Privacy Policy for Services Powered by Zero Hash

This privacy policy (“Policy”) describes how Casa Inc. (“Casa,” “we,” or “us”) receive, use, disclose, and otherwise process Personal Data when you access or use any of our services that are powered by Zero Hash, such as buying and selling cryptocurrency (“ZH Services”). In such cases, your Personal Data is collected directly by Zero Hash and is subject to the Zero Hash privacy policy , and your use of the ZH Services is subject to Zero Hash’s separate terms of service, to which you agree when signing up. We receive only limited Personal Data back from Zero Hash, as further described below. We encourage you to review the Zero Hash privacy policy for more information about its privacy practices. This Policy does not apply to Zero Hash’s processing activities, to the practices of other companies we do not own or control, or to people we do not manage.

Remember that your use of Casa’s Services is at all times subject to our Terms of Service , which incorporates our separate Privacy and Data Protection Policy that covers Services that are not powered by Zero Hash. Any terms we use in this Policy without defining them have the definitions given to them in the Terms of Service. For more information about our privacy practices for Services that are not powered by Zero Hash, please review our Privacy and Data Protection Policy .

“Personal Data” means any information that identifies or relates to a particular individual and also includes information referred to as “personally identifiable information” or “personal information” under applicable data privacy laws, rules, or regulations.

Personal Data

Categories of Personal Data We Collect

This chart details the categories of Personal Data that we receive and have received from Zero Hash over the past 12 months:

Our Commercial or Business Purposes for Processing Personal Data

• Providing, Customizing, and Improving the ZH Services

  • Processing orders or other transactions.
  • Providing you with the products, services, or information you request.
  • Meeting or fulfilling the reason you provided the information to us.
  • Providing support and assistance for the ZH Services.
  • Improving the ZH Services, including testing, research, internal analytics, and product development.
  • Personalizing the ZH Services and communications based on your preferences.
  • Doing fraud protection, security, and debugging.
  • Carrying out other business purposes as otherwise set forth in applicable data privacy laws.

• Meeting Legal Requirements and Enforcing Legal Terms

  • Fulfilling our legal obligations under applicable law, regulation, court order, or other legal process, such as preventing, detecting, and investigating security incidents and potentially illegal or prohibited activities.
  • Protecting the rights, property, or safety of you, the ZH Services, or another party.
  • Enforcing any agreements with you.
  • Responding to claims that any posting or other content violates third-party rights.
  • Resolving disputes.

How We Disclose Your Personal Data

We disclose your Personal Data to the categories of service providers and other parties listed in this section.

• Service Providers. These parties help us provide the ZH Services or perform business functions on our behalf. They include:

  • Hosting, technology and communication providers.
  • Support and customer service vendors.
  • Customer relationship management vendors.

• Parties You Authorize, Access, or Authenticate

  • Third parties you access through the services.

• Legal Obligations

  • We may disclose any Personal Data that we receive to third parties in conjunction with any of the activities set forth under “Meeting Legal Requirements and Enforcing Legal Terms” in the “Our Commercial or Business Purposes for Receiving Personal Data” section above.

Business Transfers

All of your Personal Data that we receive may be transferred to a third party if we undergo a merger, acquisition, bankruptcy, or other transaction in which that third party assumes control of our business (in whole or in part). Should one of these events occur, we will make reasonable efforts to notify you before your information becomes subject to different privacy and security policies and practices.

Data that is Not Personal Data

We may create aggregated, de-identified, or anonymized data from the Personal Data we receive, including by removing information that makes the data personally identifiable to a particular user. We may use such aggregated, de-identified, or anonymized data and disclose it to third parties for our lawful business purposes, including to analyze, build, and improve the ZH Services; and to promote our business, provided that we will not disclose such data in a manner that could identify you.

Data Retention

We retain Personal Data about you for as long as you have an open account with us or as otherwise necessary to provide you with the ZH Services. In some cases, we retain Personal Data for longer, if doing so is necessary to comply with our legal obligations, resolve disputes, or collect fees owed; or is otherwise permitted or required by applicable law, rule, or regulation. We may further retain information in an anonymous or aggregated form where that information would not identify you personally.

Personal Data of Children

As noted in the Terms of Service, we do not knowingly receive or solicit Personal Data from children under 16 years of age; if you are a child under the age of 16, please do not attempt to register for or otherwise use the ZH Services or send us any Personal Data. If we learn that we have received Personal Data from a child under 16 years of age, we delete that information as quickly as possible. If you believe that a child under 16 years of age may have provided Personal Data to us, please contact us at** help@team.casa .

Please note that certain of the Services may require you to provide information regarding the child or children in relation to whom you may be using the Services, including Personal Information such as first and last name (among other information), in order to properly provide such Services to you. As noted above, we work to protect the security of any such information that you provide us, but please be aware that no method of transmitting data over the internet or storing data is completely secure. If you’d like to request that we delete any such information, please contact us at help@team.casa .

European Union and United Kingdom Data Subject Rights

If you are a resident of the European Union (“EU”), United Kingdom (“UK”), Lichtenstein, Norway, or Iceland, you may have additional rights under the EU or UK General Data Protection Regulation (the “GDPR”) with respect to your Personal Data.

For this section, we use the terms “Personal Data” and “processing” as they are defined in the GDPR, but “Personal Data” generally means information that can be used to individually identify a person, and “processing” generally covers actions that can be performed in connection with data such as collection, use, storage, and disclosure. Casa will be the controller of your Personal Data that we receive and process in connection with the ZH Services.

Personal Data Use and Processing Grounds

We will only process your Personal Data if we have a lawful basis for doing so. Lawful bases for processing include consent, contractual necessity, and our “legitimate interests” or the legitimate interest of others, as further described below.

• Contractual Necessity: We process the following categories of Personal Data as a matter of “contractual necessity,” meaning that we need to process the data to perform under our Terms of Service with you, which enables us to provide you with the ZH Services. When we process data due to contractual necessity, failure to provide such Personal Data will result in your inability to use some or