zerohash Global Privacy Statement

Argentina Privacy Notice

Effective: October 15, 2026

This Argentina Privacy Notice (as used in this Appendix A, “Notice”) supplements the zerohash Privacy Policy and applies strictly to Users and Customers accessing our Services from the Argentine Republic.

We handle your personal information in strict compliance with Section 43 of the Constitution of the Argentine Nation, the Personal Data Protection Law No. 25,326, as restated by Executive Order No. 1,558/2001 (the "PDPL"), and the complementary regulations issued by the National Data Protection Authority.

I. Broad Scope of "Personal Data"

Pursuant to the PDPL, "personal data" is defined as information of any kind related to determined or determinable individuals or legal entities. Consequently, the protections and disclosures outlined in this Notice apply equally to natural persons and our corporate or institutional Business clients operating within Argentine jurisdiction.

II. Specific Rights of Access (PDPL Mandates)

Under the PDPL, your right to access the personal information we hold about you is highly comprehensive. In addition to requesting a copy of your records, you maintain the explicit statutory rights to:

• Know whether your personal data is currently held in our files, records, or databases.
• Know precisely which of your personal data is included in our files, records, or databases.
• Request detailed information regarding the original source from which we obtained your personal data.
• Request transparent information on the explicit purposes of our personal data collection.
• Know the intended use and planned recipients of your personal data.
• Know whether the file, record, or database containing your data is formally registered in accordance with the requirements of the PDPL.

III. Lawful Basis, Biometrics, and Consent

To legally process your personal data under the PDPL, zerohash relies primarily on your prior, informed, and express opt-in consent, except where processing is necessary for the performance of our contractual relationship.

• Sensitive Data & Biometric Processing: Your Electronic Identification ("EIDV") and biometric information (such as facial templates generated from your photographs or videos) is solely used for the purpose of identity verification and fraud prevention. Under Argentine law, you cannot be compelled to provide sensitive data. By using our identity verification systems, you grant your express, written-equivalent consent to our collection and treatment of your sensitive biometric data.
• Database Registration: In compliance with the legality principles of the PDPL, zerohash declares that its databases containing the personal data of Argentine residents are duly registered with the National Registry of Personal Databases.

IV. Strict Response Timelines for Exercising Your Rights

As the data owner, you may exercise your rights of Access, Rectification, Update, or Deletion through the zerohash Privacy Request Center.

• Free Access (Section 14, Sub-Section 3 of Law No. 25,326): You have the right to access your personal data free of charge at intervals of no less than six (6) months, unless you demonstrate a legitimate interest.
• Fulfillment of Access Requests: Upon formal verification of your identity, zerohash is legally obligated to respond to and fulfill your access request within ten (10) calendar days.
• Fulfillment of Rectification, Update, or Deletion Requests: Upon formal verification of your identity, requests to correct, update, or permanently delete inaccurate, incomplete, or outdated data will be processed and resolved within five (5) business days.

V. Direct Marketing and Opt-Outs (Decree No. 1,558/2001)

We may from time to time send you marketing communications or promotional updates. In strict compliance with the PDPL:

• Any direct marketing communication sent to you via email, SMS, or other remote electronic means will prominently display your right to request the complete or partial removal or blocking of your name from our database.
• Upon your request, we are legally required to disclose the identity of the database user, controller, or provider that originally furnished us with your contact information.

VI. Cross-Border Data Transfers

To facilitate our global blockchain and digital asset operations, we transfer and store personal information in secure cloud environments globally, including in the United States.

Because Argentina restricts the transfer of personal data to countries that do not provide adequate levels of protection under AAIP standards, zerohash utilizes robust contractual protections, including standard model data transfer clauses approved by the Argentine National Data Protection Authority, to ensure that all overseas recipients handle your personal information in a manner fully consistent with the APPs and the PDPL.

VII. Regulatory Oversight and Complaints

The Argentine Agency of Access to Public Information (AAIP), as the supervisory body of the Personal Data Protection Law No. 25,326, is legally entitled to receive claims and complaints from data subjects in connection to any breach of personal data protection rules.

If you believe your rights under the PDPL have been violated and we have not resolved your concern internally, you may file a formal complaint directly with the AAIP:

• Official Website: www.argentina.gob.ar/aaip
• Mailing Address: Av. Sgto. Cabral 372, Ciudad Autónoma de Buenos Aires, Argentina

Australia and New Zealand Privacy Notice

Effective: October 15, 2026

This Australia and New Zealand Privacy Notice (as used in this Appendix B, “Notice”) supplements the zerohash Privacy Statement and applies strictly to Users and Customers residing in Australia. zerohash Australia Pty Ltd acts as the data controller with respect to your Personal Information and handles all such data in strict compliance with the Privacy Act 1988 (Cth) (“Privacy Act”) and the 13 Australian Privacy Principles (“APPs”), and the New Zealand Privacy Act 2020 (“Privacy Act 2020”).

I. Definitions Under Australian Law

In accordance with the Privacy Act, we distinguish between two primary categories of data:

• Personal Information: Information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether the information or opinion is true or not, and whether recorded in a material form or not. This includes your name, date of birth, contact details, financial transaction data, IP address, and wallet addresses.
• Sensitive Information: Information about an individual's racial or ethnic origin, political opinions, religious beliefs, philosophical beliefs, trade union membership, genetic data, biometric data for identification, or health information. We only collect Sensitive Information with your express consent.

II. Definitions Under New Zealand Law

In accordance with Section 7 of the Privacy Act 2020, "personal information" means information about an identifiable individual, but is not limited to, your name, contact details, financial transaction data, wallet addresses, and biometric information used for identity verification.

III. Anonymity and Pseudonymity (APP 2) (IPP 1)

Where lawful and practicable, you have the right to remain anonymous or use a pseudonym when interacting with us. However, due to the regulated nature of our digital asset, cryptocurrency, and blockchain infrastructure services, it is generally impracticable and unlawful under Australian Anti-Money Laundering and Counter-Terrorism Financing (AML/CTF) regulations for us to deal with unidentified individuals. Consequently, if you choose to remain anonymous or use a pseudonym, we will be unable to provide you with access to our websites, Apps, or cryptographic platform services.

IV. Information Collection, Sensitive Data, and Consent (APP 3 & 5) (IPPs 3& 4)

We collect Personal Information through various means, including directly from you, automatically via your device tracking/cookies, and indirectly from the Businesses or Platforms you use to access our APIs/SDKs.

• Collection of Sensitive Data: Where it is reasonably necessary to pursue our functions or activities (such as verifying your identity via EIDV), we will only collect your Sensitive Information—including biometric snapshots—after obtaining your express consent, unless the collection is otherwise required or authorized by applicable privacy law.
• Consequences of Non-Collection: If you do not provide the Personal Information we request, we may not be able to fulfill the applicable purpose of collection. This means we will be unable to open or maintain your trading account, facilitate digital asset transactions, respond to support enquiries, or assess your application for employment.
• Indirect Collection Notification: If we receive information about you from a third party (such as your platform provider or identity verification vendors), we will take reasonable steps to ensure you are aware that we have collected your Personal Information and understand the circumstances of that collection.

V. Use, Disclosure, and Data Combining (APP 7)(IPP 11)

Our primary purposes for collecting, holding, using, and disclosing your data are to deliver crypto infrastructure services, perform identity checks, combat fraud, and comply with financial regulations.

• Combining Information: In carrying out our business, our related bodies corporate and trusted service providers may combine the shared information we transfer to them with other Personal Information they already hold about you to improve service delivery and platform integrity.
• Secondary Purposes: We will only use or disclose your Personal Information for a secondary purpose where such use or disclosure is strictly compliant with exemptions permitted under applicable privacy law.
• Third-Party Links: Our services or websites may contain links to third-party platforms. zerohash is not responsible for the content or privacy practices of linked websites, and we recommend reviewing their respective policies before disclosing data.

VI. Direct Marketing and Opt-Outs (APP 7)(IPPs 1 & 3)

We may, from time to time, send you direct marketing communications in the form of emails, SMS, or other communication channels in strict accordance with the Privacy Act and the Spam Act 2003 (Cth).

If you no longer wish to receive marketing materials, you have an absolute right to opt out at any time. You may exercise this right by using the unsubscribe facilities embedded directly within our marketing communications through the zerohash Privacy Request Center.

VII. How We Hold and Secure Data (APP 11) (IPP 5)

We hold your Personal Information primarily in electronic form, utilizing secure cloud infrastructure. We take all reasonable steps to hold your information securely and protect it from misuse, interference, loss, and unauthorized access, modification, or disclosure. To achieve this, we enforce a strict matrix of physical, administrative, personnel, and technical security measures. However, because no data transmission over the internet can be completely secure, we cannot absolute-guarantee the security of your data.

VIII. Overseas Disclosures (APP 8) (IPP 12)

We disclose and transfer Personal Information to recipients outside of Australia. These overseas recipients include our related bodies corporate and automated third-party service providers (such as hosting, analytics, and AML monitoring vendors) located in the following jurisdictions:

• United States, United Kingdom, European Union, Argentina, Bermuda, Brazil, Canada, New Zealand, Philippines, and Switzerland.

Pursuant to APP 8, we take reasonable steps to ensure that any overseas recipient deals with your Personal Information in a way that is thoroughly consistent with the protections guaranteed under the Australian Privacy Principles. This includes executing binding contractual safeguards and technical security standards.

To facilitate our global infrastructure operations, we may disclose your Personal Information to recipients outside of New Zealand. In accordance with IPP 12, zerohash will only disclose personal information to a foreign person or entity if we believe on reasonable grounds that the recipient is:

• Subject to the New Zealand Privacy Act 2020; or
• Required to protect the information in a way that, overall, provides comparable safeguards to the New Zealand Privacy Act 2020.

IX. Accessing and Correcting Your Information (APPs 12 & 13)(IPPs 6 &7)

You have a statutory right to request access to the Personal Information we hold about you and to request corrections if that data is inaccurate, out-of-date, incomplete, or misleading.

• Identity Verification Required: To protect your privacy and security, we must verify your identity using formal documentation before granting access or making modifications to your file.
• Access Timeline: Once your identity is verified, your information will usually be made available to you within 21 days of your request. If we are legally unable to provide access to certain portions of your data, we will provide you with a written explanation detailing our grounds for refusal.

You may submit an access or correction request through the zerohash Privacy Request Center.

X. Complaints Handling and Escalation (APP 1)(IPPs 6 &7)

If you believe we have breached the Privacy Act, the APPs, or wish to file a formal complaint regarding how we handle your data, please contact our Privacy Officer directly at [email protected] . Please ensure your communication clearly describes your complaint and includes your full contact details.

• Our Internal Response Timeline: We will launch an immediate investigation into your concerns and use all reasonable endeavors to respond to you in writing within 30 days of receiving your written complaint.
• External Regulatory Escalation: If we fail to respond to your complaint within 30 days, or if you remain dissatisfied with our internal resolution, you have a legal right to escalate your complaint to the Office of the Australian Information Commissioner (OAIC).

The OAIC can be contacted via the following channels:

• Online Privacy Complaint Form: https://www.oaic.gov.au/
• Post: GPO Box 5218, Sydney NSW 2001
• Phone: 1300 363 992

If you believe we have breached the Privacy Act 2020, IPP 6 and IPP 7, you have the right to:

1. Confirm whether we hold personal information about you.
2. Request access to your personal information.
3. Request correction of your personal information if you believe it is inaccurate or incomplete.

To exercise these rights, please contact our Privacy Officer at [email protected]. We will respond to your request within the statutory timeframes prescribed by the Privacy Act 2020.

XI. Regulatory Oversight and Complaints

If you believe that we have breached the Privacy Act 2020 or the IPPs, we encourage you to contact us directly at [email protected] so we can attempt to resolve the issue internally.

If we are unable to resolve your concerns, you have the right to lodge a formal complaint with the Office of the Privacy Commissioner (OPC) of New Zealand.

• Website: https://www.privacy.org.nz/
• Phone: 0800 803 909

Bermuda Privacy Notice

Effective: October 15, 2026

This Bermuda Privacy Notice (as used in this Appendix C, “Notice”) supplements the zerohash Privacy Policy and applies strictly to Users and Customers residing in or exploring our Services from Bermuda. In accordance with Section XI of the Global Privacy Policy, zerohash Worldwide Ltd. or zerohash LLC acts as the data controller with respect to your personal information and assumes primary responsibility for ensuring all processing operations are conducted in a lawful, fair, and secure manner. This Notice is specifically designed to satisfy the statutory disclosure and privacy notice mandates prescribed under Bermuda’s Personal Information Protection Act 2016 (PIPA).

I. Contacting Our Privacy Officer

In compliance with PIPA’s organizational requirements, zerohash has designated a Privacy Officer to oversee our data protection compliance framework and to handle all privacy-related inquiries, data rights applications, and complaints. You may contact our Privacy Officer using the details below:

• Attn: zerohash Privacy Officer
• Email: [email protected] (Please use the subject line: 'Attn: Privacy Officer')

II. Personal Information Collected and Purposes of Use

As a digital asset, cryptocurrency, and blockchain infrastructure platform, the personal information we collect depends on your interaction with our websites, APIs, SDKs, or the Platform partners through which you access our Services.

In accordance with PIPA, your personal information may be used by zerohash for the following specified business and regulatory purposes:

• Account Management: To create, host, maintain, and administer your customer profile and digital asset wallets.
• Identity Verification & EIDV: To verify your identity and legal eligibility via electronic identification verification vendors (such as Plaid or Persona), which includes processing biometric details generated from photos or videos you provide.
• Transaction Processing: To process, clear, and settle transactions involving cryptocurrency, fiat, or other digital assets.
• Regulatory Compliance: To comply with domestic and international legal obligations, including anti-money laundering (AML), know-your-customer (KYC), and financial crime detection laws.
• Platform Security: To investigate suspicious activities, prevent platform fraud, combat harmful or unlawful behavior, and preserve the security and integrity of our IT infrastructure.
• Customer Support & Communications: To deliver administrative updates, respond to customer care inquiries, and manage communications during a request made under PIPA.
• Marketing Operations: To transmit targeted marketing updates and promotional materials based on your previous consent and explicit user settings.

III. Disclosures to Third Parties

In the ordinary course of business, zerohash may disclose your personal information to authorized third parties inside or outside Bermuda to ensure efficient platform operationsThe categories of recipients to whom we may provide your information include:

• The zerohash Group: Our affiliates, subsidiaries, and associated corporate entities as part of normal global business operations.
• Business & Platform Partners: The third-party businesses or platforms whose underlying applications rely on our APIs or SDKs to provision your services.
• Third-Party Service Providers: Contractors, vendors, or agents acting on our behalf, including identity verification services (Plaid and Persona), data hosting infrastructure platforms, tax reporting vendors, and professional auditors.
• Regulatory & Law Enforcement Authorities: Local and overseas regulatory bodies, tax authorities, financial sector regulators, courts, or tribunals where reasonably necessary to respond to judicial mandates or prevent financial crime.

zerohash utilizes reasonable efforts to internally and externally restrict data access to only those individuals, agents, or entities that strictly need to know such information to fulfill their retained services.

IV. Cross-Border Transfers of Personal Information

To facilitate our global infrastructure network, zerohash transfers, stores, and processes your personal information in multiple geographic jurisdictions throughout the world, including the United States, United Kingdom, and the European Union.

Pursuant to PIPA’s cross-border transfer requirements, zerohash will only transfer personal information out of Bermuda where permitted by law. Before any transfer is executed, zerohash takes the privacy laws of the recipient's jurisdiction into active consideration. Furthermore, we act reasonably in our efforts to contractually impose our strict PIPA obligations upon all third parties and international affiliates receiving your data to guarantee that equivalent privacy standards are maintained.

V. Controlling Your Data: Personal Information Access Requests (PIAR)

Under PIPA, you have the right to retain control over your personal information. You may submit a formal Personal Information Access Request (PIAR) through the zerohash Privacy Request Center to exercise the following rights:

• Right to Access: Request a complete copy of the personal information we hold about you.
• Right to Rectification: Request corrections to any incomplete, out-of-date, or inaccurate information in your profile.
• Right to Control Use: Request that we block, erase, or destroy your personal information, subject to overriding statutory obligations.

Operational Requirements for Submitting a PIAR:

Your written request must provide accurate and complete name and contact details, alongside sufficient context to enable us, with reasonable effort, to identify the relevant information. zerohash will confirm receipt of your inquiry or data rights instructions within 48 hours of submission. We will take a reasonable amount of time to process and formally respond to your request, but this will conclude no more than 45 days from receipt, depending on the complexity of the inquiry.

VI. Data Retention and Safeguards

zerohash maintains robust technical, physical, and administrative safeguards (including firewalls, role-based access restrictions, and strict data encryption) designed to protect data from unauthorized modification, loss, or disclosure.

Your personal information will be stored by zerohash and our cloud infrastructure providers only to the extent necessary to achieve the purposes for which it was collected, and in alignment with our formal record retention policies. Please note that because zerohash operates within a highly regulated financial sector, certain financial transaction histories, identity metrics, and compliance datasets must be stored for extended periods to comply with international anti-money laundering (AML) laws, litigation holds, or other legal obligations overriding regular erasure requests.

VII. Complaints and Regulatory Escalation

zerohash is fully committed to working with you to achieve a fair and swift resolution of any privacy concerns or complaints. Internal complaints should be directed in writing to our Privacy Officer at [email protected].

If our internal resolution process fails to resolve your concerns, or if you believe zerohash has handled your data in a manner inconsistent with PIPA, you maintain a statutory right to lodge a formal complaint with the Office of the Privacy Commissioner of Bermuda. The Commissioner's official contact information is as follows:

• Address: Office of the Privacy Commissioner, Maxwell Roberts Building, 4th Floor, 1 Church Street, Hamilton, HM11, Bermuda
• Phone: 441-543-PRIV (441-543-7748)
• Email: [email protected]

Brazil Privacy Notice

Effective: October 15, 2026

This Brazil LGPD Notice (as used in this Appendix D, “Notice”) is part of the zerohash Privacy Policy and is applicable to Customers and Users, or clients of zerohash brazil limitada (“zerohash” or “zerohash Brazil” as used in this Appendix D), a limited company enrolled with the CNPJ No. 46.534.916/0001-22, with its head office at Avenida Brigadeiro Luis Antonio, 300, 10th floor, conjunto 104, in the city of São Paulo, state of São Paulo, CEP 01318-903, which is an affiliate of zerohash Holdings Ltd, a US based company.

The purpose of this Notice is to illustrate zerohash's commitment to processing data in accordance with its responsibilities under the Law No. 13,709 of August 14th, 2018 - General Data Protection Law (“LGPD”). zerohash is committed to protecting the privacy and security of your personal data. The information you share with zerohash Brazil and its affiliates worldwide (the “zerohash Group”) allows zerohash to provide you the best experience with our products and services. zerohash has implemented a privacy program to protect all personal data collected and to help zerohash properly handle your personal data.

This Notice explains our specific privacy practices in Brazil. Please read this notice together with the zerohash Privacy Policy to understand how zerohash collects and uses your personal data. Should any terms conflict, the terms of this Notice shall control. Any capitalized terms not defined herein shall have the meaning provided in the Privacy Policy.

If you do not agree with the practices or policies described in this Notice or the zerohash Privacy Policy, we ask that you discontinue use of our website or other services. Likewise, both this Notice and zerohash Holdings Privacy Policy may change from time to time and your continued use will be deemed to be acceptance of such changes.

I. Definitions

• Anonymization: Refers to the use of reasonable and available technical means at the time of the processing, through which the data loses the possibility of being directly or indirectly associated with an individual.
• Anonymized data: Data that went through the anonymization process, i.e., related to a data subject who can no longer be identified, considering the use of reasonable and available technical means at the time of the processing.
• ANPD: The National Data Protection Authority, which is the federal public administration body responsible for ensuring the protection of personal data and for regulating, implementing and supervising compliance with the LGPD in Brazil.
• Blocking: Temporary suspension of any processing operation, by means of retention of the personal data or the database
• Consent: Means any freely given, specific, informed and unambiguous indication of the Data Subject’s wishes by which he or she, by a statement or by an affirmative action, signifies agreement to the Processing of personal data relating to him or her.
• Controller: A natural person or legal entity, either public or private, that makes decisions about the processing of personal data.
• Data Protection Officer: A person named by the company to act as a channel of communication between the controller, the data subjects and the National Data Protection Authority (ANPD)
• Data subject: Means a natural person, such as an individual, a customer, a prospect, an employee, a contact person, etc, to whom the personal data that are the object of processing refer to.
• Database: Is a structured set of personal data, kept in one or several locations, in electronic or physical support.
• Deletion: Refers to the exclusion of data or a set of data stored in a database, irrespective of the procedure used.
• International transfer of data: Means the transfer of personal data to a foreign country or international organization of which the country is a member. Examples of activities with international data transfer: sharing a database between companies of the same economic group, storing data in data centers located abroad, hiring a cloud computing service provider, among others.
• Operator (or Processor): A natural person or legal entity, either public or private that processes personal data on behalf of the controller.
• Personal data: Any information relating to an identified or identifiable person (data subject).
• Processing: Covers any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, production, reception, classification, use, access, reproduction, transmission, distribution, processing, archiving, storage, deletion, evaluation or control of information, modification, communication, transfer, diffusion or extraction.
• Processing Agents: Refers to the controller and the operator (or processor).
• Research body/entity: Means a body or entity from the direct or indirect public administration or nonprofit legal entity of private law, legally organized under Brazilian law, with headquarters and jurisdiction in the Country. This body or entity includes in its institutional mission, in its corporate or statutory purposes basic or applied research of historical, scientific, technological or statistical nature.
• Sensitive personal data: Means the personal data concerning racial or ethnic origin, religious belief, political opinion, trade union or religious, philosophical or political organization membership, data concerning health or sex life, genetic or biometric data, when related to a natural person.
• Shared use of data: Communication, dissemination, international transfer, interconnection of personal data or shared processing of personal databases by public bodies and entities in compliance with their legal powers, or between these and private entities, reciprocally, with specific authorization, for one or more types of processing allowed by these public entities, or between private entities.
• Third-Party: means a natural or legal person, public authority, agency or body other than the data subject, controller, operator (or processor) who, under the direct authority of the controller or Processor, are authorized to process personal data.

II. LGPD Principles

zerohash will ensure that all activities of processing personal data are done in good faith and in accordance with the principles defined by the Article 6 of LGPD, as follows:

1. Purpose: processing of personal data needs to be done for a legitimate, specific and explicit purpose of which the data subject is informed, with no possibility of subsequent processing in a way incompatible with these purposes.
2. Adequacy: Personal data shall be processed in a manner that is compatible with the purposes informed to the data subject, in accordance with the context of the processing.
3. Necessity (data minimization): Processing of personal data must be limited to the minimum necessary to achieve its purposes, covering only relevant, proportional and non-excessive data in relation to the purposes for which they are processed.
4. Free access: Guarantee to data subjects an easy and free of charge consultation way about the form and duration of the processing, as well as the integrity of their personal data.
5. Quality of the data (accuracy): Guarantee to data subjects the accuracy, clarity, relevancy and updating of the data, according to the need and for achieving the purpose of the processing.
6. Transparency: Guarantee to data subjects a clear, precise and easily accessible information about the carrying out of the processing and the respective processing agents, subject to commercial and industrial secrecy.
7. Security: Use of technical and administrative measures to protect personal data from unauthorized accesses and accidental or unlawful situations of destruction, loss, alteration, communication or dissemination.
8. Prevention: Adoption of measures to prevent the occurrence of damages due to the processing of personal data.
9. Nondiscrimination: Processing of personal data can not be done for unlawful or abusive discriminatory purposes.
10. Accountability: The data processing has to demonstrate the adoption of measures which are efficient and capable of proving the compliance with the rules of personal data protection, including the effectiveness of such measures.

III. Lawful Purpose of Processing

All data processed by zerohash will be done in accordance with the lawful bases provided by Article 5 of LGPD:

• With your consent. zerohash will seek consent before using your personal data for commercial purposes, especially when/if the processing involves sensitive personal data. Where consent is relied upon as a lawful basis for processing data, evidence of opt-in consent will be kept with your personal data.¹
• For compliance with legal or regulatory obligations by the controller².
• For carrying out studies by research entities, ensuring, whenever possible, the anonymization of personal data.
• When necessary for the execution of a contract, agreement or preliminary procedures related to a contract of which you are a party.³
• For the regular exercise of rights in judicial, administrative or arbitration procedures.
• For the protection of life or physical safety of you or a third party, if applicable.
• When necessary to fulfill our legitimate interests controller or of a third party, except when your fundamental rights and liberties which require personal data protection prevail.¹
• For the protection of credit, including as provided in specific legislation.

¹ If we process information based on your consent, you may withdraw such consent at any time, through a free and facilitated procedure. Please contact the Data Protection Officer outlined below to withdraw your consent. Where communications are sent to you based on your previous consent, the option to revoke your consent (unsubscribe) should be clearly available and systems should be in place to ensure such unsubscription is reflected accurately in zerohash’s systems.

² Note that zerohash gathers and processes personal data to fulfill its anti-money laundering and know your customer obligations, open and manage your account, and track and monitor account activity. Besides being a regulatory obligation, zerohash has determined these activities to be in its legitimate business interest.

³ zerohash also processes your personal data in furtherance of the User Agreement you have entered with zerohash, including when onboarding you as a customer, funding your account, processing your orders, facilitating transactions, and processing withdrawals. zerohash may share your personal data between its affiliated entities, in Brazil or abroad, or with Third Parties, also both in Brazil or abroad, to facilitate these actions, which are necessary in furtherance of your agreement(s) with zerohash. zerohash will take reasonable steps to ensure personal data is accurate, so that, where necessary for the lawful basis on which data is processed, steps shall be put in place to ensure that personal data is kept up to date, in accordance with the principle of quality of data.

IV. The Data We Collect

zerohash collects the data as described in the item “3. Personal Information We Collect About You” of the zerohash Privacy Policy, such as, but not limited to:

• Identifying Information, including names, government issued identification, Taxpayer ID number, passport numbers, birth dates, addresses, telephone number, e-mail address, occupation and all other background information necessary for AML/KYC requirements, including a copy of your ID.
• Financial Information, including bank account number(s), transaction history, net worth, account balances, assets and liabilities, wallet address.
• Account Authenticating Information, including hashed representations of account passwords, PINs, and account recovery information.
• Biometric information generated based on photos or videos you provide to verify your identity
• Technical data such as IP address and device fingerprinting.
• Compliance and reputational data, such as news and media search, sanctions and PEP screenings.

Personal Data does not include generic email address or general business information that is not linked to an individual.

V. How We Collect Your Data

We collect this personal information directly from you – from in person contact, telephone, text, email, text or messaging service, or via our website. However, we may also collect information:

• Automatically via our IT systems or automatic electronic record capture and retention methods (e.g., logs, system files, electronic usage trackers, or cookies)
• From publicly accessible sources (e.g., property records);
• Directly from a third party (e.g., sanctions screening providers, credit reporting agencies, or customer due diligence providers); and
• From a third party with your consent (e.g., your bank or platform provider).

zerohash may also receive your data indirectly from vendors and third parties when conducting “know your customer” background checks or confirming the personal information you have provided. We only collect information that is reasonably necessary to fulfill the identified purpose. Although you access our services through an application provided by a platform based in Brazil, the data is processed in the United States given that zerohash Brazil is an affiliate of a US based company that uses the systems based in the US.

VI. How We Will Use Your Data

zerohash will use your data:

• To properly identify you.
• To manage your account(s) with zerohash.
• To determine your eligibility for products and services and the products and services of companies with whom we are affiliated.
• To respond to questions, requests, or concerns regarding the products and services provided by zerohash.
• To process your orders related to the digital asset trading/custody/settlement/account servicing and related services contracted for.
• To communicate with you and email you with offers on other products and services we think you might like and inform you about the products and services we provide.
• To recruit for positions at zerohash.
• To investigate legal claims.
• To detect suspicious activities and protect against fraud, money laundering and other illicit activities.
• To administer zerohash websites and any zerohash software applications.
• For such purposes for which zerohash may obtain your consent from time to time.
• For such other uses as may be permitted or required by law.

Your data may also be anonymized or aggregated to enable zerohash to manage its business, develop statistical information, test our performance, or develop products. Anonymized and/or aggregated data will not identify you. zerohash does not sell your Personal Data or information.

VII. Sharing Data With Third Parties

zerohash may share your Personal Data with Third Parties, both within your jurisdiction and abroad:

• To provide and support zerohash's products and services. For example, zerohash may submit your information to credit bureaus or KYC vendors for identification purposes.
• To comply with legal obligations, such as responding to regulatory or criminal investigations or mandatory reporting to our regulators.
• To protect you from fraud, abuse, or illegal activity. In such cases, zerohash may disclose your information to an appropriate governmental authority or next of kin to prevent illegal or fraudulent activity in your account.
• If, in our best judgment, we believe someone is seeking your information as your agent, with your consent, or if otherwise permitted by law.
• Any other situation or purpose for which zerohash obtains your consent to share, as described in the zerohash Privacy Policy.

Please note that zerohash Brazil, in accordance with LGPD and other Data Protection laws applicable to the zerohash Group, has the right to share your personal data without your consent with any national/federal, state, local and international legal, governmental and regulatory entities, authorities and officials in order to cooperate with any investigation or governmental, legal or regulatory proceeding relating to any information collected and/or website content or to any purported unlawful activities of any visitor.

VIII. How We Protect Your Data

zerohash has many processes and controls in place to protect your personal data. Controls include limiting access to private data and confidential information to authorized employees, service providers, representatives, or agents who have all been made aware of the importance of keeping your information confidential. That is, zerohash only allows access to confidential information on a need-to-know basis and appropriate security will be in place to avoid unauthorized sharing of information.

Additionally, zerohash uses safeguards that are consistent with the industry standard, including firewalls, data encryption, physical access controls, appropriate back-up and disaster recovery solutions. As stated above, zerohash Brazil is an affiliate of a US based company and may store your personal data both in Brazil and in the United States. Data transfers are carried out in accordance with applicable laws and regulations, and transfers to another jurisdiction will also be subject to the laws of the jurisdiction where the data is held.

In the event of a security incident leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to personal data, zerohash shall promptly assess the risk to people’s rights and freedoms and report the breach, if applicable, to the impacted individual(s) and the ANPD, within the deadline and format defined by the ANPD.

IX. Retention and Deletion

According to LGPD, personal data shall be deleted following the termination of their processing, within the scope and technical limits of the activities, but the storage is authorized for the following purposes:

• Compliance with a legal or regulatory obligation by the controller.
• Study by a research entity, ensuring, whenever possible, the anonymization of the personal data.
• Transfer to third parties, provided that the requirements for data processing as provided in the Law are obeyed
• Exclusive use of the controller, with access by third parties being prohibited, and provided the data has been anonymized.

To ensure that personal data is kept for no longer than necessary, zerohash adopts a records retention policy for each area in which personal data is processed and reviews this process periodically.

The records retention policy considers what data should/must be retained, for how long, and why. Your data is only retained for as long as reasonably necessary to fulfill the purpose for which it was collected. Your data will be destroyed or de-identified once no longer necessary or required to be stored by law. When personal data is deleted this must be done safely such that the data is irrecoverable.

zerohash Brazil is required by regulators to keep and maintain much of your personal data for prescribed periods from 5 (five) to 10 (ten) years, this last one to comply with AML requirements provided by the Central Bank of Brazil.

Some of your personal data may be deleted prior to the expiration of the above period, if such deletion is permitted by the local laws and regulations.

X. Marketing

zerohash would like to send you information about products and services of ours that we think you might like. If you have agreed to receive marketing, you may opt out at a later date.

You have the right at any time to stop zerohash from contacting you for marketing purposes. If you no longer wish to be contacted for marketing purposes, you can unsubscribe through the link available in the communication or submit a request to our data privacy officer through the email: [email protected].

XI. Your Data Protection Rights

• Confirmation of the existence of treatment: In response to this request, we will inform you if we process your Personal Data or not. Note that, if you are an User of our website or any of our services, we necessarily process your Personal Data, as explained in this Notice and in the zerohash Privacy Policy.
• The right to access: You have the right to request, free of charge, a copy of your personal data that is processed by us.
• The right to rectification: If you consider that your personal data is incomplete, inaccurate or outdated, you can request the rectification, indicating what needs to be changed and why. It is possible that we request a proof or supporting document to make this change.
• The right to anonymization, blocking or erasure: If you consider that we are processing your Personal Data in an unnecessary and excessive manner or in breach of the LGPD, you can request that the Personal Data be anonymized, blocked or erased, under certain conditions.
• The right to data portability: You can request the transfer of your Personal Data to another service or product supplier, by the means of an express request, pursuant with the regulations of the national authority, and subject to commercial and industrial secrets. The portability does not include data that has already been anonymized.
• The right to deletion: You can request deletion of your personal data processed on the basis of your consent, except in the events of retention of Personal Data prescribed by law.
• The right to obtain information about:
  • Public and private entities with which we share your Personal Data.
  • The possibility of denying consent and the consequences of such denial, when the consent is used as legal basis for processing of personal data.
• The right to Withdraw your consent: If your personal data is processed based on your consent, you can withdraw this consent. With that, any processing of your data that is made based on consent will be interrupted. Please note that we may not be able to offer our services or features of the services without your consent.
• Request the revision of decisions taken based on automated processes: It is possible that decisions are taken based on automated processing of your Personal Data. You have the right to request the review of such decisions that affect your interests, including decisions aimed at defining your personal, professional, consumption and credit profile.
• Right to lodge a complaint before the ANPD.

You can exercise your rights by submitting a request through the zerohash Privacy Request Center.

Note that the rights above can be exercised exclusively by you or your legal representative, upon express request. So, before answering any request for exercise of the above mentioned rights, we can request that you provide us with some information and supporting documentation to confirm and validate your identity.

XII. Cookies

Cookies are text files placed on your computer to collect standard Internet log information and visitor behavior information. When you visit our websites, we may collect information from you automatically through cookies or similar technology. You may refuse to accept browser cookies by activating the appropriate setting on your browser. For further information about cookies visit the ANPD Orientation Guide here.

XIII. Minors

In the event that our products or services are made available to minors and the processing of personal data of children and teenagers under the age of 18 years old is necessary, it will be necessarily carried out with the specific and prominent parental (or legal guardian) consent. Measures to verify and validate the parent’s or legal guardian identity will also be applied.

XIV. Changes to Our Privacy Policy

zerohash keeps this Notice and the zerohash holdings Privacy Policy under regular review and will place any updates on this web page. Your continued use of this Website after we make changes is deemed to be acceptance of those changes, so please check the policy periodically for updates.

XV. Contact Information

Our Data Protection Officer is available through the email: [email protected]

Contact us if you have any questions or comments regarding this Notice, the zerohash Privacy Policy or our privacy practices.

You can find more information about the LGPD here.

Canada and Quebec Privacy Notice

Effective: October 15, 2026

This Canadian Privacy Notice (as used in this Appendix E, “Notice”) supplements the zerohash Global Privacy Policy and applies to Users and Customers residing in Canada, including the Province of Quebec. For the purposes of this Notice, "personal information" means any information about an identifiable individual.

We handle your personal information in compliance with the Personal Information Protection and Electronic Documents Act (PIPEDA), Quebec’s Law 25, and applicable provincial framework adjustments.

I. What Personal Information We Collect

The type of personal information we handle depends on how you interact with us. In addition to the data categories described in Section I of the Global Privacy Policy, we collect:

• Contact and Identity Information: Name, address, telephone number, email, date of birth, occupation, and government-issued identification required to establish and verify your identity for regulatory compliance (e.g., AML/KYC).
• Tax Identification Numbers: Social Insurance Numbers (SIN) when legally mandated for tax reporting obligations. Providing a SIN for optional identity verification matching with credit bureaus is strictly discretionary.
• Biometric and Behavioral Details: Your Electronic Identification (EIDV) and biometric information (such as facial templates generated from your photographs or videos) is solely used for the purpose of identity verification and fraud prevention. Under Argentine law, you cannot be compelled to provide sensitive data. By using our identity verification systems, you grant your express, written-equivalent consent to our collection and treatment of your sensitive biometric data.

II. Purpose of Collection, Use, and Disclosure

We handle and share your personal information inside the zerohash Group of companies and with trusted third parties for the following specific business purposes:

• Identity Verification & Risk Management: Establishing your identity, assessing credit risks, and determining product eligibility.
• Fraud Prevention & Security Assurance: Safeguarding your financial data, preventing money laundering, investigating account breaches, and auditing operational safety measures.
• Service Delivery & Optimization: Processing digital asset orders, maintaining account settings, administering platform tools, and resolving technical support inquiries.
• Customized Marketing & Value Features: Customizing your user experience and sending tailored promotions, promotions from program partners, or insights matching your explicit preferences. You may change your marketing preferences or opt out at any time.
• Regulatory Compliance: Fulfilling statutory tax filings, financial data tracking, or responding to valid judicial mandates issued by regulatory or law enforcement bodies.

III. Safeguards, Storage, and Cross-Border Transfers

• Information Security Standards: We deploy rigorous physical, technological, and administrative protection mechanisms (including multi-layer web browser encryption and role-based access limits). We require third-party service providers via strict contracts to deploy equivalent privacy standards and prohibit them from utilizing data for unapproved purposes.
• International Processing Restrictions: Personal information may be stored, used, or processed in jurisdictions outside your home province or Canada (including the United States, United Kingdom, and Europe). While located outside Canada, your information remains subject to the laws of those countries, meaning it can be accessed in response to valid demands from foreign government authorities and courts.
• Privacy Impact Assessments (PIAs): We conduct systematic PIAs for any structural project or framework adjustment involving the automated processing, profiling, or cross-border transmission of personal information, especially regarding data passing out of the Province of Quebec.

IV. Retention and Anonymization Policies

Personal information is retained only as long as reasonably necessary for client service, legal, or regulatory enforcement.

• Record Retention Schedules: Retention periods are governed by internal schedules dictated by financial tracking and AML holding rules.
• Safe Anonymization: When retention periods expire, personal information is either permanently destroyed or fully anonymized by stripping out identifying elements. Once converted into an unidentifiable state, it may be aggregated with other metrics for internal reporting and analytics.

V. Statutory Privacy Rights and Choices

Subject to certain legal or contractual limitations, Canadian residents may submit a request through the zerohash Privacy Request Center to exercise any of the following privacy rights:

• Right to Access: Request access to the personal information we hold about you, along with descriptions of the source data and its third-party disclosure paths. Access can be provided in physical copies or alternative formats to accommodate sensory disabilities.
• Right to Rectification: Request corrections or updates to inaccurate, out-of-date, or incomplete data within your file.
• Right to Data Portability: Request that your electronic personal information be exported directly to you or another organization in a structured, commonly used, and machine-readable format (such as a plain text CSV file).
• Right to De-indexing (Quebec Residents): Request that we cease disseminating personal information or de-index links associated with your name if dissemination violates the law or causes significant injury.
• Right to Withdraw Consent: Opt-out or withdraw your consent to data collections (such as optional device configurations, call recordings, or interest-based advertising). Withdrawing foundational processing consent may require us to suspend your platform account due to overriding AML validation mandates.

VI. Privacy Contact and Escalation Framework

If you have questions, wish to update your marketing choices, or intend to file a formal privacy complaint, you may escalate your concerns via the following steps:

• Step 1: Direct Escalation Contact Customer Support or file your request directly to our designated person in charge of protecting personal information:
  • Email: [email protected] (Please use the subject line: Attn: Privacy Officer)
• Step 2: Regulatory Review If our internal response does not resolve your privacy issue, you have the right to lodge a formal complaint with the relevant regulatory authority:
  • Federal Oversight: Contact the Office of the Privacy Commission of Canada (OPC) via 1-800-282-1376 or through their portal at priv.gc.ca.

To protect your security, all access and rectification requests require written proof and formal identity verification before processing.

Mexico Privacy Notice

Effective: October 15, 2026

This Mexico Privacy Notice (as used in this Appendix F, “Notice”) supplements the zerohash Privacy Statement and applies strictly to Users and Customers residing in or accessing Services from the United Mexican States.

In compliance with the Ley Federal de Protección de Datos Personales en Posesión de los Particulares (the “Mexican Privacy Law”), its Regulations, and associated mandatory guidelines, zerohash Worldwide Ltd., zerohash LLC, or its designated local affiliate (hereinafter "zerohash") acts as the data controller and is fully committed to protecting your Personal Data in our possession.

I. Controller Address and Contact Details

For the purposes of this Notice, any communications, inquiries, or requests regarding your data should be directed to our Data Protection Department via:

• Email: [email protected] (Subject line: 'Attn: Privacy Officer')

II. Categories of Personal Data Collected

Depending on the circumstances under which you interact with our websites, applications, APIs, or SDKs, zerohash may collect and treat the following categories of Personal Data:

• Identification Data: Full name, gender, date of birth, state and country of birth, nationality, occupation, physical address, telephone number (landline or mobile), email address, official signature, and your Unique Population Registry Code (CURP).
• Representation Data: Full name, work address, position, and contact information of legal representatives or attorneys-in-fact acting on behalf of institutional clients or commercial entities.
• Financial or Patrimonial Data: Fiscal domicile, Tax Identification Number (RFC), Advanced Electronic Signature (e.firma), bank account numbers, bank statements, wallet addresses, public/private chain data, digital transaction signatures, and credit bureau information utilized for necessary risk or financial assessments.
• Sensitive Personal Data (Biometric Metrics): Biometric information, templates, and faceprints generated from photographs or videos you submit during Electronic Identification Verification (EIDV) procedures to verify your identity or live location.

III. Processing Purposes: Primary and Secondary

Under Mexican Law, processing purposes must be explicitly categorized into mandatory operations required to execute the legal relationship and optional secondary activities.

1. Primary Purposes (Necessary for the Relationship):
   1. To create, host, maintain, and manage your digital asset, cryptocurrency, and blockchain infrastructure account.
   2. To deliver our core infrastructure platform services, including processing, buying, selling, trading, or spending digital assets and hosting digital wallets.
   3. To verify your identity and legal eligibility under rigorous anti-money laundering (AML), know-your-customer (KYC), and financial crime counter-measures.
   4. To conduct required credit assessments, fraud analysis, and regulatory auditing protocols.
   5. To address platform support inquiries, manage system performance, and distribute critical account safety notices.
2. Secondary Purposes (Optional/Marketing):
   1. To customize your user experience or distribute marketing materials, promotions, and tailored updates about additional cryptocurrency products.

Opt-Out Right for Secondary Purposes: If you do not wish for zerohash to process your data for secondary purposes, you may notify us at any time by contacting [email protected]. If your relationship is handled similarly to strict institutional parameters, your data will be treated as purely confidential and will not be processed for prospecting or marketing operations.

IV. Security Measures

zerohash has implemented, updates, and enforces rigorous technical, physical, and administrative security procedures. These safeguards are designed to isolate your data from damage, loss, alteration, destruction, or unauthorized use, access, or transmission. Access to sensitive financial and personal data is restricted exclusively to authorized personnel who operate under an explicit need-to-know framework.

V. Personal Data Transfers

The operation of our global modern financial infrastructure may involve the cross-border and local transmission of your Personal Data. Transfers are executed under the following criteria:

• Affiliated Transfers: Data may be securely transferred among affiliates and entities across our parent organization network (including zerohash, Inc. in the United States, as well as teams in the UK and European Union) for standard group administration.
• Third-Party Vendors: Personal data may be communicated to trusted operational suppliers, identity checkers (such as Plaid or Persona), and payment processing companies. These third parties are provided with this Notice, are contractually bound to the same strict data protection standards as zerohash, and must assume the identical obligations governing our business parameters.
• Statutory Disclosures: Data transfers may occur without your consent under explicit exceptions authorized by the Law, such as answering legal mandates from judicial tribunals, tax authorities, or international regulatory supervisors preventing fraud and financial crime.

VI. Procedures for Exercising Your ARCO Rights

As the holder of your Personal Data, you (or your duly authorized legal representative) maintain the statutory right to exercise your rights of Access, Rectification, Cancellation, and Opposition (ARCO Rights), limit the use or disclosure of your data, or revoke previously given consent.

To exercise these rights, you may submit a formal request through the Privacy Request Center.

Definitions of ARCO Rights:

• Access: The right to be informed about which specific segments of your Personal Data reside in zerohash databases, what the data is utilized for, its origin, and any transmissions made.
• Rectification: The right to demand modifications or updates if your recorded files are inaccurate or incomplete.
• Cancellation: The right to request the full or partial elimination of your data from our active databases, which may be preceded by a mandatory legal blocking period prior to permanent suppression.
• Opposition: The right to oppose, for legitimate reasons, the continued treatment or processing of your personal registries by zerohash.

VII. Use of Tracking Technologies (Cookies)

We use cookies to understand website trends, remember configuration settings, and improve your navigation performance. Cookies are text files placed on your computer to collect standard Internet log information and visitor behavior information. When you visit our websites, we may collect information from you automatically through cookies or similar technology. You may refuse to accept browser cookies by activating the appropriate setting on your browser.

VIII. Modifications and Regulatory Recourse

zerohash reserves the right to update or modify this Notice at any time to reflect platform adjustments or legislative changes. Any updates will be promptly disclosed via a public notice posted across our digital websites and service applications.

If you believe that your data protection rights under the LFPDPPP have been compromised by our processing activities, you maintain the legal right to file a formal complaint with the National Institute for Access to Information and Protection of Personal Data (INAI).

United States Privacy Notice

Effective: October 15, 2026

This United States Privacy Notice (as used in this Appendix G, “Notice”) is for zerohash Users or Customers living in the U.S., and clarifies or further describes how we collect, use, and disclose your personal information. This Notice supplements the zerohash Global Privacy Policy (“Privacy Policy”). For purposes of the Notice, the terms “personal information” and “sensitive personal information” encompass the terms “personal data” and “sensitive personal data” and have the meaning provided under applicable U.S. state privacy laws, including the California Privacy Rights Act of 2020 (“CCPA”). Any capitalized terms not defined herein shall have the meaning provided in the Privacy Policy.

Continued Use. By continuing to use the zerohash Services, Apps, APIs, or SDKs, by accessing or using our websites, or by contacting us on our systems, you agree to this Privacy Policy.

Purpose for Collection and Disclosure of Personal Information. We’ve collected and disclosed the below categories for personal information to create, develop, operate, deliver, and improve our Services, to communicate with you, to ensure the safety, security and integrity of our Services, and for the business and commercial purposes outlined in Section II and Section III of the Privacy Policy. We do not collect, use, or disclose sensitive personal information for purposes other than those specified in this Privacy Policy, to provide the Services, or as permitted under applicable law. In addition, to the extent that zerohash de-identifies personal information, we take reasonable measures to maintain and use the information in a de-identified manner and do not make any attempts to re-identify such information, except as permitted under applicable law.

Collection and Disclosure of Personal Information. We collect the below categories of personal information, and disclose the specified types of personal information below (as that data is further referenced and outlined in Section I of the Privacy Policy) with the following categories of third parties (including personal information disclosures in the last twelve months):

Collection and Disclosure of Sensitive Personal Information. We collect and disclose the following categories of sensitive personal information, with the following categories of third parties:

Sources of Personal Information. We gather various types of personal information from our customers and individuals who access or use our Services from a range of sources, such as:

• information you give us when you sign up for, or otherwise use our Services;
• information we receive from our Affiliates and third parties; and
• information we collect automatically through cookies and similar technologies (see our Cookie Policy for more information on this type of information).

Selling or Sharing of Personal Information. We do not sell your Personal Information. We share (as that term is defined in the CCPA) identifiers with third party analytics providers or advertising partners, for analytics and advertising purposes. This includes the sharing of identifiers within the last twelve months.

We do not have actual knowledge that we sell or share the personal information of individuals under 16 years of age.

How Long We Retain Your Personal Information. We retain your information as needed to provide our Services, comply with legal obligations, or protect our or others’ interests. We decide how long we need information on a case-by-case basis.

Here is what we consider:

• When the information was collected or created;
• Whether it is necessary in order to continue offering you our Services;
• Whether we are required to hold the information to comply with our legal obligations, including AML/KYC compliance or other financial regulatory obligations, or information preservation requirements;
• We also keep certain information where necessary to protect the safety, security and integrity of our Services, Customers, and Users.

Privacy Rights. Residents of specific states (e.g., California) have certain rights with respect to personal information collected and processed under state privacy laws. You may exercise the following rights, subject to certain exceptions and limitations:

• Right to Know. You have a right to request the following information about our collection, use and disclosure of your personal information, and ask that we provide you with a copy of the following:
  • categories of and specific pieces of personal information we have collected, sold, or shared about you;
  • categories of sources from which we collect personal information;
  • the business of commercial purposes for collecting personal information;
  • categories of third parties to whom the personal information was disclosed for a business purpose; and
  • categories of personal information disclosed about you for a business purpose.
• Right to Correct. You have a right to request that we correct inaccurate personal information maintained about you.
• Right to Delete. You have a right to request that we delete personal information, subject to certain exceptions.
• Right to Opt Out. You have the right to opt out from the “sale” / “sharing” of your personal information, including the processing of your personal information for purposes of targeted advertising.
• Right to Non-Discrimination. We will not discriminate against you for exercising any of these rights.

Exercising Your Rights. You may exercise your rights through the zerohash Privacy Request Center. We may take steps to verify your identity before complying with your request to protect your privacy and security, and may decline your request if we are unable to verify your identity.

Authorized Agent. Under certain U.S. state privacy laws, you may designate an authorized agent to exercise privacy rights on your behalf. To do so, you must: (1) provide that authorized agent written and signed permission to submit such a request; and (2) verify your own identity directly with us. Please note, we may deny a request from an authorized agent that does not submit proof that they have been authorized by you to act on your behalf.

Appeal. You have the right to appeal zerohash’s decision regarding a privacy right request. In order to appeal a declined request, please email [email protected].

Questions. If you have questions or concerns regarding this Notice, or if you have a complaint, please contact us at Customer Support or at [email protected], or by writing to us at the address of your zerohash service provider (provided in Section XI of the Privacy Statement.

International Transfers

Updated: December 31, 2025

To facilitate our global operations, zerohash, its Affiliates, third-party partners and service providers may transfer, store, and process your personal information throughout the world. Below is a list of geographic locations where your information may be transferred:

• Australia
• Argentina
• Bermuda
• Brazil
• Canada
• European Union
• New Zealand
• Philippines
• Switzerland
• United Kingdom
• United States