Privacy Policy

This Privacy Policy explains how NICKLAS MILLGAARD, UNIPESSOAL LDA, trading as Millgaard, Funchal, Madeira, Portugal, NIPC 519301838, collects, uses, shares, and protects personal data when you interact with our brokerage and advisory services, our Broker Board, and our messaging on WhatsApp and Signal. "Millgaard", "we", and "us" in this policy mean that company. We act as the data controller for the personal data described here.

1. Who we are

Millgaard is a private brokerage and advisory firm operated from Funchal, Madeira, Portugal. We facilitate introductions between vetted counterparties and coordinate the related paperwork and compliance steps. For any privacy question, contact us at nicklas@millgaard.com.

2. Data we collect

• Contact details you provide (name or alias, WhatsApp or Signal number, email).
• Identity and verification data (KYC documents such as an identity document, and related attestations) where required to onboard you and to meet our anti-money-laundering obligations.
• Business information you share in connection with a matter (such as your requirements, preferences, and jurisdiction).
• Messages and metadata exchanged with us over WhatsApp, Signal, email, or call, what you attach, and the associated timestamps and delivery status. The procedure page on this site builds your message in your browser, and a PDF you attach there is read in your browser. If you attach a procedure file on the homepage, a copy of the file is saved to Millgaard's private cloud storage, so that we and Millie can work from it. We keep it for as long as we need it to work with you and delete it on request. If you attach or paste a procedure on the homepage, Millie checks it against the book at once; the procedure and your email address, which that page requires, are kept for up to ninety days so that she can come back to you when a matching counterparty appears, and they are deleted on request. The public chat with Millie on this site keeps a message count for each visitor, held under a random visitor code and under a one way hash of the visitor's network address (never the address itself), only to enforce its message limit; each count is deleted automatically after 24 hours and is not used for anything else.
• Meeting information (scheduling details, and, only where you are informed and it applies, a recording used to prepare an internal summary).
• Technical data (IP address, device and browser information) when you use the Broker Board, used for security and to keep your session safe.

3. How we use your data

• To provide our brokerage and advisory services, including identifying and coordinating suitable introductions.
• To meet legal and regulatory obligations, in particular identity verification and anti-money-laundering (AML) checks.
• To prepare and manage non-circumvention and non-disclosure agreements and other documents for electronic signature.
• To communicate with you about your onboarding, matches, meetings, and pending signatures. We contact you on WhatsApp only after you have messaged us first, or where you have an active matter with us; we do not send unsolicited marketing.
• To operate, secure, and improve the Broker Board and our internal systems.

4. WhatsApp, Signal, and Millie

We communicate with counterparties and brokers through the WhatsApp Business Platform, provided by Meta Platforms Ireland Limited. When you message us on WhatsApp, your message content and metadata are processed by Meta in transit and by us to provide the service. Meta's handling of your data on WhatsApp is governed by its own terms and privacy policy. We use WhatsApp only for service communication tied to a matter you have with us, and pre-approved notification templates when a conversation window has closed. Signal is provided by Signal Messenger LLC and works the same way for you: we answer there when you write first.

Millie is an AI. The text of the messages you send her is processed by AI language-model providers acting as our processors, and some of them are located outside the EU/EEA. We send them only the text needed to answer, and we do not send identity documents to any AI model. Do not put in a message to Millie anything you do not want read by such a provider.

5. Legal bases (GDPR)

• Performance of a contract with you, to provide the service you requested.
• Legal obligation, for identity verification and AML record-keeping.
• Legitimate interests, to run, secure, and improve our services, balanced against your rights.
• Consent, where specifically requested (for example, a meeting recording), which you may withdraw at any time.

6. How we store and protect data

We process sensitive data on private European infrastructure, apply encryption in transit and at rest where appropriate, restrict access on a need-to-know basis, and maintain audit trails. Identity and AML records are retained for the period required by applicable law (typically five years after the end of the business relationship). Deletion or anonymisation after that period is handled manually, on review; it is not automated. Other personal data is kept only as long as needed for the purposes above.

7. Who we share data with

We share personal data only as needed to deliver the service and meet our obligations, with:

• Service providers acting on our behalf under contract, including the WhatsApp Business Platform (Meta), our electronic-signature provider, our video-meeting provider, partners engaged to complete a transaction, and cloud infrastructure providers. If you book a meeting with our founder through the Book a meeting button on this site, or through the same link when Millie gives it to you, the name and email you type into the booking form are processed by Calendly, our scheduling provider, to create the appointment.
• Regulators, law-enforcement, or professional advisers where we are legally required or permitted to do so.

We do not sell your personal data, and we do not disclose one counterparty's identity to another before both have explicitly agreed to be introduced.

8. International transfers

Where personal data is transferred outside the European Economic Area (for example, to an AI language-model provider or another service provider), we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.

9. Your rights

Subject to applicable law, you may request access to your personal data, correction, erasure, restriction of processing, portability, and you may object to certain processing. You may also lodge a complaint with your data-protection supervisory authority (in Portugal, the CNPD). To exercise a right, contact nicklas@millgaard.com.

10. Changes to this policy

We may update this policy from time to time. The effective date above reflects the latest version, and material changes will be communicated where appropriate.