Privacy Policy
How we collect, use, and protect your personal information
Last updated: 9 February 2026
1. Introduction
Haystack ("Haystack," "we," "us," or "our") is committed to protecting your privacy and handling your personal data transparently and securely. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform to invest in tokenised non-listed securities. For privacy-related queries, contact our Data Protection Officer at privacy@haystack.investments.
2. Information We Collect
2.1 Identity and Contact Information
- Full legal name, date of birth, nationality
- Email address, phone number, residential address
- Government-issued identification and proof of address
Purpose: KYC/AML compliance as required by applicable regulation.
2.2 Financial Information
- Bank account details for deposits and withdrawals
- Verified wallet addresses
- Transaction history, portfolio holdings and valuations
- Tax residency and National Insurance number (for UK tax reporting)
2.3 Investment Profile
- Appropriateness assessment responses (knowledge, experience, objectives)
- Investor categorisation (retail, professional, eligible counterparty)
- Risk tolerance and investment horizon
2.4 Technical and Usage Data
- IP address, browser type, device identifiers
- Pages visited, login history and security logs
3. How We Use Your Information
- Verifying your identity and eligibility to invest
- Processing subscriptions, transfers, distributions and withdrawals
- Maintaining the securities register and ownership records
- Meeting legal, regulatory and tax obligations
- Platform security, fraud prevention and service improvement
4. Information Sharing and Disclosure
We share data with service providers (identity verification, custody, banking partners), with regulators and authorities where legally required, and in connection with business transfers. Personal data is never stored on-chain — the public register contains only claim hashes and provider references.
5. Data Security
We use encryption in transit and at rest, access controls, audit logging and regular security reviews. No system is completely secure; notify us immediately of any suspected compromise of your account.
6. Data Retention
We retain personal data for as long as your account is active and as required by law (typically 5–7 years after account closure for financial records).
7. Your Rights Under GDPR
- Access, rectification and erasure (subject to regulatory retention duties)
- Restriction of and objection to processing
- Data portability
- Right to lodge a complaint with the ICO (UK) or your local supervisory authority
8. Cookies
We use essential cookies for authentication and security, and analytics cookies with your consent. You can manage preferences in your browser.
9. International Transfers
Where data is transferred outside the UK/EEA we use appropriate safeguards such as adequacy decisions or standard contractual clauses.
10. Changes and Contact
We may update this policy from time to time; material changes will be notified on the platform. Questions: privacy@haystack.investments.