Privacy Policy

1. Who is responsible

Fractionalogic is a fractional leadership practice operated by E. Muralidharan, trading as Fractionalogic, based in Chennai, Tamil Nadu, India. For the website, business enquiries, partner applications, and our own business administration, that operator determines why and how personal information is used. It acts as controller or Data Fiduciary where those terms apply.

Privacy and grievance contact: Muralidharan Erumbala, Founder, Fractionalogic. Email: murali.e@fractionalogic.com, with the subject “Privacy request” or “Privacy grievance.”

You do not need to be a client, create an account, or subscribe to marketing to ask a privacy question or exercise a right.

2. What this Policy covers

This Policy explains how we handle personal information about website visitors, prospective and current client contacts, people requesting resources or conversations, applicants to the Twin Partner Network, professional collaborators, and other people communicating with our practice. It covers relevant website, email, telephone, professional-network, meeting, and offline interactions.

Personal information means information about an identified or identifiable person. Business contact details can be personal information even when used in a B2B context. Information irreversibly anonymized so that no person can reasonably be identified is not treated as personal information under this Policy.

Client-controlled data is different. If we access a client’s CRM, lead database, campaign platform, or employee information solely on that client’s documented instructions, the client ordinarily controls that processing and we act as its processor or service provider. The engagement agreement and any data processing agreement govern that work. Contact the client for its privacy notice and rights process; we will assist as required. We do not use client-controlled records for our own prospecting or unrelated marketing.

3. Information you give us

• Conversation requests: name, email address, company, professional role, country, preferred region, your message, and, optionally, how you found us. These details help us assess the enquiry and arrange a relevant conversation.
• Partner applications: name, email address, LinkedIn profile URL, primary function, working region, and information about your practice, experience, clients, and preferred mandates. Do not identify confidential clients or provide another person’s personal data without authority.
• Communications: messages, meeting arrangements, correspondence, and relevant notes from discussions. A telephone number is collected if you provide it or communicate with us by phone.
• Engagement administration: business contact details, authorized-signatory details, proposals, agreements, billing information, payment references, and records necessary to manage the relationship. The public enquiry form is not a payment channel.
• Resources and preferences: details you provide when requesting a resource or choosing to receive updates, together with subscription, consent, and opt-out records where relevant. Simply reading an ungated resource does not require you to provide contact details.

Fields identified as required are needed to handle that specific request. Optional information is voluntary. If you do not provide necessary details, we may be unable to respond, assess an application, or perform the requested work; you may still browse public content.

4. Technical information and other sources

When you visit, our hosting and infrastructure providers may process IP address, request date and time, requested pages, referring page where supplied, browser or device information, error information, and security-related records. This supports delivery, diagnostics, reliability, and abuse prevention. Where IP-derived location is processed, it is approximate, not precise GPS location.

This website is hosted on Vercel. Website forms are delivered to us by Web3Forms, and messages to our published email address are handled by our email service provider. A provider may process limited information for its own legal or security purposes under its own notice as well as providing services to us. Provider information: vercel.com/legal/privacy-notice and web3forms.com/privacy.

We may receive relevant professional information from a referral, a prospective client or partner, LinkedIn or another public professional source, or an event or meeting in which you participate. We limit this to information relevant to the relationship and record its source where appropriate. Public availability does not by itself authorize unrelated use or unrestricted marketing.

Where the law requires notice for indirectly obtained information, we will provide this Policy and relevant context within the required period, including at first contact, before disclosure, or within one month where those rules apply, subject to lawful exceptions.

5. Information we do not request

Do not submit government identifiers, passwords, bank-login details, full payment-card data, health records, biometric data, precise location, or sensitive information about another person through a public form. Our ordinary website enquiries and partner applications do not require such information.

If a particular engagement genuinely requires sensitive or specially protected data, we will agree the purpose, lawful basis, secure channel, access restrictions, retention, and any additional notice or consent before that processing. A general website enquiry is not authorization for that activity.

6. Why we use information

“Legitimate interests” applies only where the relevant law recognizes it and the processing is necessary, proportionate, and not overridden by your rights. We assess the interests involved; it is not permission to ignore a consent requirement. A contract with your employer does not automatically make contractual necessity the lawful basis for all of your personal information.

For India, where applicable and in force, we rely on consent or a specifically permitted legitimate use under the DPDP Act, and on other lawful requirements as relevant. We do not treat GDPR “legitimate interests” as a general substitute for an Indian-law basis. A new incompatible purpose requires an appropriate basis and notice before it begins.

7. Marketing choices

Requesting a conversation, downloading a resource, or applying to the partner roster does not automatically subscribe you to a newsletter or authorize a partner to market to you. We distinguish replies about your request and essential engagement messages from optional promotional messages.

Where consent is required, we ask separately, do not pre-tick the choice, and identify the communication channel and purpose. Where local law permits relevant B2B outreach without prior consent, we use only an appropriate lawful basis and honour opt-outs. We do not assume that every professional email address belongs to an incorporated business rather than a sole trader.

You can stop promotional emails through the unsubscribe facility where provided or by emailing murali.e@fractionalogic.com with “Unsubscribe.” You can also withdraw a particular marketing permission or object to direct marketing at any time. We will stop the relevant marketing and keep only a minimal suppression record where necessary to respect your choice. Essential replies and contracted-service communications may continue where lawful.

8. Cookies, analytics, and advertising

Cookies and similar technologies can store or access information on your device. We distinguish technologies necessary for a service you request from optional analytics, embedded media, or advertising features. Technical server logs do not necessarily involve a cookie.

We do not use advertising pixels or personal information for cross-context behavioural advertising or targeted-advertising audiences under this Policy. If that changes, we will assess the legal requirements, update the notice, and implement any necessary controls before the activity starts. We do not treat continued browsing or acceptance of our Terms as consent to optional tracking.

Where an optional technology is offered, we will explain its provider, purpose, duration, and choice through the relevant notice or settings, and obtain consent before use wherever required. Rejecting optional technology must not prevent ordinary access to public content. Consent can be changed or withdrawn through the relevant settings, or by contacting us; browser deletion alone may not communicate withdrawal to every provider.

Following a normal external link, such as to LinkedIn, takes you to the external service. If an embedded third-party service would access your device before you visit that service, we will apply the relevant notice and choice requirements before loading it. No general cookie-consent banner is a substitute for an accurate technology inventory.

9. Who receives information

• Authorized people within the practice: the founder and properly authorized associates with a genuine need to handle your enquiry, application, engagement, or administration, subject to suitable confidentiality obligations.
• Service providers: hosting and infrastructure providers, email and business-communication providers, and any specifically selected form, scheduling, document, CRM, billing, or professional-support providers needed for the relevant activity. These providers receive only what is necessary and are subject to appropriate terms where they act for us.
• Delivery partners: a relevant Twin Partner Network professional or strategic collaborator, including Magic Pencils where its instruments are used, only when appropriate to an enquiry or agreed engagement, with a lawful basis and an explanation of the role. We do not circulate every enquiry to the full roster.
• Professional advisers and authorities: legal, tax, accounting, insurance, regulatory, or law-enforcement recipients where necessary, proportionate, and lawful, including to meet a binding requirement or address a genuine legal claim.
• A business successor: only where a proposed transfer or reorganization of the practice requires it, subject to appropriate confidentiality, limited access, and continued protection. We will give notice where required and will not use a transaction to bypass existing privacy rights.

We do not sell personal information, rent contact lists, or disclose personal information for cross-context behavioural advertising. A necessary service-provider disclosure is not permission for that provider to use your information for unrelated marketing. When an independent partner determines its own purposes, we will explain that role and direct you to its notice where appropriate. If joint-controller rules apply, we will establish the required arrangement and explain its essential terms.

Partner applicants’ profiles are not published just because they apply. Permission and any profile-publication terms are addressed separately.

10. International handling

Our practice is based in India, and information may be accessed there. Depending on the provider or engagement, information may also be processed in countries where an authorized provider or professional operates. This may include the United States and countries in APAC, the Middle East, or Europe. We do not promise that every record stays in one country or that all countries have equivalent privacy laws.

Where international-transfer requirements apply, we use a lawful mechanism before a restricted transfer. Depending on the relevant law and destination, this may be an adequacy decision, approved contractual safeguards such as the EU Standard Contractual Clauses, the UK International Data Transfer Agreement or UK Addendum, or another lawfully available mechanism. We assess any required supplementary safeguards rather than treating a policy reference as an executed transfer agreement.

Transfers from India are subject to applicable restrictions and continuing requirements, including any relevant sector rules. We do not rely on your website visit or acceptance of the Terms as blanket consent to international transfers. Contact us for information about relevant recipient locations and safeguards, and a copy or summary of applicable safeguards subject to lawful redactions.

11. How long we keep information

We keep personal information only for as long as reasonably necessary for the disclosed purpose, a justified continuing relationship, or a legal requirement. We review retention and do not keep a prospect or application file indefinitely merely because it may be useful someday.

A legal hold or binding statutory retention obligation may require us to preserve limited records after a relationship ends or erasure is requested. We restrict their use accordingly. When retention ends, we delete or irreversibly anonymize information, or isolate it securely pending scheduled backup deletion. We will explain a material retention exception when responding to an affected request, where required.

12. Security and incident response

We use reasonable technical and organizational safeguards appropriate to the information and risks, including controlled access, suitable authentication, secure transfer methods, confidentiality measures, and proportionate provider review. Access is limited to people who need it for the relevant purpose. No website, email system, or transmission method can be guaranteed completely secure.

If a personal-data incident occurs, we will assess it, take appropriate containment and remedial steps, and notify affected people, clients, and authorities where and when required by applicable law or contract. We do not promise that every incident has the same notification threshold or deadline worldwide. Report a suspected issue to murali.e@fractionalogic.com without sending unnecessary sensitive data.

13. AI tools, recordings, and automated decisions

Where AI tools are used in work involving personal information, we limit the information to what is necessary, assess the provider and settings, and apply an appropriate lawful basis and safeguards. We do not put identifiable enquiry or application data, or client-confidential material, into public/general-purpose AI services for unrestricted use or model training. Client-controlled data is used only within the client’s authorized instructions and agreed safeguards.

We do not make decisions producing legal or similarly significant effects about you solely by automated processing under this Policy. Commercial fit and partner selection remain subject to human judgment. If a future activity changes this position, we will explain it and provide any required rights and safeguards before it begins.

We do not record or transcribe a meeting merely because you contact us. If recording, AI note-taking, or transcription is proposed, we will tell participants beforehand, explain the purpose and handling, obtain any required permission, and offer an appropriate alternative where practicable.

14. Your rights and how to ask

Depending on applicable law and its commencement, you may request access to information, correction, completion or updating, deletion, restriction, portability, or an explanation of relevant processing. You may withdraw consent, object to permitted grounds of processing, and object to direct marketing. Some laws also provide nomination, authorized-agent, appeal, or other specific rights.

Email murali.e@fractionalogic.com with the request and enough context to locate your interaction, such as the email address used for an enquiry. Tell us which right you wish to exercise; legal terminology is not required. We may ask for proportionate verification or evidence of an agent’s authority, but will not request excessive identity documents or make you open an account.

We respond without undue delay and within the applicable legal period. For EU/UK requests, this is ordinarily one month, with a lawful extension where permitted and explained. For applicable US-state requests, the period is commonly 45 days, subject to the particular law and any permitted extension. For California requests to know, correct, or delete, where the CCPA applies, we confirm receipt within 10 business days and ordinarily give a substantive response within 45 calendar days, with any permitted extension explained. Different requests, including advertising opt-outs, can have shorter deadlines. We will explain any lawful refusal, limitation, fee, or extension and the available review or complaint route.

Withdrawal does not invalidate earlier lawful processing. We may continue limited processing where a different valid legal basis requires or permits it, for example a mandatory record. We will not discriminate or retaliate against you for exercising a protected right.

15. Regional provisions

India. We will handle personal information under the Indian requirements that apply at the relevant time, including the IT Act and SPDI Rules where applicable and the DPDP Act and Rules as their provisions commence. Once applicable, relevant DPDP rights include access to a summary of processing and specified sharing information, correction, completion, updating, erasure, grievance redressal, withdrawal of consent, and nomination of another person to exercise rights in the circumstances provided by law. Contact the named privacy and grievance contact to make a request. This Policy does not represent uncommenced statutory rights as already enforceable.

EU/EEA and UK. Where the EU GDPR or UK GDPR applies, the purposes and lawful grounds are described in Section 6, recipients in Section 9, transfers in Section 10, and retention in Section 11. You may complain to the competent supervisory authority, including the authority where you live or work or where an alleged infringement occurred, and to the UK Information Commissioner where relevant. You do not have to complain to us first where the law permits a direct complaint. UK regulator information: ico.org.uk/make-a-complaint/.

United States. State privacy statutes differ in coverage, thresholds, and exemptions; some exclude certain business-contact data. Where a statute applies to your interaction and our processing, applicable rights may include knowing or accessing information, correction, deletion, portability, opting out of sale, targeted advertising or specified profiling, and an appeal against a refusal. California rights, where applicable, also include limiting certain uses of sensitive personal information and using an authorized agent. We do not use sensitive personal information for purposes that require a California limitation mechanism under this Policy.

US category disclosure. The categories addressed by this Policy are identifiers (for example name, email and IP address), professional or employment-related information (such as role, function and professional profile), commercial relationship records (such as requests, proposals and billing), internet or network information (such as request and security logs), and information you include in correspondence. Sources are you, relevant professional or referral sources, and technical service providers. Purposes are listed in Section 6; business-purpose recipients are listed in Section 9; retention criteria are in Section 11. For the twelve months preceding this Policy’s last-updated date, the applicable categories are those listed above that were collected through the activities described in Sections 3 and 4. The relevant categories may be disclosed for the business purposes in Section 6 to the recipient categories in Section 9, subject to the stated safeguards. We do not sell or share these categories for cross-context behavioural advertising or use them for targeted-advertising audiences.

US choices. Submit a request or appeal to murali.e@fractionalogic.com; for an appeal, state “Privacy appeal” and identify the original decision. We will provide the response and further complaint options within the period the applicable law requires. Where legally required and relevant to an activity we undertake, we honour recognized universal opt-out signals such as Global Privacy Control. A general “Do Not Track” setting is not the same as every legally recognized opt-out signal. The absence of a sale or targeted-advertising activity does not remove other rights that apply.

Singapore. Where the Singapore PDPA applies, you may request access and correction and withdraw consent, subject to applicable exceptions and consequences that we will explain. Overseas transfers require the applicable comparable-protection safeguards. The law treats qualifying business contact information differently; that does not make every record about a professional exempt. Contact our privacy contact first; unresolved matters may be referred to the Personal Data Protection Commission at www.pdpc.gov.sg/.

Australia. Where the Australian Privacy Act and Australian Privacy Principles apply, you may request access and correction and complain to us about our handling of your information. Allow a reasonable opportunity for us to respond, ordinarily 30 days; unresolved matters may be raised with the Office of the Australian Information Commissioner at www.oaic.gov.au/privacy/privacy-complaints. Likely overseas recipient locations must be identified as specifically as practicable, and applicable cross-border safeguards remain our responsibility unless a lawful exception applies.

United Arab Emirates. Where the UAE federal personal-data law applies, relevant rights can include access, correction, erasure, restriction, and objection subject to statutory conditions. Contact us to identify the applicable route. A separate framework may apply where the interaction falls within a financial free zone such as DIFC; the existence of UAE-based contact details does not make every framework apply. We will assess the applicable regime and transfer requirements rather than assuming that a single Middle East rule covers every engagement.

Other regions. If privacy law in an APAC, Middle Eastern, or other jurisdiction applies, we will honour the relevant notice, consent or other lawful-basis, transfer, security, access, correction, withdrawal, and complaint obligations. Rights are not identical everywhere, and providing a global website does not establish that every overseas law applies to every visitor. Mandatory local protections prevail over any inconsistent wording in this Policy.

16. Questions and grievances

Please contact Muralidharan Erumbala at murali.e@fractionalogic.com with “Privacy grievance” and describe the concern. We acknowledge promptly, and in any event within 30 days where UK complaint-handling requirements apply. We investigate without undue delay, keep you informed, and aim to address grievances within one month, or within a shorter period if applicable law requires. If an issue cannot be fully resolved in that time, we will explain the position and any lawful next steps; an update does not replace a binding deadline.

Where an Indian-law complaint route requires first using our grievance mechanism, please do so. Once the relevant DPDP provisions and complaint process apply, you may escalate an unresolved matter to the Data Protection Board of India in accordance with that process. This does not delay another regulator complaint or legal remedy available under applicable law.

17. Children and third-party services

Our website enquiries and professional services are intended for adults, not children under 18. We do not knowingly seek personal information from children through the public website. If you believe a child has provided information, tell us so that we can assess the position and delete or otherwise handle it as required by law. An age statement is not a substitute for additional safeguards if an activity actually involves children.

External sites and independently operated partner platforms have their own privacy practices. Review their notices before giving them information. Linking to a service does not authorize it to collect information through our website without any notice or choice required by law.

18. Changes to this Policy

We will post an updated Policy and revision date when our practices change. For material changes, we will give additional notice where appropriate and obtain fresh consent before a new use where required. Continuing to browse does not amount to consent to a new processing purpose. Earlier information will not be used inconsistently with applicable law or an existing valid commitment.