> For the complete documentation index, see [llms.txt](https://docs.hamilton.xyz/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.hamilton.xyz/legal/legal-documents/privacy-policy.md). # Privacy Policy **Hamilton Digital Assets Limited — Privacy Policy** Effective Date: October 23, 2026 ## 1. Introduction Hamilton Digital Assets Limited ("HDA", "we", "us", "our") is committed to protecting your personal data. This Privacy Policy explains how we collect, use, store, and share personal information when you visit hamilton.xyz (the "Website"), use the Hamilton application (the "Platform"), or engage with HDA's services. Please read this Policy carefully. By using our Website or Platform, you agree to the practices described herein. ## 2. Data Controller HDA is the data controller for personal data collected through the Website and Platform. For data protection inquiries, contact: ## 3. Information We Collect 3.1 Information you provide directly: * Name, email address, and contact details when you register or contact us * Identity verification documents (government-issued ID, passport, proof of address) for KYC/AML purposes (Primary Users only) * Corporate documentation including certificates of incorporation, UBO declarations, and financial statements (corporate Primary Users) * Wallet addresses you connect to the Platform * Communications you send to HDA 3.2 Information collected automatically: * IP address, browser type, device information, and operating system * Usage data: pages visited, features accessed, timestamps, and session duration * Cookies and similar tracking technologies (see Section 9) * On-chain transaction data associated with wallet addresses (which is publicly available on blockchain networks) 3.3 Information from third parties: * Identity verification and sanctions screening results from our KYC/AML service providers * Blockchain analytics data from third-party providers * Information from public sources used to verify KYC/AML documentation ## 4. How We Use Your Information 4.1 To provide our services: * Process KYC/AML onboarding for Primary Users * Facilitate USDh minting and redemption for Primary Users * Maintain your account and transaction records * Respond to your inquiries and support requests 4.2 For compliance and legal purposes: * Comply with applicable AML/CTF laws and regulations * Screen against sanctions lists (OFAC, UN, EU, UK) * Respond to lawful requests from law enforcement and regulatory authorities * Maintain records as required by applicable law 4.3 For platform operations: * Improve the Website and Platform * Analyze usage patterns and optimize user experience * Detect and prevent fraud, abuse, and security threats * Send service-related communications 4.4 Legal bases and applicable data protection regimes: * Contract performance: processing necessary to deliver our services * Legal obligation: compliance with AML/CTF and other applicable laws * Legitimate interests: fraud prevention, security, and platform improvement * Consent: where we rely on your consent (e.g., marketing communications). USDh is not offered to residents of the United States, the United Kingdom, the European Union, the European Economic Area, the Swiss Confederation, or any jurisdiction subject to comprehensive sanctions (each a Restricted Territory, as defined in the USDh Terms and Conditions). To the extent any data subject is located in a Restricted Territory and personal data is nonetheless processed by HDA, HDA will apply the legal bases and data subject rights set out under the applicable local regime (including, where relevant, the EU General Data Protection Regulation, the UK GDPR, the UAE Personal Data Protection Law (Federal Decree-Law 45/2021), the Singapore Personal Data Protection Act, the Hong Kong Personal Data (Privacy) Ordinance, the Swiss Federal Act on Data Protection, the Japan Act on Protection of Personal Information, and the BVI Data Protection Act 2021). ## 5. How We Share Your Information 5.1 We do not sell your personal data to third parties. 5.2 We may share your data with: * **KYC/AML providers:** Identity verification and sanctions screening service providers * **Blockchain analytics providers:** Services used to analyze wallet activity for compliance purposes * **Legal and regulatory authorities:** Law enforcement agencies, tax authorities, financial regulators, and courts when required by applicable law or legal process * **Professional advisers:** Lawyers, accountants, and auditors under confidentiality obligations * **Corporate transactions:** In connection with a merger, acquisition, reorganization, or asset sale, subject to standard confidentiality protections * **Affiliates and group entities:** Related entities within the Hamilton group for operational purposes We require all third-party service providers to handle your data in accordance with applicable data protection law. ## 6. Data Retention We retain your personal data for as long as necessary to fulfill the purposes described in this Policy, or as required by applicable law. KYC/AML records for Primary Users are retained for a minimum of five (5) years following the end of the business relationship, or longer if required by applicable law. Account and transaction records are retained for the period required by applicable financial regulations. Upon expiry of the applicable retention period, data is securely deleted or anonymized. ## 7. International Data Transfers HDA is incorporated in the British Virgin Islands. Your data may be transferred to and processed in countries other than your country of residence, including countries that may not provide the same level of data protection as your home jurisdiction. Where we transfer personal data from the European Economic Area (EEA) to third countries, we implement appropriate safeguards in accordance with applicable data protection law (e.g., Standard Contractual Clauses). By using our Website or Platform, you consent to the transfer of your data as described in this Section. ## 8. Your Rights 8.1 Depending on your jurisdiction, you may have the following rights regarding your personal data: * **Access:** Request a copy of the personal data we hold about you * **Correction:** Request correction of inaccurate or incomplete data * **Deletion:** Request deletion of your data, subject to legal retention requirements * **Restriction:** Request restriction of processing in certain circumstances * **Portability:** Receive your data in a structured, machine-readable format (where applicable) * **Objection:** Object to processing based on legitimate interests Residents of jurisdictions with a data protection supervisory authority may also lodge complaints with that authority (for example, the UAE Data Office under the UAE PDPL, the Personal Data Protection Commission of Singapore under the PDPA, the Office of the Privacy Commissioner for Personal Data of Hong Kong under the PDPO, the Federal Data Protection and Information Commissioner of Switzerland under the nFADP, or the relevant supervisory authority under the EU GDPR / UK GDPR where applicable). To exercise your rights, contact . We will respond within 30 days. Note that we may need to verify your identity before processing requests, and that certain rights may be limited by applicable legal obligations (e.g., AML record-keeping requirements). ## 9. Cookies and Tracking Technologies 9.1 We use cookies and similar technologies to operate the Website and Platform and to collect usage analytics. 9.2 Types of cookies we use: * **Essential cookies:** Required for the Website and Platform to function * **Analytics cookies:** Used to understand how users interact with the Website (e.g., Google Analytics) * **Preference cookies:** Used to remember your settings and preferences You may disable cookies through your browser settings, but this may affect the functionality of the Website. We do not use third-party advertising cookies or sell browsing data to advertisers. ## 10. Security We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, disclosure, alteration, or destruction. No method of data transmission or storage is completely secure. We cannot guarantee absolute security of your data. In the event of a data breach that poses a risk to your rights and freedoms, we will notify you and applicable regulators as required by law. ## 11. Children's Privacy The Platform is not intended for use by persons under the age of 18. We do not knowingly collect personal data from minors. If you believe we have collected data from a minor, please contact . ## 12. Changes to This Policy We may update this Privacy Policy at any time. The updated Policy will be effective upon posting on our Website. We will notify you of material changes by posting a prominent notice on our Website or by email where we hold your contact details. Your continued use of the Website or Platform after any update constitutes acceptance of the revised Policy. ## 13. Contact Us For questions about this Privacy Policy or our data practices: Hamilton Digital Assets Limited Registered office: British Virgin Islands (full registered address to be inserted at production cutover) Email: ## 14. Governing Law This Privacy Policy is governed by and construed in accordance with the laws of the British Virgin Islands. Any dispute arising out of or in connection with this Policy shall be finally resolved by binding arbitration administered by the BVI International Arbitration Centre ("BVIAC") in accordance with the BVIAC Arbitration Rules then in force, seated in the British Virgin Islands. Notwithstanding the foregoing, HDA may seek injunctive or other equitable relief in any court of competent jurisdiction. Each party waives any right to bring claims as part of a class action, collective action, or representative proceeding. You have the right to opt out of the arbitration provisions and class-action waiver in this Section 14 by sending written notice of your decision to opt out to within thirty (30) days of your first use of the Website or Platform. The notice must include your name and contact details. If you do not send a timely opt-out notice, you shall be bound to resolve disputes through individual (non-class) arbitration in accordance with this Policy. Nothing in this Section 14 limits a data subject's statutory right to lodge a complaint with a competent data protection supervisory authority under applicable law.