Legal
Privacy Notice
Last updated: 12 May 2026
1. Introduction
SableRock S.à r.l. (“Sablerock”, “we”, “us”, “our”) is committed to protecting your personal data and respecting your privacy. This Privacy Notice explains what personal data we collect, why we collect it, how we use it, and the rights you have under the General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”) and the Luxembourg Data Protection Law of 1 August 2018.
This notice applies to visitors to sablerock.lu, prospective customers contacting us via the website or other channels, candidates applying for a position with Sablerock, newsletter subscribers, customers of Sablerock and their authorised users, and investors, partners, and service providers.
Not every processing activity described below is currently live. Depending on your relationship with Sablerock, only the activities relevant to that relationship will apply to you.
2. Data controller
The data controller for the personal data described in this notice is:
- SableRock S.à r.l.
- Registered office: 49, Boulevard Prince Henri, L-1724 Luxembourg
- RCS Luxembourg: B307697
- Email: info@sablerock.lu
We have not appointed a Data Protection Officer, as we are not currently required to do so under the GDPR. Privacy-related questions may be addressed to info@sablerock.lu.
3. What personal data we collect, and why
Depending on your relationship with us, we may process the following categories of personal data:
| Purpose | Data categories | Legal basis (GDPR Art. 6) | Retention |
|---|---|---|---|
| Browsing the website | Technical data: IP address, browser, OS, pages visited, timestamps, device identifiers | Legitimate interest (Art. 6(1)(f)) — operating the website, ensuring its security, and maintaining evidence of access | 12 months for security logs |
| Contact form / email enquiries | Identity, contact details, content of your message | Pre-contractual measures (Art. 6(1)(b)) and legitimate interest (Art. 6(1)(f)) — responding to enquiries and maintaining evidence of communications | 3 years from last contact |
| Career applications (where active) | Identity, CV, cover letter, qualifications, references | Pre-contractual measures (Art. 6(1)(b)); consent (Art. 6(1)(a)) for talent-pool retention | Up to 2 years if not hired (with consent) |
| Newsletter subscription (where active) | Email, name | Consent (Art. 6(1)(a)) | Until you unsubscribe |
| Customer relationship management | Identity, contact, professional details, contract data, transaction data | Performance of contract (Art. 6(1)(b)); legitimate interest (Art. 6(1)(f)) — managing prospects and the customer relationship, protecting our legal rights | Term of the contract + 10 years (Lux commercial-law retention) |
| AML / KYC obligations | Identity, beneficial ownership, sanctions and PEP screening, transaction monitoring data | Legal obligation (Art. 6(1)(c)) — AML Law of 12 November 2004, as amended | 5 years after end of business relationship (extendable by law) |
| Cookies | Device data | See Cookie Policy | See Cookie Policy |
| Investor relations (Sablerock’s own investors) | Identity, contact, professional and financial information of persons holding or considering an interest in Sablerock itself | Consent (Art. 6(1)(a)); legitimate interest (Art. 6(1)(f)) | 5 years after end of relationship |
4. Mandatory or optional personal data
Where we request personal data, we will indicate whether it is mandatory or optional. If you do not provide mandatory data, we may be unable to respond to your request, enter into a contract with you, provide our services, or comply with legal obligations such as AML/KYC requirements.
5. When Sablerock acts as a processor
In certain mandates, Sablerock acts as a processor on behalf of a customer (for example for AML/KYC, fund-operations support, or related services delivered to regulated counterparties). In those cases, Sablerock processes personal data only on documented instructions from the customer, under a written data-processing agreement. The relevant customer remains the data controller and is responsible for providing privacy information to the data subjects concerned, unless otherwise agreed.
6. Recipients of your data
We share personal data only with:
- our employees, on a strict need-to-know basis
- our service providers (hosting, IT support, accountant, legal counsel, marketing tools, KYC vendor) under written data-processing agreements
- regulatory authorities and courts when legally required (CSSF, CRF, tax administration, judicial authorities)
- professional advisors (lawyers, auditors, insurers) bound by confidentiality
We do not sell your personal data.
7. International transfers
We primarily process personal data within the European Economic Area (EEA). Where data is transferred outside the EEA, we ensure appropriate safeguards apply, in accordance with Articles 44 to 49 GDPR, including transfer to a country covered by an adequacy decision of the European Commission, Standard Contractual Clauses approved by the European Commission supplemented by additional measures where necessary, or other valid mechanisms.
Hosting in France. Our website is hosted by OVH SAS on infrastructure located in France, within the European Economic Area. No international transfer of personal data takes place in connection with the hosting of the website.
A copy of the safeguards in place can be obtained on request to info@sablerock.lu.
8. Your rights
Under the GDPR, you have the right to:
- Access your personal data and obtain a copy (Art. 15)
- Rectify inaccurate or incomplete data (Art. 16)
- Erase your data, also known as the right to be forgotten (Art. 17), subject to applicable retention obligations
- Restrict processing in certain cases (Art. 18)
- Object to processing based on legitimate interest (Art. 21)
- Receive your data in a portable format and transmit it to another controller (Art. 20)
- Withdraw consent at any time, where processing is based on consent (this does not affect the lawfulness of processing carried out before withdrawal)
- Lodge a complaint with the Luxembourg supervisory authority: Commission Nationale pour la Protection des Données (CNPD), 15, boulevard du Jazz, L-4370 Belvaux, cnpd.public.lu
To exercise any of these rights, contact us at info@sablerock.lu. We will respond within one month of receipt of your request, extendable by two further months for complex cases (we will inform you of any extension).
9. Automated decision-making
We do not currently engage in automated decision-making, including profiling, that produces legal effects or similarly significant effects on you.
10. Security
We implement appropriate technical and organisational measures, proportionate to the nature of the processing and the risks involved. These may include encryption in transit, access controls, authentication measures, audit logging, supplier due diligence, and staff awareness measures.
Despite these measures, no system is fully secure. Where a personal-data breach occurs that is likely to result in a risk to your rights, we will notify the CNPD within 72 hours of becoming aware of it, and notify you directly without undue delay where the risk is high.
11. Children
The website and our services are not directed to children under the age of 16. We do not knowingly collect personal data from children. If you believe we have collected data from a child, please contact info@sablerock.lu so we can remove it.
12. Updates
We may update this Privacy Notice from time to time. The most recent version is always available at sablerock.lu/privacy. The “Last updated” date at the top indicates when it was last revised. Material changes will be communicated by email to newsletter subscribers and customers, or by a banner on the website.
13. Contact
For any question about this Privacy Notice or about our processing of your personal data, please contact us at info@sablerock.lu.
Other legal pages