exercise your rights, write to kontakt@hetmancapital.com.
You may also lodge a complaint with the Polish supervisory authority, the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl), or with the authority in your country of residence.
9. Automated decisions
We do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you. The Terminal automatically refuses a third device on the same personal link; this is a technical access safeguard, and if it causes a problem just write to kontakt@hetmancapital.com.
10. Changes
We may update this policy, e.g. when website features change. The current version is always available on this page, and we inform members of significant changes in a post in the Club space “📣 Announcements”.