Legal & Compliance

Privacy Policy

EXLPRS LLP  ·  Effective Date: 01 March 2025  ·  Last Updated: 25 May 2026

1. Introduction

Welcome to EXLPRS LLP ("EXLPRS", "we", "our", or "us"). We are a Performance Systems Architecture consultancy incorporated in Hyderabad, Telangana, India, providing leadership development, AI-powered capability diagnostics, and organisational transformation services to enterprises worldwide.

This Privacy Policy explains how we collect, use, store, disclose, and protect personal data when you visit exlprs.com (the "Site"), engage our services, or otherwise interact with us. It applies to all visitors, clients, prospective clients, and newsletter subscribers.

This policy is designed to comply with the EU General Data Protection Regulation (GDPR), the Digital Personal Data Protection Act 2023 (DPDPA) of India, and the California Consumer Privacy Act (CCPA) / CPRA. Where requirements differ across jurisdictions, we apply the standard most protective of your rights.

By using our Site or services, you acknowledge that you have read and understood this policy. If you do not agree, please discontinue use of our Site. We may update this policy periodically; material changes will be notified via a banner on the Site or by email where we hold your contact details.

2. Data We Collect

We collect personal data in the following categories:

2.1 Data You Provide Directly

2.2 Data Collected Automatically

2.3 Data from Third Parties

2.4 Special Categories of Data

We do not intentionally collect sensitive or special-category personal data (including health information, racial or ethnic origin, political opinions, religious beliefs, biometric data, or financial account details). If you inadvertently provide such data, we will delete it promptly upon discovery.

3. How We Use Your Data

We use personal data only for the purposes described in this policy. The table below summarises our principal processing activities:

Purpose Data Used Legal Basis
Respond to discovery enquiries and service requests Contact info, form responses, communications Contract / Legitimate interest
Deliver consulting, coaching, and capability programmes All data relevant to the engagement Contract performance
Send newsletters, insights, and thought-leadership content Email address, name, preferences Consent
Personalise website content and recommendations Usage data, cookies, form inputs Consent / Legitimate interest
Analytics — understand Site usage and improve it Anonymised usage & technical data Legitimate interest
Security — detect fraud, abuse, and technical threats IP address, device data, usage anomalies Legitimate interest / Legal obligation
Comply with legal obligations (tax, regulatory, court orders) Any relevant data Legal obligation
Invoice and payment administration Name, address, email, engagement details Contract / Legal obligation

We do not sell your personal data to third parties, use it for automated profiling that produces legal or similarly significant effects, or use it for any purpose incompatible with the purposes listed above without your prior consent.

5. Data Retention

We retain personal data only for as long as necessary for the purposes set out in this policy, or as required by law. Our general retention schedule is:

Data Category Retention Period Reason
Website enquiry & form data (no engagement followed) 24 months from last contact Legitimate interest in following up
Client engagement records 7 years from end of engagement Legal / tax obligation (India)
Invoice and financial records 8 years Companies Act / GST compliance
Newsletter subscribers Until unsubscribe, or 3 years of inactivity Consent-based
Analytics data (anonymised) 26 months (Google Analytics 4 default) Site improvement
Security logs 12 months Security incident investigation

When data is no longer required, we securely delete or anonymise it. Where data is held by third-party processors, we request deletion in accordance with our data processing agreements.

6. Sharing with Third Parties

We do not sell, rent, or trade your personal data. We share data only in the following circumstances:

6.1 Service Providers (Data Processors)

We engage trusted third-party service providers who process data on our behalf, under written data processing agreements, and only as instructed by us:

6.2 Professional Advisors

We may share limited data with our lawyers, accountants, or auditors where necessary for the provision of professional services to EXLPRS. These advisors are bound by confidentiality obligations.

6.3 Legal Requirements

We may disclose data when required by applicable law, regulation, court order, or governmental authority, or where we believe disclosure is necessary to protect the rights, property, or safety of EXLPRS, our clients, or the public.

6.4 Business Transfers

In the event of a merger, acquisition, or sale of assets, personal data may be transferred as part of the transaction. We will notify you before your data is transferred and becomes subject to a different privacy policy.

6.5 International Transfers

As a company based in India serving global clients, data may be transferred to and processed in countries outside your country of residence, including India, the United States, and the EEA. Where we transfer EEA/UK personal data outside those regions, we rely on appropriate safeguards including Standard Contractual Clauses (SCCs) or adequacy decisions. You may request a copy of the relevant safeguards by contacting privacy@exlprs.com.

7. Your Rights

Depending on your jurisdiction, you have the following rights regarding your personal data. We will respond to verifiable requests within the timeframes required by applicable law (generally 30 days, extendable to 90 days for complex requests).

Right of Access

Request a copy of the personal data we hold about you and information on how we process it. (GDPR Art. 15 / DPDPA / CCPA)

Right to Rectification

Request correction of inaccurate or incomplete personal data we hold. (GDPR Art. 16 / DPDPA)

Right to Erasure

Request deletion of your personal data where it is no longer necessary, or where you withdraw consent. (GDPR Art. 17 / DPDPA / CCPA "Right to Delete")

Right to Restriction

Request that we restrict processing of your data in certain defined circumstances. (GDPR Art. 18)

Right to Portability

Receive your data in a structured, commonly used, machine-readable format. (GDPR Art. 20 / CCPA)

Right to Object

Object to processing based on legitimate interests or for direct marketing at any time. (GDPR Art. 21)

Right to Withdraw Consent

Withdraw consent at any time where processing relies on consent, without affecting the lawfulness of prior processing. (GDPR / DPDPA)

Right to Non-Discrimination

We will not discriminate against you for exercising any privacy right. (CCPA / CPRA)

Right to Nominate (DPDPA)

As a Data Principal under Indian law, you may nominate another individual to exercise your rights in the event of death or incapacity.

Opt-Out of Sale / Sharing

California residents: we do not sell or share personal data for cross-context behavioural advertising. No opt-out action is required.

How to Exercise Your Rights

Email us at privacy@exlprs.com with the subject line "Privacy Rights Request". Include sufficient information to verify your identity. We may request additional verification to protect against unauthorised access. There is no fee for most requests; however, we may charge a reasonable fee for manifestly unfounded or excessive requests.

Right to Lodge a Complaint

If you believe we have not handled your personal data in accordance with applicable law, you have the right to lodge a complaint with the relevant supervisory authority:

We would, however, appreciate the opportunity to address your concerns directly before you escalate to a regulatory body.

9. DMCA Policy

EXLPRS LLP respects intellectual property rights and expects all users and visitors to do the same. In accordance with the Digital Millennium Copyright Act (DMCA), we have designated a registered DMCA Agent and will respond expeditiously to valid takedown notices.

9.1 Designated DMCA Agent

DMCA Agent Registration ID: DMCA-1073295
Organisation: EXLPRS LLP
Email: legal@exlprs.com
Subject Line: DMCA Takedown Notice
Postal Address: EXLPRS LLP, Hyderabad, Telangana, India

9.2 Filing a Takedown Notice

If you believe that material on our Site infringes your copyright, send a written notice to our DMCA Agent at legal@exlprs.com containing the following information as required by 17 U.S.C. § 512(c)(3):

  1. A physical or electronic signature of the copyright owner or their authorised representative.
  2. Identification of the copyrighted work claimed to have been infringed, or if multiple works are covered, a representative list of such works.
  3. Identification of the infringing material with sufficient detail (URL, description) for us to locate it.
  4. Your contact information: name, address, telephone number, and email address.
  5. A statement that you have a good-faith belief that the disputed use is not authorised by the copyright owner, its agent, or the law.
  6. A statement, under penalty of perjury, that the information in the notice is accurate and that you are the copyright owner or authorised to act on their behalf.

9.3 Counter-Notification

If you believe that material you posted was removed by mistake or misidentification, you may file a counter-notification with our DMCA Agent at legal@exlprs.com. A valid counter-notification must comply with 17 U.S.C. § 512(g)(3) and must include: your physical or electronic signature; identification of the removed material and its prior location; a statement under penalty of perjury that the removal was erroneous; your name, address, and telephone number; and consent to jurisdiction of the appropriate federal court.

9.4 Repeat Infringer Policy

We will, in appropriate circumstances and at our sole discretion, terminate access to the Site for users who are determined to be repeat infringers of intellectual property rights.

9.5 EXLPRS Intellectual Property

All content on this Site — including the EXLPRS name, logo, frameworks, methodologies, written content, case studies, whitepapers, and visual design — is the intellectual property of EXLPRS LLP and is protected by copyright, trademark, and other applicable laws. Unauthorised reproduction, distribution, or derivative use is strictly prohibited. To seek a licence, contact legal@exlprs.com.

10. Data Deletion Request

You have the right to request deletion of your personal data from our systems. We will honour verifiable deletion requests, subject to our legal obligations to retain certain data (for example, financial records required by Indian tax law, or data relevant to a pending legal matter).

Upon a valid and verified request, we will:

  1. Verify your identity to prevent unauthorised deletion.
  2. Identify all personal data we hold relating to you across our systems and sub-processors.
  3. Permanently delete or securely anonymise that data within 30 days (or as required by applicable law).
  4. Instruct our third-party processors to delete your data pursuant to their respective data processing agreements.
  5. Confirm completion of the deletion in writing to the email address you provide.

Important: Submitting a deletion request will remove you from our client database, newsletter lists, and marketing communications. If you are a current client with an active engagement, full deletion may not be possible until the engagement concludes and applicable retention periods have elapsed.

Submit a Data Deletion Request

Click the button below to send a deletion request to our privacy team. Please include your full name and the email address(es) associated with your interactions with EXLPRS.

Request Data Deletion →

11. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us using the details below. We aim to respond to all enquiries within 5 business days and will resolve matters within the timeframes required by applicable law.

Privacy & Data Protection
EXLPRS LLP
Hyderabad, Telangana, India

Privacy enquiries: privacy@exlprs.com
Legal / DMCA matters: legal@exlprs.com
Website: exlprs.com

For newsletter unsubscribes, use the unsubscribe link at the bottom of any email we send you. For cookie preference changes, revisit this Site and update your settings via the consent banner, or clear your browser cookies and reload the page.

This Privacy Policy was last reviewed and updated on 25 May 2026. We reserve the right to amend this policy at any time. The most current version will always be available at exlprs.com/privacy.html. Continued use of the Site following any amendment constitutes acceptance of the updated policy.