Privacy Policy

Introduction and Scope

HashCore FZ-LLC (“Company”, “we”, “us”, or “our”) is fully committed to safeguarding and respecting the privacy of its users. This Privacy Policy describes in detail how we collect, use, process, and protect personal information in connection with the use of our services, software, and websites. The provisions of this Policy apply comprehensively to all products and solutions offered by the Company, including HashCore Firmware and its related software applications, the HashCore Toolkit management software, and the HashCore Proxy services. The Policy further extends to the use of our website and other online resources available at https://hashcore.com, as well as customer support interactions, related communications, mobile applications, and any associated services provided by us.

Legal Framework and Compliance

This Privacy Policy has been prepared in accordance with applicable data protection and privacy regulations in the jurisdictions where we operate. In particular, the Policy is designed to ensure compliance with the United Arab Emirates Federal Law No. 45 of 2021 on the Protection of Personal Data, the General Data Protection Regulation (GDPR) applicable to users located within the European Union, and the California Consumer Privacy Act (CCPA) applicable to residents of California. It also takes into account other relevant legal and regulatory requirements governing the protection of personal information in the territories in which our services are made available.

By accessing or using our services, you expressly acknowledge and agree that your personal data may be collected, processed, and disclosed in accordance with the provisions of this Policy and in compliance with the applicable laws and regulations.

Definitions and Key Terms

For the purposes of this Privacy Policy, the following definitions apply:

• “Personal Data” means any information relating to an identified or identifiable natural person, including but not limited to names, email addresses, phone numbers, postal addresses, IP addresses, device identifiers, and usage data.
• “Processing” means any operation performed on Personal Data, whether by automated means or not, including collection, recording, organization, structuring, storage, adaptation, alteration, retrieval, consultation, use, disclosure, dissemination, restriction, erasure, or destruction.
• “Data Controller” means HashCore FZ-LLC, which determines the purposes and means of Processing Personal Data.
• “Data Subject” means any identified or identifiable natural person whose Personal Data is processed by us.
• “Services” means all products, software, applications, websites, and related services provided by HashCore FZ-LLC.
• “DevFee” means the automated compensation mechanism built into our software that collects a predetermined percentage of mining results.
• “Third Parties” means individuals, companies, or organizations that are not directly affiliated with HashCore FZ-LLC but may provide services to us or receive Personal Data from us in connection with the Services.

Data Controller Information

• Data Controller: HashCore FZ-LLC
• Registered Address: CWEP0638, Compass Building, Al Shohada Road, Al Hamra Industrial Zone-FZ, Ras Al Khaimah, United Arab Emirates
• Data Protection Contact: [email protected]
• General Contact: [email protected]
• EU Representative: [email protected]
• UK Representative: [email protected]

Personal Data We Collect

We collect different categories of personal data depending on how you interact with our Services.

Information You Provide Directly

When you create an account, interact with support, or use our Services, you may provide:

Account Registration Data: Full name and username, email address, phone number (optional), country and region of residence, preferred language settings, and account security information (passwords, security questions).

Payment and Financial Information: Cryptocurrency wallet addresses, payment method details (for fiat payments), transaction history and payment records, tax identification numbers (when legally required), and banking details for withdrawals.

Communication Data: Support tickets and correspondence, forum posts and community interactions, feedback and survey responses, email communications and preferences, chat logs, and other support conversations.

Profile and Preference Data: Mining preferences and configurations, notification settings, dashboard customization, API access credentials and related settings, and marketing communication preferences.

Information Collected Automatically

When you use our Services, we automatically collect:

Technical and Usage Data: IP addresses and geolocation, device type, model, and operating system, browser type and version, screen resolution, referring and exit pages, timestamps, and session duration.

Mining and Performance Data: Hardware specifications and configurations, hashrate, power consumption, performance metrics, pool connection and statistics, DevFee calculations and transactions, error logs, diagnostic information, and firmware update history.

Website and Application Analytics: Page views, clicks, navigation patterns, feature usage, search queries, downloads and installation statistics, performance reports, and A/B testing and optimization data.

Information from Third Parties

We may also collect data from third-party and public sources:

Blockchain and Public Data: Public blockchain transaction details, mining pool performance statistics, cryptocurrency market and pricing information, and network difficulty data.

Service Providers and Partners: Payment processor transaction records, cloud service provider logs, threat intelligence from security providers, marketing platform engagement data, and customer support platform interactions.

Social Media and Public Sources: Publicly available social media profiles (when accounts are connected), forum posts and contributions, industry publications, news mentions, and public business registry data.

How We Use Your Personal Data

Service Provision and Management

We use your data to:

• Provide access to HashCore software and services.
• Process and manage account registration and authentication.
• Deliver software updates and security patches.
• Manage mining pool operations and payouts.
• Process DevFee calculations and transactions.
• Monitor and optimize service performance, troubleshoot errors, and conduct system maintenance.

Communication and Support

We use your data to:

• Respond to support requests, inquiries, and account issues.
• Provide technical assistance, troubleshooting, and training content.
• Send service-related notifications, security alerts, account statements, and regulatory communications.
• Deliver product updates, feature announcements, and compliance notices.

Business Operations and Compliance

We process data to:

• Handle payments and financial transactions.
• Comply with tax reporting and regulatory obligations.
• Conduct anti-money laundering (AML) checks and know-your-customer (KYC) procedures.
• Maintain records for audit and compliance purposes.
• Prevent fraud, monitor threats, and implement security controls.

Marketing and Business Development

Where legally permitted or based on your consent, we may:

• Send promotional emails, newsletters, and special offers.
• Share industry news, educational content, and loyalty program details.
• Analyze user behavior and preferences to improve services and design.
• Conduct market research, develop new products, and measure campaign effectiveness.

Legal Basis for Processing

We rely on the following legal grounds to process personal data:

1. Contractual Necessity – to perform our Terms of Service and related agreements, including account creation, service delivery, payment processing, and DevFee collection.
2. Legitimate Interests – for improving services, ensuring security and fraud prevention, conducting analytics, marketing to existing customers, and complying with legal obligations.
3. Legal Compliance – to meet obligations such as tax reporting, AML and KYC requirements, data retention, and regulatory reporting.
4. Consent – for optional data collection, marketing to prospects, use of cookies and tracking technologies (where required), third-party integrations, and research or development activities.

Data Sharing and Disclosure

We treat your personal data with strict confidentiality and only share it in limited circumstances as described below.

Service Providers and Processors

We may share your personal data with trusted third-party service providers that assist us in delivering and improving our services. These include:

Technical Service Providers: cloud hosting and infrastructure providers, content delivery networks (CDNs), database and backup providers, software development and maintenance contractors, and security and monitoring services.

Business Service Providers: payment processors and financial institutions, customer support and help desk platforms, marketing and communication services, analytics and business intelligence providers, and legal and professional advisers.

All such service providers are bound by strict confidentiality and data processing agreements ensuring compliance with GDPR and other applicable laws. Safeguards include regular audits, security assessments, data minimization, and the implementation of appropriate technical and organizational measures.

Business Transfers and Corporate Transactions

In the event of a merger, acquisition, sale of assets, or similar corporate transaction:

• Personal data may be transferred to the acquiring entity.
• Users will be notified in advance of any such transfer.
• The acquiring entity will remain bound by this Privacy Policy.
• Users will retain the right to object to the transfer.
• Alternative arrangements will be made for users who object.

Legal Requirements and Law Enforcement

We may disclose personal data when required by law or when necessary to protect our rights. This includes:

• Compliance with court orders, lawful requests from government authorities, and regulatory reporting obligations.
• Cooperation with law enforcement or national security investigations.
• Enforcement of our Terms of Service and related agreements.
• Protection of intellectual property rights.
• Defense against legal claims and litigation.
• Prevention of fraud, illegal activities, and threats to user safety and security.

Blockchain and Public Disclosures

Certain data is inherently public due to the nature of blockchain technology:

• DevFee transactions are recorded on public blockchains.
• Mining pool statistics may be displayed publicly.
• Cryptocurrency wallet addresses may be visible on-chain.
• Transaction data is transparent, immutable, and cannot be deleted.

We also may share anonymized and aggregated data, including usage statistics, performance benchmarks, industry reports, and research outputs. Such data will not identify individual users and may also be used in marketing and promotional materials.

Sub-processors and third-party partners

HashCore engages certain trusted third-party sub-processors to provide hosting, analytics, payment processing, and security services. A current list of sub-processors is available upon request by contacting [email protected] or may be published on our website. HashCore ensures that each sub-processor is bound by written agreements requiring compliance with applicable data protection laws, confidentiality obligations, and adequate security standards.

International Data Transfers

As a global service provider, we may transfer personal data across international borders for the purposes of service delivery, support, and compliance. Such transfers will always be subject to appropriate safeguards to ensure that your data is protected in line with applicable data protection laws, including the GDPR and equivalent regimes.

Transfer Mechanisms

We rely on recognized legal mechanisms for cross-border data transfers, including:

• Standard Contractual Clauses (SCCs) approved by the European Commission.
• Adequacy decisions issued by relevant data protection authorities.
• Binding Corporate Rules (BCRs), where applicable.
• Certification schemes and approved codes of conduct.
• Specific derogations permitted under applicable data protection laws, where no other mechanism is available.

Primary Transfer Destinations include:

• United States: cloud infrastructure, hosting, and service providers.
• European Union: data processing and analytics services.
• Other jurisdictions where our contracted service providers operate.

Data Protection Measures

We implement strong technical and organizational measures to safeguard international data transfers, including:

Technical Safeguards:

• End-to-end encryption for data in transit.

• Strong encryption for data at rest.

• Secure communication protocols (TLS/SSL).

• Regular security audits and penetration testing.

• Multi-factor authentication and strict access controls.

Organizational Measures:

• Data Processing Agreements (DPAs) with all third-party processors.

• Regular training for employees and contractors on data protection obligations.

• Incident response and breach notification procedures.

• Privacy Impact Assessments (PIAs) for high-risk processing activities.

• Ongoing compliance monitoring and independent auditing.

These safeguards ensure that personal data remains protected to the same high standards, regardless of where it is processed.

Explicit consent for cross-border transfers

In cases where no adequacy decision, Standard Contractual Clauses, or equivalent safeguards are available, HashCore may rely on the User’s explicit consent to transfer Personal Data internationally. By providing such consent, the User acknowledges that their data may be subject to differing data protection standards in the destination jurisdiction, which may not provide the same level of protection as their home country. Users may withdraw this consent at any time.

Data Retention

Retention Principles

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, unless a longer retention period is required by law, regulation, or legitimate business interest.

General Retention Periods:

• Account Data: retained while the account is active and for 7 years after closure.
• Transaction Data: retained for 10 years to comply with tax and regulatory obligations.
• Communication Data: retained for 3 years after the last interaction with us.
• Technical Logs: retained for 2 years for security, diagnostics, and troubleshooting.
• Marketing Data: retained until consent is withdrawn, plus 1 additional year for audit purposes.

Factors Affecting Retention:

• Applicable legal and regulatory requirements.
• Legitimate business interests (e.g., fraud prevention, dispute resolution).
• User preferences and specific deletion requests.
• Technical limitations and system constraints.
• Security and operational needs.

ADDITIONAL RETENTION FOR LEGAL CLAIMS

Notwithstanding the retention periods set forth above, HashCore may retain certain Personal Data for a longer duration where necessary for the establishment, exercise, or defense of legal claims, compliance with regulatory investigations, or to meet statutory limitation periods.

Data Deletion Procedures

Automated Deletion:

• Systematic deletion of data based on predefined retention schedules.

• Regular review and purging of outdated or redundant data.

• Secure deletion methods that prevent recovery of deleted data.

• Verification of deletion completion and effectiveness.

• Documentation of deletion activities for compliance and audit purposes.

Manual Deletion Requests:

• User-initiated deletion requests will be processed within 30 days.

• Identity verification is required before processing such requests.

• Users will be informed of any legal or technical limitations that may prevent complete deletion.

• Confirmation of deletion will be provided upon completion.

• Minimal records may be retained where necessary for compliance with legal obligations.

Your Privacy Rights

Universal Rights

All users have the following rights regarding their personal data:

Right of Access:

• Request information about the personal data we process.

• Obtain copies of your personal data.

• Receive details about processing purposes and data recipients.

• Understand the source of your personal data.

• Learn about any automated decision-making processes.

Right to Rectification:

• Correct inaccurate or incomplete personal data.

• Update outdated information.

• Add missing information where necessary.

• Ensure accuracy of data for ongoing processing.

• Receive confirmation of corrections made.

Right to Erasure (“Right to be Forgotten”):

• Request deletion of personal data in specific circumstances.

• Have data erased when no longer necessary for the original purpose.

• Withdraw consent and have data deleted.

• Object to unlawful processing and request deletion.

• Exercise the right to erasure for publicly disclosed data.

Enhanced Rights for EU/EEA Residents (GDPR)

If you are located in the EU/EEA, you have additional rights under the GDPR:

Right to Restrict Processing:

• Limit how we use your personal data.

• Suspend processing while data accuracy is verified.

• Restrict processing instead of deletion in certain cases.

• Limit processing for legal claims.

• Object to processing based on legitimate interests.

Right to Data Portability:

• Receive personal data in a structured, commonly used, and machine-readable format.

• Transfer your data directly to another service provider, where technically feasible.

• Obtain data originally provided on the basis of consent or contract.

• Exercise portability rights for automated processing.

• Receive data without undue hindrance from us.

Right to Object:

• Object to processing based on legitimate interests.

• Opt-out of direct marketing communications at any time.

• Object to profiling and automated decision-making.

• Stop processing for research and statistical purposes.

• Exercise the right to object at any time.

California Residents’ Rights (CCPA/CPRA)

If you are a California resident, you have specific rights under the California Consumer Privacy Act (CCPA), as amended by the CPRA:

Right to Know:

• The categories of personal information collected.

• The sources of such personal information.

• The business or commercial purposes for collecting the information.

• The categories of third parties with whom data is shared.

• The specific pieces of personal information collected.

Right to Delete:

• Request deletion of your personal information.

• Deletion may be subject to exceptions for legal compliance and operational needs.

• Verification of deletion requests is required.

• Service providers will be notified about deletions.

• Confirmation of deletion completion will be provided.

Right to Non-Discrimination:

• Equal service and pricing regardless of privacy choices.

• No denial of goods or services for exercising privacy rights.

• No higher prices or lower quality of services for exercising rights.

• Any incentive programs must be reasonably related to the value of the data.

United Arab Emirates Residents’ Rights (PDPL – Federal Decree-Law No. 45 of 2021)

If you are a resident of the United Arab Emirates (UAE), you have specific rights under the UAE Federal Data Protection Law (PDPL):

Right to Access:

• Obtain confirmation whether your personal data is being processed.

• Request access to your personal data and details about processing purposes, categories, and recipients.

• Obtain a copy of your personal data, subject to applicable legal restrictions.

Right to Rectification:

• Request correction or completion of inaccurate or incomplete personal data.

• Ensure your personal data remains accurate and up-to-date.

Right to Erasure:

• Request deletion of personal data where it is no longer necessary for the original purpose.

• Request deletion when consent is withdrawn.

• Request deletion in cases of unlawful processing or where retention is no longer justified.

Right to Restrict Processing:

• Request suspension of processing in certain cases (e.g., while accuracy is contested).

• Request restriction instead of deletion when continued storage is legally required.

Right to Data Portability:

• Request to receive personal data in a structured, machine-readable format.

• Request transfer of personal data to another controller, where technically feasible.

Right to Object:

• Object to processing based on legitimate interests, including profiling.

• Object to direct marketing communications.

Right to Withdraw Consent:

• Withdraw your consent to processing at any time, without affecting the lawfulness of processing based on consent before withdrawal.

Right to Lodge Complaints:

• Submit a complaint to the UAE Data Office if you believe your rights under the PDPL have been violated.

• We encourage you to contact us first to resolve any concerns directly.

Exercising Your Rights

How to Submit Requests:

• Email: [email protected]

• Written request to our registered address.

• Through your account settings (for applicable rights).

• Via customer support channels.

Request Processing:

• Identity verification is required for all requests.

• Standard response time is within 30 days (may be extended by an additional 60 days where legally permitted).

• Requests are processed free of charge, unless manifestly excessive or unfounded.

• An explanation will be provided if a request is refused.

• An appeal process is available for denied requests.

Automated decision-making and profiling

Automated Processing: HashCore may use limited forms of automated decision-making or profiling in the context of fraud prevention, security monitoring, and optimization of DevFee mechanisms. Such processing shall not produce legal or similarly significant effects for Users without human review.

User Rights: Users have the right to:

• obtain meaningful information about the logic involved in such processing;
• contest decisions made solely on the basis of automated processing;
• request human intervention in review of such decisions.

Limitations: HashCore does not conduct automated decision-making for marketing targeted at children or vulnerable individuals, nor does it engage in profiling that produces discriminatory effects.

Cookies and Tracking Technologies

Types of Cookies We Use

Essential Cookies

• Necessary for core website functionality.
• Enable features such as user authentication and session management.
• Remember login status and user preferences.
• Provide security protections and fraud prevention.
• Cannot be disabled without significantly affecting website performance.

Performance and Analytics Cookies

• Collect data on how users interact with our website.
• Help us understand user behavior and improve functionality.
• Provide insights into popular content, navigation flows, and feature usage.
• Support performance optimization, load balancing, and A/B testing.
• Enable continuous improvements to user experience.

Functional Cookies

• Remember your settings, preferences, and customizations.
• Enable enhanced features, personalization, and saved configurations.
• Support social media integrations and content sharing.
• Facilitate chat, helpdesk, and customer support functions.
• Maintain consistency of settings across sessions and devices.

Marketing and Advertising Cookies

• Deliver personalized advertisements and promotional content.
• Measure the performance of advertising campaigns.
• Support retargeting, remarketing, and cross-platform tracking.
• Enable social media advertising integrations and insights.
• Provide analytics on user interests and advertising effectiveness.

Cookie Management

Browser Controls

• Users can configure browsers to accept, reject, or delete cookies.
• Options include blocking third-party cookies while allowing first-party cookies.
• Users may clear existing cookies at any time.
• Browsers can be set to notify users when cookies are placed.

Our Cookie Preferences Tool

• Users can manage cookie categories directly on our website.
• Preferences may be updated or withdrawn at any time.
• Users may opt out of all non-essential cookies.
• Information on the impact of disabling certain cookies is provided.

Third-Party Tracking

Analytics Providers

• Google Analytics for traffic and performance monitoring.
• Custom analytics tools for mining-related metrics.

Marketing Platforms

• Social media tracking pixels (Facebook, LinkedIn, Twitter).
• Email marketing providers (Mailchimp, SendGrid).
• Affiliate tracking and attribution platforms.
• Advertising networks and demand-side platforms (DSPs).

Opt-Out Options

• Industry opt-out mechanisms such as NAI, DAA, and EDAA.
• Browser-based tracking protection features.
• Use of ad-blockers and privacy tools.
• Direct opt-out with individual third-party providers.
• Recognition of Global Privacy Control (GPC) signals.

Data Security

Technical Security Measures

Encryption

• AES-256 encryption for data at rest.
• TLS 1.3 for data in transit.
• End-to-end encryption for sensitive communications.
• Robust key management and rotation procedures.
• Use of Hardware Security Modules (HSMs) for secure key storage.

Access Controls

• Multi-factor authentication (MFA) required for all accounts.
• Role-based access control (RBAC) applied across systems.
• Principle of least privilege implemented throughout.
• Regular user access reviews and timely deprovisioning.
• Privileged Access Management (PAM) solutions for high-risk accounts.

Network Security

• Firewalls and Intrusion Detection/Prevention Systems (IDS/IPS).
• Virtual Private Networks (VPNs) for secure remote access.
• Network segmentation and micro-segmentation applied.
• Distributed Denial-of-Service (DDoS) protection.
• Regular vulnerability scanning and penetration testing.

Organizational Security Measures

Security Governance

• Implementation of an Information Security Management System (ISMS).
• Regular security risk assessments and independent audits.
• Formal incident response and crisis management procedures.
• Business continuity and disaster recovery planning.
• Third-party vendor security assessments and due diligence.

Personnel Security

• Background checks for employees with access to sensitive data.
• Regular security awareness and training programs.
• Confidentiality and non-disclosure agreements (NDAs).
• Secure onboarding and offboarding processes.
• Insider threat monitoring and prevention programs.

Physical Security

• Secure data centers with 24/7 monitoring and restricted access.
• Biometric and smart-card access controls, plus CCTV surveillance.
• Environmental controls for temperature, humidity, and fire suppression.
• Redundant power supply and disaster recovery sites.
• Secure disposal of hardware and data storage media.

Security Monitoring and Incident Response

Continuous Monitoring

• 24/7 Security Operations Center (SOC) monitoring.
• Automated threat detection and real-time response systems.
• Centralized log aggregation and SIEM (Security Information and Event Management).
• Behavioral analytics and anomaly detection.
• Regular reporting of security KPIs and metrics.

Incident Response

• Dedicated incident response team with documented procedures.
• Rapid containment, mitigation, and escalation protocols.
• Forensic analysis and root-cause investigation of incidents.
• Prompt communication with affected users and relevant authorities.
• Post-incident review and continuous improvement measures.

BREACH NOTIFICATION TIMELINES

In the event of a data breach involving Personal Data, HashCore will notify the competent supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of the breach, as required under GDPR and UAE PDPL. If the breach is likely to result in a high risk to the rights and freedoms of Users, HashCore will also notify affected Users without undue delay, providing information on the nature of the breach, likely consequences, and remedial actions taken.

Children’s Privacy

Age Restrictions

HashCore FZ-LLC takes the protection of children’s privacy seriously and applies strict safeguards to prevent the unauthorized collection or use of their personal data. Our Services are not directed to children under the age of 13, and we do not knowingly collect, process, or otherwise handle personal information relating to individuals in this age group. In most jurisdictions, users must be at least 18 years of age in order to create an account and access the Services. Where local laws permit individuals between the ages of 13 and 18 to use online services, such use is permitted only on the basis of verified parental consent. For this purpose, age verification mechanisms are integrated into the registration process to prevent unauthorized access.

Special Protections for Minors:

Special protections apply to minors who are legally permitted to use the Services. These include enhanced privacy safeguards, restricted collection of personal data, and minimal processing of information related to such users. We do not direct targeted marketing communications to minors, and parents or legal guardians retain rights of access and control over the personal data of their children. The Company regularly reviews and improves its procedures for age verification and parental consent to ensure that the privacy of minors is effectively safeguarded.

Parental Rights and Controls

If Your Child Has Provided Information Without Consent:

HashCore FZ-LLC recognizes the rights of parents and legal guardians to control the processing of their children’s personal data. In the event that a child provides information without the necessary consent, parents or guardians are encouraged to contact us immediately at [email protected]. Upon receiving such a request, the Company will take steps to verify both the child’s age and the parental or guardian relationship. Any personal data provided by the child will be promptly deleted once verification is complete, and the associated account will be suspended or terminated if unauthorized use is confirmed. Parents or guardians will also be informed of any accidental collection of their child’s data.

Parental Consent Mechanisms:

Where the processing of a child’s data is legally permitted, verifiable parental consent will be obtained prior to any collection or use of such information. Parents and guardians will receive a clear explanation of the purposes for which data is collected, the ways in which it will be used, and the manner in which it will be stored. They retain ongoing rights to access, review, and request deletion of their child’s data at any time. In addition, parents and guardians will be notified of any material changes to our data processing practices that could affect minors, thereby ensuring full transparency and continued oversight.

UAE CHILDREN’S DATA PROTECTION (PDPL ARTICLE 21)

HashCore complies with Article 21 of the UAE Federal Decree-Law No. 45 of 2021 (PDPL), which establishes enhanced safeguards for the processing of children’s Personal Data. Accordingly:

• No profiling, automated decision-making, or direct marketing is conducted towards children.
• Processing of children’s data is permitted only with verifiable parental or guardian consent.
• Where parental consent is withdrawn, HashCore will promptly delete the child’s data.
• Special technical and organizational measures are implemented to secure children’s data against unauthorized use.

Legal Compliance

We comply with applicable children’s data protection laws, including:

COPPA (Children’s Online Privacy Protection Act, US) – governing online services directed to children under 13.

GDPR Article 8 (EU/EEA) – requiring parental consent for processing personal data of children under 16 (or a lower age limit provided by Member States, but not below 13).

UAE Federal Decree Law No. 45 of 2021 on the Protection of Personal Data (PDPL), Article 21 – establishing enhanced safeguards for the processing of children’s personal data, including:

• explicit parental consent before any collection or processing of children’s personal data,
• prohibition of profiling, automated decision-making, or behavioral monitoring of children,
• strict restrictions on marketing communications or targeted advertising directed at children,
• mandatory transparency regarding the purposes of processing and safeguards applied.

Privacy by Design

Data Minimization

Collection Limitation:

HashCore FZ-LLC follows the principle of Privacy by Design, ensuring that the protection of personal data is embedded into every stage of the development and operation of its Services. In line with this principle, the Company applies strict rules of data minimization. Personal data is collected only to the extent necessary for clearly defined and legitimate purposes, with strict adherence to purpose limitation and use restriction requirements. Regular reviews of data collection practices are conducted to confirm that no unnecessary information is gathered. Automated tools for data classification and handling are employed to further safeguard compliance, while users are provided with clear options to control the collection of non-essential data.

Processing Minimization:

The processing of personal data is likewise minimized to what is strictly necessary for lawful and legitimate purposes. Whenever possible, techniques such as anonymization and pseudonymization are applied, and aggregated or statistical information is used in place of identifiable data. Access to personal information is restricted to authorized personnel on a strict need-to-know basis, and unnecessary or outdated personal data is deleted regularly in accordance with retention policies.

Transparency and User Control

Clear Communication:

HashCore FZ-LLC is committed to ensuring transparency in its data protection practices and to providing users with meaningful control over their personal information. To achieve this, the Company communicates its privacy practices in clear, plain, and easily understandable language. Privacy information is presented in a layered format, allowing users to access summaries or explore more detailed explanations as needed. Visual dashboards and intuitive control interfaces are provided to give users practical tools for managing their privacy preferences. Regular updates and notifications are issued to inform users of any changes to privacy practices, while educational resources are made available to increase awareness of data protection issues.

User Empowerment:

The Company also places a strong emphasis on user empowerment. Users are offered granular controls to manage their privacy settings and preferences, as well as straightforward tools to exercise their rights in respect of their personal data. Data processing and sharing practices are maintained in a transparent manner, supported by user-friendly mechanisms for consent and opt-out. To reinforce this commitment, the Company conducts periodic privacy checkups and sends reminder notifications, ensuring that users remain fully informed and in control of their data throughout their engagement with the Services.

Data Protection Impact Assessments (DPIA)

Where data processing is likely to result in a high risk to the rights and freedoms of natural persons (including large-scale processing of personal data, sensitive data, or systematic monitoring of publicly accessible areas), HashCore will carry out a Data Protection Impact Assessment (DPIA) prior to commencing such processing. The DPIA will include:

• an assessment of the necessity and proportionality of processing operations;
• identification of risks to data subjects;
• measures to mitigate such risks;
• consultation with supervisory authorities where required by law.

Updates to this Privacy Policy

Modification Procedures

Regular Reviews:

HashCore FZ-LLC reserves the right to update and amend this Privacy Policy in order to reflect changes in legal requirements, industry practices, or the development of its Services. To maintain compliance and accountability, the Company conducts an annual comprehensive review of its privacy practices, supplemented by quarterly assessments of regulatory developments and evolving requirements. Continuous monitoring of industry standards and best practices is carried out, and the Company actively integrates user feedback while performing privacy impact assessments. Findings from regular security and privacy audits are also used to guide ongoing improvements.

Change Notification Process:

When material changes to this Privacy Policy are introduced, users will be provided with no less than thirty (30) days’ advance notice. Such notice will be delivered through email communications to all registered users, prominently displayed announcements on the Company’s website, and in-app notifications where applicable. Each notification will contain a detailed explanation of the modifications and their potential impact on users. Where legally permissible, users will be given an opportunity to review the proposed changes and to raise objections prior to their implementation.

Types of Changes

Material Changes:

Changes to this Privacy Policy may be either material or non-material in nature. Material changes include amendments to the ways in which personal data is collected or the purposes for which it is processed, the introduction of new data-sharing arrangements or additional third-party recipients, modifications to user rights or to the procedures for exercising those rights, adjustments to data retention periods or deletion practices, and updates to the legal basis relied upon for processing personal data.

Non-Material Changes:

Non-material changes, on the other hand, generally involve clarifications and editorial refinements, updates to contact details, technical corrections or formatting adjustments, the inclusion of further examples and explanatory notes, or organizational restructuring that does not materially affect the handling of personal data. While such changes do not alter the substance of the Company’s privacy practices, they are made to enhance transparency and accuracy in the presentation of this Policy.

Contact Information and Complaints

Privacy Contacts

Data Protection Officer (DPO):

• Email: [email protected]
• Address: CWEP0638 Compass Building, Al Shohada Road, Al Hamra Industrial Zone-FZ, Ras Al Khaimah, UAE

General Privacy Inquiries:

General inquiries regarding privacy may be directed to HashCore FZ-LLC at any time. Such inquiries may include questions about the provisions of this Privacy Policy, requests for further information concerning our privacy practices, or concerns relating to the collection and use of personal data. Users are also welcome to submit suggestions for improvements to our privacy framework, as well as to report any suspected or potential violations of data protection requirements. All inquiries will be handled with due care and in accordance with applicable legal and regulatory obligations.

Privacy Rights Requests:

Users are entitled to exercise their privacy rights in accordance with applicable data protection laws. Such rights include the ability to request access to the personal data held by HashCore FZ-LLC, to seek rectification of inaccurate information, to request the erasure of personal data, and to obtain a portable copy of their information. Users may also object to the processing of their data or request that such processing be restricted. Where data processing is based on consent, users retain the right to withdraw that consent at any time and to make use of available opt-out mechanisms.

In addition, users may submit complaints relating to any perceived violations of their privacy rights and, where a privacy request has been denied, may lodge an appeal of that decision. All such requests will be assessed and addressed in accordance with the procedures set out in this Policy and the requirements of applicable data protection regulations.

Regulatory Complaints

Users have the right to file complaints with competent regulatory authorities if they believe that HashCore FZ-LLC has violated applicable data protection laws. In the United Arab Emirates, individuals may submit complaints to the UAE Data Office, the authority responsible for overseeing compliance with the Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL). Residents of the European Union or European Economic Area may lodge complaints with their local Data Protection Authority, including the lead authority in Ireland or any other supervisory authority competent under the General Data Protection Regulation (GDPR). In the United Kingdom, complaints may be raised with the Information Commissioner’s Office (ICO) under the UK GDPR framework.

California residents who wish to report concerns under the California Consumer Privacy Act (CCPA) or the California Privacy Rights Act (CPRA) may direct their complaints to the California Privacy Protection Agency (CPPA). Individuals residing in other jurisdictions are likewise entitled to contact their local data protection or privacy authority to address concerns regarding the Company’s privacy practices.

Response Commitments

Response Timeframes:

HashCore FZ-LLC is committed to responding to privacy-related inquiries and requests in a timely and transparent manner. All privacy inquiries are acknowledged within forty-eight (48) hours of receipt, and substantive responses to general privacy questions are normally provided within ten (10) business days. Requests to exercise privacy rights are processed within thirty (30) days, with the possibility of an extension for an additional thirty (30) days where this is permitted by law. Complaints relating to privacy practices are investigated within thirty (30) days, and, where appropriate, corrective measures are implemented without undue delay.

Escalation Procedures:

To ensure proper handling of such matters, the Company applies a structured escalation procedure. All inquiries and requests are first reviewed by the privacy team. More complex issues are escalated to the Data Protection Officer, while serious complaints are brought to the attention of senior management. Matters requiring interpretation of regulatory obligations are subject to legal review, and external consultation may be sought in cases involving novel or particularly complex privacy questions.

Effective Date and Superseding Provisions

This Privacy Policy is effective as of January 12**, 2026**, and supersedes all previous versions. By continuing to use our services after this date, you acknowledge that you have read, understood, and agreed to be bound by this Privacy Policy.

Previous Policy Versions:

• Version 1.0: April 10, 2024 – January 11, 2026
• This policy represents a comprehensive update to address evolving privacy requirements, user expectations, and regulatory obligations.

Transitional Provisions:

• Existing users have 60 days to review and object to material changes.
• Data processing continues under previous consent until new consent is obtained.
• Users may request deletion of personal data collected under previous policies.
• Grandfathered rights and preferences will be honored where possible.

© 2026 HashCore FZ-LLC. All rights reserved.