How we handle your personal data
What personal data Fractional collects in Kuala Lumpur, what we do with it, who we share it with, and the rights you have under Malaysia PDPA.
Last updated: 21 August 2026This policy describes our privacy practices in plain terms. It is not legal advice, and it does not replace the terms of any engagement you have with us. If you have a specific question about your data, write to hello@fractional-global.com and a person will answer it.
Who we are and what this covers
Fractional Global L.L.C.F.Zis a free-zone company registered in the United Arab Emirates (“Fractional”, “we”, “us” or “our”). We are the controller of the personal data described here, which means we decide what is collected and why.
This policy applies to this website, to enquiries and applications you send us from it, to our events in Kuala Lumpur, and to the email we send you. It is the same policy we publish on every Fractional site; section 8 sets out your rights under Malaysia PDPA, which is the law that applies to visitors in Malaysia.
Contact us about anything in this policy at hello@fractional-global.com.
The personal data we collect
We collect only what we need to answer you and to run the service. Depending on how you deal with us, that is:
- What you tell us. Your name, work email, phone number, company, website, role, the leadership need or the experience you describe, and anything else you choose to put in a form or a message.
- What you send us. CVs, supporting documents and attachments, where you are applying to join the collective or responding to a mandate.
- Our record of dealing with you. Messages, call and meeting notes, the status of your enquiry or application, and the assessment notes and scores we record against it.
- Technical data. IP address, approximate country derived from it, device and browser, the pages you view and how you reached them.
- Publicly available professional information. Company and professional information from public sources, used to research a company or to complete a profile. We do not buy personal data from data brokers.
We do not ask for special-category or sensitive data, and you should not send it to us. If you tell us about an access or dietary requirement for an event, we use it only to run that event and delete it afterwards.
What we do with it, and why
Each row below is a separate activity, with the data it uses, the reason we are allowed to do it, and how long the records last. Where a law requires us to name a lawful basis, this is the basis we rely on.
| Activity | What it uses | Why | Lawful basis | How long |
|---|---|---|---|---|
| Client enquiries and leadsPeople who contact us about hiring a fractional executive. | Name, work email, phone, company, website, role, the leadership need you describe, budget and timing indications, the page you enquired from, and our correspondence with you. | To answer your enquiry, qualify the requirement, introduce you to the right people, and keep a record of what was discussed. | Steps taken at your request before entering a contract, and our legitimate interest in running and recording a business-to-business sales process. | For the life of the relationship, and for up to six years after the last contact so we can meet accounting and limitation-period obligations. Enquiries that go nowhere are reviewed and cleared sooner. |
| Executive applications and the collectiveExecutives applying to join the Fractional collective. | Your application answers, CV and supporting documents, career history, sector and functional experience, day rate and availability, city, referees where you give them, and the assessment notes and scores we record. | To assess your application, build your profile, put you forward for mandates that fit, and manage your membership of the collective. | Steps taken at your request before entering a contract, our legitimate interest in operating an executive search business, and your consent where you ask to stay on file for future roles. | For as long as you are a member of the collective, and for up to two years after your last activity if you are not placed, so we can consider you for later mandates. You can ask us to remove you at any time. |
| Matching, scoring and client briefsExecutives in the collective, and the clients they are matched to. | Profile and application data, structured scores against a mandate, the reasons recorded for a score, shortlist status, and the notes that go into a client brief. | To shortlist executives against a client requirement and to produce the brief a client receives. | Our legitimate interest, and the interest of both sides, in matching a mandate to suitable candidates accurately and consistently. | Scoring records are kept for the life of the mandate and archived with it, so a decision can be explained after the fact. |
| Automated assistance in matching and researchExecutives, client contacts and companies. | Application text, public professional information about a company or executive, and the mandate description. | We use AI services to summarise applications, draft first-pass scores and reasons, extract company information from public sources, and prepare research. Outputs are decision support only. | Our legitimate interest in assessing a large volume of applications consistently and quickly. | Generated summaries and scores are stored with the record they belong to. No decision that materially affects you is made by automated means alone: a person reviews and decides. |
| Events, registration and ticketingPeople who register for or attend a Fractional event. | Name, email, company, role, dietary or access requirements you tell us, registration and check-in records, and where an event is paid, the payment reference held by our payment processor. | To register you, admit you on the day, send joining details and follow-ups, and run the event. | Performance of the ticket or registration terms, and our legitimate interest in running and improving our events programme. | Registration records are kept for up to three years after the event. Payment records are kept for the period our accounting obligations require. |
| Email updates and broadcastsSubscribers, event registrants and business contacts. | Email address, name, city, the lists and segments you belong to, and delivery and engagement records such as delivery, open and click events. | To send you the updates, invitations and insights you asked for, and to see whether they are working. | Your consent, or our legitimate interest in business-to-business marketing to relevant professional contacts where the law allows it. | Until you unsubscribe, plus a suppression record kept indefinitely so we do not email you again by mistake. |
| Website and product analyticsVisitors to our websites and the applicant portal. | Pages viewed, referrer, approximate location derived from IP, device and browser type, and an analytics identifier stored in your browser. | To understand how the sites are used so we can improve them, and to measure which channels bring people to us. | Your consent where consent is required for non-essential cookies and analytics. Where it is not required, our legitimate interest in measuring and improving our own websites. | Analytics records are retained by our analytics providers on a rolling basis, currently no more than 26 months for Google Analytics and no more than 12 months for product analytics. |
| Engagements, invoicing and paymentsClient contacts and engaged executives. | Engagement terms, contacts, invoices, payment status and the records our payment processor returns to us. | To run an engagement, invoice for it, get paid, and keep our books. | Performance of a contract, and compliance with our legal, tax and accounting obligations. | Financial records are kept for the period required by UAE and free-zone accounting law, currently at least five years. |
| Security, logs and abuse preventionEveryone who reaches our systems. | Request logs, IP addresses, error reports, and records of blocked or suspicious requests. | To keep the service available, investigate faults, and detect and block abuse such as scanning and spam. | Our legitimate interest in the security and integrity of our systems, and our legal obligation to protect the data we hold. | Operational logs are kept for a short rolling window, typically no more than 30 days, unless retained longer for a specific investigation. |
Automated decisions
We use AI to summarise applications, draft first-pass scores and prepare research. Those outputs are decision support: no decision that materially affects you, including whether you join the collective or are put forward for a mandate, is made by automated means alone. A person reviews and decides, and you can ask us to explain a decision.
Who we share it with
We do not sell your personal data, and we do not share it for anyone else’s advertising. We share it only where the work requires it:
- Members of the collective. Where we are matching your requirement to executives, the relevant executives see what they need to consider it. Where you are an executive, a client sees the profile and brief we prepare for the mandate you are put forward for.
- Our suppliers. The companies listed in the next section, which process data on our instructions and under contract, and may not use it for their own purposes.
- Professional advisers. Our lawyers, accountants and auditors, where they need it to advise us.
- Authorities. Where the law requires it, or to establish, exercise or defend a legal claim.
- A successor. A buyer or successor entity in a merger, acquisition or reorganisation, on terms no less protective than this policy.
The suppliers who process data for us
These are the companies that handle personal data on our behalf. They act on our instructions, are bound by contract, and are reviewed before we use them.
| Supplier | What they do for us | Where they process it |
|---|---|---|
| Vercel | Website and application hosting, file storage, and traffic analytics. | United States and global edge network |
| MongoDB Atlas | The primary database behind the service. | Cloud regions we select, currently in the European Union |
| Neon | The database behind our email delivery analytics. | European Union |
| Resend | Sending and delivery tracking of transactional and marketing email. | United States and European Union |
| PostHog | Product analytics on our websites and portal. | European Union |
| Google Analytics | Website traffic measurement. | United States and global |
| OpenAI and Google | AI models used for summarising, scoring and research support. Our business data is not used to train their models. | United States and global |
| Apify | Collection of publicly available company and professional information used in research. | European Union and United States |
| Attio | Customer relationship management for client and lead records. | United States and European Union |
| Stripe | Payment processing for paid events and invoices. | United States, European Union and global |
International transfers
We run one platform across many countries, and several of our suppliers are outside Malaysia. That means your personal data may be processed outside your own country.
Transfers outside Malaysia are made where the destination provides protection substantially similar to the PDPA, or with your consent.
Whatever the route, the protection travels with the data: transfers happen under written terms that hold the recipient to standards equivalent to those described in this policy, and you can ask us which safeguard applies to a particular transfer.
Cookies and analytics
We use a small number of cookies and similar technologies. The full list, what each one does, and how long it lasts are set out in our Cookie Policy.
We show a consent banner to visitors in the United Kingdom, the European Union and the rest of the European Economic Area, and there nothing in the analytics category loads until you accept. Everywhere else analytics loads by default. Declining, or switching it off later, costs you nothing either way: nothing on these sites depends on analytics.
We do not use anything we set for advertising, and we do not share it with advertising networks.
Either way, you can change your choice whenever you like, from the “Cookie preferences” link in the footer of any page. Your choice is stored in your own browser, so it is per browser and per device.
Your rights in Malaysia
This site serves Malaysia, so the law that applies to you is the Personal Data Protection Act 2010, as amended. Under it, and subject to the limits the law itself sets, you can ask us to:
- Give you a copy of the personal data we hold about you, and tell you what we do with it.
- Correct anything that is wrong, out of date or incomplete.
- Delete your data, where we have no overriding reason or legal duty to keep it.
- Stop using your data for marketing, at any time and without giving a reason.
- Withdraw consent you have given, without affecting what we did lawfully before you withdrew it.
- Under Malaysia PDPA: withdraw consent to processing by written notice
- Under Malaysia PDPA: require us to stop processing your personal data for direct-marketing purposes
- Under Malaysia PDPA: request data portability where the portability provisions apply
To exercise any of these, write to hello@fractional-global.com. We answer within the period the law sets, and within 30 days where it sets none. We may need to check who you are first, and we will not charge you for a reasonable request.
If you are not satisfied with how we handle it, you can complain to the Personal Data Protection Commissioner (JPDP). We would rather you came to us first so we can put it right.
How long we keep data
The retention period for each activity is in the table in section 3. As a general rule we keep personal data for as long as we are dealing with you, then for as long as we need it to meet a legal, tax or accounting duty or to defend a claim, and then we delete or anonymise it. Suppression records, which exist so we do not contact someone who asked us not to, are the deliberate exception: those we keep.
How we protect data
Access to personal data is limited to the people who need it, and the operations console enforces that by capability and by city rather than by trust. Data is encrypted in transit, held with the suppliers listed in section 5, and administrative surfaces are separated from the public sites. No system is perfectly secure, but we keep safeguards proportionate to the sensitivity of what we hold, and we will tell you and the relevant regulator about a breach where the law requires it.
Children
Our sites and our service are for business and professional audiences. They are not directed at children, and we do not knowingly collect data from anyone under 18. If you think a child has given us personal data, tell us and we will remove it.
Changes to this policy
When we change this policy we update the “Last updated” date at the top of this page. Where a change affects what you have agreed to, we ask again rather than assuming: the cookie banner reappears when the terms of consent change, not only when your browser storage is cleared.
Our Terms of Service cover your use of the website itself.
How to contact us
Write to Fractional Global L.L.C.F.Z at hello@fractional-global.com. Mark a data-protection request as such in the subject line and it will be routed to the right person.