As a European company, it is obliged to comply with existing privacy laws (GDPR) in order to operate. The necessary income is obtained through the Ghostery Enterprise.
Similar to what Proton does, although Proton is OpenSource, they require revenue for the servers for the mail service and the VPN, but they offer these for free without ads or tracking in a reduced form, in mail with the storage limit and the VPN with a reduced number of servers (21 in 3 countries), financed with premium accounts.
There are many methods of creating income on the Internet and they are normally US companies that use the method of surveillance advertising, trafficking in user data, these practices are not used in the EU due to existing privacy regulations and even large corporations have to take care of them.
An example is comparing Microsoft's privacy in the US and the EU (where it is not perfect either but light years better)