BnR360 Cookie and Similar Technologies Policy

1. Purpose and Scope

1.1 This Policy explains how BnR360 uses cookies and similar technologies on www.bnr360.com, on the web applications of Sphere, NeuroHire, GenRapide, GenRapide Light and NexGen RFP, and, where applicable, in the BnR360 iOS and Android applications (together, the “Properties”).

1.2 It is read together with the BnR360 Privacy Policy. Capitalised terms not defined here have the meanings given in the Master Subscription Agreement.

2. What These Technologies Are

2.1 “Cookies” are small files stored on a browser or device. “Similar technologies” include local storage, session storage, pixels, tags, scripts, software development kits (SDKs), authentication tokens, push tokens, device and application identifiers, and analytics libraries. References to cookies include these technologies unless the context requires otherwise.

2.2 Session technologies expire when the browser or app session ends. Persistent technologies remain for a stated period. First-party technologies are set by BnR360 or a BnR360 controlled domain. Third-party technologies are set by a provider acting for BnR360 or on its own account.

3. Categories We Use

• Strictly necessary. Required to provide a service you request or to protect the Properties: authentication, session management, load balancing, fraud and abuse prevention, security, and recording your consent choices. These operate without consent where Applicable Law permits and cannot be switched off through the banner. Blocking them may stop the Properties from working.
• Functional. Remember choices such as language, display settings and workspace preferences. Treated as optional where Applicable Law requires consent for them.
• Analytics and performance. Measure traffic, feature usage, errors and performance so that BnR360 can improve reliability and usability. Optional and off by default where prior consent is required.
• Marketing and advertising. BnR360 uses, or will use, Google Analytics, the Meta Pixel and the LinkedIn Insight Tag for audience measurement, conversion tracking and retargeting. These technologies are off by default and load only after consent where the law requires prior consent, including in the European Union, the European Economic Area, the United Kingdom and Quebec, and are subject to opt out and Global Privacy Control where the law requires. BnR360 does not currently use advertising SDKs in its mobile applications. If it does, this Policy and the in app consent control will be updated before deployment.

4. Cookie Inventory

4.1 BnR360 maintains an inventory of the technologies actually deployed. The published inventory will state, for each item: name, provider, purpose, category, duration, domain, first or third party, and whether consent is required. The inventory includes Google Analytics (Google), the Meta Pixel (Meta Platforms) and the LinkedIn Insight Tag (LinkedIn), and the consent tool displays the name, duration and purpose of each item.

4.2 Third parties that may set technologies on our behalf fall within these functions: analytics, customer support, authentication, security, communications and payment processing. Providers are identified in the inventory and, where they are subprocessors, in the Subprocessor Disclosure.

5. Product Use

5.1 Sphere, GenRapide, GenRapide Light and NexGen RFP use necessary technologies for sign-in, session continuity, role based access and security, and may use functional and analytics technologies as described above.

5.2 NeuroHire uses necessary technologies for authenticated candidate sessions, assessment continuity and security.

5.3 Consent to cookies is not consent to recording, microphone or camera access, biometric processing, or AI assessment. Those require the separate product notices and consents described in the NeuroHire Addendum and the AI Addendum. Cookie consent, acceptance of the MSA, and marketing consent are separate actions and are never bundled into one checkbox.

6. Managing Your Choices

6.1 Where Applicable Law requires consent for non essential technologies, BnR360 will present a consent tool that: (a) blocks those technologies until you choose; (b) offers “Accept all”, “Reject optional” and “Manage preferences” with rejection no harder than acceptance; (c) uses no pre ticked boxes and treats neither silence nor continued browsing as consent; (d) records your choice, its time and the banner version; and (e) lets you change or withdraw consent at any time through a persistent “Cookie Settings” link.

6.2 Withdrawal does not affect the lawfulness of processing before withdrawal.

6.3 You may also delete or block cookies through browser settings. Blocking necessary technologies may impair the Properties.

6.4 Global Privacy Control. Where Applicable Law requires, BnR360 will treat a valid Global Privacy Control signal as an opt out of sale or sharing for the relevant browser. BnR360 does not respond to legacy Do Not Track signals except where required by law.

6.5 Mobile applications. In the iOS and Android applications, BnR360 uses operating system permission prompts (for example camera, microphone, photos and notifications), and, where an analytics or diagnostic SDK is used, an in app preference control. Apple App Tracking Transparency will be presented before BnR360 tracks users across other companies' apps or websites. The Android advertising ID will not be used for advertising without the permission the platform requires. BnR360 completes the Apple privacy nutrition label and the Google Play Data safety form consistently with this Policy and the Privacy Policy.

7. Regional Notes

7.1 European Union, EEA and United Kingdom. BnR360 seeks prior consent before storing or accessing non essential information on your device, as required by the ePrivacy Directive as implemented in Member States and by the UK Privacy and Electronic Communications Regulations. Strictly necessary technologies rely on the legal exemption.

7.2 Canada. Where cookie derived information is personal information, BnR360 will meet the transparency and consent requirements of PIPEDA, Quebec Law 25 (including defaults that are off for technologies that profile, and notice in French where Quebec users are targeted) and CASL for any related electronic messages.

7.3 United States. Google Analytics, the Meta Pixel and the LinkedIn Insight Tag may amount to “sale” or “sharing” under California law. BnR360 therefore does not state that it never sells or shares personal information, honours Global Privacy Control, and offers a “Do Not Sell or Share My Personal Information” control.

7.4 Australia. Information collected through these technologies that relates to an identifiable individual is personal information under the Privacy Act 1988 and the Australian Privacy Principles, and is handled in line with the Privacy Policy.

7.5 Middle East. Where cookie derived data is personal data under the Saudi PDPL, UAE PDPL, DIFC, ADGM, Qatar, Bahrain or Oman law, BnR360 will provide the notice and consent mechanisms those laws require.

7.6 South East Asia. Where the laws of Singapore, Malaysia, Indonesia, Thailand, the Philippines or Vietnam apply, BnR360 will address notice, consent, purpose limitation, security and retention for cookie derived personal data.

7.7 Pakistan. BnR360 complies with Pakistani law in force from time to time governing electronic systems and communications, including the Electronic Transactions Ordinance 2002 and the Prevention of Electronic Crimes Act 2016. No comprehensive Pakistani data protection statute is claimed to apply unless and until one is enacted and in force.

8. Security, Fraud and Fingerprinting

8.1 Technical identifiers may be used to detect suspicious sign ins, account takeover and automated attacks. These uses may operate regardless of optional analytics choices.

8.2 BnR360 does not use covert device fingerprinting for advertising or to circumvent your consent choices. Device characteristics used for security are limited to that purpose.

9. Payments

9.1 Where payments are collected through Stripe, which is connected to Aashaz Technology Inc., or another payment provider, that provider's own cookies and similar technologies may apply in its checkout or billing environment, under its own privacy terms. BnR360 does not control them.

10. AI and Telemetry

10.1 BnR360 does not use identifiable cookie derived browsing data to train a general purpose AI model for unrelated customers. Limited operational or de identified telemetry may be used for security, performance and product improvement. Cookie derived marketing or browsing behaviour is not intended to be sent to AI Providers for training.

11. Children

11.1 The Properties are for business users and are not directed to children. BnR360 does not knowingly use behavioural advertising technologies to target children.

12. Third Party Responsibility

12.1 Third party technologies are operated by independent providers under their own terms. Subject to clause 14 of the Master Subscription Agreement and to Applicable Law that cannot be excluded, BnR360 is not responsible for the acts, omissions, failures or unlawful acts of those providers.

13. Changes

13.1 BnR360 may update this Policy when technologies, products, providers or laws change. The effective date above shows the current version. Where a change affects consent requirements, the consent tool will be updated before the change takes effect.

14. Contact

Questions: support@bnr360.com, or H#C-40, Karachi University Staff Town, Karachi, Pakistan. BnR360 replies Monday to Friday during business hours, 7:00 a.m. to 4:00 p.m. EST. Statutory deadlines that apply to a request are met in accordance with Applicable Law.