This privacy policy (“Policy”) describes how Casa Inc. (“Casa,” “we,” or “us”) receive, use, disclose, and otherwise process Personal Data when you access or use any of our services that are powered by Zero Hash, such as buying and selling cryptocurrency (“ZH Services”). In such cases, your Personal Data is collected directly by Zero Hash and is subject to the Zero Hash privacy policy, and your use of the ZH Services is subject to Zero Hash’s separate terms of service, to which you agree when signing up. We receive only limited Personal Data back from Zero Hash, as further described below. We encourage you to review the Zero Hash privacy policy for more information about its privacy practices. This Policy does not apply to Zero Hash’s processing activities, to the practices of other companies we do not own or control, or to people we do not manage.
Remember that your use of Casa’s Services is at all times subject to our Terms of Service, which incorporates our separate Privacy and Data Protection Policy that covers Services that are not powered by Zero Hash. Any terms we use in this Policy without defining them have the definitions given to them in the Terms of Service. For more information about our privacy practices for Services that are not powered by Zero Hash, please review our Privacy and Data Protection Policy.
“Personal Data” means any information that identifies or relates to a particular individual and also includes information referred to as “personally identifiable information” or “personal information” under applicable data privacy laws, rules, or regulations.
Providing, Customizing, and Improving the ZH Services
- Processing orders or other transactions.
- Providing you with the products, services, or information you request.
- Meeting or fulfilling the reason you provided the information to us.
- Providing support and assistance for the ZH Services.
- Improving the ZH Services, including testing, research, internal analytics, and product development.
- Personalizing the ZH Services and communications based on your preferences.
- Doing fraud protection, security, and debugging.
- Carrying out other business purposes as otherwise set forth in applicable data privacy laws.
Meeting Legal Requirements and Enforcing Legal Terms
- Fulfilling our legal obligations under applicable law, regulation, court order, or other legal process, such as preventing, detecting, and investigating security incidents and potentially illegal or prohibited activities.
- Protecting the rights, property, or safety of you, the ZH Services, or another party.
- Enforcing any agreements with you.
- Responding to claims that any posting or other content violates third-party rights.
- Resolving disputes.
How We Disclose Your Personal Data
We disclose your Personal Data to the categories of service providers and other parties listed in this section.
Service Providers. These parties help us provide the ZH Services or perform business functions on our behalf. They include:
- Hosting, technology and communication providers.
- Support and customer service vendors.
- Customer relationship management vendors.
Parties You Authorize, Access, or Authenticate
- Third parties you access through the services.
Legal Obligations
We may disclose any Personal Data that we receive to third parties in conjunction with any of the activities set forth under “Meeting Legal Requirements and Enforcing Legal Terms” in the “Our Commercial or Business Purposes for Receiving Personal Data” section above.
Business Transfers
All of your Personal Data that we receive may be transferred to a third party if we undergo a merger, acquisition, bankruptcy, or other transaction in which that third party assumes control of our business (in whole or in part). Should one of these events occur, we will make reasonable efforts to notify you before your information becomes subject to different privacy and security policies and practices.
Data that is Not Personal Data
We may create aggregated, de-identified, or anonymized data from the Personal Data we receive, including by removing information that makes the data personally identifiable to a particular user. We may use such aggregated, de-identified, or anonymized data and disclose it to third parties for our lawful business purposes, including to analyze, build, and improve the ZH Services; and to promote our business, provided that we will not disclose such data in a manner that could identify you.
Data Retention
We retain Personal Data about you for as long as you have an open account with us or as otherwise necessary to provide you with the ZH Services. In some cases, we retain Personal Data for longer, if doing so is necessary to comply with our legal obligations, resolve disputes, or collect fees owed; or is otherwise permitted or required by applicable law, rule, or regulation. We may further retain information in an anonymous or aggregated form where that information would not identify you personally.
Personal Data of Children
As noted in the Terms of Service, we do not knowingly receive or solicit Personal Data from children under 16 years of age; if you are a child under the age of 16, please do not attempt to register for or otherwise use the ZH Services or send us any Personal Data. If we learn that we have received Personal Data from a child under 16 years of age, we delete that information as quickly as possible. If you believe that a child under 16 years of age may have provided Personal Data to us, please contact us at help@team.casa.
Please note that certain of the Services may require you to provide information regarding the child or children in relation to whom you may be using the Services, including Personal Information such as first and last name (among other information), in order to properly provide such Services to you. As noted above, we work to protect the security of any such information that you provide us, but please be aware that no method of transmitting data over the internet or storing data is completely secure. If you’d like to request that we delete any such information, please contact us at help@team.casa.
European Union and United Kingdom Data Subject Rights
If you are a resident of the European Union (“EU”), United Kingdom (“UK”), Lichtenstein, Norway, or Iceland, you may have additional rights under the EU or UK General Data Protection Regulation (the “GDPR”) with respect to your Personal Data, as outlined below.
For this section, we use the terms “Personal Data” and “processing” as they are defined in the GDPR, but “Personal Data” generally means information that can be used to individually identify a person, and “processing” generally covers actions that can be performed in connection with data such as collection, use, storage, and disclosure. Casa will be the controller of your Personal Data that we receive and process in connection with the ZH Services.
If there are any conflicts between this section and any other provision of this Policy, the policy or portion that is more protective of Personal Data shall control to the extent of such conflict. If you have any questions about this section or whether any of the following applies to you, please contact us at help@team.casa.
The “Categories of Personal Data We Receive” section above details the Personal Data that we receive about you.
The “Our Commercial or Business Purposes for Receiving Personal Data” section above explains how we use your Personal Data.
We will only process your Personal Data if we have a lawful basis for doing so. Lawful bases for processing include consent, contractual necessity, and our “legitimate interests” or the legitimate interest of others, as further described below.
- Contractual Necessity: We process the following categories of Personal Data as a matter of “contractual necessity,” meaning that we need to process the data to perform under our Terms of Service with you, which enables us to provide you with the ZH Services. When we process data due to contractual necessity, failure to provide such Personal Data will result in your inability to use some or all portions of the ZH Services that require such data.
- Contact Data - Legitimate Interest: We process the following categories of Personal Data when we believe it furthers the legitimate interest of us or third parties:
- Commercial Data
- We may also de-identify or anonymize Personal Data to further our legitimate interests.
Examples of these legitimate interests include (as described in more detail above):
- Providing, customizing and improving the Services.
- Meeting legal requirements and enforcing legal terms.
- Completing corporate transactions. - Consent: In some cases, we process Personal Data based on the consent you expressly grant to us. When we process Personal Data based on your consent, it will be expressly indicated to you at the point and time of collection.
- Other Processing Grounds: From time to time we may also need to process Personal Data to comply with a legal obligation, if it is necessary to protect the vital interests of you or other data subjects, or if it is necessary for a task carried out in the public interest.
The “How We Disclose Your Personal Data” section above details how we disclose your Personal Data to third parties.
You have certain rights with respect to your Personal Data, including those set forth below. For more information about these rights, or to submit a request, please email us at help@team.casa. Please note that in some circumstances, we may not be able to fully comply with your request, such as if it is frivolous or extremely impractical, if it jeopardizes the rights of others, or if it is not required by law; but in those circumstances, we will still respond to notify you of such a decision. In some cases, you may also need to provide us with additional information, which may include Personal Data, if necessary, to verify your identity and the nature of your request.
- Access: You can request more information about the Personal Data we hold about you and request a copy of such Personal Data. You can also access certain of your Personal Data by logging into your account.
- Rectification: If you believe that any Personal Data we are holding about you is incorrect or incomplete, you can request that we correct or supplement such data. You can also correct some of this information directly by logging on to your account.
- Erasure: You can request that we erase some or all of your Personal Data from our systems.
- Withdrawal of Consent: If we are processing your Personal Data based on your consent (as indicated at the time of collection of such data), you have the right to withdraw your consent at any time. Please note, however, that if you exercise this right, you may have to then provide express consent on a case-by-case basis for the use or disclosure of certain of your Personal Data, if such use or disclosure is necessary to enable you to utilize the ZH Services.
- Portability: You can ask for a copy of your Personal Data in a machine-readable format. You can also request that we transmit the data to another controller where technically feasible.
- Objection: You can contact us to let us know that you object to the further use or disclosure of your Personal Data for certain purposes, such as for direct marketing purposes.
- Restriction of Processing: You can ask us to restrict further processing of your Personal Data.
- Right to File Complaint: You have the right to lodge a complaint about the ZH Services' practices with respect to your Personal Data with the supervisory authority of your country or EU Member State. A list of Supervisory Authorities is available here: https://edpb.europa.eu/about-edpb/board/members_en.
The ZH Services are hosted and operated in the United States (“U.S.”) and elsewhere throughout the world through Casa and its service providers, where the laws may differ from the laws where you reside. By using the ZH Services, you acknowledge that any Personal Data about you, regardless of whether provided by you or obtained from a third party, is being provided to Casa and will be hosted on U.S. servers and elsewhere throughout the world, and you authorize Casa to transfer, store, and process your information to and in the U.S. and elsewhere throughout the world as necessary to perform our duties in providing you with the ZH Services. Additionally, you understand that your Personal Data may be processed in countries (including the United States) where laws regarding processing Personal Data may be less stringent than in your country. Please contact us at help@team.casa with any questions or concerns.
Changes to this Policy
We’re constantly trying to improve the ZH Services, so we may need to change this Policy from time to time, but we will alert you to any material changes by placing a notice on the ZH Services website, by sending you an email and/or by some other means. Please note that if you’ve opted not to receive legal notice emails from us (or you haven’t provided us with your email address), those legal notices will still govern your use of the ZH Services, and you are still responsible for reading and understanding them. If you use the ZH Services after any changes to the Policy have been posted, that means you agree to all of the changes. Use of information we receive is subject to the Policy in effect at the time such information is received.
Contact Information
If you have any questions or comments about this Policy, the ways in which we receive and use your Personal Data or your choices and rights regarding such receipt and use, please do not hesitate to contact us at:
Effective Date: March 27, 2025