Summary
| Question | Short answer |
|---|---|
| Who is responsible for my data? | BnR360, Karachi, Pakistan, for its own website, account, billing, marketing and support data. For candidate, applicant, employee and bidder data inside a Service, our customer decides, and BnR360 acts on its instructions |
| Do you sell personal data for money? Website advertising and analytics tools may count as sharing under some laws, see section 25 | No |
| Do you use AI? | Yes. Customers use AI Features that send content to AI Providers. A human customer makes the decisions, not BnR360 |
| Do you record or infer emotion or personality? | Only in NeuroHire. Its optional Analysis Module may analyse facial expression and voice and infer emotion signals from candidate recordings. It is off by default, is disabled in the EU, EEA, UK, Illinois, Texas, Washington State and Quebec, and elsewhere needs the candidate's explicit consent and a non-AI alternative. No other Product does this |
| Where is data processed? | Pakistan and the regions in which our cloud and AI providers operate |
| How do I make a request? | Email support@bnr360.com with the subject Privacy Request. We reply Monday to Friday, 7:00 a.m. to 4:00 p.m. EST |
1. Who we are
1.1 “BnR360”, “we” and “us” means BnR360, H#C-40, Karachi University Staff Town, Karachi, Pakistan. Our privacy contact is support@bnr360.com.
1.2 This Policy explains how we handle personal data when you visit www.bnr360.com, use a BnR360 Mobile App or Service, contact us, attend our events or are included in information that one of our customers processes with our Services (Sphere, NeuroHire, GenRapide, GenRapide Light and NexGen RFP).
1.3 Terms with capital letters not defined here have the meanings in the Master Subscription Agreement. “Personal data” includes personal information and equivalent terms under applicable law.
2. Our roles
2.1 Controller. For our own account, billing, support, website, marketing, security and legal compliance purposes, we decide why and how personal data is used, and we are the controller (or the business or organisation, or equivalent term).
2.2 Processor. When a customer uses a Service to process personal data of candidates, applicants, employees, evaluators, bidders and others, the customer decides why and how that data is used, and we process it on the customer's behalf as processor (or service provider, or equivalent term) under the Data Processing Addendum. In that case, the customer's own privacy notice governs, and you should send requests about that data to the customer. If you send such a request to us, we will pass it to the customer where we can identify them, and may not be able to act on it ourselves.
2.3 Joint use. We may use limited de-identified or aggregated data derived from Service operation for security, analytics and product improvement, as the Master Subscription Agreement describes.
3. Information we collect
3.1 Account and identity. Name, work email, telephone, job title, employer, role, language, time zone, credentials and authentication data, and records of acceptance of our terms.
3.2 Billing and commercial. Billing contacts, invoicing and tax details, purchase history and communications with Aashaz Technology Inc. about payment. We do not store full payment card numbers. Payments are processed through Stripe, which is connected to Aashaz Technology Inc., and card and bank details are handled by Stripe under its own terms and privacy notice.
3.3 Usage and technical. IP address, device type, operating system, browser, app version, device and advertising identifiers where permitted, language settings, pages and features used, timestamps, error and crash logs, and performance and security events.
3.4 Support and communications. Emails to support@bnr360.com, call or meeting notes, feedback, survey responses and attachments you send us.
3.5 Marketing and event. Name, work email, company, interests, event registration and preferences.
3.6 Customer Data (as processor). Customers may submit resumes and profiles, application forms, interview recordings, audio, video and transcripts, assessment answers, notes, scores, RFPs, bids, evaluations, vendor information, contact details and other content. We do not decide what a customer submits.
3.7 Mobile App data. Device and operating system data, crash data, push notification tokens, and data from permissions you grant, such as camera, microphone, files and notifications. See section 8.
3.8 Special categories. We do not ask customers or individuals for sensitive information such as health, race, religion, political opinion, sexual orientation, union membership, biometric identifiers or criminal records, but such information may appear in documents or recordings a customer submits. The customer decides whether to collect and process it and is responsible for the legal basis.
3.9 What we do not do. Except for the NeuroHire Analysis Module, BnR360 does not use voice, face or video to identify an individual or to infer emotion, personality or any protected characteristic. Where a customer enables the Analysis Module, and only where the law permits, it may analyse facial expression and voice (including voiceprint matching) and infer emotion signals from a candidate's recording, on the customer's instructions and with the candidate's explicit consent. These are biometric or sensitive data in some places. The Analysis Module is off by default, is disabled for candidates and roles in the European Union, the European Economic Area, the United Kingdom, Illinois, Texas, Washington State and Quebec, and is never the sole basis of a decision. Biometric data is deleted when the customer's purpose ends, or when the customer's subscription ends plus 30 days, whichever is earlier.
4. How we collect it
From you directly; automatically through our website, Services and Mobile Apps, including by cookies and similar technologies; from our customers and their Authorised Users; from integrations a customer or you authorise, such as LinkedIn, job boards, email and calendar providers, and identity providers; from public sources for business contact and compliance screening; from payment processors and Aashaz; and from our service providers.
5. Why we use it and our legal bases
Where the GDPR, UK GDPR or a similar law requires a legal basis, we rely on the following.
| Purpose | Examples | Legal basis |
|---|---|---|
| Provide and operate the Services | Create accounts, authenticate, host, run AI Features on a customer's instructions, support | Contract. For Customer Data, the customer's instructions |
| Billing and collections | Invoicing, payment through Aashaz, tax, accounting | Contract and legal obligation |
| Security and fraud prevention | Logging, abuse detection, incident response | Legitimate interests and legal obligation |
| Improve and develop the Services | Analytics, debugging, de-identified usage statistics | Legitimate interests |
| Communicate with you | Service notices, replies to support, updates to terms | Contract and legitimate interests |
| Marketing to business contacts | Product news, events, case studies | Legitimate interests, or consent where the law requires |
| Legal compliance and claims | Respond to lawful requests, enforce our terms, establish or defend claims | Legal obligation and legitimate interests |
| Mobile App features needing a permission | Camera, microphone, push notifications | Consent |
Where we rely on legitimate interests, they are running and securing a business-to-business software service, preventing fraud and misuse, and developing our products, and we balance them against your rights. You may object under section 22.
6. People whose data is in our customers' Services
6.1 If you are a candidate, applicant, employee, bidder or other individual whose information is processed through a Service, the organisation that invited or assessed you is the controller. We process your data to provide the Service to them. Please read their privacy notice.
6.2 We do not make hiring, selection, rejection, award or contracting decisions. The customer makes them. If an AI Feature has contributed to a decision about you, you may ask the customer for an explanation, for human review and to correct your information.
6.3 You may contact us at support@bnr360.com if you cannot identify or reach the customer. We will try to direct you, but we may be bound by confidentiality and the customer's instructions.
7. AI Features and automated processing
7.1 Our Services include AI Features that extract, summarise, transcribe, translate, match, rank, score or generate. To provide them, content, which may include personal data, is sent to AI Providers (section 12), which process it and return output to us.
7.2 AI output may be wrong, incomplete or biased. It is decision support. BnR360 does not make solely automated decisions with legal or similarly significant effects about individuals. Customers are required by contract to ensure human review, to give you any notice or choice the law requires, and, except for the NeuroHire Analysis Module in the territories and on the conditions that NeuroHire Product Addendum allows, not to use emotion recognition or biometric identification.
7.3 We do not ourselves use customers' personal data to train a general-purpose AI model for other customers. Our AI Providers' own practices are governed by their terms, and we select interfaces and settings accordingly. We do not control them.
8. Mobile Apps (iOS and Android)
8.1 App store disclosures. The privacy details on our App Store and Google Play listings (Apple privacy nutrition labels and the Google Play Data safety section) describe categories of data we collect, whether it is linked to you, and whether it is shared. They are updated when our practices change. If there is a difference, this Policy and the listings should be read together, and the more protective reading applies to you.
8.2 Permissions. A Mobile App may request access to the camera, microphone, photos or files, and notifications. We ask at the time the feature is first used and you may refuse or later withdraw permission in your device settings. Some features will not work without it.
8.3 Tracking. We do not track you across other companies' apps and websites for advertising, and we do not use the Apple advertising identifier or the Android advertising ID for advertising. If that changes, we will request your permission through Apple's App Tracking Transparency prompt or the equivalent Android control before doing so.
8.4 Third-party AI consent. Before a Mobile App first sends personal data to an AI Provider, it will tell you which provider or category of provider will receive it and for what purpose, and will ask for your explicit permission where the app store rules or the law require it. If you do not agree, the AI feature will not be used for your data in the Mobile App.
8.5 Account deletion. You may start deletion of your account from within the Mobile App, in the account or settings area, or by emailing support@bnr360.com. Deleting your user account does not delete data that a customer holds for its own purposes, which is handled by the customer and, on termination, by clause 25 of the Master Subscription Agreement.
8.6 Crash and analytics. We may use software development kits from service providers for crash reporting, performance and push notifications. They receive device data and identifiers, as described on our store listings.
10. Marketing communications
We send business-to-business marketing to contacts only where permitted. Each message tells you how to opt out, and you may opt out at any time by email to support@bnr360.com. Where Canada's Anti-Spam Legislation, the Spam Act 2003 (Australia), the ePrivacy Directive and similar laws require prior consent, we obtain it. We send text messages only with your consent. Service and legal notices are not marketing and may continue.
12. AI Providers
12.1 The AI Providers we currently use or may use are OpenAI, Google (Gemini) and DeepSeek. Which provider handles a task depends on the Product, feature, customer configuration and availability, and may change. Providers act as our subprocessors and operate under their own terms.
12.2 We use DeepSeek’s own hosted service for certain AI Features of GenRapide and NexGen RFP. Data sent to it may be processed on servers located in the People’s Republic of China and is subject to the law of that country, including laws that may require disclosure to authorities. We do not use DeepSeek for NeuroHire. We do not send candidate or employee personal data, special category data or confidential bid information to DeepSeek unless the customer has enabled it in the Order Form or configuration and obtained any required consent, and a customer may exclude DeepSeek in the Order Form. We are implementing zero data retention configurations with OpenAI and Google Gemini for customers with sensitive data, which apply only where the Order Form expressly provides them.
12.3 A customer may ask us to exclude a particular AI Provider, but we can promise this only in a signed Order Form.
12.4 You should not include sensitive personal data in prompts or free-text fields unless the feature is designed for it.
13. Subprocessors
13.1 We use subprocessors to host, secure, support and deliver the Services. The detailed list of subprocessors, with their location and function, is not published on our website. It is available on request to our customers and to prospective customers evaluating the Services, by email to support@bnr360.com with the subject Subprocessor Request. We may ask the requester to identify itself and agree to confidentiality, and we may decline requests that appear to come from competitors or for no legitimate purpose.
13.2 Customers whose agreement or the law entitles them to notice of changes will be told of a new subprocessor by email as the Data Processing Addendum provides. Categories of subprocessors are: cloud infrastructure, AI Providers, communications and email, identity and security, analytics and crash reporting, customer support and payment processing.
14. Payments and Aashaz Technology Inc.
Aashaz Technology Inc., a company in Canada, may issue invoices and collect payments as BnR360's agent. It receives billing contact names, email addresses, organisation and tax details, invoice and payment information. It acts under our instructions for that purpose and is bound to keep the information confidential and secure. Aashaz does not receive Customer Data. Payments are processed through Stripe, which is connected to Aashaz's account, and card and bank payment details are processed by Stripe under its own privacy notice.
15. International transfers
15.1 We are based in Pakistan, and our providers operate in other countries, including the United States, Canada, the European Economic Area, the United Kingdom, the Gulf region, Southeast Asia and Australia. Your personal data will be transferred to, stored in and accessed from countries other than your own, which may have lower standards of data protection than yours.
15.2 Where law restricts transfers, we use the mechanisms it recognises. For personal data subject to the GDPR or the UK GDPR, these are an adequacy decision where one exists, the European Commission's Standard Contractual Clauses (Modules Two and Three) and the UK International Data Transfer Addendum, supported by an assessment of the destination and supplementary measures where needed. Pakistan does not currently benefit from an adequacy decision, so transfers to BnR360 in Pakistan rely on those clauses. For other regions we rely on the mechanisms the local law recognises, such as contractual protections, consent, necessity for a contract, or regulator approval where it is required.
15.3 You may ask us for information about the safeguards we use by emailing support@bnr360.com.
16. How long we keep personal data
16.1 We keep personal data only as long as needed for the purposes in this Policy, unless the law requires or permits longer. Typical periods are:
- Account and contract records: for the term of the agreement and up to six years afterwards, for tax, accounting and limitation purposes.
- Billing records: as required by tax and accounting law, generally six to ten years depending on the jurisdiction.
- Security and access logs: up to 12 months, longer where an investigation requires.
- Support communications: up to three years after closure.
- Marketing records: until you opt out, then a minimal suppression record.
- Website cookie data: as stated in the Cookie Policy.
- Customer Data: for the term and for the export period and deletion cycle in clause 25 of the Master Subscription Agreement, subject to the customer's retention settings. Backups roll off in the ordinary cycle, and a customer may instruct earlier deletion.
16.2 Data held by AI Providers follows their retention terms, which we do not control.
17. Security
We use administrative, technical and organisational measures appropriate to the risk, described at a high level in the Security and Trust Statement. No system is completely secure, and we cannot guarantee the security of information transmitted to or stored with us or with third parties. You are responsible for keeping your credentials confidential. We will notify affected customers and, where the law requires, regulators and individuals, of a personal data breach as the law and the Data Processing Addendum provide.
18. Children
Our Services are for business use by adults. We do not knowingly collect personal data from anyone under 18 for our own purposes. A customer may not submit data of persons under 18 unless the Order Form permits it. If we learn that we hold such data without authority, we will delete it or return it to the customer. Contact support@bnr360.com if you believe a child has provided data.
19. Links and integrations
Our Services and website may link to or integrate with other sites and services, such as LinkedIn, job boards, calendar and email providers and procurement portals. If a customer or you connect one of them, we use the permissions granted only to provide the integration. Those providers have their own privacy notices, and we are not responsible for them. You may revoke access in the provider's settings.
20. Do Not Track and global privacy signals
Our websites respond to the Global Privacy Control signal and similar opt-out signals where the law requires, as the Cookie Policy describes. Other do-not-track signals are not currently honoured, because no common standard applies.
21. Region-specific disclosures
Sections 23 to 29 give additional information for people in particular regions. They apply in addition to the rest of this Policy. If you are in a region listed there, those sections prevail where they differ.
22. Your rights and how to use them
22.1 General. Depending on where you live, you may have the right to: know whether we process your data and obtain a copy; correct inaccurate data; delete data; restrict or object to processing; receive data in a portable format; withdraw consent at any time without affecting earlier processing; object to direct marketing; not be subject to a decision based solely on automated processing that has legal or similarly significant effects; and complain to a regulator.
22.2 How. Email support@bnr360.com with the subject Privacy Request, saying who you are, what right you wish to use, and any account details that help us locate you. We may need to verify your identity, and may ask for information to confirm that you are the person concerned, or an authorised agent. We read and reply to email Monday to Friday between 7:00 a.m. and 4:00 p.m. EST. A request received outside those hours is treated as received when those hours next begin, to the extent that the law allows. We respond within the period required by the law that applies to you, and in any event within a reasonable time.
22.3 Requests about customer-controlled data. If we process your data only as a processor, we will tell you that we cannot respond as controller and will, where we can, refer your request to the customer.
22.4 Limits. We may refuse or limit a request if the law allows, for example where it is manifestly unfounded or excessive, would reveal another person's data, or conflicts with a legal duty or the establishment, exercise or defence of legal claims. We will tell you why unless the law forbids.
22.5 No retaliation. We will not treat you unfavourably for using your rights.
23. European Economic Area and United Kingdom
23.1 Where the GDPR or UK GDPR applies to our processing as controller, you have the rights in section 22 and the legal bases in section 5 apply. We process personal data on the legal bases listed there. Where we rely on consent, you can withdraw it at any time.
23.2 Our representative in the European Union under Article 27 GDPR, and in the United Kingdom under Article 27 UK GDPR, if required, is to be appointed, and will be named here once appointed. A data subject may contact that representative about processing governed by those laws.
23.3 You may lodge a complaint with the supervisory authority in the country where you live, work or where the alleged infringement occurred, or in the United Kingdom with the Information Commissioner's Office.
23.4 For high-risk AI systems used for recruitment within the scope of the EU AI Act, your employer or prospective employer, as deployer, is responsible for informing you before use and for giving you an explanation of the role of the system in a decision about you where the law entitles you to one.
24. Canada
24.1 Under the Personal Information Protection and Electronic Documents Act and applicable provincial laws, you may access your personal information, challenge its accuracy and withdraw consent subject to legal limits. In Quebec, you may also request information about automated decisions made exclusively by automated processing, the personal information used and the principal factors and parameters, and may ask for the decision to be reviewed by a person. Cross-border transfer information is in section 15. Our personnel or the customer's will answer privacy questions at support@bnr360.com.
24.2 You may complain to the Office of the Privacy Commissioner of Canada or to the privacy regulator of your province, including the Commission d'acces a l'information du Quebec.
25. United States
25.1 State privacy laws. Depending on your state, you may have rights to know, access, correct, delete, obtain a portable copy, opt out of the sale or sharing of personal data, targeted advertising and certain profiling, and limit the use of sensitive personal data. As to our own processing as controller: we do not sell personal data for money, our website advertising and analytics tools may count as sharing, and you can opt out through the Do Not Sell or Share My Personal Information control or Global Privacy Control, and we do not use sensitive personal data beyond what is needed to provide the Services. If we do so in future, we will give you the notice and opt-out the law requires.
25.2 Categories. In the last 12 months we collected the categories in section 3, which correspond to identifiers, commercial information, internet or network activity, professional or employment-related information and inferences drawn from them, and we disclosed them for business purposes to the recipients in section 11.
25.3 Service provider. As to Customer Data, we act as a service provider or processor to our customers, and requests about it should go to the customer.
25.4 Employment and AI notices. Employers using our Services are responsible for the notices and consents that laws such as the Illinois Artificial Intelligence Video Interview Act, the Illinois Biometric Information Privacy Act, New York City Local Law 144 and California regulations on automated decision-making technology require.
25.5 Appeals and complaints. If we refuse a request, you may appeal by replying to our email within a reasonable time. You may also contact your state attorney general.
26. Middle East
Personal data of people in Saudi Arabia, the United Arab Emirates (including the DIFC and ADGM), Qatar, Bahrain, Oman and other countries in the region is processed under the applicable national law. Where those laws give you rights of access, correction, deletion, objection and withdrawal of consent, you may use them as set out in section 22. Cross-border transfers, including to Pakistan, rely on the legal grounds the local law recognises, and the customer is responsible for any approval or notification that it requires. You may complain to the competent authority, such as the Saudi Data and AI Authority, the UAE Data Office, the DIFC Commissioner of Data Protection or the ADGM Office of Data Protection.
27. South East Asia
Personal data of people in Singapore, Malaysia, Indonesia, Thailand, the Philippines, Vietnam and other countries in the region is processed under the applicable national law, including the Personal Data Protection Acts of Singapore, Malaysia and Thailand, Indonesia's Personal Data Protection Law, the Philippines' Data Privacy Act of 2012 and Vietnam's Personal Data Protection Law. You may use your rights under section 22 as the law gives them. You may complain to the competent authority, such as the Personal Data Protection Commission of Singapore, the Malaysian Personal Data Protection Commissioner, the Indonesian authority, the Thai Personal Data Protection Committee, the Philippines National Privacy Commission, or the Vietnamese Ministry of Public Security.
28. Australia
The Privacy Act 1988 (Cth) and the Australian Privacy Principles apply to us where the law reaches our activities. You may ask to access and correct your personal information, and we will respond within a reasonable time, generally 30 days. Where we use computer programs to make or substantially assist decisions that significantly affect you, we will publish the information the law requires from the date it applies, 10 December 2026. We notify the Office of the Australian Information Commissioner and affected individuals of eligible data breaches. If you are not satisfied, you may complain to us, and then to the Office of the Australian Information Commissioner.
29. Pakistan
29.1 We process personal data in accordance with the laws of Pakistan, including the Electronic Transactions Ordinance, 2002 and the Prevention of Electronic Crimes Act, 2016. Pakistan has no comprehensive personal data protection statute in force as at the date of this Policy. We nevertheless give the rights in section 22 to people in Pakistan and will comply with any such statute when it takes effect.
29.2 Complaints may be sent to us at support@bnr360.com and, where the law provides, to the competent authority.
30. Complaints
Please contact us first at support@bnr360.com so that we can try to resolve your concern. You may also complain to your local data protection authority at any time.
31. Changes to this Policy
We may update this Policy. We will post the updated version with a new effective date and, where the law requires or the change is material, notify account holders by email or in the Service. Your continued use after the effective date is acceptance, where the law allows.
32. Contact
BnR360, H#C-40, Karachi University Staff Town, Karachi, Pakistan. Email: support@bnr360.com. Reply hours: Monday to Friday, 7:00 a.m. to 4:00 p.m. EST.
33. Translations
This Policy is in English. A translation, where we provide one, is for convenience only, and the English version prevails unless the law requires otherwise.