PRIVACY POLICY This Privacy Policy describes the privacy practices of HashKey Wallet ("we", "us" or "our") and how we handle personal information collected through our website, application, the self-custodial wallet module embedded within the HashKey Global App, and associated digital services that link to this Privacy Policy (collectively, the "Services"). REGULATORY INDEPENDENCE NOTICE: You acknowledge that HashKey Wallet provides self-custodial software services. The data processing activities described herein are conducted independently of the regulated virtual asset exchange services operated by other HashKey Group entities. This Privacy Policy applies to the non-custodial Web3 module and related services provided by HashKey Hub Limited. Personal information we collect Information you provide to us. Personal information you may provide to us through the Service or otherwise includes: • Communications that we exchange with you, including when you contact us with questions or feedback you send via social media or email, and other information disclosed at the time of interaction with the Services. • Other data not specifically listed here, which we will use as described in this Privacy Policy or as otherwise disclosed at the time of collection. Third-party sources. We may receive personal information about you from third-party sources. For example, we may obtain your personal information from third parties such as publicly-available sources and data providers. We do not collect personal information from third-party sources without your consent. In some cases, you may authorize a third-party wallet provider to share information with us when connecting to the Services. Furthermore, we may obtain data from blockchain analytics providers relating to your public wallet address to conduct risk assessments and compliance screenings. Preferences and Settings. We may also collect your preferences or settings, such as language selection or marketing opt-in preferences, when you interact with the Services. Automatic data collection. We, our service providers, and business partners may automatically collect information about your device and usage of the Services through cookies, SDKs, and similar technologies. This information may include: • Device information: IP address, operating system, browser type, screen resolution, device model, device ID, mobile network, and general location (e.g., city or region). • Technical Geolocation and Network Data: We automatically collect your IP address, detailed location data, and network environment information (including VPN, proxy, or Tor usage detection). This information is strictly used to enforce our geographical restrictions and prevent access from prohibited jurisdictions (such as Mainland China, Hong Kong SAR, the United States, and sanctioned regions). • Usage data: the pages you view, the time spent on pages, links clicked, referring URLs, and interactions with our emails or marketing messages. How we use your personal information We use your personal information for the following purposes or as otherwise described at the time of collection: Service delivery and communication. We use your personal information to: • provide, operate, maintain, and improve the Service and our business; • facilitate the generation and management of your self-custodial wallet; • retrieve and display blockchain-based asset information; • send you service-related communications, such as transaction notifications, updates, announcements, and support messages; • understand your needs and interests, and personalize your experience with the Service and our communications; and • provide support for the Service, and respond to your requests, questions and feedback. Research and development. We may use your personal information for research and development purposes to: • analyze and improve the Service and our business; • create aggregated, de-identified or other anonymous data from personal information we collect. We make personal information into anonymous data by removing information that makes the data personally identifiable to you. Legal Compliance and Risk Management. We may use your personal information to: • enforce our geographical restrictions by blocking access from prohibited jurisdictions (e.g., China, HK, US) via IP geolocation; • conduct "Know Your Address" (KYA) and "Know Your Transaction" (KYT) screening to detect and prevent interactions with sanctioned or high-risk wallet addresses; • comply with applicable laws, lawful requests, legal process, or government requests, such as to respond to subpoenas or requests from government authorities; • protect our, your or others' rights, privacy, safety or property (including by making and defending legal claims); • audit our internal processes for compliance with legal and contractual requirements and internal policies; • enforce the terms and conditions that govern the Service; and • identify, investigate, prevent and deter fraudulent, harmful, unauthorized, unethical or illegal activity, including cyberattacks and identity theft. How we share your personal information We may share your personal information with the following parties: • Service Providers: Third-party vendors and service providers that perform services on our behalf, such as hosting, IT support, analytics, email delivery, customer support, marketing, and compliance screening providers. For example, we may use Google Analytics and Amplitude to analyze Service usage data. • Compliance Partners: Third-party blockchain analytics firms that assist us in conducting address screening and transaction monitoring for AML/sanctions compliance purposes. • Public Blockchain: Transactions made through the Services may be recorded on public blockchains. These records, including wallet addresses, transaction times and amounts, are public, immutable, and outside our control. Please note that public blockchain data cannot be deleted or modified by HashKey Wallet. Your public wallet address may remain on the blockchain ledger indefinitely. • Legal Authorities and Others: Government agencies, law enforcement, or private parties when we believe it is necessary for legal compliance, protection of rights, or investigation of fraud, as described in the “Compliance and Protection” section above. • Business Transfers: Parties involved in corporate transactions, such as mergers, acquisitions, asset sales, financings, reorganizations, or bankruptcy proceedings. Your choices You have the following choices with respect to your personal information. • Do Not Track. Some Internet browsers may be configured to send "Do Not Track" signals to the online services that you visit. We currently do not respond to "Do Not Track" or similar signals. • Communication Preferences. You may opt out of receiving promotional emails by following the unsubscribe instructions in the messages. Please note that you may continue to receive transactional or service-related emails even if you opt out of marketing communications. • Access and Control of Your Information. You may access, correct, or delete certain personal information by contacting us using the email address provided below. Depending on your jurisdiction, you may have additional rights under applicable data protection laws, such as the right to object to certain processing or request data portability. • Declining to provide information. We aim to collect as little personal information as possible to provide the Service. We will inform you at the time of collection what information is necessary for us to provide the Service. We may, however, be unable to provide other services, such as customer support, without personal information. Other sites and services The Service may contain links to websites, decentralized applications (DApps), mobile applications, and other online services operated by third parties. In addition, our content may be integrated into web pages or other online services that are not associated with us. These links and integrations are not an endorsement of, or representation that we are affiliated with, any third party. We do not control websites, DApps, mobile applications or online services operated by third parties, and we are not responsible for their actions. Security We employ a number of technical, organizational and physical safeguards designed to protect the personal information we collect. We attempt to collect as little personal information as possible to provide the Service. However, security risk is inherent in all internet and information technologies and we cannot guarantee the security of your personal information. As a non-custodial service, you are solely responsible for the security of your private keys and seed phrases. We do not have access to this information and cannot recover it if lost or compromised. International data transfer We are based in the Hong Kong and may use service providers located in other countries. As a result, your personal information may be transferred to and processed in jurisdictions outside of your state, province, or country, including jurisdictions that may not provide the same level of data protection as your home jurisdiction. Children The Service is not intended for use by children under 16 years of age. If we learn that we have collected personal information through the Service from a child under 16 without the consent of the child's parent or guardian as required by law, we will delete it. Your Privacy Rights Depending on your jurisdiction, you may have certain rights under applicable data protection laws, including the right to access, correct, update, or delete your personal information, as well as to object to or restrict certain types of data processing. If you have any questions or wish to exercise your rights, you may contact us using the email address provided below. We will respond to your request as required by applicable law. Changes to this Privacy Policy We may update this Privacy Policy from time to time in response to changing legal, technical, or business developments. When we update our Privacy Policy, we will take appropriate measures to inform you, consistent with the significance of the changes we make. We encourage you to review this Privacy Policy periodically to stay informed about our practices. Your continued use of the Services after the effective date of the revised Privacy Policy will be deemed as your acceptance of the changes. Cookies and Similar Technologies We use cookies and similar technologies to enhance your experience, analyze usage, and improve our Services. For more information about the types of cookies we use and your choices regarding cookies, please refer to our Cookie Notice or adjust your browser settings. How to contact us Email: [email protected]