Hash Hedge – Privacy Policy

Last Updated: October 8, 2026

1. INTRODUCTION

This Privacy Policy applies to hashhedge.com, the Hash Hedge mobile application and personal data processed by Empower Academy Ltd, a company duly incorporated and registered in the United Arab Emirates under registration number 01010596 ("Company," "we," "our," or "us"), in connection with the Platform and Services. We are committed to protecting the privacy and personal data of our Users. This Privacy Policy outlines the types of personal data we collect, how we process it, and the measures we take to safeguard your information in compliance with the Personal Data Protection Law (PDPL) and other relevant international and UAE laws.

The Company operates the Platform and administers Challenge Plans, simulated Evaluation Stages, User Accounts, support and analytics. Where applicable, personal data may also be processed in connection with Live Account access as described in the Terms and Conditions and Commercial Terms.

All terms used in this Privacy Policy shall have the same meanings as defined in the Terms and Conditions of our Platform, unless otherwise specified. References to the "Commercial Counterparty" mean the entity identified in Section 5.1.

1.1. SCOPE OF THE PRIVACY POLICY

This Privacy Policy applies to personal data collected or processed through our website, the Hash Hedge mobile application, the Platform, Services, and any related digital tools or communications. It governs how we collect, use, and share personal information provided by our users, ensuring transparency and accountability in all our data processing activities.

1.2. PURPOSE OF DATA PROCESSING

We collect and process personal data to enhance user experience, provide and administer the Platform, Evaluation Stages and related support services, facilitate platform functionality, and comply with applicable laws and regulations. This includes processing data to:

Process payments and refunds relating to the Services, track User participation in Challenges, and share relevant payout information with the Commercial Counterparty where necessary to administer rewards under the Commercial Terms.

Analyze user activity to improve our services and platform functionalities.
Enforce Platform integrity rules, including but not limited to detection and prevention of Prohibited Hedging across Accounts, coordinated trading, multi-accounting.
Conduct investigations into suspected breaches of the Terms and Conditions, including Holds imposed under Section 16 of the Terms and Conditions, by analyzing trading patterns, cross-referencing Account data, and reviewing device, network, and behavioral information.
Perform Know Your Customer (KYC), Anti-Money Laundering (AML), Counter-Terrorism Financing (CTF), and enhanced due diligence (EDD) procedures, including enhanced identity Re-Verification under Section 6.5 of the Terms and Conditions.

Identify Related Persons (as defined in the Terms and Conditions) by cross-referencing personal data, browser-derived device or network identifiers collected through web access, where applicable, IP addresses, payment methods, behavioral patterns, and other indicia of affiliation across User Accounts.

Support the Commercial Counterparty in administering the Affiliate Program, including verifying the legitimacy of referred Users, detecting Fraudulent Traffic, cross-referencing Affiliate data with referred Users' data, and enforcing commission clawback provisions.

Share relevant data, where required, with competent authorities, external forensic or compliance advisors, industry anti-fraud databases, and other service providers as further described in Section 5 of this Privacy Policy.

By accessing or using our Platform and Services, you acknowledge and agree to this Privacy Policy. If you do not agree to any part of this Policy, please discontinue the use of our Services. We encourage users to periodically review this document for updates or changes.

2. HOW WE COLLECT PERSONAL DATA

At the Company we collect personal data to deliver and improve our services. This section explains how we collect information from users of our platform.

2.1. DATA PROVIDED BY USERS

We collect personal data directly from users when they:

Register on the platform and create an account.
Fill out forms, participate in challenges, or complete surveys.
Contact our support team or engage with our communication channels.
Provide information for transactions, such as payment details.

2.2. DATA COLLECTED AUTOMATICALLY

Our Platform may automatically collect and process certain technical, usage, session, authentication and activity data in connection with the provision, security and operation of the Services, including:

Technical Data: Such as IP address, browser type, operating system, and device information.
Cookies: Small text files stored on users' devices to track preferences and enhance functionality.
Usage Data: Information about how users interact with our platform, such as navigation patterns and feature usage.

Device and Network Identification Data: When the Platform is accessed through a web browser, the Company may process browser and network information for security, fraud-prevention and Account-integrity purposes. Where such browser or network information is collected through web access, it may be used for identifying Related Persons, detecting multi-accounting, and enforcing the Single Live Account Rule. The Hash Hedge mobile application may process technical, usage, session and authentication data as described in this Privacy Policy for the operation, security and support of the mobile application.

Behavioral and Trading Pattern Data: Detailed records of trading activity, including order timestamps, instrument selection, position sizes, entry/exit prices, holding periods, trade frequency, and patterns of activity across sessions. This data is collected for the purposes of detecting Prohibited Hedging, and conducting investigations under Section 16 of the Terms and Conditions.
Session and Authentication Data: Login timestamps, session duration, multi-factor authentication records, and concurrent session indicators, used for security, fraud prevention, and investigation purposes.

2.3. DATA FROM THIRD PARTIES

We may receive data about users from trusted third parties, such as:

Payment processors, to confirm transaction details.
Analytics providers, to analyze and improve our platform's performance.
Public databases or other lawful sources, to verify user identity and comply with regulations.

2.4. DATA GENERATED THROUGH CROSS-REFERENCING

In the course of enforcing Platform integrity rules, the Company may generate derived data by cross-referencing information across multiple User Accounts, Affiliate data provided or made available by the Commercial Counterparty, and external sources. Such derived data may include:

Correlation scores between Users' trading patterns, indicating potential coordinated trading or Prohibited Hedging;

Related Persons indicators, derived from matching browser-derived device or network identifiers collected through web access, where applicable, IP addresses, payment methods, behavioral patterns, or registration data across Accounts;

Risk scores and fraud probability assessments generated by the Company's automated monitoring systems;
Matching results from sanctions lists, PEP registers, and industry anti-fraud databases.

This derived data constitutes personal data to the extent it relates to an identified or identifiable User and is processed in accordance with this Privacy Policy.

3. WHAT TYPES OF PERSONAL DATA WE PROCESS

To provide our services and enhance the user experience on our platform, we may collect and process the following types of personal data:

3.1. PERSONAL INFORMATION PROVIDED BY USERS

Full name.
Email address.
Phone number.
Date of birth.
Country of residence.
Payment details (such as billing address, card information, or transaction identifiers).

3.2. TECHNICAL INFORMATION COLLECTED AUTOMATICALLY

Internet Protocol (IP) address.
Device type and operating system.
Browser type and version.
Log data, including access times and visited pages.
Cookies and similar technologies used to track user preferences and enhance functionality.

3.3. ACTIVITY AND TRANSACTION DATA

Participation in challenges and related actions on the platform.
Transaction history, including payments made to us.
Data regarding user engagement with platform features, including navigation behavior and interaction analytics.

3.4. DATA FROM THIRD PARTIES

Information from payment processors to confirm and reconcile transactions.
Data from analytics providers to improve user experience and platform performance.
Verification data obtained from public records or other lawful sources to ensure compliance with legal and regulatory requirements.

3.5. SPECIAL NOTE ON SENSITIVE DATA

The Company does not generally seek to collect or process sensitive personal data except where such processing is expressly described in this Privacy Policy or is otherwise necessary for the provision, security, verification, or compliance-related operation of the Services.

In particular, the Company may collect and process biometric data, including facial images captured through live selfie or video verification, for identity verification and Re-Verification purposes as described in Section 3.6.

Other categories of sensitive personal data, such as health information, religious beliefs, or political opinions, are not intentionally collected unless required by applicable law or voluntarily provided by the User in circumstances relevant to the Services. Any sensitive personal data processed by the Company shall be handled in accordance with this Privacy Policy and applicable data protection laws.

By using the Platform, Users acknowledge the processing activities described in this Privacy Policy. Where consent is required as the legal basis for a specific processing activity, the Company will request such consent separately and provide the User with the ability to withdraw it in accordance with applicable law. For further details on how data is processed, stored, or shared, please refer to subsequent sections of this Privacy Policy.

3.6. RE-VERIFICATION AND ENHANCED DUE DILIGENCE DATA

In connection with the Company's KYC, AML, CTF, and identity re-verification procedures (as set out in Section 6.5 of the Terms and Conditions), we may collect and process additional categories of personal data, including but not limited to:

(a) Identity documents: Government-issued photographic identity documents (passport, national ID card, driving licence), including document images, document numbers, machine-readable zone (MRZ) data, issue and expiry dates, and issuing authority;
(b) Biometric data: Facial images captured via live selfie or video verification, used solely for the purpose of identity confirmation by cross-referencing with the photographic identity document. The Company does not create or store biometric templates for ongoing surveillance or identification purposes beyond the Re-Verification process;
(c) Proof of address documents: Utility bills, bank statements, government-issued correspondence, or equivalent documents dated within the last three (3) months;
(d) Source-of-funds and source-of-wealth declarations and supporting documentation, including bank statements, employment contracts, or business ownership records;
(e) Account ownership and control declarations: Confirmation that the User is the sole owner and operator of the Account and does not operate the Account on behalf of, for the benefit of, or under the control of any third party;
(f) Politically Exposed Person (PEP) self-declarations;
(g) Sanctions and PEP screening results: Outcomes of checks performed by the Company or its authorized third-party providers against international sanctions lists (UN, EU, OFAC, HMT) and PEP registers;
(h) Adverse media screening results, where applicable.

This data is collected and processed on the following legal bases:

(i) compliance with a legal obligation (UAE AML/CTF legislation, including Federal Decree-Law No. 20/2018 and Cabinet Decision No. 10/2019);
(ii) performance of a contract (the Terms and Conditions); and
(iii) the Company's legitimate interest in fraud prevention and Platform integrity.

3.7. INVESTIGATION AND HOLD DATA

Where a User's Account is placed on Hold or becomes subject to investigation under Section 16 of the Terms and Conditions, the Company may collect, generate, and process additional categories of personal data specific to the investigation, including:

(a) Detailed trading activity records, including full order history, execution logs, position snapshots, and P&L calculations;
(b) Cross-Account correlation data, including comparisons of the User's trading patterns with those of other Users;
(c) Technical and network data, including browser-derived device or network identifiers collected through web access, where applicable, browser configurations, and indicators of remote access tools, VPNs, or proxy services;
(d) Communication metadata (to the extent lawfully available), such as timestamps and frequency of interactions with the Platform's support channels;
(e) Third-party intelligence, including information obtained from forensic analysts, compliance consultants, or external investigation services engaged by the Company;
(f) Investigation records, including internal notes, assessment reports, risk committee determinations, and outcome decisions (Outcome A, B, or C under Section 16.4 of the Terms and Conditions);
(g) Any additional information or documentation provided by the User in response to the Company's investigation requests.

This data is processed on the legal bases of:

(i) the Company's legitimate interest in protecting Platform integrity and preventing fraud;
(ii) performance of a contract; and
(iii) compliance with legal obligations, including UAE AML/CTF requirements.

3.8. AFFILIATE PROGRAM DATA

Where a User has been referred to the Platform through the Affiliate Program, the Company and the Commercial Counterparty may process and share the following additional data in connection with the User's Account:

(a) The identity and account details of the referring Affiliate;
(b) Cross-referencing data between the User and the Affiliate (and other Users referred by the same Affiliate), including comparisons of registration data, browser-derived device or network identifiers collected through web access, where applicable, IP addresses, payment methods, and trading patterns, for the purpose of detecting Fraudulent Traffic, Related Persons relationships, and coordinated trading;
(c) Affiliate commission records attributable to the User's activity.

This data is processed for the purposes of preventing fraud, ensuring the integrity of the Affiliate Program, administering Commissions and supporting related compliance processes.

4. PURPOSE FOR PERSONAL DATA COLLECTION

We process personal data strictly to provide high-quality services while complying with legal and regulatory requirements. The personal data we collect is used for the following purposes:

USER REGISTRATION AND IDENTIFICATIONTo create and manage user accounts, verify user identity, and ensure compliance with our Terms and Conditions, including eligibility requirements for platform participation.
PROVIDING PLATFORM SERVICES AND FUNCTIONALITYTo facilitate the operation of our platform, including enabling participation in Challenges, managing User progress, and providing account information, analytics and related Platform functionality.

PAYMENT PROCESSING

To process payments, fees, and refunds related to Challenges, Add-Ons, and other Services offered through the Platform, and to enable the Commercial Counterparty to process reward and Affiliate Commission payouts, ensuring secure and efficient transactions through trusted payment providers.
ANALYSIS AND IMPROVEMENT OF SERVICESTo analyze user behavior, preferences, and platform usage trends to improve our services, develop new features, and enhance the user experience.
LEGAL AND REGULATORY COMPLIANCETo comply with applicable laws and regulations, including those of the United Arab Emirates and international standards, such as anti-money laundering (AML) and data protection requirements.
MARKETING AND COMMUNICATIONSTo provide users with updates, promotional content, and notifications about services or challenges, subject to user preferences and consent.
FRAUD PREVENTION AND SECURITYTo monitor, investigate, and prevent unauthorized access, fraudulent activities, and other security threats to protect the integrity of our platform and user data.
CUSTOMER SUPPORTTo assist users with inquiries, address complaints, and resolve issues related to the platform and its services.
PLATFORM INTEGRITY AND RISK MANAGEMENTTo enforce the rules set out in the Terms and Conditions, including the Single Live Account Rule, Prohibited Hedging restrictions. This includes automated monitoring, cross-referencing of User data, and pattern analysis across Accounts.
INVESTIGATION AND ENFORCEMENTTo conduct investigations under Section 16 of the Terms and Conditions (Hold procedure), including analysis of trading data, cross-referencing of Account information, engagement of third-party forensic or compliance advisors, and determination of investigation outcomes. This purpose also encompasses enforcement actions such as Account suspension, termination, determinations affecting payout eligibility, and regulatory reporting.
IDENTIFICATION OF RELATED PERSONSTo identify individuals that share devices, networks, payment methods, or other indicia of affiliation with a User, for the purpose of enforcing the Single Live Account Rule and anti-hedging provisions. This may involve cross-referencing data across all registered Accounts on the Platform.
AFFILIATE PROGRAM INTEGRITYTo verify the legitimacy of Affiliate referrals, detect Fraudulent Traffic, cross-reference Affiliate data with referred Users' data, support the Commercial Counterparty in administering commission clawback provisions, and ensure compliance with the Affiliate Program Terms and Conditions.
REGULATORY REPORTING AND COOPERATIONTo comply with reporting obligations to the UAE Financial Intelligence Unit (FIU), relevant Free Zone authorities, and other competent bodies, including the filing of Suspicious Transaction Reports (STRs) and Suspicious Activity Reports (SARs) where required by law.

By agreeing to this Privacy Policy, you acknowledge that your personal data may be processed for these purposes. We ensure that all processing activities are conducted transparently and in accordance with applicable laws, including UAE PDPL and other applicable data protection regulations.

5. HOW WE SHARE PERSONAL DATA

We are committed to maintaining the privacy of your personal data. We share personal data only when necessary and in accordance with this Privacy Policy. Below is an outline of how and why personal data may be shared:

5.1. SHARING WITH SERVICE PROVIDERS AND COMMERCIAL COUNTERPARTY

We may share your personal data with trusted third-party service providers and with the Commercial Counterparty where necessary to facilitate the operation of our Platform, provide the relevant Services, and administer the purposes described in this Privacy Policy. This includes:

Payment Processors: For processing payments and refunds related to Challenges, Add-Ons, and other Services offered through the Platform.
Analytics Providers: To monitor and enhance platform performance and user experience.
Hosting Providers: To securely store and maintain platform data.
Forensic and Compliance Advisors: External forensic analysts, compliance consultants, legal advisors, and investigation specialists engaged by the Company to assist with investigations under Section 16 of the Terms and Conditions or to support KYC/AML/CTF compliance.
Identity Verification Providers: Third-party identity verification and biometric matching services used to process Re-Verification requests under Section 6.5 of the Terms and Conditions.
Sanctions and PEP Screening Providers: Third-party providers of sanctions list screening, PEP register checks, and adverse media monitoring services.
Industry Anti-Fraud Databases: Where permitted by applicable law and where the Company has determined that a User, or the Commercial Counterparty has determined that an Affiliate, has engaged in confirmed fraud, identity fraud, or coordinated manipulation, the Company and/or the Commercial Counterparty, as applicable, may share limited identifying information with industry-recognized anti-fraud databases or networks for the purpose of preventing repeat fraud across the industry.
Commercial Counterparty: FinSmart Solution Ltd, a company duly incorporated and registered in Seychelles under registration number 246832, administers Live Account profit allocation and payouts under the Commercial Terms and operates the Affiliate Program. The Company may share relevant identification, Account, trading, verification, payout, referral and compliance information with FinSmart Solution Ltd where necessary in connection with Live Account access, profit allocation and payouts, Affiliate Commissions, Hold outcomes and fraud prevention.

5.2. LEGAL AND REGULATORY REQUIREMENTS

We may disclose personal data if required to do so by law or in response to valid legal requests, such as subpoenas or court orders. This includes compliance with:

Applicable UAE laws and international regulations.
Anti-money laundering (AML) and counter-terrorism financing (CTF) obligations.
Tax reporting and other regulatory requirements.

5.3. BUSINESS TRANSFERS

In the event of a merger, acquisition, or sale of our business, your personal data may be transferred to the acquiring entity as part of the business transaction. We will ensure that the new owner upholds the commitments outlined in this Privacy Policy.

5.4. SAFEGUARDING USERS' RIGHTS AND PLATFORM INTEGRITY

We may share personal data to:

Investigate and prevent fraudulent activities, unauthorized access, or other breaches of our Terms and Conditions.
Protect the safety and rights of our users, employees, or the public.

5.5. AGGREGATED AND ANONYMIZED DATA

We may share aggregated or anonymized data that cannot be used to identify individual users with third parties for research, analysis, or marketing purposes. This data does not include personally identifiable information.

5.6. USER CONSENT

Where required by law, we will obtain your explicit consent before sharing your personal data with third parties for purposes not covered in this Privacy Policy.

We require third-party service providers, processors, contractors, and other recipients to whom we disclose Personal Data in connection with providing our Services to implement the same or an equivalent level of protection as described in this Privacy Policy, as appropriate to their role and the nature of the processing, including through applicable data processing agreements, confidentiality obligations, and data protection requirements.

5.7. CROSS-REFERENCING AND INTRA-PLATFORM DATA SHARING

To enforce Platform integrity rules and detect Prohibited Practices, the Company may cross-reference personal data across:

(a) multiple User Accounts registered on the Platform, to identify Related Persons, coordinated trading, or Prohibited Hedging;
(b) User Accounts and Affiliate data provided or made available by the Commercial Counterparty, to detect Fraudulent Traffic, Related Person relationships between Affiliates and referred Users, or coordinated fraud schemes;
(c) current User data and historical records of terminated or banned Users, to prevent re-registration by previously disqualified individuals.

This cross-referencing constitutes processing of personal data for the purposes of legitimate interest (fraud prevention and Platform integrity) and contractual performance. The Company implements appropriate safeguards, including access controls and data minimization principles, to ensure that cross-referencing is conducted proportionately and only to the extent necessary for the stated purposes.

Users are informed that their personal data may be compared with data of other Users without the Company disclosing the identity of those other Users. No User will be granted access to another User's personal data as a result of cross-referencing activities.

5.8. DATA SHARING WITH COMPETENT AUTHORITIES

The Company may disclose personal data to competent authorities without the User's consent where:

(a) required by applicable law, including under UAE Federal Decree-Law No. 20/2018 (AML/CTF), Cabinet Decision No. 10/2019, or directives of the UAE Financial Intelligence Unit (FIU);
(b) in response to a lawful request, court order, subpoena, or regulatory directive from a UAE authority, Free Zone authority, or international regulatory body with jurisdiction;
(c) the Company has reasonable grounds to suspect that a User's activity involves money laundering, terrorism financing, identity fraud, or other financial crime, and the Company is obligated or entitled to file a Suspicious Transaction Report (STR) or Suspicious Activity Report (SAR);
(d) necessary to protect the rights, property, or safety of the Company, its Users, or the public.

The Company shall not notify the User of such disclosure where doing so is prohibited by law or would prejudice an ongoing investigation ("tipping off" prohibition under UAE AML legislation).

6. YOUR DATA PROTECTION RIGHTS & CHOICES

We ensure that users retain control over their personal data, in compliance with UAE data protection regulations.

You have the right to access your personal data and request a copy of the information we hold about you. Additionally, you can request the correction of any inaccurate or incomplete data to ensure it is up to date.

In certain circumstances, you may ask us to delete your data, such as when it is no longer necessary for the purposes outlined in this Privacy Policy or if you withdraw your consent. You may also request restrictions on data processing or object to its use for specific purposes, such as direct marketing.

If you wish to transfer your data to another service provider, we can provide it in a commonly used, machine-readable format where technically feasible. Furthermore, you can withdraw consent for processing at any time, without affecting the lawfulness of processing prior to the withdrawal.

To exercise these rights, contact us at [email protected]. We aim to respond to all requests within 30 days, except where extensions are permitted by law.

Limitations on Data Subject Rights

Users should be aware that certain data subject rights may be limited in the following circumstances:

(a) AML/KYC Data: Where personal data has been collected as part of KYC, AML/CTF, or enhanced identity Re-Verification procedures (Section 3.6), the right to erasure and the right to restriction of processing may be limited. The Company is required by UAE Federal Decree-Law No. 20/2018 and Cabinet Decision No. 10/2019 to retain identification and transaction records for a minimum of five (5) years following the end of the business relationship. Deletion requests will be honoured only to the extent compatible with these legal obligations.
(b) Investigation Data: Where personal data has been collected or generated in connection with an investigation under Section 16 of the Terms and Conditions (Section 3.7), the right to access may be partially restricted to the extent that disclosure would:
- (i) prejudice an ongoing investigation;
- (ii) reveal the Company's proprietary fraud-detection methodologies;
- (iii) compromise the privacy rights of other Users whose data was involved in cross-referencing; or
- (iv) conflict with a legal obligation or regulatory directive.
(c) Cross-Referencing Data: Where personal data has been generated through cross-referencing (Section 2.4 / 5.7), the User's right to access extends only to their own personal data and derived data directly relating to them. The Company will not disclose the identity or personal data of other Users involved in the cross-referencing process.
(d) Regulatory Reporting: Where personal data has been disclosed to competent authorities (Section 5.8) or is subject to a tipping-off prohibition, the Company may be unable to confirm whether such disclosure has taken place.
(e) Automated Decision-Making: Where automated systems are used to flag potential breaches, Users have the right to request human review of any automated decision that significantly affects them. Such requests should be submitted in writing to the Company and will be reviewed within fourteen (14) business days.

These limitations are applied only to the minimum extent necessary and in compliance with applicable law. The Company will inform the User of any restriction applied and the reasons for it, unless doing so is prohibited by law.

7. FOR HOW LONG WE RETAIN PERSONAL DATA

We retain personal data only for as long as necessary to fulfill the purposes outlined in this Privacy Policy and to comply with legal, regulatory, or contractual obligations.

7.1. RETENTION PERIODS

User Account Information: Retained for the duration of the user's active account and five (5) years after account closure, as required by UAE law or for legitimate business purposes.
Transaction and Financial Records: Retained for a minimum of five (5) years to comply with anti-money laundering (AML) regulations, tax obligations, and audit requirements.
Technical Data (e.g., IP addresses, cookies): Retained for up to one (1) year or as specified by local regulations for analytics, security, or service improvement.
Marketing Data: Retained until the user withdraws consent or requests deletion, whichever comes first.
Re-Verification and Enhanced Due Diligence Data: Retained for a minimum of five (5) years from the date of collection or the date of termination of the User's Account, whichever is later, in compliance with UAE AML record-keeping requirements (Federal Decree-Law No. 20/2018, Art. 16; Cabinet Decision No. 10/2019, Art. 24).
Investigation and Hold Records: Internal investigation records, Hold determinations, and outcome decisions (Outcome A, B, or C) shall be retained for a minimum of five (5) years from the date of the final determination. Where the investigation resulted in a regulatory report (STR/SAR) or referral to competent authorities, records shall be retained for a minimum of ten (10) years or such longer period as required by the relevant authority.
Cross-Referencing and Related Persons Data: Derived data generated through cross-referencing shall be retained for the same period as the underlying Account data (i.e., five (5) years after account closure).
Affiliate Program Data (for referred Users): The Affiliate identity and commission records attributable to a referred User shall be retained for a minimum of five (5) years after the termination of the User's Account or the Affiliate's participation in the Program, whichever is later.

Technical and Behavioral Data: Browser-derived device or network identifiers collected through web access, where applicable, and behavioral trading pattern data used for fraud detection and Related Persons identification shall be retained for three (3) years from the last activity associated with the relevant User Account or the relevant identifier, whichever is later, unless such data is relevant to an ongoing investigation, in which case retention shall be extended until the investigation and any subsequent proceedings have been concluded.

Biometric Data (Re-Verification): Facial images and video verification recordings shall be retained for five (5) years from the date of Re-Verification, in accordance with AML record-keeping obligations, after which they shall be securely deleted unless required for ongoing legal proceedings.

7.2. DELETION AND ANONYMIZATION

When personal data is no longer necessary for the specified purposes or retention periods, we will securely delete or anonymize it. Anonymized data may be used for research, analysis, or business development purposes, without identifying individual users.

7.3. USER REQUESTS FOR DATA DELETION

Users have the right to request deletion of their account and associated personal data in accordance with applicable laws. To submit a deletion request, Users may follow the account-deletion instructions provided in this Privacy Policy or contact the Company at [email protected].

Personal data associated with the Account will be deleted or anonymized unless the data is required to:

Fulfill ongoing legal or regulatory obligations.
Resolve disputes or enforce our agreements.
Maintain security and fraud prevention records.

Certain personal data may be retained where and for so long as necessary for the purposes and retention periods described in this Privacy Policy or as required by applicable law. Uninstalling the Hash Hedge mobile application from a device does not delete the User's account.

By adhering to these retention policies, we ensure the secure handling of user data and compliance with UAE regulations and international standards.

8. INTERNATIONAL DATA TRANSFERS

Personal data we collect through our platform may be transferred to and processed in countries outside the United Arab Emirates, including Seychelles, the European Union (EU), the United States, and other jurisdictions where our service providers or business partners operate. These transfers are necessary to ensure platform functionality, process transactions and reward payouts, administer the Affiliate Program, analyze user activity, and maintain high-quality service delivery.

To safeguard personal data during international transfers, we comply with UAE PDPL and other international data protection laws.

We may engage third-party service providers located outside the UAE to process personal data. These providers are contractually obligated to uphold data protection standards in line with this Privacy Policy and applicable laws.

Users may request details about the safeguards applied to their personal data during international transfers or exercise their rights regarding these transfers by contacting us at [email protected]. By using the Platform and Services, Users acknowledge that their personal data may be transferred internationally as described in this Privacy Policy. Where consent is required as the legal basis for a particular international transfer, the Company will obtain such consent separately in accordance with applicable law.

In connection with investigations under Section 16 of the Terms and Conditions, Re-Verification under Section 6.5 of the Terms and Conditions, and Affiliate Program compliance, personal data may be transferred to third-party forensic analysts, identity verification providers, or compliance consultants located outside the UAE. Such transfers shall be subject to appropriate safeguards, including contractual clauses requiring the recipient to maintain data protection standards equivalent to those under UAE law.

Where the Company shares data with industry anti-fraud databases (Section 5.1), such data may be accessible to participating firms located in various jurisdictions. The Company shall ensure that only the minimum data necessary for fraud prevention purposes is shared and that appropriate contractual safeguards are in place.

9. CHILDREN'S INFORMATION

We recognize the importance of protecting the privacy and safety of children. Our platform, services, and offerings are not intended for individuals under the age of 18, and we do not knowingly collect or process personal data from children.

9.1. RESTRICTIONS ON ACCESS BY MINORS

Individuals under the age of 18 are prohibited from creating accounts, using our services, or providing any personal data on the platform. By accessing or using our platform, you confirm that you are at least 18 years old.

9.2. INCIDENTAL COLLECTION OF CHILDREN'S DATA

If we become aware that personal data of a child has been collected inadvertently, we will take immediate steps to delete such data from our records. In cases where parental or guardian consent is legally required, we will ensure compliance with applicable regulations, such as the UAE data protection laws.

9.3. PARENTAL OR GUARDIAN INVOLVEMENT

Parents or legal guardians who suspect that their child has provided personal data to us are encouraged to contact us immediately at [email protected]. We will cooperate fully to address any concerns and ensure the data is promptly removed.

10. SECURITY

The security of personal data is our top priority. We implement industry-standard technical, administrative, and physical safeguards to protect personal data from loss, misuse, unauthorized access, disclosure, alteration, or destruction.

10.1. MEASURES TO SAFEGUARD PERSONAL DATA

We employ a combination of security measures, including but not limited to:

Data encryption in transit and at rest to prevent unauthorized access.
Regular system monitoring and vulnerability assessments to identify and mitigate potential security risks.
Secure storage facilities with restricted access to authorized personnel only.
Implementation of secure authentication mechanisms for accessing personal data.
Employee training programs on data protection and information security best practices.
Role-based access controls for investigation and Re-Verification data, ensuring that only authorized compliance and risk management personnel have access to Hold records, biometric data, and cross-referencing outputs.
Segregation of Re-Verification biometric data from general user data, with additional encryption and audit trail requirements.
Automated alerts for unusual access patterns to investigation records and cross-referencing data.
Periodic audits of access logs for sensitive data categories, including Re-Verification documents, investigation records, and Affiliate cross-referencing outputs.

10.2. LIMITATIONS OF SECURITY MEASURES

While we strive to protect personal data using commercially reasonable efforts, no method of electronic transmission or storage is completely secure. As such, we cannot guarantee the absolute security of personal data. Users are advised to take precautions, such as using strong passwords and safeguarding account credentials, to further protect their data.

10.3. SECURITY BREACH NOTIFICATION

In the unlikely event of a data breach that affects personal data, we will notify affected users and relevant regulatory authorities as required by applicable laws. The notification will outline the nature of the breach, the data involved, and any actions users should take to minimize potential risks.

10.4. USER RESPONSIBILITY FOR ACCOUNT SECURITY

Users are responsible for maintaining the confidentiality of their account credentials and for ensuring that they use secure devices and networks when accessing our platform. If you suspect unauthorized access to your account, please contact us immediately at [email protected].

11. USE OF COOKIES

We use cookies and similar technologies to enhance your experience on our platform, provide essential functionality, and analyze user behavior. This section explains how we use cookies and your choices in managing them.

11.1. WHAT ARE COOKIES?

Cookies are small text files that are placed on your device (computer, smartphone, or other devices) when you access our platform. They store information about your interaction with our platform, which helps us improve your user experience.

11.2. TYPES OF COOKIES WE USE

We use the following categories of cookies on our platform:

Essential Cookies: These cookies are necessary for the operation of our platform. They enable basic functions like page navigation and access to secure areas. Without these cookies, the platform cannot function properly.
Performance and Analytics Cookies: These cookies help us understand how users interact with our platform by collecting and reporting information anonymously. This allows us to improve platform performance and user experience.
Functional Cookies: These cookies allow us to remember your preferences and provide enhanced functionality, such as language settings or saved login details.
Marketing and Advertising Cookies: These cookies track your browsing activity to deliver personalized advertisements and promotions that are relevant to your interests.

11.3. PURPOSES OF USING COOKIES

We use cookies to:

Enhance platform functionality and improve user experience.
Analyze traffic and user interactions to identify areas for improvement.
Provide tailored content and advertisements based on user preferences.
Remember user preferences and login details for convenience.

11.4. THIRD-PARTY COOKIES

Our platform may include cookies set by third-party providers, such as analytics services (e.g., Google Analytics) or advertising partners. These third parties may collect data about your online activities across other websites and applications.

11.5. MANAGING COOKIES

You can manage or disable cookies through your browser settings at any time. However, please note that disabling certain cookies may impact your ability to use some features of our platform.

Browser Settings: Most browsers allow you to block or delete cookies. Refer to your browser's help section for instructions.
Cookie Preferences: You can adjust your cookie preferences directly on our platform by accessing the cookie settings.

11.6. CONSENT TO COOKIES

Essential cookies and similar technologies may be used where necessary to provide, secure and operate the Platform. Where consent is required for analytics, advertising, marketing, tracking or other non-essential technologies, the Company will request such consent before their use. Users may withdraw or modify their preferences through the available cookie or privacy settings.

12. CHANGES TO OUR PRIVACY POLICY

We periodically update this Privacy Policy to reflect changes in laws, regulations, business practices, or our services. These updates ensure continued compliance and transparency in how we process personal data.

Users will be notified of significant changes through announcements on our platform or, where required by law, via email. The updated Privacy Policy will take effect on the "Last Updated" indicated at the top of this document.

By continuing to use our platform and services after the updates become effective, you confirm your acceptance of the revised terms. For material changes requiring explicit consent, such as those mandated by applicable laws, we will request your agreement before applying the updates.

13. HOW TO CONTACT US

If you require more information or have any questions about our Privacy Policy, please feel free to contact us by email at [email protected].