Welcome to Bridge.
European Privacy Policy
Last updated June 3, 2026
These terms will be conditionally effective beginningJuly 1, 2025 pending approval from the Commission de Surveillance du Secteur Financier.
01
Overview and Definitions
1.1 Who we are: Bridge Building S.A., a company incorporated in Luxembourg with its registered office at 26, Boulevard Royal 2449 Luxembourg / Luxembourg and other companies in the Bridge group collect and use certain Personal Data.
1.2 Please read this Privacy Policy: We take your privacy very seriously. Please read this Privacy Policy carefully as it contains important information on who we are and how and why we collect, store, use and share any information relating to you (your Personal Data) in connection with your use of the Services and other online platforms. It also explains your rights in relation to your Personal Data and how to contact us or a relevant regulator in the event you have a complaint.
1.3 Bridge’s Role: Depending on the activity, Bridge assumes the role of a “data controller” or “data processor” (“service provider”). We are the controller of the Personal Data obtained via the Services to provide them to you, as well as information collected from other online platforms (such as social media). This means we are the organisation legally responsible for ensuring compliance with data protection laws, including (but not limited to) the EU GDPR and any other national implementing or supplementing data protection legislation. This includes deciding how and for what purposes Personal Data is used. Bridge assumes the role of data processor for Personal Data needed by Bridge Partners to provide their Services to you, and the Bridge Partner would be the organisation legally responsible for ensuring compliance with data protections laws for these transactions.
1.4 Third party links: Throughout our Services, we may link to other websites owned and operated by certain trusted third parties, including ones that help us perform identity verification or make additional products and services available to you. Those third-party websites may also gather information about you in accordance with their own separate privacy policies. For privacy information relating to those third-party websites, please consult their privacy policies as appropriate.
1.5 Changes to this Privacy Policy: We may change this privacy policy from time to time. When we make significant changes, we will take steps to inform you, for example by including a prominent link to a description of those changes on our website for a reasonable period or by other means, such as email.
Depending on the context, “you” might be a User, Business User, or a Visitor:
- Users. Because Bridge does not offer service directly to the public, you must first have a valid account with a Bridge Partner to open a Bridge Account and access the Services. When you are not directly transacting with Bridge, but we receive your Personal Data in order to provide Services to you through a Business Partner, we refer to you as a “User”.
- Representatives: When you are acting on behalf of an existing or potential Business Partner or Financial Partner —perhaps as a company founder, account administrator for a Business User, or a recipient of an employee credit card from a Business User via Stripe Issuing—we refer to you as a “Representative” or “Business User.”
- Visitors. When you interact with Bridge by visiting a Website without being logged into a Bridge account, or when your interaction with Bridge does not involve you being a User or Representative, or when you visit a Bridge office or other Bridge premises, we refer to you as a “Visitor.” For example, you are a Visitor when you send a message to Bridge asking for more information about our Services.
“Bridge”, “Bridge Group” “we” or “us” means Bridge Building S.A. and its affiliates, including Bridge’s parent company, Stripe, LLC;
“Bridge employees” means employees employed by the Bridge, its parent company Stripe, LLC or any of its affiliates;
“Bridge Partners” means legal entities that have entered into a service agreement with BBSA to integrate Bridge Services into their own applications or platforms;
“Financial Partners” means financial institutions, banks, and other partners such as payout providers, payment method providers, payment processors, crypto exchanges and card networks that Bridge partners with, directly or indirectly, to provide the Services;
“EEA” means the European Economic Area.
“GDPR” means the European Union’s General Data Protection Regulation (Regulation (EU) 2016/679) and any laws and regulations implementing or created pursuant to the EU GDPR and the UK General Data Protection Regulation and any laws and regulations implementing it;
“Personal Data” means any data which relates to a living individual who can be identified from that data or from that data and other information which is in the possession of, or is likely to come into the possession of, Bridge (or its representatives or service providers). In addition to factual information, it includes any expression of opinion about an individual and any indication of the intentions of Bridge or any other person in respect of an individual;
“Privacy Policy” means this privacy policy;
“Services” means the Bridge Website, our online platform (including APIs) made available through the website of one of our partners, the software, systems, and services made available under the Bridge User Terms, and any other online service or platform that Bridge provides users from time to time.
“Service Provider” means a business that we use to provide the Services, including cloud infrastructure providers, analytics providers to evaluate the performance, accuracy, and security of our Services; identity verification; fraud and sanctions screening; and customer support and audit functions.
“Visitor” means an individual who visits a Site without being logged into a Bridge account, or interacts with Bridge without being a User or Representative, or visits a Bridge office or other Bridge premises. For example, you are a Visitor when you send a message to Bridge asking for more information about our Services.
“Website” means the Bridge website available at bridge.xyz and any other website made available by Bridge or its affiliates from time to time;.
02
Personal Data Collection
2.1 Personal Data we collect: The Personal Data we collect about you depends on the Services that you use and the particular activities carried out. Many of the Services offered by Bridge require us to obtain Personal Data about you in order to perform the Services we provide. Users may be unable to access the Services if such Personal Data are not provided.
We need certain Personal Data from you to verify your identity, to process your Bridge Account application, and to provide the Bridge Services to you. Your Partner may share your Personal Data with us with your permission, or we may collect it from you directly. Personal Data may include your name, email address, residential address, phone number, date of birth, and tax identification number, copies of your passport, driver’s license, military identification card or other government-issued photo identification; bank account statements; cryptocurrency wallet addresses you control, the purpose of your use of the Bridge Services, the source of funds you use to buy or sell Stablecoins, and related information we request. We may keep records of your Personal Data if required by a Financial Partners or by applicable law. The Personal Data you provide must always be accurate, complete and up to date.
2.2 User Data: If you are a User, we will collect and process the following Personal Data about you:
- Information that you provide to us: This includes information about you that you provide to us. The nature of the services you are requesting will determine the kind of Personal Data we might ask for, though such information may include (but is not limited to):
- basic Personal Data (such as first name; family name; date of birth; job role; email address; phone number; postal address; city; postcode; country; hashed password; national identification number, identity documents (including driver’s license, passport, or other government issued photo identification); proof of address documentation, payment information (such as banking information, wallet address, payment card details)); the purpose of your use of the Bridge Services, the source of funds you use to buy or sell Stablecoins, and related information we request.
- any other information that you choose to share via the Services which may be considered Personal Data;
- Information that we collect or generate about you. This includes (but is not limited to): technical information about your use of the Services e.g. sensor, location, connectivity, technical and aggregated usage data, such as your GPS/GNSS location data; home and work locations; IP addresses, wireless networks, cell towers and Wi-Fi access points; non-identifying data regarding a device, operating system, and browser; activity, communication, and performance logs; issues and bugs; and user activity on our Services. This data does not enable us to learn your true identity or contact details and serves mostly to improve the overall performance of our Services, and to better understand how our users typically use our Services and how we could improve their user experience. For more information on the cookies and other tracking technologies used by Bridge please see Section 9 of this Privacy Policy and our Cookie Notice below. To change your cookie preferences, click on the “Cookie Preference” link at the bottom of the Bridge home page.
- Information we obtain from other sources. We may receive information about you from third parties. For example, we may receive information about you from outside records of third parties, such as identity information. We may supplement the information we collect about you through the Services with such information from third parties in order to verify your identity or enhance our ability to serve you. If we combine such data with information we collect through the Services, such information is subject to this Privacy Policy unless we have disclosed otherwise.
2.3 Representative Data: If you are a Representative of a Business Partner, we will collect the following Personal Data about you:
- Registration and contact information. When you register for a Bridge account for a Business or Financial Partner (including incorporation of a Business), we collect your name and login credentials. If you register for or attend an event organized by Bridge or sign up to receive Bridge communications, we collect your registration and profile data. As a Representative, we may collect your Personal Data from third parties, including data providers, to advertise, market, and communicate with you.
- Identification Information. As a current or potential Representative of a Business Partner, an owner or a shareholder, officer, or director of a Business Partner, we need your contact details, such as name, postal address, telephone number, and email address, and bank account information to fulfill our Financial Partner and regulatory requirements, verify your identity, and prevent fraudulent activities and harm to the Bridge platform. We collect your Personal Data, such as ownership interest in the Business User, date of birth, government-issued identity documents, and associated identifiers, as well as any history of fraud or misuse, directly from you and/or from publicly available sources, third parties such as credit bureaus and via the Services we provide. You may also provide us with bank account information.
- We collect information from publicly available sources, third parties (such as credit bureaus), and via the Services we offer as part of the fraud prevention, detection, security monitoring, and compliance efforts for Bridge and its and its Business Partners. In some instances, we may also collect information about you directly from you, or from our Business Users, Financial Partners, and other third parties for the same purposes. Furthermore, to protect our Services, we may receive details such as IP addresses and other identifying data about potential security threats from third parties. Such information helps us verify identities, conduct credit checks where lawfully permitted, and prevent fraud.
- Information we obtain from other sources. We may also receive information about you and your business from third parties. We may supplement the information we collect about you through the Services with such information from third parties in order to verify your identity, enhance our ability to serve you, or suggest products and services to you. If we combine such data with information we collect through the Services, such information is subject to this Privacy Policy unless we have disclosed otherwise.
2.4 Visitor Data: If you are a Visitor to our website, we collect the following Personal Data about you either provided directly by you or collected through our use of cookies and similar technologies. If you choose to complete a form on the Website, we collect the information you included in the form. This may include your contact information and other information pertaining to your questions about our Services. We may also associate a location with your visit. For more information on the cookies and other tracking technologies used by Bridge please see Section 9 of this Privacy Policy and our Cookie Notice below. To change your cookie preferences, click on the “Cookie Preference” link at the bottom of the Bridge home page.
03
Personal Data Use
3.1 Our legal basis to use your Personal Data: We can only use your Personal Data if we have a legal basis to do so, e.g.:
a. where you have given consent;
b. to comply with our legal and regulatory obligations;
c. for the performance of a contract with you or to take steps at your request before entering into a contract, or
d. for our legitimate interests or those of a third party.
A legitimate interest is when we have a business or commercial reason to use your Personal Data, so long as this is not overridden by your own rights and interests. We will carry out an assessment when relying on legitimate interests, to balance our interests against your own.
3.2 What we use your Personal Data for and why.
a. Purpose
To facilitate, operate, and provide our Services as set out in their relevant terms and conditions and to enforce our User Terms and any other agreements between you and Bridge.
Our reasons and lawful basis relied on under the GDPR
To perform our contract with you (or to take steps at your request before entering into a contract).
Relevant categories of Personal Data
Your name, address, date of birth, and contact information, including email address and telephone number, your account details (username) and your payment details
Your identity documentation and proof of address documentation.
Your national identification number
Any other information that you choose to share via the Services which may be considered Personal Data.
b. Purpose
To provide our Users with assistance and support.
Our reasons and lawful basis relied on under the EU GDPR
To perform our contract with you.
Relevant categories of Personal Data
Your account details (username) and contact information, including email address and telephone number.
c. Purpose
To authenticate the identity of our Users, and to allow them to access and use our Services. We use Personal Data to meet our contractual and legal obligations related to anti-money laundering, Know-Your-Customer ("KYC") laws, anti-terrorism activities, safeguarding vulnerable customers, export control, and prohibition of doing business with restricted persons or in certain business fields, among other legal obligations. For example, we may monitor transaction patterns and other online signals and use those insights to identify fraud, money laundering, and other harmful activity that could affect Bridge, its Affiliates, Users, Representatives, Financial Partners and others. Safety, security, and compliance for our Services are key priorities for us, and collecting and using Personal Data is crucial to this effort.
Our reasons and lawful basis relied on under the EU GDPR
Compliance with a legal obligation and to perform our contract with you.
Relevant categories of Personal Data
Your name, address, date of birth, and contact information, including email address and telephone number, your account details (username) and your payment details.
Your identity documentation and proof of address documentation
Your national identification number
Any other information that you choose to share via the Services which may be considered Personal Data.
d. Purpose
Fraud Prevention and security. We collect and use Personal Data to support and enhance our data security measures, including for the purposes of preventing and mitigating the risks of fraud, error, or any illegal or prohibited activity, and to secure our Services and transactions against unauthorized access, use, alteration or misappropriation of Personal Data, information, and funds. Additionally, we might use technology to evaluate the potential risk of fraud associated with individuals seeking to procure our Business Services or arising from attempted transactions by a User with our Business or Financial Partners.
Our reasons and lawful basis relied on under the EU GDPR
Compliance with a legal obligation and legitimate interests
Relevant categories of Personal Data
Your name, address, date of birth, and contact information, including email address and telephone number, your account details (username) and your payment details
Your identity documentation and proof of address documentation
Your national identification number.
Any other information that you choose to share via the Services which may be considered Personal Data.
5. Purpose
To comply with any other applicable laws and regulations.
Our reasons and lawful basis relied on under the EU GDPR
Compliance with a legal obligation.
Relevant categories of Personal Data
Your name, address, date of birth, and contact information, including email address and telephone number, your account details (username) and your payment details.
Your identity documentation and proof of address documentation.
Your national identification number.
Any other information that you choose to share via the Services which may be considered Personal Data.
04
Disclosure of your information to third parties
The table below sets out who we share Personal Data with.
4.1. Other Bridge Group companies
Use by recipient
To assist us in performing our Services.
Relevant categories of personal information transferred (or likely to be transferred to) recipient
Your name, address, date of birth, and contact information, including email address and telephone number, your account details (username) and your payment details
Your identity documentation and proof of address documentation.
Your national identification number
Any other information that you choose to share via the Services which may be considered Personal Data.
4.2. Third party service providers
Use by recipient
To help deliver our Services to you, such as payment service providers, digital storage providers, and identity verification providers.
To help us run our business including (but not limited to) hosting and server co-location services, data analytics services, marketing and advertising services, data and cyber security services, fraud detection and prevention services, payment processing services, e-mail and SMS distribution and monitoring services, session recording, and our business, legal and financial advisors). These Service Providers may have access to your Personal Information, depending on each of their specific roles and purposes in facilitating and enhancing our Services, and may only use it for such purposes. They may use or disclose the Personal Data we make available to them to perform services on our behalf and to comply with relevant legal obligations. We require these Service Providers to contractually commit to security and confidentiality obligations for the Personal Data they process on our behalf.
Relevant categories of personal information transferred (or likely to be transferred to) recipient
Your name, address, date of birth, and contact information, including email address and telephone number, your account details (username) and your payment details
Your identity documentation and proof of address documentation
Your national identification number
Information we generate about your use of the Services, including location, connectivity, technical and aggregated usage data, IP addresses, wireless networks, cell towers and Wi-Fi access points; data regarding a device, operating system, and browser; activity, communication, and performance logs; issues and bugs; and user activity on our Services
Any other information that you choose to share via the Services which may be considered Personal Data.
To see our list of third-party service providers, please ask for a copy.
4.3. Bridge Partners
Use by recipient
If you access Services through the website of one of Bridge’s partners, then we may share your Personal Information with that partner in order to provide the Services.
Relevant categories of personal information transferred (or likely to be transferred to) recipient
Your name, address, date of birth, and contact information, including email address and telephone number, your account details (username) and your payment details
Your identity documentation and proof of address documentation.
Your national identification number
Any other information that you choose to share via the Services which may be considered Personal Data.
4.4 Payment Network Operators
Where transactions are processed via third-party payment networks or instant payment infrastructure (such as the FedNow® Service), we may share transaction data and fraud-related information with the operators of those networks as required by their applicable operating rules.
Use by recipient
Fraud-detection, fraud-reporting, directory, and compliance purposes
Relevant categories of personal information transferred (or likely to be transferred to) recipient
Transactional data
4.5 Our regulators, law enforcement agencies or other relevant governmental agencies
Use by recipient
Compliance with a legal obligation and legitimate interests.
Relevant categories of personal information transferred (or likely to be transferred to) recipient
Your name, address, date of birth, and contact information, including email address and telephone number, your account details (username) and your payment details
Your identity documentation and proof of address documentation.
Your national identification number.
Any other information that you choose to share via the Services which may be considered Personal Data.
05
International Transfers of Personal Data
5.1 Transfer of your Personal Data: Bridge has customers and operations spread around the world. As a result, we collect and transfer Personal Data on a global basis. That means that we may transfer your Personal Data to locations outside of your country, including to Bridge affiliates and service providers.
5.2 Protections when transferring internationally: Where we transfer your Personal Data to another country outside the EEA, we will ensure that it is protected and transferred in a manner consistent with legal requirements. In relation to data being transferred outside the EEA, for example, this may be done in one of the following ways:
- the country that we send the data to might be approved by the European Commission as offering an adequate level of protection for Personal Data. A list of countries the European Commission has currently made adequacy decisions in relation to is available here. We rely on adequacy decisions for transfers to any country on that list, when necessary.
- there are appropriate safeguards in place for you (including, but not limited to, the recipient might have signed up to a contract based on “standard contractual clauses” approved by the European Commission, obliging them to protect your Personal Data);
- the recipient may have adhered to binding corporate rules (only for intragroup transfers);
- Other alternative data transfer mechanisms that the law may permit us to otherwise transfer your Personal Data outside of the EEA.
You can obtain more details of the protection given to your Personal Data when it is transferred outside the EEA by contacting us as described below.
06
How we safeguard your information
We maintain administrative, technical, and physical safeguards that are designed to protect the privacy and security of your Personal Data. For example, all information you provide is accessible only to designated staff. In addition, all information is protected by SSL/TLS encryption when it is exchanged between your web browser and the Services.
We note, however, that the transmission of information via the internet is not completely secure. Although we do our best to protect your Personal Information, we cannot guarantee the security of information transmitted to or via the Services. Any transmission of personal information is at your own risk. We are not responsible for circumvention of any privacy settings or security measures contained on the Services. In addition, where you have chosen a password for access to certain parts of our Services, you are responsible for keeping this password confidential.
We will take steps to ensure that the Personal Data is accessed only by employees or authorized contractors or of Bridge or its affiliates that have a need to do so for the purposes described in this Privacy Policy.
07
Data Retention
How long we will hold your Personal Data for will vary and will be determined by the following cumulative criteria:
- the purpose for which we are using it – Bridge will need to keep your Personal Data for as long as is necessary for that purpose;
- as needed to deal with potential or actual legal claims, complaints, litigation or regulatory proceedings; and
- legal obligations – laws or regulation may set a minimum period for which Bridge has to keep your Personal Data.
08
Your Rights
8.1 In all the above cases in which we collect, use or store your Personal Data, you may have the following rights which you can exercise free of charge. These rights include:
- the right to obtain information regarding the processing of your Personal Data and access to the Personal Data which we hold about you;
- the right to withdraw your consent to the processing of your Personal Data at any time. Please note, however, that we may still be entitled to process your Personal Data if we have another legitimate reason for doing so. For example, we may need to retain Personal Data to comply with a legal obligation;
- in some circumstances, the right to receive some Personal Data in a structured, commonly used and machine-readable format and/or request that we transmit those data to a third party where this is technically feasible. Please note that this right only applies to Personal Data which you have provided directly to Bridge;
- the right to request that we rectify your Personal Data if it is inaccurate or incomplete;
- the right to request that we erase your Personal Data in certain circumstances. Please note that there may be circumstances where you ask us to erase your Personal Data, but we are legally entitled to retain it;
- the right to object to, or request that we restrict, our processing of your Personal Data in certain circumstances. Again, there may be circumstances where you object to, or ask us to restrict, our processing of your Personal Data but we are legally entitled to refuse that request; and
- the right to lodge a complaint with the relevant data protection regulator if you think that any of your rights have been infringed by us.
8.2 You can exercise your rights by contacting us using the details listed below. Further information about your rights may be obtained by contacting the supervisory data protection authority located in your jurisdiction. For a list of EEA data protection supervisory authorities and their contact details see here.
10
Automated Decision Making
10.1 Automated Decision Making Technologies
We may use automated decision-making technologies, including profiling, to process your personal data in certain circumstances. This means decisions are made by electronic systems without manual human review. We use automated decision making for the following types of operations:
- Identity verification (approving or rejecting users during KYC/KYB).
- Automated sanctions screening (blocking accounts or transactions involving sanctioned entities).
- Real-time transaction decisioning at the exact moment of authorization (including sufficient funds checks and fraud controls).
- Anti-Money laundering transaction monitoring that can flag or restrict accounts
10.2 Your Rights
When a decision is made solely by automated means, you have the following rights:
- Right to Explanation: You can request a detailed explanation of how your specific data was processed to reach a particular result.
- Right to Human Intervention: You have the right to request that a human staff member reviews the automated decision.
- Right to Contest: You may express your point of view and contest the decision
You can exercise these rights by contacting us at privacy@bridge.xyz.
11
Contact Us
If you have questions or concerns regarding, or a request to make pursuant to this Privacy Policy, please contact us by please contact us using the following contact details.
Address: Bridge Building S.A, Attn: Customer Service, 26, Boulevard Royal 2449 Luxembourg / Luxembourg
Email: privacy@bridge.xyz
12
Concerns and Complaints
12.1 Contact us: For further information regarding the processing of your Personal Data by Bridge, this Privacy Policy, questions relating to consent, or in order to exercise the rights mentioned above, please contact us using the details above.
12.2 Lodging complaints: We hope we will be able to resolve any issues you may have. You also have the right to lodge a complaint with:
a. our lead supervisory authority in the EEA, details of which are below:
Commission Nationale pour la Protection des Données
15, Boulevard du Jazz
L-4370 Belvaux
Tel. +352 2610 60 1
Fax +352 2610 60 6099
Email: info@cnpd.lu
Website: http://www.cnpd.lu/
or
b. a relevant data protection supervisory authority in the EEA state of your habitual residence, place of work or of an alleged infringement of data protection laws in the EEA. For a list of EEA data protection supervisory authorities and their contact details see here.
