Effective November 1, 2026
Privacy Policy & Data Residency Notice
1. Data Controller
Bastion Ledger AG, Hardturmstrasse 161, 8005 Zurich, Switzerland (“Bastion Ledger”), acts as the data controller for business contact inquiries and member portal accounts, and as a bound data processor under our Standard Data Processing Agreement (DPA) for customer workspace records.
2. Categories of Data Processed
We process corporate contact names, work email addresses, organizational roles, and submitted governance scope descriptions strictly to provision evaluation workspaces, schedule technical briefings, or deliver requested compliance documentation.
3. Sovereign Hosting & Zero Model Training
Customer workspaces are isolated within Frankfurt (`eu-central-1`) or Zurich (`eu-central-2`) using per-tenant envelope KMS encryption. Uploaded SOC 2 reports, ISO certificates, penetration test summaries, and vendor responses are never retained by third-party foundation model providers or used for model training.
4. Retention & Data Subject Rights
Under GDPR and the Swiss Federal Act on Data Protection (FADP), you may request access, rectification, export, or erasure of your business contact data at any time by writing to privacy@bastion-ledger.example.