No. 15 · Legal

Privacy Policy

Publius Foundation and Hamilton Digital Assets Limited · Privacy Policy

Last updated: October 31, 2026

1. Introduction#

This Privacy Policy explains how personal data is collected, used, stored and shared when you visit usdh.money or docs.hamilton.xyz (the "Websites"), use the web application at app.usdh.money (the "App"), hold USDh, or use the services Hamilton Digital Assets Limited provides to Mint Users. Please read it carefully. It applies whenever you use the Websites or the App, or engage with those services.

2. Who is responsible for your data#

Two entities act as data controllers, each for its own activities:

(a) Publius Foundation, a Panama foundation ("Publius Foundation"), operates the Websites and the App and is the controller for data collected through them, such as device, usage and cookie data and connected wallet addresses.

(b) Hamilton Digital Assets Limited, a company incorporated in the British Virgin Islands ("HDA"), issues USDh and is the controller for data processed to onboard and serve Mint Users (including KYC and KYB data), to screen mints, redemptions and wallets, and to meet its legal obligations as issuer.

In this Policy, "we", "us" and "our" mean Publius Foundation or HDA, as the context requires. For any data protection question, contact privacy@usdh.money and we will route your request to the right controller.

3. Information we collect#

3.1 Information you give us:

name, email address and contact details when you register or contact us;
for Mint Users, identity verification documents (such as a passport or other government ID and proof of address) for KYC and AML purposes;
for Mint Users that are entities, corporate documents such as certificates of incorporation, registers of directors and shareholders, beneficial ownership declarations and financial statements, and identity data for directors, beneficial owners and authorised individuals;
wallet addresses you connect to the App or whitelist with HDA; and
the content of your communications with us.

3.2 Information collected automatically:

IP address, browser type, device information and operating system;
usage data, such as pages visited, features used, timestamps and session length;
cookies and similar technologies (see Section 9); and
onchain transaction data linked to wallet addresses, which is public on the relevant blockchain.

3.3 Information from third parties:

identity verification and sanctions screening results from our KYC, KYB and AML service providers;
wallet risk and blockchain analytics data from third-party providers; and
information from public sources used to verify onboarding documents.

3.4 Users of approved routes. When you redeem or mint USDh through a third party’s approved route (for example, an aggregator), HDA screens the wallet addresses involved in the transaction. The third party does not share your name, contact details or other identity data with HDA, and HDA does not ask it to.

4. How we use your information#

4.1 To provide our services:

onboard Mint Users, including KYC and KYB checks;
process USDh mints and redemptions for Mint Users and through approved routes;
operate the Websites and the App;
keep account and transaction records; and
respond to enquiries and support requests.

4.2 For compliance and legal purposes:

comply with anti-money laundering, counter-terrorist financing, sanctions and other applicable laws;
screen people, entities and wallet addresses against sanctions lists, including those maintained by OFAC, the United Nations, the European Union and the United Kingdom;
block or freeze USDh where required;
respond to lawful requests from courts, law enforcement and regulators; and
keep records as the law requires.

4.3 For operations and security:

improve the Websites and the App;
analyse usage to improve the user experience;
detect and prevent fraud, abuse and security threats; and
send service communications.

4.4 Legal bases. Where data protection law requires a legal basis, we rely on:

performance of a contract, to provide our services to you;
legal obligation, to comply with AML, sanctions and other laws;
legitimate interests, for fraud prevention, security, compliance screening and improving our services, where those interests are not overridden by your rights; and
consent, where we ask for it (for example, for non-essential cookies or marketing), which you may withdraw at any time.

4.5 Where we operate. USDh is not offered to persons in the United States, to Restricted Persons, or to persons in Restricted Territories under the USDh Terms and Conditions. The Services and Mint User status are not available in the Prohibited Jurisdictions listed in the Terms of Service and the USDh Mint User Agreement. Where we process the personal data of people in other jurisdictions, we apply the data protection law that applies to that processing, which may include the EU General Data Protection Regulation (GDPR), the UK GDPR, the Swiss Federal Act on Data Protection, the UAE Personal Data Protection Law (Federal Decree-Law 45/2021), the Singapore Personal Data Protection Act, the Hong Kong Personal Data (Privacy) Ordinance, the Japan Act on the Protection of Personal Information, and the BVI Data Protection Act 2021.

5.1 We do not sell your personal data.

5.2 We may share personal data with:

KYC, KYB, AML and sanctions screening providers;
blockchain analytics providers used for compliance;
hosting, infrastructure and analytics providers that operate the Websites and the App for us;
courts, law enforcement, tax authorities and regulators, where the law requires;
professional advisers, such as lawyers, accountants and auditors, under duties of confidentiality;
a buyer or successor in connection with a merger, acquisition, reorganisation or sale of assets, under confidentiality protections; and
Publius Foundation, HDA and other entities in the Hamilton group, for the purposes in this Policy (for example, when the App passes a Mint User’s onboarding data to HDA).

5.3 We require our service providers to protect personal data and to process it only on our instructions and in line with applicable data protection law.

6. How long we keep your information#

6.1 We keep personal data only as long as needed for the purposes in this Policy, or as the law requires.

6.2 KYC and KYB records for Mint Users are kept for at least five years after the business relationship ends, or longer if the law requires.

6.3 Transaction records are kept for the period required by applicable law.

6.4 When a retention period ends, we delete or anonymise the data securely. Data recorded on a public blockchain cannot be deleted by us.

7. International transfers#

7.1 HDA is incorporated in the British Virgin Islands, and our service providers operate in several countries. Your data may be transferred to and processed in countries other than your own, which may not offer the same level of protection.

7.2 Where we transfer personal data from the European Economic Area, the United Kingdom or Switzerland to a country without an adequacy decision, we use appropriate safeguards, such as the European Commission’s Standard Contractual Clauses and their UK and Swiss equivalents. You can ask us for a copy of the relevant safeguards.

8. Your rights#

8.1 Depending on where you live, you may have the right to:

access the personal data we hold about you;
correct inaccurate or incomplete data;
delete your data, subject to legal retention duties;
restrict our processing in some circumstances;
receive your data in a portable format;
object to processing based on legitimate interests; and
withdraw consent at any time, where we rely on consent.

8.2 You may also complain to a data protection authority, for example the relevant supervisory authority under the EU GDPR or UK GDPR, the Swiss Federal Data Protection and Information Commissioner, the UAE Data Office, Singapore’s Personal Data Protection Commission, or Hong Kong’s Privacy Commissioner for Personal Data.

8.3 To exercise your rights, email privacy@usdh.money. We will reply within 30 days. We may need to verify your identity first, and some rights may be limited by legal obligations such as AML record keeping.

9. Cookies#

9.1 The Websites and the App use cookies and similar technologies to work and to understand how they are used.

9.2 We use:

essential cookies, needed for the Websites and the App to work;
analytics cookies, to understand how people use them (for example, Google Analytics); and
preference cookies, to remember your settings.

9.3 Where the law requires, we ask for your consent before setting non-essential cookies. You can also block cookies in your browser, though some features may stop working.

9.4 We do not use third-party advertising cookies or sell browsing data.

10. Security#

We use appropriate technical and organisational measures to protect personal data against unauthorised access, disclosure, alteration and destruction. No system is completely secure, so we cannot guarantee absolute security. If a data breach is likely to put your rights at risk, we will notify you and the relevant authorities as the law requires.

11. Children#

The Websites, the App and USDh are not intended for anyone under 18, and we do not knowingly collect their personal data. If you believe we have, contact privacy@usdh.money.

12. Changes to this Policy#

We may update this Policy by posting a new version with a new date. If a change is material, we will post a prominent notice on the Websites or email you where we have your address. Continued use of the Websites or the App after an update means you accept it, to the extent the law allows.

13. Contact#

For any question about this Policy or your personal data, or to exercise your rights, email privacy@usdh.money. The controllers are Publius Foundation, a foundation established in Panama, and Hamilton Digital Assets Limited, a company incorporated in the British Virgin Islands, each for the activities described in Section 2. We will route your request to the right controller.

14. Governing law and disputes#

This Policy is governed by the laws of the British Virgin Islands. Any dispute arising out of or in connection with it will be resolved under the dispute resolution clause of the Terms of Service or, for Mint Users, the USDh Mint User Agreement. Nothing in this Policy limits your right to complain to a data protection authority or any other right you have under mandatory data protection law.

Privacy Policy.