The policy states that users may request deletion of their personal data and that Ledger will fulfill such requests, except where retention is required to comply with legal obligations, with accounting cited as an example.
This analysis describes what Ledger's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes a deletion right that is qualified by a legal retention carve-out. The scope of data that may be retained under legal obligations is not exhaustively defined in the excerpted policy text, meaning the practical scope of a deletion request depends on Ledger's internal determination of applicable retention requirements.
Interpretive note: The scope of data subject to legal retention obligations is not enumerated in the policy, meaning the practical extent of deletable data depends on Ledger's internal compliance determinations and applicable jurisdiction-specific retention requirements.
The updated policy removes explicit language stating that Ledger Recover and Ledger Multisig services are excluded from this privacy policy. Previously, users were directed to separate privacy policies for those services; that direction is now absent. This creates ambiguity about whether this policy now covers those services or whether separate policies still apply. The dramatic reduction in policy length (from 224 to 36 sentences) suggests substantial content was removed, though the specific implications depend on what other sections were condensed or eliminated. You should review the full updated policy to confirm what data practices and service exclusions remain in effect for all Ledger services you use.
View change record →Ledger removed language explicitly stating that this privacy policy does not cover Ledger Recover and Ledger Multisig services, and eliminated references to dedicated privacy policies for those services. This creates ambiguity about whether those services are now governed by the main privacy policy or whether separate policies exist but are no longer disclosed in this document. If you use Ledger Recover or Ledger Multisig, you should review the privacy disclosures for those specific services directly, as it is no longer clear from the main privacy policy whether separate protections apply.
View change record →This provision establishes the right to deletion while creating a broad exception for legal retention requirements, which could significantly limit the practical scope of deletion rights.
View full change record →Under this clause, users who request data deletion may not receive complete erasure if Ledger determines that some data must be retained under applicable legal obligations such as accounting or financial regulations. The policy does not specify which data categories are subject to mandatory retention or the duration of such retention.
Cross-platform context
See how other platforms handle Data Deletion with Legal Retention Carve-Out and similar clauses.
Compare across platforms →"Ask that we delete your data. We will delete all your data, unless we have to retain it to respect our legal obligations (e.g. accounting).Excerpt from Ledger's Privacy Policy
1) REGULATORY LANDSCAPE: This provision reflects GDPR Article 17's right to erasure, which includes explicit exceptions for compliance with legal obligations.
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
This provision establishes a deletion right that is qualified by a legal retention carve-out. The scope of data that may be retained under legal obligations is not exhaustively defined in the excerpted policy text, meaning the practical scope of a deletion request depends on Ledger's internal determination of applicable retention requirements.
Under this clause, users who request data deletion may not receive complete erasure if Ledger determines that some data must be retained under applicable legal obligations such as accounting or financial regulations. The policy does not specify which data categories are subject to mandatory retention or the duration of such retention.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Ledger.