Ledger Privacy Policy

This document is Ledger's privacy policy governing the collection, use, and sharing of personal data across Ledger's hardware wallet products, the Ledger Live application, and associated services, with Ledger SAS (a French company) acting as data controller under GDPR as the stated legal basis for EU-facing operations. The policy states that Ledger collects identifiers (name, email, postal address, IP address), purchase and transaction data, device usage data, and technical diagnostics, and the terms authorize sharing this data with service providers, logistics partners, and third-party analytics providers for purposes including order fulfillment, fraud prevention, and marketing. A notable operational characteristic is that the policy applies to a company whose customers are cryptocurrency hardware wallet users, meaning the intersection of purchase data, shipping addresses, and device usage data carries elevated sensitivity given that such data could indicate ownership of significant digital assets, creating a risk profile that may exceed that of a typical e-commerce privacy policy. The policy engages GDPR (Ledger SAS is headquartered in Paris, France, making the CNIL the primary supervisory authority), the California Consumer Privacy Act for US residents, and potentially the UK GDPR post-Brexit for UK customers; the policy discloses data transfers outside the EEA and states that appropriate safeguards such as Standard Contractual Clauses are used. Compliance teams should note that Ledger experienced a significant customer data breach in 2020 in which names, email addresses, phone numbers, and postal addresses of over one million customers were leaked, making the adequacy of the security measures described in this policy a material due diligence consideration.