We ignore reading the privacy page, and most of us read it after a problem occurs, so I will quote for you some parts related to privacy and data protection or (erased it from them systems):
We may archive some of your personal data, with restricted access, for an additional period of time when it is strictly necessary for us to comply with our legal and/or regulatory archiving obligations and for the applicable statute of limitation periods. At the end of this additional period, your remaining personal data will be permanently erased or anonymized from our systems.
The maximum data retention period is 10 years.
If you purchased a product or a service from us, we may retain some transactional data attached to your Contact Details to comply with our legal, tax or accounting obligations for a maximum 10 years period set forth by French applicable laws, as well as to allow us to manage our rights (for example to assert our claims in Courts) during applicable French statutes of limitations.
They have the right to transfer data to third parties, but they make sure that their tasks are sufficiently secure and that your privacy is protected.
We may also transmit some of your data to third parties such as payment services, infrastructure, logistics, and other services providers.
(In certain circumstances) administrative authorities and a third party (not clearly defined) can obtain your files.
In certain circumstances and only where required by Applicable Laws, we may disclose some of your data to competent administrative or judicial authorities or any other authorized third party.
A request to erase personal data may take a month after confirming your identity and they can refuse if they have legitimate and compelling reasons for processing (do not forget that they can share your personal data with third parties who have different privacy rules.)
If you object to the processing or ask for the erasure of your personal data by Ledger, we shall acknowledge the receipt of your request and, within a maximum one month period, we shall stop processing your personal data or erase it from our IT systems, except where Ledger has legitimate and compelling grounds for processing, or for the purpose of ascertaining, exercising or defending its legal rights in accordance with the Applicable Laws.
Source and Read more ---->
https://shop.ledger.com/pages/privacy-policy