Privacy Policy
Effective from: 2026-10-22. This is a translation of the Polish version, which prevails in case of any discrepancy.
1. Data controller
The controller of personal data provided through hetmancapital.com is JDN Justyna Dawidowicz, Moderska 12A, 62-062 Strykowo, NIP 7773356501, trading as Hetman Capital (the “Controller”). For any matter related to personal data, contact [email protected] (ideally with “GDPR” in the subject).
2. What data we process and why
- Contact form: full name, e-mail address, optionally phone number, topic, market experience and the message. Purpose: replying to your enquiry and further correspondence. Legal basis: your consent (Art. 6(1)(a) GDPR) and the Controller’s legitimate interest in handling correspondence (Art. 6(1)(f) GDPR). The form is protected by Cloudflare Turnstile: once you start filling it in, your browser connects to Cloudflare, which checks that a human is filling in the form (using, among other things, your IP address and technical browser data). Turnstile does not set cookies. Legal basis: the Controller’s legitimate interest in protection against spam and abuse (Art. 6(1)(f) GDPR).
- Contact via WhatsApp, Telegram, Messenger or e-mail: the data you share in your message. Purpose and legal basis as above. These services operate under their providers’ own terms and privacy policies.
- Hetman Capital Club (club.hetmancapital.com): account data (name or nickname, e-mail address, profile photo if you add one), content you post in the community, activity information and details of your purchased plan. Purpose: creating and running your account, providing the Membership, billing and handling complaints. Legal basis: performance of a contract (Art. 6(1)(b) GDPR), legal obligations including tax and accounting (Art. 6(1)(c) GDPR) and legitimate interests such as community safety and pursuing claims (Art. 6(1)(f) GDPR).
- Newsletter and marketing messages: e-mail address, first name and language. Purpose: sending the newsletter (weekly plan, lessons and Club offers). Subscribing requires confirmation via a link sent to the address you provide (double opt-in). Legal basis: your consent (Art. 6(1)(a) GDPR and Art. 398 of the Polish Electronic Communications Law). Consent is voluntary, is not a condition of buying a Membership, and can be withdrawn at any time via the “unsubscribe” link in every e-mail. Service e-mails related to your account and Membership (e.g. purchase confirmation, changes to the Terms) are sent on the basis of the contract, regardless of marketing consent. Newsletter data is kept until consent is withdrawn, and proof of consent until any claims become time-barred.
- Payments: payment data is processed by the payment provider Stripe. The Controller receives payment status information and has no access to full card details.
- Server logs: IP address, date and time, browser type and the page visited. Purpose: security and proper operation of the website. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).
Providing data is voluntary, but without an e-mail address we cannot reply to a contact form message.
3. How long we keep data
Club account data is kept for as long as the account exists, and billing records for the period required by tax law (usually 5 years from the end of the year). Correspondence data is kept for as long as needed to handle it, and then until any claims become time-barred or until you withdraw consent. Server logs are kept by the hosting provider according to its settings, usually no longer than several dozen days.
4. Recipients
Data may be shared with providers of technical services to the Controller: website and e-mail hosting (Hostinger International Ltd.), domain services, bot protection for forms and anonymous visit statistics (Cloudflare, Inc.), the Club community platform (Circle.so, Inc.), newsletter delivery (UAB “MailerLite”, Vilnius, Lithuania), payments (Stripe Payments Europe, Ltd.) and video hosting (Vimeo.com, Inc.). They process data only on the Controller’s instructions.
5. Cookies and third-party content
hetmancapital.com does not use analytics or marketing cookies and does not track visitors. That is why there is no cookie banner.
Visit statistics. We measure visits to hetmancapital.com and the Club (club.hetmancapital.com) with Cloudflare Web Analytics (Cloudflare, Inc.). It sets no cookies, uses no browser storage and creates no profiles or identifiers of individual people. We see only aggregate data: the number of visits and page views, pages viewed, the referring site, country, and device and browser type. To produce them, Cloudflare processes technical connection data (including IP address and browser headers), which we do not receive. Legal basis: the Controller’s legitimate interest in understanding which content is useful and improving the website (Art. 6(1)(f) GDPR).
The preview of our latest YouTube, Instagram and TikTok posts consists of cover images stored on our own server, so viewing the page does not connect you to those services. Only clicking a post, or the “Show posts” button (when the preview is unavailable), connects your browser to Meta Platforms (Instagram) or TikTok servers, which may set their own cookies and process your data under their privacy policies. Social media links lead to external services.
Hetman Capital Club runs on the Circle platform at club.hetmancapital.com. The platform uses its own cookies that are necessary for logging in and running your account. Club use is governed by the Terms.
6. YouTube API Services
We use the tool “Hetman Media Publisher”, which uses YouTube API Services, to publish our own videos to the Hetman Capital YouTube channel and to read that channel’s statistics. By using it we are bound by the YouTube Terms of Service; data processed by Google is subject to the Google Privacy Policy. The tool only accesses our own channel and does not collect or store data of other YouTube users. Channel statistics (views, watch time, retention) are stored locally on the owner’s computer for no longer than 30 days. Access can be revoked at any time at security.google.com/settings/security/permissions.
7. Transfers outside the EEA
Some providers (e.g. Circle, Stripe, Vimeo, Cloudflare, Meta, TikTok, WhatsApp) may process data outside the European Economic Area. Such transfers are based on a European Commission adequacy decision (EU-US Data Privacy Framework) or standard contractual clauses.
8. Your rights
You have the right to access your data, rectify it, erase it, restrict processing, data portability, object to processing based on legitimate interests and withdraw consent at any time (without affecting the lawfulness of processing before withdrawal). To exercise your rights, write to [email protected].
You may also lodge a complaint with the Polish supervisory authority, the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl), or with the authority in your country of residence.
9. Automated decisions
We do not make decisions based solely on automated processing, including profiling.
10. Changes
We may update this policy, for example when the website’s features change. The current version is always available on this page.