Privacy Policy

Last Updated: 18 October 2026
‍
CapitalRock Legacy Limited (“CapitalRock”, “we”, “our”, or “us”) respects your privacy. This Privacy Policy explains how we collect, use, store and share personal information when you visit our website, use our client portal and digital tools, request or receive our services, or communicate with us.
‍
1. Information We Collect
Depending on your interactions with us, we may collect: Contact information: your name, email address, telephone number, country of residence and company details. Account information: information used to create and administer your portal account. Financial information: recorded assets, liabilities, holdings, income, expenditure, financial goals and assumptions you provide for illustrative scenarios. Documents and communications: documents you upload or submit, enquiries, correspondence and service-related communications. Identity information: identification details or documents where reasonably necessary for an explained onboarding or verification purpose. Technical information: IP addresses, browser and device details, login activity and website or portal usage.We indicate which information is required when collecting it. If required information is not provided, we may be unable to process your request or provide the relevant service.Please avoid submitting information about another person unless you are authorized to do so and have provided any necessary privacy information to them.
‍
2. How We Use Your Information
The information you provide enables us to: Respond to enquiries and arrange consultations. Process access requests, administer accounts and provide support. Organize financial information and prepare reports, descriptive analysis and illustrative scenarios within the agreed service scope. Operate, maintain and improve our website, portal and digital tools. Protect accounts, investigate technical issues and prevent misuse. Manage service agreements, payments and business records. Meet applicable legal obligations and handle complaints or disputes.
Where the necessary consent has been obtained, we may send newsletters, market insights and promotional updates. You can opt out at any time using the unsubscribe option provided or by contacting us.Opting out of marketing does not prevent essential account or service communications.
‍
3. Confidentiality
We treat personal financial information and circumstances with appropriate confidentiality.
Access is limited to authorized people and service providers who reasonably need the information for the purposes described in this policy, subject to appropriate confidentiality and security arrangements.
‍
4. Sharing Your Information
We do not sell, rent or trade your personal information. We may share information where reasonably necessary with service providers supporting our operations, including: Website and platform hosting providers. Database and document storage providers. Customer relationship management and communications providers. Payment processing providers. Technical support and security providers.
We may also disclose information to professional advisers or relevant authorities where necessary to meet legal obligations, protect legal rights or handle disputes.
We take reasonable steps to ensure that providers processing personal information on our behalf apply appropriate safeguards and use it for authorized purposes.
‍
5. AI-Assisted Features
Where you use AI-assisted features, your questions and information submitted to those features may be processed to generate explanations or responses. Where an external AI provider is involved, we will provide information about the relevant processing at or before collection, including the information shared and its intended use. Please avoid entering identity documents, account credentials or unnecessary personal information into AI features.

6. International Storage and Access
Personal information may be stored or processed outside Hong Kong through our service providers or accessed by authorized personnel working in other locations. These locations may have different data protection laws. Where information is handled internationally, we take reasonable steps to maintain appropriate protection through provider selection, contractual arrangements and access controls.

7. Data Security
We maintain reasonable technical and organisational safeguards designed to protect your personal information against unauthorised access, misuse, alteration, loss, or disclosure. While no method of electronic transmission or storage can guarantee absolute security, we continually review and enhance our security measures to help protect the information entrusted to us.

8. Data Retention
We retain personal information only for as long as reasonably necessary for the purposes described in this policy, including providing services, maintaining required business records, meeting legal obligations and resolving disputes. Retention depends on the type of information, the nature of our relationship and applicable requirements. Ending a trial or closing an account does not necessarily result in immediate deletion of all records. When information is no longer needed, we take reasonable steps to delete it securely or anonymize it. Copies held in backups may remain until removed through the applicable backup retention cycle.
‍
9. Cookies
Our website may use cookies and similar technologies to improve functionality, understand how visitors use our website, and enhance your browsing experience. You may disable cookies through your browser settings if you wish; however, certain features of the website may not function as intended.
‍
10. Your Rights
Depending on the laws applicable to your location, you may have the right to request access to your personal information, request correction of inaccurate information, request deletion of your information where appropriate, or withdraw your consent to receive marketing communications. Should you wish to exercise any of these rights, please contact us using the details provided below.
‍
11. Third-Party Links
For your convenience, our website may contain links to third-party websites. CapitalRock is not responsible for the privacy practices, policies, or content of external websites, and we encourage you to review their privacy policies before providing any personal information.
‍
12. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our business, legal obligations, or website functionality. Any updates will be published on this page together with the revised Last Updated date.