Privacy Policy

Last updated: 30 Apr 2026

HashKey Bermuda Limited uses information about you that can identify you, and we are committed to using your personal information in a lawful and fair manner, and in compliance with the Bermuda’s Personal Information Protection Act 2016 (“PIPA”). This Privacy Notice is designed to comply with our privacy notice requirements pursuant to PIPA. This Privacy Notice applies exclusively to the services provided to you by HashKey Bermuda Limited and the HashKey Global platform.

1. How to contact us about our handling of personal information

For any inquiries or concerns regarding our handling and use of your personal information, please contact our Privacy Officer.

HashKey Bermuda Privacy Officer

Company Address: Rosebank Centre, 5th Floor, 11 Bermudiana Road, Pembroke, HM 08, Bermuda

Email: dpo@hashkey.com

2. The purposes and lawful bases for which personal information is or might be used

We will process your personal information relying on one or more of the following lawful conditions: where we have obtained your consent, where necessary for the performance of a contract with you, for compliance with our legal obligations, or where necessary for our legitimate interests.

Your personal information may be used for the following purposes:

• processing your applications, subscriptions and registration for HashKey products and services;
• verifying your identity, including during account opening and authorization of investment, as well as the process of changing your information in our records;
• administering your accounts and provide you with HashKey products and services.
• providing you with the online services available through the HashKey's website(s), through the HashKey Bermuda Limited Exchange and/or through other telecommunication channels;
• complying with any legal and regulatory obligations and/or internal processes or other information disclosure requirements to disclose information;
• responding to and processing your enquiries and taking further action or to following up as required;
• storing your details (and updating them when necessary) on our database, so that we can contact you in relation to the function or activities of HashKey;
• improving your experience while using our services;
• designing new and/or enhance existing services, products, activities and/or other events relating to HashKey products or services;
• conducting research, survey and/or analysis from time to time to better understand your needs, preferences, interests, experiences and/or habits;
• subject to having obtained your consent, we may provide direct marketing information to you relating to the products and services provided by us. For example, register you for investor-related events, activities and materials; market and promote existing and future HashKey products or services; provide you with information regarding the market insights in connection with HashKey products or services;
• establishing, exercising or defending any claim or potential claim brought against us;
• preventing money laundering, financing for terrorism or fraud and/or pursuant to other applicable laws or compliance requirements, which may require, among other things, your Personal Data to be screened against the relevant sanction lists and the processing of such information to check whether you have held any political office or have links with proscribed organizations;
• managing risk, performing creditworthiness and solvency checks, or assessing, detecting, investigating, preventing and/or remediating fraud or other potentially prohibited or illegal activities and otherwise protecting the reputation of our services and products;
• fulfilling the compliance requirements of investor suitability review, qualified investor surveys and other compliance requirements;
• complying with any contractual or commitment entered into with local or foreign legal, regulatory, governmental, tax, law enforcement or other authorities, or self-regulatory or industry bodies or associations of financial institutions that is assumed by or imposed on us by reason of its financial, commercial, business or other interests or activities in or related to the jurisdiction of the relevant local or foreign legal, regulatory, governmental, tax, law enforcement or other authority, or self-regulatory or industry bodies or associations;
• enabling any due diligence and other appraisals or evaluations for actual or proposed merger, acquisition, financing transactions or joint ventures; and
• any other legitimate business purposes, such as protecting you and other investors from losses, maintaining the security of your account, and protecting any of our other rights and properties or the rights and properties of us.

We may utilize automated systems, machine learning, or artificial intelligence technologies to monitor network activity, verify your identity (KYC), and detect anomalous transaction patterns to protect your account and comply with our legal and regulatory obligations.

3. The identity and types of individuals or organisations to whom personal information might be disclosed

HashKey Bermuda Limited will, or may, disclose your personal information to the following types of individuals and organisations:

• HashKey Group affiliates and related entities, including HashKey Digital Asset Group Limited and its subsidiaries, for purposes directly related to the provision of our services to you;
• regulatory authorities, supervisory bodies, government agencies, and law enforcement authorities (including the Bermuda Monetary Authority), as required or permitted by applicable law or regulation;
• professional advisers and service providers, including legal counsel, auditors, compliance consultants, KYC/AML screening providers, IT infrastructure and cloud service providers, and other third parties who provide administrative, technical, or operational services to us under appropriate confidentiality and data processing obligations; and
• any third party in connection with an actual or proposed merger, acquisition, restructuring, financing transaction, or other corporate reorganisation involving HashKey Bermuda Limited, subject to applicable confidentiality obligations.
• outsourced service providers and vendors engaged to support our operations, including cloud hosting and infrastructure providers, SaaS and DaaS platform operators, IT service providers, and other third-party processors, each of whom is required to handle your personal information in accordance with applicable data protection obligations and our contractual requirements.

4. Cross-border Transfers

As we operate globally, your personal information may be transferred to and stored in jurisdictions outside of Bermuda (including by our group affiliates, cloud hosting, and SaaS providers). When transferring your personal information overseas, we ensure that appropriate safeguards are in place in accordance with PIPA, such as relying on adequate protection in the destination jurisdiction or implementing standard contractual clauses and comparable-protection assessments.

5. Breach Notification

In the event of a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to your personal information, we will notify you and the Privacy Commissioner in accordance with our obligations under PIPA, where such breach is likely to adversely affect you.

6. How we use cookies and similar technologies

If you access HashKey's information or services through the HashKey website(s) or the HashKey Exchange (as applicable), you should be aware that cookies are used. Cookies are small text files which are used to record information necessary for the proper functioning of our website. For detailed information on how HashKey uses cookies and similar technologies, please refer to our Cookies Policy.

7. Third party websites

The HashKey website(s) or the HashKey Exchange may from time to time contain links to other third-party websites for your convenient access. These third-party websites are independent from the HashKey website(s) or the HashKey Exchange and may have their own terms and conditions and privacy policies which you should review before using their services. HashKey has no control or management over the contents of such other websites or their privacy policies and is not responsible for the contents of links or third-party websites and services. You should be fully aware that the provision of such links does not constitute an endorsement, approval or any form of association by or with HashKey and your use of such third-party websites and services is at your own risk. HashKey Bermuda Limited will not be held liable for any loss or damage arising from your use of these third-party websites.

8. Means we use to allow you to control our use of your personal information in accordance with PIPA

You have the right to obtain access to or make a request for a correction, blocking, erasure and destruction to your personal information. Please submit a written request to the Privacy Officer, which must include sufficient information to enable us, with reasonable effort, to identify the personal information that is relevant to your request.  Your request must also include all necessary contact information for us to respond to your request.

Please note that certain rights available in other jurisdictions (such as the right to data portability or the right to restriction of processing under the EU GDPR) are not absolute requirements under Bermuda PIPA and may not be applicable to your relationship with HashKey Bermuda Limited.

You will be contacted by one of our privacy administrators promptly to confirm our receipt of your request, but no more than two business days after we have received your request. 

Please note the following information associated with any request we receive from you:

• We require your accurate and complete name, contact information
• We will confirm our receipt of your enquiry or instructions within two business days after we have received same
• We will take a reasonable amount of time to process your enquiry or instructions and initially respond to your request, but usually no more than 45 days (depending upon the nature and complexity of your request), which may be extended in accordance with PIPA where the request is complex

You also have the right under PIPA to lodge a complaint with the Privacy Commissioner if you believe your rights have been infringed.

9. Retention Period

We retain your Personal Data only for as long as necessary for the purposes for which it was collected, or as required to meet our legal and regulatory obligations under applicable Bermuda law (including AML/ATF and corporate record-keeping requirements). When no longer required, Personal Data is securely deleted or anonymised.

HashKey Bermuda Limited reserves the right to update this privacy notice at any time and as may be prudent or necessary to reflect changes in our privacy practices or legal requirements.

Hashkey reserves all of its rights and protections afforded to it under PIPA.