What can I do about this clause?

{'method': 'WEB_FORM', 'recipient': 'https://support.ledger.com', 'difficulty': 'MODERATE', 'action_type': 'DELETE_DATA', 'instructions': 'Submit a data deletion request to Ledger through their support portal at support.ledger.com, citing your GDPR right to erasure (Art. 17) or CCPA right to deletion (§1798.105). Provide your name and the email address used for your purchase to enable identification.', 'deadline_days': 30, 'deadline_hours': None}

Which regulatory agencies enforce this type of clause?

{'agency': 'FTC', 'reason': "The FTC has jurisdiction over data security practices and unfair or deceptive data handling under FTC Act Section 5, relevant given Ledger's prior data breach and ongoing collection of consumer purchase data.", 'complaint_url': 'https://reportfraud.ftc.gov/'}, {'agency': 'State_AG', 'reason': 'California AG and CPPA enforce CCPA rights including the right to know about and delete personal data collected during e-commerce transactions, applicable to California residents who purchase from Ledger.', 'complaint_url': 'https://www.naag.org/find-my-ag/'}

What is the severity of this clause?

ConductAtlas classifies this Personal Data Processing for Sales Transactions clause as high severity. Severity reflects the magnitude of rights affected, the breadth of users impacted, and the degree of discretion the platform retains.

Personal Data Processing for Sales Transactions — Ledger

Share 𝕏 Share in Share 🔒 PDF

What it is

When you buy from Ledger's shop, your personal data (name, address, payment information, and email) is collected and processed to fulfill your order — Ledger's privacy policy governs how this data is used.

Consumer impact (what this means for users)

Personal data including your name, shipping address, and email collected during a Ledger purchase may be shared with third-party service providers for order fulfillment — given Ledger's prior data breach history, consumers should use a dedicated email and shipping address where possible.

What you can do

⚠️ These actions may provide transparency or partial mitigation but may not fully address the underlying issue. Effectiveness varies by jurisdiction and individual circumstances.

Delete Your Data
Within 30 days
Submit a data deletion request to Ledger through their support portal at support.ledger.com, citing your GDPR right to erasure (Art. 17) or CCPA right to deletion (§1798.105). Provide your name and the email address used for your purchase to enable identification.

Cross-platform context

See how other platforms handle Personal Data Processing for Sales Transactions and similar clauses.

Compare across platforms →

Need full compliance memos? See Professional →

Why it matters (compliance & risk perspective)

Your purchase data is processed by Ledger and may be shared with third-party logistics, payment processors, and potentially global delivery partners, so understanding how your data flows is important especially given Ledger's 2020 data breach that exposed customer information.

Institutional analysis (Compliance & legal intelligence)

(1) REGULATORY FRAMEWORK: Processing of personal data for sales transactions is governed by GDPR (Regulation 2016/679) Art. 6(1)(b) (processing necessary for performance of a contract) as the primary legal basis. Data transfers to third-party logistics and payment providers constitute data sharing under GDPR Art. 28, requiring data processing agreements. International data transfers outside the EEA must comply with GDPR Chapter V (standard contractual clauses or adequacy decisions). UK GDPR applies equivalent requirements for UK customers. California customers benefit from CCPA §1798.100 et seq. rights including the right to know what data is collected and to request deletion. Enforcement authority: French CNIL (lead supervisory authority for Ledger as a French entity under GDPR one-stop-shop), ICO (UK), California AG and CPPA. (2)

🔒

Compliance intelligence locked

Regulatory citations, enforcement risk, and due diligence action items.

Watcher $9.99/mo Professional $149/mo

Watcher: regulatory citations. Professional: full compliance memo.

Applicable agencies

FTC

The FTC has jurisdiction over data security practices and unfair or deceptive data handling under FTC Act Section 5, relevant given Ledger's prior data breach and ongoing collection of consumer purchase data.
File a complaint →
State AG

California AG and CPPA enforce CCPA rights including the right to know about and delete personal data collected during e-commerce transactions, applicable to California residents who purchase from Ledger.
File a complaint →

Provision details

Document information

Document

Ledger Terms of Sale

Entity

Ledger

Document last updated

April 29, 2026

Tracking information

First tracked

April 27, 2026

Last verified

April 27, 2026

Record ID

CA-P-003651

Document ID

CA-D-00277

Evidence Provenance

Source URL

https://shop.ledger.com/pages/terms-and-conditions

Wayback Machine

View archived versions →

SHA-256

b36e40a3b107c112841a48a87e67ca3295e19bad535ca3b1178a811b9bf32fbb

Verified

✓ Snapshot stored ✓ Change verified

How to Cite

ConductAtlas Policy Archive
Entity: Ledger | Document: Ledger Terms of Sale | Record: CA-P-003651
Captured: 2026-04-27 15:28:36 UTC | SHA-256: b36e40a3b107c112…
URL: https://conductatlas.com/platform/ledger/ledger-terms-of-sale/personal-data-processing-for-sales-transactions/
Accessed: May 2, 2026

Classification

Severity

High

Personal Data Processing for Sales Transactions