Privacy Policy

Document version: 12.10.2026

1. Who we are

GLO Services AG, Grafenauweg 8, CH-6300 Zug, Switzerland, operating under the name Global Ledger (“Global Ledger”, “we”, “us”), processes personal data as described in this Privacy Policy. Our responsibilities depend on the nature and context of the processing and the requirements of applicable data protection law.

This Privacy Policy explains how we process personal data in connection with our websites, marketing, customer relationships and the provision of our blockchain analytics services (the "Services"). It is designed to comply with the Swiss Federal Act on Data Protection (FADP) and, where applicable, the EU General Data Protection Regulation (GDPR) and the UK GDPR (together, the "Data Protection Laws").

2. Data we process on behalf of our business customers

Where we process personal data contained in screening, monitoring, investigation or other service inputs submitted or queried by our business customers on their documented instructions, we act as a processor or subprocessor, as applicable. Such inputs may include wallet addresses, transaction identifiers, transaction hashes and related screening data. We process that personal data in accordance with our agreement with the customer and its documented instructions, subject to applicable legal requirements.

In that case, the customer is the controller or acts on behalf of its own controller, and the relevant controller’s privacy notice applies. The terms of our agreement with the customer, including any data processing agreement, approved processing locations and restrictions on the use of data, prevail over this Privacy Policy.

3. Personal data we collect

We collect the following categories of personal data:

data you provide to us: name, business email address, company, job title, account and login details, communication preferences, the content of your enquiries, and information you provide when registering for events, webinars or downloads;

customer onboarding and compliance data: information required for our own know-your-customer (KYC), anti-money laundering and sanctions checks on our customers and their representatives;

payment, billing and subscription data: information relating to payments, billing and subscriptions, including limited payment metadata and payment status information received from our payment service providers;

payment security data: information and technical signals used in connection with payment fraud prevention and security;

screening inputs: where you use the Services in your own right and we are not acting as a processor under section 2, the wallet addresses, transaction hashes and related inputs you submit;

technical and usage data: IP address, browser type, internet service provider, referring and exit pages, platform type, date and time stamps, clicks, domain name and approximate location derived from your IP address;

data from third parties and public sources: publicly available professional information (such as company websites and professional networks), information from event organisers and data from analytics providers. Where we obtain personal data from third parties, we take reasonable steps to confirm that it was collected and disclosed to us lawfully;

blockchain data: see section 5.

We use Stripe as our payment service provider. When you make a payment, start or renew a subscription, or save a payment method for future charges, Stripe may process your payment details, billing details, transaction data and related fraud prevention and security signals. Stripe may collect full payment credentials directly from you. We may receive limited payment metadata and payment status information from Stripe for billing, customer support, fraud prevention and compliance purposes.

Recurring payments and the use of saved payment methods are based on your authorisation and the subscription and payment terms you accept, which specify the timing and frequency of charges, the amount or how it is determined, and the applicable cancellation arrangements.

We do not store the card verification code (CVV/CVC) after authorisation.

We may also create aggregated statistical data. Aggregated data may be derived from personal data but does not directly or indirectly identify you.

Special categories of personal data. Other than as allowed by the Data Protection Laws, Global Ledger websites do not collect any special categories of personal information about you (this includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health and genetic and biometric data). We do not collect information about criminal convictions and offences from individuals merely visiting our websites. Data processed in connection with the Services under sections 2 and 5 may include such information, including attribution labels and risk indicators linked to an identifiable individual, subject to the Data Protection Laws.

Children. Our Services are not directed to children, and we do not knowingly collect personal data from individuals under the age required by applicable law to use the Services independently.

4. Purposes and legal bases

We process personal data for the following purposes and on the following legal bases:

providing the Services, managing accounts, creating and managing subscriptions, including renewals, plan changes, cancellations, suspensions and refunds, processing recurring and one-time payments, issuing invoices, receipts and billing notices, and providing customer and billing support: performance of a contract where you are a party; otherwise, our legitimate interests in serving our business customers and managing relationships with their representatives;

complying with our legal obligations, including accounting, calculating, collecting and reporting taxes, anti-money laundering and sanctions requirements, and responding to lawful requests from authorities: legal obligation;

ensuring the security of our platform, detecting, preventing and investigating fraud and abuse, managing payment disputes and chargebacks, and troubleshooting: our legitimate interests;

improving the Services, including developing and training AI models, using our own intelligence datasets and data anonymised so that neither individuals nor customers can reasonably be identified: our legitimate interests, where personal data is involved; you may object to such processing at any time. We do not use personal data processed on a customer’s behalf under section 2, or information derived from customer queries, monitored selections, rules, cases or service outputs, for these purposes;

marketing: consent or, where permitted by law, our legitimate interests (see section 7);

establishing, exercising or defending legal claims: our legitimate interests.

We use personal data only for the purposes for which it was collected, or for compatible purposes. If we need to use it for an unrelated purpose, we will inform you and, where required, ask for your consent. We do not sell personal data.

5. Individuals whose blockchain addresses are analysed

Our Services analyse public blockchain data and attribute blockchain addresses to entities or risk categories. For this purpose, we process blockchain addresses, transaction data, attribution labels and risk indicators. We obtain this data from public blockchain ledgers, publicly available sources (such as official sanctions lists, public reports and law enforcement publications) and our customers under our agreements with them. Our own intelligence datasets exclude data processed on a customer’s behalf and information derived from customer queries, monitored selections, rules, cases or service outputs.

Where a blockchain address can be linked to an identifiable individual, this processing involves personal data. We carry it out on the basis of our legitimate interests, and those of our customers and the public, in preventing money laundering, terrorist financing, sanctions evasion and fraud.

6. Automated processing and profiling

Our Services automatically generate risk scores, attribution labels and screening results. These support, but do not replace, customers’ own assessments. Customers must review results and exercise their own professional judgement before material action. Legally regulated use of our results for automated decision-making requires express terms agreed in advance in a Purchase Order and compliance with applicable law.

If you believe a decision about you was based on our results, you may contact us to request human review of the underlying attribution, express your views and contest it.

7. Marketing

We send bulk marketing emails only:

where you have given your consent; or

where you or your organisation is an existing customer and we inform you about our own similar services, provided that you were given the opportunity to object when your contact details were collected and in every email we send.

We do not send bulk marketing emails to contacts obtained from public sources without their consent. We store marketing contact data in our customer relationship management (CRM) system. Where required by law and with your consent, we analyse your interaction with our emails (such as opens and clicks) to improve the relevance of our communications.

You may unsubscribe at any time using the link in any marketing email or by contacting us. You may also object at any time to the processing of your personal data for direct marketing, including related profiling. Communications about your account, subscription, payments, security or operational matters are not marketing communications.

8. Principles we apply

We process personal data in accordance with the principles of the Data Protection Laws. Personal data is:

(a) processed lawfully, fairly and in a transparent manner;

(b) collected for specified, explicit and legitimate purposes and not further processed in a manner incompatible with those purposes;

(d) accurate and, where necessary, kept up to date;

(e) kept in a form which permits identification for no longer than necessary; and

(f) processed with appropriate security, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage.

9. Recipients

We may disclose personal data to the following categories of recipients:

our group companies, staff and professional advisers;

service providers who process data on our behalf, such as hosting, website management, technical support, CRM and marketing analytics providers;

payment service providers, including Stripe, banks, acquirers and card networks;

fraud prevention, risk assessment and account security providers;

invoicing, bookkeeping, tax and accounting providers;

competent authorities, courts and other third parties, where disclosure is required by applicable law, necessary to establish, exercise or defend legal claims, or necessary to protect the vital interests of any person;

any other person with your consent.

Where service providers process personal data on our behalf, they are bound by contract to process it in accordance with the Data Protection Laws and to implement appropriate technical and organisational security measures.

Depending on the processing activity, Stripe and other payment-related recipients may act as processors on our behalf or as independent controllers. Where they act as independent controllers, their own privacy notices describe their processing and how you may exercise your rights. Further information about Stripe is available in Stripe’s Privacy Policy.

10. International transfers

We may disclose personal data abroad. The destination countries and applicable transfer safeguards or statutory exceptions are identified in our Subprocessor List. You may request a copy of the relevant safeguards.

11. How long we keep personal data

We keep personal data for as long as necessary for the purposes described in this Privacy Policy, including to provide the Services, manage subscriptions and payments, comply with legal, tax, accounting and regulatory obligations, resolve disputes and enforce agreements.

Payment, billing and subscription records may be retained after a subscription ends where necessary to meet those obligations, handle refunds, payment disputes or chargebacks, prevent or investigate fraud, or establish, exercise or defend legal claims.

Retention periods vary depending on the type of data, the purpose of processing and applicable legal requirements. When personal data is no longer needed, we delete or anonymise it.

12. Your rights

Subject to the conditions of the Data Protection Laws, you have the right to:

access your personal data;

request rectification of inaccurate data;

request erasure of your data;

request restriction of processing;

receive your data in a portable format or have it transmitted to another controller, where technically feasible;

object to processing based on our legitimate interests, and at any time to processing for direct marketing;

withdraw your consent at any time, without affecting the lawfulness of processing before withdrawal;

obtain human review of, express your point of view on and contest a decision based solely on automated processing that significantly affects you.

To exercise your rights, contact us at contact@globalledger.io. We respond without undue delay within 30 days of receipt, or any shorter deadline required by law.

We may extend the deadline only as permitted by law, notifying you within the initial deadline of the reasons and the new response deadline. Where the GDPR applies, an extension may not exceed two further months and must be necessary considering the complexity and number of requests.

You have the right to lodge a complaint with a competent supervisory authority. In Switzerland, you may contact the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, CH-3003 Berne, Switzerland, telephone +41 (0)58 462 43 95, email info@edoeb.admin.ch, or through its official contact form: https://www.edoeb.admin.ch/en/contact-2.

In the EEA, you may lodge a complaint with the supervisory authority in the country of your habitual residence, place of work or the place where the alleged infringement took place. A list of EEA supervisory authorities is available at: https://www.edpb.europa.eu/about-edpb/our-members_en.

You may contact us first, but this does not restrict your right to complain directly to a supervisory authority.

13. Information security

We implement technical and organisational measures appropriate to the risk of processing, including storing personal data on secure servers with restricted access and encrypting personal data in transit over public networks using industry-standard TLS/HTTPS. We work only with service providers that apply appropriate security measures. We have procedures in place to deal with data breaches and will notify you and the competent authority where required by law.

14. Links to third-party websites

Our websites contain links, plug-ins and applications of third parties. Enabling these connections may allow third parties to collect or share data about you. We are not responsible for their privacy practices and encourage you to read their privacy notices.

15. Cookies

We use cookies and similar technologies in connection with our websites and Services, including for secure account access, payment processing, subscription management and fraud prevention. For information about these technologies, their purposes and duration, and how to manage your preferences, please see our Cookie Policy.

16. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. Material changes will be published on this page with an updated effective date and, where required by law, notified to you separately.

Data protection contact: contact@globalledger.io.