Privacy Policy

This policy explains how Haydamax OÜ (Tallinn, Estonia — "ESMIA", "we") processes personal data when you use esmia.org. We act as the data controller for the platform; our brokerage partner acts as an independent controller for brokerage records it is required to keep.

What we collect

• Identity data from your Chakloon ID sign-in: name, e-mail address and account identifier. ESMIA never sees or stores your password.
• Account application data you provide when activating investing: name, date of birth, address, phone, tax residency and tax identifier, and your answers to regulatory disclosure questions. This data is transmitted to our brokerage partner to open and operate your brokerage account.
• Activity data: orders you place, your watchlist, sessions and security events (kept in an audit log), and standard technical logs (IP address, browser, timestamps).

Why we process it

• To provide the service you request — signing in, opening a brokerage account, placing orders (performance of a contract).
• To meet legal obligations of a financial platform — identity verification, sanctions and abuse screening, record-keeping.
• To keep the service secure — session management, audit trail, fraud prevention (legitimate interest).

Who receives your data

• Alpaca (Alpaca Securities LLC / AlpacaDB, Inc., USA) — to open and carry your brokerage account and execute your orders. Alpaca's own Privacy Notice applies to that processing.
• Chakloon identity service — authentication only.
• Infrastructure providers hosting our servers in the European Union.

Transfers to the United States (Alpaca) are made because they are necessary for the performance of your brokerage contract. We do not sell personal data and we do not use it for third-party advertising.

Retention

Platform account data is kept while your account exists. Brokerage application data, orders and the audit trail are kept for as long as financial-services regulation requires (typically 5–7 years after the relationship ends). Technical logs are rotated on a short schedule.

Your rights

Under the GDPR you may request access, rectification, erasure, restriction, portability, and object to processing based on legitimate interest. Write to office@haydamax.com. You may also lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) or your local supervisory authority.

Cookies

ESMIA uses a single strictly-necessary cookie (esmia_session) to keep you signed in. We set no advertising or cross-site tracking cookies.