BnR360 Master Subscription Agreement

BnR360 Master Subscription Agreement

Effective 6 October 2026. Provider: BnR360, H#C-40, Karachi University Staff Town, Karachi, Pakistan. Support: support@bnr360.com. Website: www.bnr360.com.

This is a business-to-business agreement. Aashaz Technology Inc., Canada may invoice and collect payment as BnR360's agent but is not the provider of any Service.

Key terms summary

This summary is for convenience only. The clauses control.

Order Form framework

Each Order Form is a document, signed or electronically accepted, that incorporates this MSA. It records the following.

• Customer legal name, entity type, place of formation, principal address, notice email and authorised representative.
• Each Product ordered, the plan, the number of Authorised Users, the Initial Term, billing frequency, currency, Fees, implementation Fees and renewal terms.
• Any commitment BnR360 gives beyond the standard terms, and only if expressly selected: zero data retention for a named AI Provider and endpoint, dedicated hosting, a named hosting region, inclusion or exclusion of named AI Providers, a service level agreement, a security schedule, a custom retention period, a specific accessibility standard, a statement of work for professional services.
• Whether Aashaz Technology Inc. will invoice and collect on BnR360's behalf.

A commitment not written in the Order Form does not exist, whatever was said in a demonstration, presentation, proposal, questionnaire or marketing material.

1. Agreement and parties

1.1 This Master Subscription Agreement (the "MSA"), each Order Form, each Product Addendum, the DPA, the AI Addendum, the AUP and every other document expressly incorporated by reference (together, the "Agreement") is made between BnR360, a company incorporated and existing under the laws of Pakistan, whose principal place of business is at H#C-40, Karachi University Staff Town, Karachi, Pakistan ("BnR360", "we", "us"), and the person identified as customer in an Order Form or who accepts this MSA under clause 4 ("Customer", "you"). Each is a "Party".

1.2 Aashaz Technology Inc., a company incorporated in Canada ("Aashaz"), is not a Party and supplies no Service. Its role is confined to clause 19.

1.3 This MSA applies to every Product BnR360 makes available now or later, including Sphere, NeuroHire, GenRapide, GenRapide Light and NexGen | RFP, for so long as that Product is ordered.

2. Definitions and interpretation

2.1 In this Agreement the following terms have the meanings given.

• "Affiliate" means an entity that controls, is controlled by or is under common control with a Party, control meaning ownership of more than fifty per cent of voting rights or the power to direct management.
• "AI Addendum" means the BnR360 AI Services and Responsible AI Addendum.
• "AI Feature" means any functionality using artificial intelligence, machine learning, large language models, natural language processing, computer vision, speech processing, scoring, ranking, matching, extraction, classification, summarisation, transcription, translation, recommendation or generation.
• "AI Input" means anything supplied to an AI Feature, including prompts, instructions, documents, resumes, RFPs, audio, video, images and Customer Data.
• "AI Output" means anything produced or assisted by an AI Feature, including text, scores, rankings, matches, summaries, classifications, recommendations and evaluations.
• "AI Provider" means a Third-Party Provider that supplies a model, inference service, API or other AI capability used by BnR360.
• "Applicable Law" means all statutes, regulations, binding regulatory requirements, orders and other mandatory law applying to the relevant Party or activity from time to time.
• "Authorised User" means an individual whom Customer permits to access a Service.
• "AUP" means the BnR360 Acceptable Use Policy.
• "Business Day" means a day, Monday to Friday, that is not a public holiday gazetted in Sindh, Pakistan, reckoned in Karachi time.
• "Confidential Information" has the meaning in clause 27.
• "Customer Data" means data, content, files, documents and information that Customer or its Authorised Users or End Subjects submit to a Service or that a Service generates from them, including AI Input and AI Output.
• "Customer Personal Data" means Personal Data within Customer Data that BnR360 processes on Customer's behalf.
• "Data Protection Law" means law governing the processing of Personal Data that applies to a Party, including as applicable the GDPR, UK GDPR, PIPEDA and provincial equivalents, US state privacy laws, the Saudi Personal Data Protection Law, UAE federal, DIFC and ADGM data protection laws, the Australian Privacy Act 1988, the Singapore PDPA and other Southeast Asian data protection laws, and Pakistani law on electronic data.
• "DPA" means the BnR360 Data Processing Addendum.
• "Documentation" means BnR360's published user documentation for a Product.
• "End Subject" means an individual whose information Customer processes through a Service, including a candidate, applicant, employee, evaluator, bidder representative or vendor contact.
• "Fees" means all amounts payable under an Order Form.
• "Mobile App" means a BnR360 application distributed through the Apple App Store or Google Play.
• "Order Form" means an order, subscription page or statement of work accepted by both Parties that references this MSA.
• "Personal Data" means information relating to an identified or identifiable individual, and equivalent terms such as personal information under Data Protection Law.
• "Platform" means BnR360's software, models, workflows, interfaces, APIs, infrastructure and Documentation.
• "Product" means each of Sphere, NeuroHire, GenRapide, GenRapide Light, NexGen | RFP and any later BnR360 product, and "Product Addendum" means the addendum for that Product.
• "Security Incident" means a confirmed breach of BnR360's security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of or access to Customer Personal Data in BnR360's possession or control.
• "Services" means each Product and related hosting, support and any Mobile App, as ordered.
• "Subprocessor" means a Third-Party Provider engaged by BnR360 to process Customer Personal Data.
• "Support Hours" means 7:00 a.m. to 4:00 p.m. EST (UTC minus five hours), Monday to Friday, excluding public holidays gazetted in Sindh, Pakistan.
• "Third-Party Provider" means any person other than BnR360 and its own personnel that supplies technology, infrastructure, models, data, content, connectivity or services used in or with the Services, including Microsoft Azure, DigitalOcean, OpenAI, Google (Gemini), DeepSeek, payment processors, email and identity providers, app store operators, job boards, LinkedIn, procurement portals and their respective suppliers and subcontractors. Every AI Provider and every Subprocessor is a Third-Party Provider. Aashaz is not a Third-Party Provider for the purposes of clause 14 but is protected by clauses 19.5 and 34.
• "Third-Party Provider Event" has the meaning in clause 14.1.
• "Trial Services" means Services provided free of charge, on trial, in beta, preview or early access.
• "Usage Data" means technical and operational data about use of the Services that does not identify Customer or an individual.

2.2 In this Agreement: headings do not affect interpretation; "including" means including without limitation; a statute includes it as amended or re-enacted; "writing" includes email; the rule of construction against the drafter does not apply; and references to clauses are to clauses of this MSA unless stated.

3. Contract documents and precedence

3.1 If documents conflict, the following order applies, highest first: (a) a signed written amendment; (b) the Order Form, for the matters it expressly states; (c) the DPA, for processing of Personal Data; (d) the applicable Product Addendum, for that Product; (e) the AI Addendum, for AI matters; (f) this MSA; (g) the AUP; (h) the Documentation.

3.2 No Order Form, Product Addendum, Documentation or other document reduces clause 14 or clause 34 unless it identifies the clause by number and states the change.

3.3 The Privacy Policy, Cookie Policy, Accessibility Statement, Security and Trust Statement, website content, demonstrations, proposals, responses to RFPs, security questionnaires and marketing material are informational. They are not incorporated into the Agreement, create no warranty and are not relied on by Customer, unless an Order Form incorporates a specific statement by title and section.

3.4 Terms in a purchase order, vendor portal, procurement document or Customer policy do not apply, even if BnR360 processes the order, unless a signed amendment expressly accepts those terms.

4. Formation, electronic acceptance and authority

4.1 The Agreement is formed when Customer (a) signs an Order Form in ink or electronically, (b) ticks an unticked acceptance box and proceeds, (c) accepts in a Mobile App or web flow, or (d) first uses a Service after notice of this MSA, whichever is first.

4.2 The Parties intend electronic acceptance to be effective under the Electronic Transactions Ordinance, 2002 and the Qanun-e-Shahadat Order, 1984. BnR360 may keep, and the Parties agree is prima facie evidence of acceptance, a record of the account, organisation, individual, timestamp, IP address, device information, agreement version and Order Form.

4.3 The individual accepting for an organisation warrants that they are authorised to bind it and are at least eighteen years old. BnR360 may rely on that warranty.

5. Business use only

5.1 The Services are offered only to Customers contracting for business, professional, governmental or institutional purposes, and not as consumers. Customer warrants it is not a consumer under Applicable Law.

5.2 BnR360 may decline, restrict or withdraw a Service in any jurisdiction or for any person where Applicable Law, sanctions, a Third-Party Provider restriction or an unacceptable legal risk makes that prudent.

6. Services and subscription licence

6.1 Subject to this Agreement and payment of Fees, BnR360 grants Customer a limited, non-exclusive, non-transferable, non-sublicensable, revocable right during the term to access and use each ordered Service for Customer's internal business purposes. No ownership passes.

6.2 Each Product ordered is a separate Service for Fees, term, termination, service credits and liability, unless the Order Form says otherwise.

6.3 Customer's Affiliates may use a Service only if the Order Form names them. Customer is liable for their acts and omissions as for its own.

6.4 Trial Services are provided as is, may be changed or withdrawn at any time, carry no warranty, support or availability commitment, and BnR360's total liability for them is limited to USD 100.

6.5 BnR360 will provide each paid Service so that it materially conforms to its Documentation, subject to clause 30.

7. Authorised Users and accounts

7.1 Each user licence is for one named individual. Customer may reassign it from one individual to another where reasonably necessary, but not to circumvent licence limits.

7.2 Customer controls Authorised Users, roles, permissions, integrations, workflow configuration, thresholds, criteria and final business decisions, and is responsible for all activity under its accounts.

7.3 Customer shall keep credentials confidential, enable multi-factor authentication where offered, promptly remove departed or unauthorised users, and notify support@bnr360.com without delay of suspected compromise. BnR360 is not liable for loss arising from Customer's failure to do so.

7.4 End Subjects do not need a paid licence unless the Order Form says so.

8. Restrictions

8.1 Customer shall not, and shall not permit any person to: (a) resell, sublicense, lease or operate the Services as a service bureau, unless an Order Form permits; (b) reverse engineer, decompile or extract source code or models, except to the extent Applicable Law permits despite this restriction; (c) circumvent licence, usage, security or access controls; (d) scrape, harvest or bulk extract the Platform or other customers' data; (e) introduce malware or conduct unauthorised scanning, penetration or load testing; (f) use the Services, AI Output or Documentation to build, train or benchmark a competing product or model; (g) publish benchmark or performance results without BnR360's written consent; (h) use a Service in breach of the AUP, a Product Addendum or Applicable Law; (i) use a Service where its failure could foreseeably cause death, personal injury or serious environmental harm; or (j) use a Service to make a decision about an individual that Applicable Law requires to be made by a human, without that human involvement.

8.2 BnR360 does not seek by this Agreement to restrain any person from a lawful profession, trade or business. Clause 8.1(f) restricts only use of BnR360's Platform and AI Output, and is not a restraint on Customer's trade for the purposes of section 27 of the Contract Act, 1872.

9. Customer Data

9.1 As between the Parties, Customer owns Customer Data. BnR360 acquires only the rights in this clause.

9.2 Customer grants BnR360 and its Affiliates a worldwide, non-exclusive licence during the term, and afterwards for the periods in clause 25, to host, copy, index, process, analyse, transmit (including to Third-Party Providers), transform technically, display and back up Customer Data as reasonably necessary to provide, secure, support, maintain and improve the Services, to enforce this Agreement and to comply with Applicable Law.

9.3 Customer warrants that it has all rights, authority, notices, consents and lawful bases needed to submit Customer Data and to have it processed as this Agreement contemplates, and that Customer Data and its use do not infringe or violate any right or law.

9.4 Unless a Product Addendum or the Order Form expressly supports the category, Customer shall not submit: complete payment card numbers; passwords or authentication secrets; government identity numbers not needed for the workflow; classified or national security information; data of persons under eighteen; health, criminal or other special category data not needed for the workflow; or biometric identifiers, except through the NeuroHire Analysis Module where the NeuroHire Product Addendum permits it.

9.5 Customer is responsible for maintaining its own copies and records of Customer Data and any records Applicable Law requires it to keep. BnR360 is not Customer's records custodian.

9.6 BnR360 may remove or disable Customer Data that it reasonably believes is unlawful, infringing or in breach of the AUP, and may preserve it as evidence.

10. Customer compliance responsibilities

10.1 Customer alone determines why and how it uses the Services. Customer is responsible for compliance with all law governing its recruitment, employment, procurement, tendering, evaluation, contracting and records activities, including anti-discrimination, labour, procurement, competition, anti-corruption, privacy and accessibility law.

10.2 Customer shall give every notice and obtain every consent required to process End Subject information through the Services, including notice of the use of AI, recording, profiling, automated assessment and sharing with service providers, in the form and language Applicable Law requires.

10.3 Customer shall tell BnR360 promptly if it learns that a feature is unlawful or restricted in a jurisdiction in which Customer uses it, and shall not use that feature there.

10.4 BnR360's provision of a feature does not mean that using it is lawful for Customer in any particular case. BnR360 does not warrant that any workflow satisfies any law applicable to Customer.

11. Product changes and discontinuation

11.1 BnR360 may update, improve, redesign, replace, add or discontinue features, models, Third-Party Providers and integrations from time to time. Roadmaps and statements of intention are not commitments.

11.2 If, during a committed Initial Term, BnR360 permanently removes a core feature that the Order Form expressly identifies, without substantially equivalent functionality, Customer may terminate the affected Service by written notice within 60 days of the removal and receive a pro rata refund of prepaid Fees for the unused period. That is Customer's sole remedy for the removal.

11.3 BnR360 may suspend, restrict or discontinue a feature if continued provision would be unlawful, would create material legal, regulatory or security risk, or a Third-Party Provider ceases to supply what it needs.

12. Third-party services and integrations

12.1 The Services may connect to Customer-selected systems, including LinkedIn, job boards, HR and payroll systems, email, calendar and identity providers, document storage and procurement portals. Customer is responsible for its accounts with, and its compliance with the terms of, those systems.

12.2 Customer authorises BnR360 to use credentials, tokens and permissions Customer grants, solely for the integration. Customer may revoke them through the relevant system.

12.3 Third parties may change or discontinue interfaces, pricing, permissions and availability at any time. Clause 14 applies.

13. AI Features

13.1 Decision support only. AI Features generate probabilistic outputs to assist Customer. They are not professional, legal, employment, procurement, financial or other advice, and are not a substitute for Customer's own judgment.

13.2 Human review. Customer shall ensure that a competent human reviews AI Output, and the underlying source material where it matters, before Customer relies on it, communicates it to a third party or acts on it. Customer is solely responsible for every hiring, selection, rejection, promotion, tender, bid, award, pricing, contracting or other decision made, influenced or informed by AI Output.

13.3 No solely automated decisions. Customer shall not configure or use a Service so that a decision producing legal or similarly significant effects on an individual is made solely by automated means, unless Applicable Law permits it and Customer has satisfied every condition the law imposes.

13.4 Known limitations. Customer acknowledges that AI Features may produce output that is inaccurate, incomplete, outdated, fabricated, inconsistent between runs, biased, offensive, infringing or unsuitable; may misread documents, accents, languages, scripts, formatting or audio; and may rank individuals or proposals unfairly. BnR360 does not warrant the accuracy, completeness, fairness, lawfulness, originality or fitness of AI Output.

13.5 Customer notices and consents. Customer shall give every notice and obtain every consent, in the form and language Applicable Law requires, before any End Subject interacts with, is assessed by or has Personal Data processed by an AI Feature. Where a Mobile App or web flow shares End Subject Personal Data with an AI Provider, Customer shall ensure the End Subject has been told who receives the data and has given explicit consent where Applicable Law or app store rules require it.

13.6 Prohibited AI uses. Customer shall not use a Service to infer emotions, personality traits, mental state, health, disability, sexual orientation, religion, political opinion, race, ethnicity or other protected characteristics of an individual; to perform biometric identification or categorisation; or to use any technique that is prohibited by Applicable Law, including Article 5 of Regulation (EU) 2024/1689. BnR360 may disable any feature in any jurisdiction for this reason. The only exception is the NeuroHire Analysis Module, used as the NeuroHire Product Addendum permits and never in a Restricted Territory as that Addendum defines.

13.7 Training. BnR360 does not itself use Customer Data to train or fine-tune a general-purpose model made available to other customers. BnR360 selects AI Provider interfaces and settings with reasonable care, but the retention, logging, abuse monitoring and training practices of an AI Provider are governed by that provider's terms and are Third-Party Provider matters under clause 14. Zero data retention, regional processing or an AI Provider restriction exists only if the Order Form expressly provides it.

13.8 AI Output ownership. As between the Parties and to the extent permitted by Applicable Law, Customer owns AI Output generated from Customer Data, subject to clause 26 and to the rights of third parties. BnR360 does not warrant that AI Output is protected by intellectual property rights or is free of third party rights, and similar output may be generated for others.

13.9 The AI Addendum applies in addition to this clause. In a conflict about AI matters, clause 3.1 governs.

14. Third-Party Providers

14.1 Third-Party Provider Event. A "Third-Party Provider Event" means any of the following, whether or not foreseeable and whether arising in contract, tort (including negligence), statute or otherwise: (a) any act, omission, error, defect, outage, delay, degradation, interruption, discontinuance, suspension, price or term change, security incident, data loss, data breach, insolvency, sanction, regulatory action, breach of contract or breach of law of or by a Third-Party Provider; (b) any content, output, score, ranking, recommendation, transcription, translation, summary, hallucination, bias, inaccuracy or infringement generated, transmitted or caused by an AI Provider or its model; (c) any unlawful, unauthorised, negligent, fraudulent or wilful act or omission of a Third-Party Provider or of its personnel, subcontractors or suppliers; (d) the retention, use, logging, monitoring, training, disclosure, transfer or localisation of data by a Third-Party Provider in accordance with or contrary to its own terms; and (e) any change in law, policy or enforcement affecting a Third-Party Provider's ability to supply what BnR360 needs.

14.2 No responsibility. Subject only to clause 14.3, BnR360 is not responsible or liable to Customer, its Affiliates, Authorised Users or End Subjects for any Third-Party Provider Event or for any loss, damage, cost or claim arising from it. No Third-Party Provider Event is a breach of this Agreement by BnR360, a failure of any warranty, service level or support commitment, or a ground for any credit, refund or termination right, other than as clause 14.5 provides.

14.3 Limits of this clause. Clause 14.2 does not exclude or limit: (a) any liability that Applicable Law does not allow to be excluded or limited, including, where the GDPR or UK GDPR applies to BnR360 as a processor, its liability under Article 28(4) for the failure of a Subprocessor to fulfil data protection obligations; (b) liability for BnR360's own fraud or wilful misconduct; (c) liability of BnR360 for its own breach of this Agreement, including failure to exercise the standard of care in clause 14.6; or (d) a commitment that BnR360 expressly assumes in a written Order Form signed by an authorised signatory of BnR360 that identifies this clause by number. To the extent clause 14.2 would otherwise be unenforceable, it applies to the maximum extent that is enforceable.

14.4 Pass through of remedies. Where BnR360 holds a right of recovery against a Third-Party Provider for a Third-Party Provider Event that has caused loss to Customer, and is able to enforce it, BnR360 will, on Customer's written request and at Customer's cost, use reasonable efforts to pass through the benefit of that right to Customer, without obligation to commence litigation. BnR360 gives no assurance that any recovery is available.

14.5 Replacement and affected Services. If a Third-Party Provider Event makes a material part of a paid Service unavailable for more than 30 consecutive days, BnR360 may replace the Third-Party Provider or the affected feature with a reasonably equivalent alternative. If it does not do so within that period, Customer may terminate the affected Service on written notice and receive a pro rata refund of prepaid Fees for the unused period. That is Customer's sole and exclusive remedy for the Third-Party Provider Event.

14.6 Standard of BnR360's own conduct. BnR360 will select Third-Party Providers with reasonable care, and will require each Subprocessor to be bound by written confidentiality and data protection terms no less protective of Customer Personal Data than the DPA requires. BnR360 will require its own personnel with access to Customer Data to be bound by written confidentiality duties. That standard measures only BnR360's own conduct. It does not make BnR360 the guarantor of any Third-Party Provider.

14.7 Provider terms and no agency. Customer acknowledges that Third-Party Providers supply their services under their own terms, which may include restrictions, disclaimers, usage policies, data practices and governing law, and that BnR360 does not control them. No Third-Party Provider is BnR360's agent, partner or joint venturer, and BnR360 does not warrant their acts or omissions. Customer has chosen to use the Services knowing the Services depend on Third-Party Providers.

14.8 Customer's own providers. Where Customer connects its own account, tenant, model key, system or service provider, that provider is Customer's Third-Party Provider and clause 14 applies with equal force.

14.9 Indemnity and cap. Customer's obligations under clause 31 extend to third party claims arising from a Third-Party Provider Event to the extent caused by Customer's use of a Service in breach of this Agreement. Nothing in clause 14 increases the limit in clause 34.

14.10 This clause 14 is a fundamental term, reflects the allocation of risk in the Fees, and survives termination.

15. Data protection and privacy

15.1 Where BnR360 processes Customer Personal Data on Customer's behalf, the DPA applies and, together with this MSA, is Customer's complete instruction for that processing. BnR360's processing of other Personal Data, such as account holder, billing and website visitor data, is described in the BnR360 Privacy Policy, under which BnR360 acts as a controller.

15.2 Each Party shall comply with the Data Protection Law that applies to it. As between the Parties, Customer is the controller (or the business or equivalent) for Customer Personal Data, and BnR360 is the processor (or the service provider or equivalent).

15.3 International transfers. Customer acknowledges and authorises that Customer Data will be processed in Pakistan and in the regions in which BnR360 and its Third-Party Providers operate, including the United States, Canada, the European Economic Area, the United Kingdom, the Gulf region, Southeast Asia, Australia and any other region where a Third-Party Provider processes data, and that such regions may not offer protection equal to Customer's home jurisdiction. BnR360 will put in place the transfer mechanisms the DPA describes where Data Protection Law requires them.

15.4 Local residency. BnR360 does not promise that Customer Data will be hosted or processed in any particular country unless the Order Form says so. Where Customer is subject to a data localisation rule, Customer is responsible for deciding whether to use the Services and shall tell BnR360 before ordering.

15.5 Data subject requests and regulators. Each Party will give the other the cooperation the DPA requires. Customer is solely responsible for End Subject requests and for any regulatory enquiry concerning Customer's own processing.

16. Support

16.1 BnR360 provides support by email only, at support@bnr360.com, unless the Order Form provides another channel. A support request must come from an Authorised User or notified administrator and should state the Service, the account, the time of the issue and the steps to reproduce it.

16.2 BnR360 will reply only during Support Hours, being Monday to Friday, 7:00 a.m. to 4:00 p.m. EST, excluding public holidays gazetted in Sindh, Pakistan. An email received outside Support Hours is treated as received at the start of the next period of Support Hours. BnR360 has no obligation to respond, monitor or act outside Support Hours.

16.3 BnR360 will use reasonable efforts to acknowledge a support request within one Business Day of receipt. No other response or resolution time is guaranteed unless an Order Form for a service level agreement says so.

16.4 Support does not include training, configuration of Customer's own systems, legal or compliance advice, review of AI Output, issues with Customer-selected third-party systems, or any issue caused by a Third-Party Provider Event. BnR360 may charge its then current rates for work outside support.

16.5 Customer's security reports, privacy requests and legal notices must also be sent in the manner stated in clause 44 and the relevant policy. Sending a notice only to a support channel is not valid notice of a claim.

17. Availability and maintenance

17.1 BnR360 will use commercially reasonable efforts to make each paid Service available, but does not warrant that a Service will be uninterrupted, timely, secure or error free.

17.2 BnR360 may carry out scheduled maintenance, and will try to give reasonable advance notice by email or in the Service where practicable. BnR360 may carry out emergency maintenance, including security patching, without notice.

17.3 Unavailability caused by any of the following does not count against any availability commitment: a Third-Party Provider Event; Customer's systems, networks, configuration or acts; force majeure under clause 40; scheduled maintenance; suspension under clause 21 or 24; Trial Services; or features designated as beta.

17.4 Any uptime commitment and service credits apply only if an Order Form expressly contains them. Service credits are Customer's sole remedy for unavailability and are applied against future Fees, never paid in cash.

18. Security

18.1 BnR360 will maintain administrative, technical and organisational measures designed to protect Customer Data against unauthorised access, loss and alteration, appropriate to the nature of the data and proportionate to the Services. Customer acknowledges that no system is completely secure.

18.2 The Security and Trust Statement describes BnR360's security approach for information. It is not a warranty or a schedule to this Agreement unless an Order Form incorporates it.

18.3 Customer is responsible for the security of its own accounts, devices, networks, integrations, API keys and exported data, and for configuring role permissions appropriately.

18.4 Incident notice. If BnR360 becomes aware of a Security Incident, it will notify Customer without undue delay and, where Applicable Law sets a shorter or longer period for processors, within that period, and in any case will aim to do so within 72 hours of confirming it. BnR360 will give information about the incident as it becomes available. Notice of an incident is not an admission of fault or liability.

18.5 Where an incident occurs within a Third-Party Provider's environment, BnR360 will pass on to Customer the material information it receives. Clause 14 governs responsibility for the incident.

18.6 Customer shall not conduct security testing of the Platform without BnR360's prior written consent. Responsible disclosure of a vulnerability may be sent to support@bnr360.com. BnR360 will not take legal action against good faith research that follows the AUP, avoids accessing data of others and gives BnR360 reasonable time to fix the issue.

19. Fees, invoicing and payment through Aashaz

19.1 Customer shall pay the Fees stated in the Order Form, in the currency stated or, if none, in United States dollars. Unless the Order Form says otherwise, subscription Fees are invoiced annually in advance and usage and professional services Fees monthly in arrears. Fees are non-cancellable and, except as clauses 11.2, 14.5, 24.5 and 32 provide, non-refundable.

19.2 Payment agent. Customer acknowledges and agrees that BnR360 has appointed Aashaz Technology Inc. as its agent for the limited purposes of issuing invoices in BnR360's name or its own, receiving payment of Fees, issuing receipts and communicating about billing. A payment made to Aashaz, or to an account or payment link that Aashaz or BnR360 nominates in writing, discharges Customer's obligation to BnR360 pro tanto.

19.3 Aashaz is not a Party, does not provide any Service, and gives no warranty about any Service. Customer's contract for the Services is solely with BnR360. A dispute about a Service is a dispute with BnR360 only, and payment to Aashaz is not a defence to non-performance of a payment obligation that remains unpaid.

19.4 BnR360 may change the collecting entity, the bank account or the payment method on written notice, and may itself collect Fees directly.

19.5 Protection of Aashaz. Customer shall not bring any claim against Aashaz, its directors, officers, employees or agents that arises out of the Services or this Agreement, other than a claim to recover a payment that Aashaz received and failed to remit or refund as BnR360 directed, or a claim for Aashaz's own fraud. Clauses 14, 30 and 34 apply for the benefit of Aashaz as they apply for the benefit of BnR360, and BnR360 may enforce them on Aashaz's behalf, as agent and trustee, to the extent allowed by Applicable Law.

19.6 Verification of payment details. Fraudsters impersonate suppliers. Before the first payment, and whenever payment details change, Customer shall confirm the account details by an email from a bnr360.com address or by emailing support@bnr360.com. BnR360 is not responsible for payments Customer makes to an account that has not been so verified.

19.7 Payment processors. Card, bank transfer and wallet payments may be handled by Third-Party Providers whose terms and fees apply. Processor failure, declined payments, chargebacks and processor fees are matters between Customer and the processor, and BnR360 may recover from Customer any chargeback or processor charge caused by Customer.

19.8 Fee changes. BnR360 may change Fees for a renewal term by written notice at least 60 days before the renewal date. If Customer does not accept, it may give notice of non-renewal under clause 23.2.

19.9 Usage. If Customer exceeds the Authorised Users, volume, storage, AI usage or other limits in the Order Form, BnR360 may invoice the excess at the Order Form rate or, if none, at its then current rate, and may throttle use of a Service.

19.10 In-app purchases. Payments are made through Stripe, which is connected to Aashaz's account, using the checkout or payment link that BnR360 or Aashaz provides, including from a Mobile App where the store rules allow, and Stripe's terms apply to that processing. Where Customer or an Authorised User purchases through a Mobile App store, Apple or Google collects payment under its own terms, and refunds, taxes and billing issues for that purchase are governed by the store's terms and are Third-Party Provider matters.

20. Taxes and withholding

20.1 Fees exclude all taxes, duties, levies and charges of any kind, including value added, goods and services, harmonised sales, sales, use, digital services, withholding and similar taxes, other than taxes on BnR360's net income. Customer shall pay them in addition to the Fees, and BnR360 or Aashaz may add them to invoices where it is required or entitled to collect them.

20.2 If Applicable Law requires Customer to withhold tax from a payment, Customer shall (a) withhold only the minimum required, (b) pay the withheld amount to the competent authority on time, (c) give BnR360 an official receipt within 30 days, and (d) increase the payment so that BnR360 receives the full amount it would have received had no withholding applied, unless an applicable tax treaty or exemption certificate that BnR360 has accepted in writing removes the withholding.

20.3 Customer shall give BnR360 its tax registration details, and any exemption certificate, before the first invoice. Customer is responsible for self-assessing any tax on a reverse charge basis where Applicable Law so requires.

20.4 Customer bears all bank, transfer, correspondent and currency conversion charges. If a payment is made in a currency other than the invoiced currency, BnR360 may convert at the rate its bank or Aashaz's bank applies.

21. Late payment, disputes and suspension

21.1 Invoices are due 30 days after the invoice date unless the Order Form says otherwise. Payment is made in cleared funds without set-off, counterclaim or deduction.

21.2 If an amount is overdue, BnR360 may charge, as compensation for the administrative and financing cost of late payment which the Parties agree is a reasonable pre-estimate of that loss for the purposes of section 74 of the Contract Act, 1872, a one-time late payment charge of one per cent of the overdue amount, a fixed charge that is not interest and does not compound or accrue further, and may recover the reasonable costs of collection, including legal fees.

21.3 Customer shall notify any good faith dispute about an invoice in writing, with reasons, within 14 days after the invoice date. Customer shall pay the undisputed part on time. The Parties will try in good faith to resolve a dispute within 30 days.

21.4 If an amount that is not subject to a good faith dispute remains unpaid 10 days after written notice, BnR360 may suspend access to the affected Services, or all Services under the Order Form, until payment. Suspension does not suspend Customer's obligation to pay Fees. BnR360 may charge a reasonable reinstatement fee.

21.5 BnR360 may suspend a Service immediately, without notice and without liability if: it reasonably believes the Service is being used in breach of the AUP or Applicable Law; use creates a security risk or risk to other customers; a court, regulator or Third-Party Provider requires it; or a sanctions or similar law makes continued supply unlawful. BnR360 will restore access when the cause is resolved, where it reasonably can.

22. Mobile Apps

22.1 Licence. If BnR360 makes a Mobile App available, it licenses it to Authorised Users on a limited, revocable, non-transferable basis, for use on devices they own or control, subject to the app store's usage rules and this Agreement. The Mobile App is licensed and not sold.

22.2 App store acknowledgments. The Parties acknowledge that this Agreement is between BnR360 and Customer only, and not with Apple Inc. or Google LLC (each an "App Store Provider"). BnR360, and not an App Store Provider, is responsible for the Mobile App and its content. An App Store Provider has no obligation to provide maintenance or support for the Mobile App. If the Mobile App fails to conform to any applicable warranty, the Authorised User may notify the App Store Provider for a refund of any purchase price, and to the maximum extent permitted by law, the App Store Provider has no other warranty obligation. As between BnR360 and Customer, BnR360 is responsible for any claim relating to the Mobile App, including product liability, legal compliance and consumer protection claims, subject to this Agreement. If a third party claims that the Mobile App infringes its intellectual property rights, BnR360, and not the App Store Provider, is responsible for the investigation, defence and settlement of the claim, subject to clause 32.

22.3 Representations. Customer represents that it and each Authorised User is not located in a country subject to a government embargo or designated as a terrorist-supporting country, and is not on any prohibited or restricted party list.

22.4 Apple third-party beneficiary. Apple Inc. and its subsidiaries are third-party beneficiaries of the Apple-specific terms in this clause 22 and, once an Authorised User accepts them, have the right to enforce them against that Authorised User.

22.5 Platform terms. Customer and each Authorised User shall comply with the applicable third party terms, including the app store's terms of service, when using the Mobile App. BnR360's developer name and contact details are shown on the app store listing, and queries may be sent to support@bnr360.com.

22.6 Permissions and data. A Mobile App may ask for device permissions such as camera, microphone, notifications, files or storage. An Authorised User may decline a permission, but certain features may then be unavailable. App store privacy and data safety disclosures describe the data the Mobile App collects and are accurate as of the date of release.

22.7 Consent before AI sharing. Where a Mobile App sends personal data to an AI Provider, it will show the person the identity or category of the recipient and request explicit consent before the first transfer, as the app store rules require. Customer shall not circumvent that consent flow.

22.8 Account deletion. An Authorised User who created an account in a Mobile App may request deletion of the account from within the Mobile App or by emailing support@bnr360.com. Deletion of an Authorised User account does not by itself delete Customer Data held for the Customer account, which is dealt with under clause 25.

22.9 Store events. Removal, suspension, rejection, delay or change of a Mobile App listing, or any change in an App Store Provider's rules, fees or technical requirements, is a Third-Party Provider Event. BnR360 may in that case offer access through a web browser instead.

23. Term and renewal

23.1 This MSA starts on the earlier of the Effective Date shown above, if Customer accepts after it, the date Customer accepts it, and the Order Form start date, and continues until all Order Forms have expired or been terminated.

23.2 Each Order Form has the Initial Term it states. Unless it states otherwise, it renews automatically for successive renewal terms of 12 months, unless either Party gives written notice of non-renewal at least 30 days before the end of the current term. BnR360 may send reminders but is not required to.

23.3 Trial Services end at the end of the trial period unless converted to a paid subscription. BnR360 may end a trial at any time.

24. Termination

24.1 Either Party may terminate an Order Form or this MSA on written notice if the other commits a material breach and fails to remedy it within 30 days after written notice describing it, or if the breach cannot be remedied.

24.2 Either Party may terminate on written notice if the other becomes insolvent, makes an assignment for the benefit of creditors, has a receiver or liquidator appointed, ceases business or is the subject of winding up or bankruptcy proceedings.

24.3 BnR360 may terminate or suspend immediately on written notice if Customer breaches clause 8, clause 13.6 or the AUP in a way that creates legal, safety or security risk; fails to pay an undisputed amount within 30 days after notice; or if continued supply would be unlawful or breach sanctions.

24.4 Customer may not terminate for convenience during an Initial Term or renewal term. If Customer purports to do so, Fees for the remainder of the term remain payable.

24.5 If Customer terminates for BnR360's uncured material breach, BnR360 will refund prepaid Fees for the period after termination. If BnR360 terminates under clause 24.3 or for Customer's breach, no Fees are refunded and unpaid Fees for the remainder of the term become immediately due.

24.6 Termination or expiry does not affect rights accrued before it.

25. Effect of termination, data export and deletion

25.1 On expiry or termination, Customer's right to use the Services ends, and Customer shall stop using them and, if requested, certify that it has done so.

25.2 Export window. For 30 days after expiry or termination (the "Export Period"), BnR360 will, on written request to support@bnr360.com, make Customer Data available for export in a commonly used format, such as CSV, JSON or PDF, or give Customer read-only or limited access for that purpose. The Export Period does not apply where BnR360 has terminated under clause 24.3 for unlawful use, or where Customer has not paid undisputed Fees, unless Customer pays them.

25.3 Deletion. After the Export Period, BnR360 will delete Customer Data from active systems at the end of the Export Period, which is 30 days after the subscription ends. Backups are taken weekly and are overwritten in the ordinary cycle. Customer Data in backups is not restored for any other purpose, and Customer must make any request for a backup or export before the Export Period ends, because BnR360 will not provide or restore Customer Data after that. BnR360 may keep Customer Data that Applicable Law requires or that is needed for legal claims, audit or dispute resolution, on the terms of the DPA, and may keep aggregated and de-identified data that does not identify Customer or any individual.

25.4 Customer Data that BnR360 has disclosed to Third-Party Providers is subject to their retention periods, and BnR360 does not control them. Clause 14 applies.

25.5 EU switching rights. Where Regulation (EU) 2023/2854 (the Data Act) applies to the Services and Customer is entitled to its switching rights, Customer may give BnR360 a switching request on a maximum notice period of two months, and BnR360 will support the transition within a mandatory transitional period of 30 days (extended where technically unfeasible, as the Data Act allows) and will export the data and digital assets within the scope of the Data Act. BnR360 will charge no switching charge from 12 January 2027, and until then will charge no more than its direct costs, to the extent the Data Act requires. Customer remains liable for Fees accrued until termination takes effect, and the minimum commitment already agreed is not waived except as the Data Act provides.

25.6 Survival. Clauses 2, 8, 9.3, 10, 13.4 to 13.8, 14, 15, 19 to 21, 24.5, 25, 26 to 36, 42 to 44 and any other provision intended to survive, survive termination or expiry.

26. Intellectual property

26.1 As between the Parties, BnR360 and its licensors own all right, title and interest in the Platform, the Services, the Documentation, models, prompts, templates, scoring methods, workflows, source and object code, designs, trademarks and all improvements, modifications and derivative works, whoever suggests them. Customer receives only the rights expressly granted in clause 6. No licence is implied.

26.2 Customer owns Customer Data and Customer's own trademarks, and grants BnR360 the rights in clause 9.2.

26.3 BnR360 may collect and use Usage Data, and may create and use aggregated or de-identified data derived from Customer Data that does not identify Customer, any Authorised User or any individual, to operate, secure, analyse and improve the Services and its products. BnR360 owns that data.

26.4 Customer shall not remove or obscure any proprietary notice. BnR360 will not use Customer's trademarks except as clause 28.2 allows.

27. Confidentiality

27.1 "Confidential Information" means non-public information disclosed by a Party ("Discloser") to the other ("Recipient") that is marked confidential or that a reasonable person would understand to be confidential, including Customer Data (which is Customer's Confidential Information), the Platform's non-public features, pricing, security documentation and the terms of the Agreement.

27.2 It does not include information that: is or becomes public without the Recipient's breach; was known to the Recipient before disclosure without a duty of confidence; is received from a third party without a duty of confidence; or is independently developed without use of the Discloser's information.

27.3 The Recipient shall use Confidential Information only to perform or exercise rights under the Agreement; protect it with at least reasonable care; and disclose it only to its and its Affiliates' personnel, advisers, insurers, financiers, Aashaz (as to billing information) and Third-Party Providers (as to Customer Data, to the extent needed to provide the Services) who need to know and are bound by duties of confidence no less protective than this clause. The Recipient is responsible for their compliance, subject to clause 14.

27.4 The Recipient may disclose Confidential Information if required by law, court order or a regulator, after giving the Discloser prompt notice where lawful and practicable, and disclosing only what is required.

27.5 Obligations under this clause continue for five years after termination, and for trade secrets and Customer Personal Data for as long as they remain confidential or protected by law. On request after termination, the Recipient will delete or return the Discloser's Confidential Information, subject to clause 25 and to legal retention duties and ordinary backups.

27.6 Breach may cause irreparable harm for which damages are inadequate, and the Discloser may seek injunctive relief without proof of actual damage, in addition to other remedies.

28. Feedback and publicity

28.1 If Customer gives suggestions, ideas or feedback about the Services, BnR360 may use them without restriction or payment. Customer grants BnR360 a perpetual, irrevocable, worldwide, royalty-free licence to do so.

28.2 BnR360 may name Customer as a customer and display its name and logo on its website and in sales material, unless Customer opts out by email to support@bnr360.com. BnR360 will not otherwise issue a press release naming Customer without its consent.

29. Warranties

29.1 Each Party warrants that it has the power and authority to enter into and perform the Agreement, and that the Agreement is binding on it.

29.2 BnR360 warrants that it will provide the paid Services in a professional manner, with reasonable skill and care, and that each paid Service will materially conform to its Documentation. Customer's sole remedy for breach of this warranty is that BnR360 will use reasonable efforts to correct the nonconformity or, if it cannot do so within 60 days of notice, Customer may terminate the affected Service and receive a pro rata refund of prepaid Fees for the unused period. This warranty does not apply to AI Output, Trial Services, Third-Party Provider Events, or nonconformity caused by Customer, misuse, unauthorised modification or Customer's systems.

29.3 Customer warrants that it will comply with Applicable Law in its use of the Services, that it has the rights and authority described in clause 9.3, and that its use of AI Output will be lawful.

30. Disclaimer

30.1 EXCEPT AS EXPRESSLY STATED IN CLAUSE 29, AND TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, THE SERVICES, AI FEATURES, AI OUTPUT, DOCUMENTATION AND ALL THIRD-PARTY PROVIDER SERVICES ARE PROVIDED "AS IS" AND "AS AVAILABLE". BnR360 AND ITS LICENSORS DISCLAIM ALL OTHER WARRANTIES, CONDITIONS AND REPRESENTATIONS, EXPRESS, IMPLIED OR STATUTORY, INCLUDING OF MERCHANTABILITY, SATISFACTORY QUALITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, NON-INFRINGEMENT, ACCURACY, COMPLETENESS, AND UNINTERRUPTED OR ERROR-FREE OPERATION.

30.2 BnR360 does not warrant that use of a Service will result in any particular hiring, interview, sourcing, evaluation, tender, bid, award, revenue or compliance outcome, that any candidate, vendor or proposal identified is suitable, qualified, truthful or lawful, or that any Service satisfies any legal requirement applicable to Customer.

30.3 BnR360 does not verify the identity, credentials, claims, background or conduct of any End Subject or third party, or the content of any resume, RFP, bid or document.

30.4 Nothing in this Agreement excludes a right that cannot be excluded under Applicable Law. Where Applicable Law implies a term that cannot be excluded, BnR360's liability for its breach is limited, to the extent the law allows, to supplying the Service again or paying the cost of having it supplied again.

31. Customer indemnity

31.1 Customer shall defend, indemnify and hold harmless BnR360, its Affiliates, Aashaz, and their respective directors, officers, employees, agents and licensors (the "BnR360 Indemnitees") from and against all third party claims, proceedings, investigations, losses, damages, fines (to the extent lawful), costs and expenses, including reasonable legal fees, to the extent arising out of: (a) Customer Data or its processing as instructed; (b) Customer's breach of clause 8, 9, 10, 13 or the AUP; (c) Customer's failure to give a notice or obtain a consent required by Applicable Law; (d) any employment, recruitment, procurement, award or other decision made or influenced by Customer using a Service, including claims of discrimination, unfair treatment, defamation or breach of confidence by an End Subject or unsuccessful bidder; (e) Customer's infringement or violation of law or third party rights; (f) Customer's unauthorised use of AI Output; and (g) as clause 14.9 states.

31.2 BnR360 shall give Customer prompt notice of a claim, allow Customer to control its defence and settlement (provided Customer may not settle in a way that admits fault of or imposes obligation on a BnR360 Indemnitee without consent), and give reasonable cooperation at Customer's cost. Delay relieves Customer only to the extent of actual prejudice. The BnR360 Indemnitees may participate with their own counsel at their own cost.

32. BnR360 intellectual property indemnity

32.1 BnR360 shall defend Customer against a third party claim that the Platform, as provided by BnR360 and used by Customer in accordance with the Agreement, infringes that third party's patent, copyright, trademark or trade secret rights, and shall pay the damages and reasonable costs finally awarded by a court or agreed in settlement approved by BnR360, to the extent attributable to the claim.

32.2 This clause does not apply to a claim arising from: Customer Data; AI Output; any Third-Party Provider's technology, model or content; Trial Services; modification not made by BnR360; combination with items not supplied by BnR360; use in breach of the Agreement; or continued use after BnR360 has supplied a non-infringing alternative.

32.3 If a claim is made or likely, BnR360 may procure the right for Customer to continue, modify the Platform so that it is non-infringing, or terminate the affected Service and refund prepaid Fees for the unused period.

32.4 Customer shall give BnR360 prompt notice, sole control of defence and settlement, and reasonable cooperation. This clause 32 states BnR360's entire liability and Customer's sole remedy for infringement claims. BnR360's liability under this clause counts toward the limit in clause 34.

33. Exclusion of certain losses

33.1 TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, NEITHER BnR360 NOR ITS AFFILIATES, AASHAZ, LICENSORS, THIRD-PARTY PROVIDERS OR THEIR PERSONNEL IS LIABLE TO CUSTOMER OR ANYONE CLAIMING THROUGH CUSTOMER FOR: (a) INDIRECT, CONSEQUENTIAL, SPECIAL, INCIDENTAL, EXEMPLARY OR PUNITIVE LOSS; (b) LOSS OF PROFIT, REVENUE, CONTRACT, BUSINESS, ANTICIPATED SAVINGS, GOODWILL OR REPUTATION; (c) LOSS, CORRUPTION OR RECOVERY OF DATA, EXCEPT AS CLAUSE 18 AND THE DPA PROVIDE; (d) COST OF SUBSTITUTE SERVICES; (e) COSTS OF A BAD HIRE, A MISSED HIRE, A LOST OR MIS-AWARDED CONTRACT OR A PROCUREMENT CHALLENGE; OR (f) ANY LOSS ARISING FROM RELIANCE ON AI OUTPUT, IN EACH CASE WHETHER IN CONTRACT, TORT (INCLUDING NEGLIGENCE), BREACH OF STATUTORY DUTY OR OTHERWISE, AND EVEN IF ADVISED OF THE POSSIBILITY.

33.2 Clause 33.1 does not apply to liability that cannot be excluded under Applicable Law.

34. Limitation of liability

34.1 TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, THE TOTAL AGGREGATE LIABILITY OF BnR360, ITS AFFILIATES, AASHAZ AND THEIR RESPECTIVE DIRECTORS, OFFICERS, EMPLOYEES, AGENTS AND LICENSORS, FOR ALL CLAIMS ARISING OUT OF OR RELATING TO THE AGREEMENT OR THE SERVICES, UNDER ANY THEORY, IS LIMITED TO THE FEES ACTUALLY PAID BY CUSTOMER FOR THE AFFECTED SERVICE IN THE 12 MONTHS BEFORE THE EVENT FIRST GIVING RISE TO LIABILITY.

34.2 The limit in clause 34.1 is a single aggregate limit for all claims, and is not per claim or per year. Several claims do not enlarge it. It includes liability under clause 32.

34.3 The limit in clause 34.1 does not apply to: (a) liability that cannot be limited under Applicable Law; (b) liability for fraud or wilful misconduct; or (c) Customer's obligations to pay Fees. Customer's liability under clause 31 is not limited by this clause.

34.4 The limit for Trial Services is USD 100.

34.5 Customer acknowledges that the Fees reflect this allocation of risk, that BnR360 would not provide the Services at these Fees without it, and that this clause is fundamental to the Agreement and is intended to apply even if a limited remedy fails of its essential purpose.

34.6 Aashaz is an intended beneficiary of clauses 14, 30, 33 and 34, which BnR360 may enforce on its behalf.

35. Mitigation

35.1 Each Party shall take reasonable steps to mitigate loss. Customer shall promptly stop using any AI Output or feature that it knows or should reasonably suspect to be defective, biased or unlawful, and shall tell BnR360 at support@bnr360.com.

36. Notice of claims and limitation

36.1 Customer shall notify BnR360 in writing of any claim or circumstance that may give rise to a claim as soon as reasonably practicable, with reasonable detail, in the manner in clause 44. Late notice does not bar a claim, but BnR360's liability is reduced to the extent it is prejudiced by the delay.

36.2 Nothing in this Agreement shortens the period allowed by the Limitation Act, 1908 or other Applicable Law for bringing a claim.

37. Compliance, sanctions and anti-corruption

37.1 Each Party shall comply with the anti-corruption and anti-bribery laws that apply to it, including the Prevention of Corruption Act, 1947 and, where applicable, the U.S. Foreign Corrupt Practices Act and the UK Bribery Act 2010, and shall not offer or accept any improper payment or advantage in connection with the Agreement. Customer shall not use a Service to facilitate bribery, bid rigging, collusion, money laundering or any anti-competitive conduct, including by feeding confidential bid information of a competitor or evaluator into a Service.

37.2 Customer warrants that neither it nor any Authorised User is the target of sanctions administered by the United Nations, the United States, the European Union, the United Kingdom, Canada, Australia or any other applicable authority, or located in, or ordinarily resident in, a comprehensively sanctioned jurisdiction, and shall not use or export the Services in breach of sanctions or export control law.

38. Assignment and subcontracting

38.1 Customer may not assign, novate or transfer the Agreement or any right under it without BnR360's prior written consent. A change of control of Customer is an assignment.

38.2 BnR360 may assign or novate the Agreement to an Affiliate, or to a successor to all or substantially all of its business or assets, on notice. BnR360 may subcontract performance, and remains responsible for its own subcontractors' performance subject to clause 14.

39. Relationship and third parties

39.1 The Parties are independent contractors. Nothing creates partnership, agency (except Aashaz's role under clause 19), employment or fiduciary relationship.

39.2 No person other than a Party has the right to enforce the Agreement, except as expressly stated in clauses 19.5, 22.4, 31 and 34.6 for the persons named there. The Parties may amend the Agreement without any third party's consent.

40. Force majeure

40.1 Neither Party is liable for delay or failure to perform (other than to pay money due) caused by an event beyond its reasonable control, including act of God, flood, fire, earthquake, epidemic, war, terrorism, civil disturbance, strike or labour dispute (other than of its own personnel), governmental action, change in law, sanctions, embargo, internet, telecommunications or power failure, cyber attack that could not have been prevented by reasonable measures, and failure of public infrastructure.

40.2 The affected Party shall notify the other promptly and use reasonable efforts to resume performance. If the event continues for more than 60 days, either Party may terminate the affected Service on written notice, and BnR360 will refund prepaid Fees for the period after termination. This clause is in addition to, and does not limit, clause 14.

41. Regional terms

41.1 Schedule A (Regional Terms) forms part of this MSA. It applies to a Customer, End Subject or processing connected to the region it describes.

41.2 If Schedule A conflicts with the rest of this MSA, Schedule A prevails for the region concerned, to the extent of the conflict and only so far as the law of that region requires.

42. Governing law and disputes

42.1 Governing law. This Agreement, and every non-contractual obligation arising out of or in connection with it, is governed by the laws of the Islamic Republic of Pakistan, without regard to conflict of laws rules.

42.2 Courts. Subject to clause 42.4, the courts at Karachi, Sindh, Pakistan have exclusive jurisdiction over any dispute arising out of or in connection with this Agreement, including its existence, validity or termination. Each Party irrevocably submits to that jurisdiction and waives any objection to venue or inconvenient forum.

42.3 Escalation. Before starting proceedings, except for urgent interim relief or a claim for unpaid Fees, a Party shall give written notice of the dispute, and senior representatives shall meet or confer in good faith for 30 days to try to resolve it.

42.4 No arbitration. The Parties do not agree to arbitrate. Every dispute is subject to the exclusive jurisdiction of the courts at Karachi, Sindh, as clause 42.2 provides, and no Order Form may elect arbitration.

42.5 Interim relief and Fees. Either Party may seek interim or injunctive relief to protect Confidential Information or intellectual property from any competent court. BnR360 may sue for unpaid Fees in the courts of Karachi or in any jurisdiction where Customer is located or holds assets.

42.6 Service of process. Customer agrees that proceedings may be served on it by courier or by email to its notice address, in addition to any method the law permits. Customer located outside Pakistan shall, on request, appoint an agent for service in Pakistan.

42.7 No class actions. To the extent permitted by Applicable Law, each Party may bring claims only in its own capacity and not as a plaintiff or class member in any representative proceeding.

42.8 This clause does not limit any right that Applicable Law gives a Customer that cannot be excluded by agreement.

43. Changes to this MSA and entire agreement

43.1 BnR360 may update this MSA, the AUP, a Product Addendum, the AI Addendum or the DPA from time to time by posting the updated version and notifying Customer by email at least 30 days before the effective date for an existing Customer. If Customer does not object in writing to support@bnr360.com within that period, the update applies. A change that is materially adverse to Customer and not required by law does not apply during a committed Initial Term or renewal term, but applies from the next renewal.

43.2 BnR360 may update immediately where required by Applicable Law, to address a security risk, or to add features or Products without reducing Customer's rights.

43.3 This Agreement is the entire agreement about its subject matter and replaces prior proposals, representations, understandings and negotiations. Each Party acknowledges that it has not relied on any statement not set out in the Agreement. Nothing excludes liability for fraud.

44. Notices

44.1 Notices to BnR360 must be in writing in English and sent by email to support@bnr360.com with the subject "LEGAL NOTICE", and by courier to BnR360 at H#C-40, Karachi University Staff Town, Karachi, Pakistan, attention: Legal. Notices to Customer are sent to the notice email and address in the Order Form or account, or posted in the Service.

44.2 Notices by email are deemed received at the start of the next Business Day (for notices to BnR360) or on the next day (for notices to Customer), and by courier on delivery or refusal.

44.3 Customer shall keep its notice details current. BnR360 may rely on the last details given.

45. General

45.1 Severability. If a provision is held invalid or unenforceable, it is enforced to the maximum extent permissible and the rest of the Agreement continues.

45.2 Waiver. A failure or delay in exercising a right is not a waiver. A waiver must be in writing.

45.3 Language. The Agreement is made in English, which prevails over any translation. Translations are for convenience only, unless Applicable Law requires otherwise.

45.4 Counterparts and e-signature. The Agreement may be executed in counterparts and electronically.

45.5 Cumulative remedies. Rights and remedies are cumulative, except as stated to be sole or exclusive.

45.6 Interpretation of days. A period of "days" means calendar days unless "Business Days" is stated.

45.7 Further assurance. Each Party shall do what is reasonably necessary to give effect to the Agreement.

Schedule A. Regional Terms

This Schedule supplements clause 41. A statement that Customer is responsible for compliance is not a statement that the law named applies in any given case. It identifies the principal regimes and allocates responsibility. Customer should take its own legal advice.

A.1 All regions

(a) Customer shall tell BnR360 before it uses a Service in a region in which it has not previously used it, if a local rule requires a licence, registration, local representative, localisation, consultation with workers or a regulator, or a local language contract.

(b) BnR360 may restrict or withdraw a feature in a region where it reasonably considers the feature cannot lawfully be offered or used there.

(c) Where Applicable Law of a region gives a person a right that cannot be excluded, that right is preserved to the minimum extent required, and the rest of this Agreement continues.

A.2 European Union, EEA and United Kingdom

(a) Data protection. Where the GDPR or the UK GDPR applies, the DPA, including the Standard Contractual Clauses and UK Addendum referred to there, applies. Customer is the controller and BnR360 the processor for Customer Personal Data. BnR360's representative in the Union and the United Kingdom, where Article 27 requires one, will be named in the Privacy Policy once appointed.

(b) Artificial intelligence regulation. Regulation (EU) 2024/1689 (the AI Act) may apply. AI systems used for recruitment, selection, evaluation or promotion are classified as high-risk under Annex III. The Parties acknowledge: (i) obligations that the AI Act places on a provider cannot be disclaimed by this Agreement and BnR360 will perform the obligations that apply to it in that capacity, as set out in the AI Addendum; (ii) Customer, as deployer, is responsible for obligations of deployers under Article 26, including using the system in accordance with instructions, assigning human oversight to competent persons, monitoring operation, keeping logs under its control for the period required, informing workers' representatives and affected workers before putting a high-risk system into use at the workplace, and informing individuals who are subject to decisions; (iii) Customer shall ensure AI literacy of its staff under Article 4; (iv) emotion recognition in the workplace and in recruitment is prohibited under Article 5(1)(f), and no Service is designed or authorised for that purpose; and (v) Article 50 transparency duties for interaction with an AI system or synthetic content are the responsibility of the Party identified in the AI Addendum.

(c) Data Act. Clause 25.5 applies.

(d) Electronic communications. Customer shall comply with Directive 2002/58/EC and national implementing law when it uses a Service to contact individuals, and shall obtain any consent required for cookies or similar technologies on pages it controls.

(e) Mandatory law. Nothing in this Agreement limits a right of an individual, or a supervisory authority power, that mandatory EU, EEA or UK law provides. Statements about law reflect the position at 6 October 2026 and may change, including through legislative simplification proposals that are not yet in force.

A.3 North America

Canada. (a) The Personal Information Protection and Electronic Documents Act and applicable provincial laws, including Quebec's Act respecting the protection of personal information in the private sector as amended by Law 25, may apply. Customer is responsible for consent, transparency about automated decisions and its own privacy impact assessments. Where Customer is in Quebec, the Parties confirm that they have required that this Agreement and all related documents be drawn up in English. Les parties confirment qu'elles ont exige que la presente convention ainsi que tous les documents connexes soient rediges en anglais. Where French is legally required, a French version will be provided on request to support@bnr360.com.

(b) Where Customer uses a Service to publish a job posting in Ontario that uses AI to screen, assess or select applicants, Customer is responsible for the disclosure required by the Employment Standards Act, 2000 from 1 January 2026.

(c) Canada's Anti-Spam Legislation applies to commercial electronic messages Customer sends through a Service. Customer is responsible for consent and identification requirements.

(d) Goods and services tax or harmonised sales tax that is payable on the Fees is Customer's cost and may be collected by Aashaz as agent under clause 20.

United States. (e) Customer is responsible for compliance with federal, state and local employment, anti-discrimination and privacy law, including the California Consumer Privacy Act and its regulations on automated decision-making technology, other state comprehensive privacy laws, Illinois' Artificial Intelligence Video Interview Act and Biometric Information Privacy Act, New York City Local Law 144 (which requires a bias audit and notice before an automated employment decision tool is used for candidates or employees in New York City), the Colorado Artificial Intelligence Act as and when effective, and any similar law. BnR360 does not conduct, and is not responsible for, any bias audit, impact assessment, notice or consent that law requires of an employer, and Customer shall not enable a feature in a jurisdiction where it has not completed them.

(f) BnR360 acts as a service provider or processor under US state privacy laws for Customer Personal Data, on the terms of the DPA. Neither Party sells Customer Personal Data.

(g) The Services are not offered for use as a consumer report or in a way that makes BnR360 a consumer reporting agency under the Fair Credit Reporting Act, and Customer shall not use a Service for that purpose.

A.4 Middle East

(a) Applicable regimes. Depending on the location of Customer and End Subjects, these may include the Saudi Personal Data Protection Law and its implementing regulations, the UAE Federal Decree-Law No. 45 of 2021 on Personal Data Protection, the Dubai International Financial Centre Data Protection Law No. 5 of 2020, the Abu Dhabi Global Market Data Protection Regulations 2021, and the data protection laws of Qatar, Bahrain, Oman and other states.

(b) Transfers. Customer authorises transfer of Customer Personal Data outside the country concerned, including to Pakistan, and is responsible for determining whether a transfer is permitted, and for any consent, assessment, notification or approval a regulator requires. BnR360 will cooperate with reasonable requests for information to support them.

(c) Government and regulated customers. BnR360 does not warrant that any Service meets a local residency, sovereign cloud, classification or certification requirement unless an Order Form expressly says so.

(d) Language. English is the governing language. An Arabic translation is for convenience only, unless law requires otherwise.

(e) Customer shall not use a Service in a way that contravenes local law on content, public morality, defamation or religious sensitivities where it operates.

A.5 South East Asia

(a) Applicable regimes. These may include Singapore's Personal Data Protection Act 2012, Malaysia's Personal Data Protection Act 2010 as amended, Indonesia's Personal Data Protection Law (Law No. 27 of 2022), Thailand's Personal Data Protection Act B.E. 2562, the Philippines' Data Privacy Act of 2012 and Vietnam's Personal Data Protection Law taking effect on 1 January 2026.

(b) Transfers and impact assessments. Customer is responsible for consent, notice, cross-border transfer conditions, data protection impact assessments and any registration or filing with a regulator that applies to its own processing. BnR360 will provide reasonable assistance on request.

(c) Language. Where Indonesian law requires an agreement with an Indonesian party to be in the Indonesian language, the Parties will, on request, enter into an Indonesian version, and the English version prevails to the extent permitted by law.

(d) Local hiring rules. Customer is responsible for local rules on discrimination, work permits and employment practices in the country concerned.

A.6 Australia

(a) The Privacy Act 1988 (Cth) and the Australian Privacy Principles may apply. Customer is responsible for notice, consent and compliance for its own use, and for the transparency about automated decisions required from 10 December 2026. The notifiable data breaches scheme applies as it applies.

(b) The Australian Consumer Law (Schedule 2 to the Competition and Consumer Act 2010 (Cth)) may give rights that cannot be excluded. To the extent Services are not of a kind ordinarily acquired for personal, domestic or household use, BnR360's liability for failure to comply with a consumer guarantee is limited, so far as the law allows, to resupplying the Services or paying the cost of resupply.

(c) If Customer is a small business, as defined for the unfair contract terms regime, the Parties acknowledge that this Agreement may be a standard form contract, and that BnR360 has taken care to draft terms that protect only its legitimate interests.

(d) Customer shall comply with the Spam Act 2003 (Cth) and the Do Not Call Register Act 2006 (Cth) in its messages and calls to individuals.

(e) Goods and services tax, where applicable, is added to the Fees under clause 20.

A.7 Pakistan

(a) Applicable law. The Services are supplied from Pakistan subject to the Electronic Transactions Ordinance, 2002, the Prevention of Electronic Crimes Act, 2016, the Contract Act, 1872 and other Pakistani law. Pakistan has not, as at 6 October 2026, enacted a comprehensive personal data protection statute. BnR360 will comply with any such law from its effective date, and Customer shall cooperate with reasonable steps required to do so.

(b) Government customers. A Customer that is a government body or state-owned enterprise warrants that it has authority and appropriations for the Order Form, that its procurement complied with applicable rules, and that it is responsible for deciding whether data may be placed in the cloud under the Cloud First Policy and data classification rules. BnR360 does not warrant that the Services satisfy any classification requirement unless an Order Form says so.

(c) Foreign exchange and taxes. Payments by a Customer outside Pakistan are expected to be received through Aashaz or banking channels in compliance with State Bank of Pakistan requirements. Customer shall provide information reasonably required for tax, banking or regulatory compliance.

(d) Content. Customer shall not use a Service to publish or process content that is unlawful under the Prevention of Electronic Crimes Act, 2016, including cyber stalking, defamation or unauthorised access.

Acceptance wording

Where Customer accepts online or in a Mobile App, BnR360 will show the following statement next to an unticked box or button: "I am authorised to bind my organisation. I have read and agree to the BnR360 Master Subscription Agreement effective 6 October 2026, including the Acceptable Use Policy, the Data Processing Addendum, the AI Services and Responsible AI Addendum and the applicable Product Addendum, and I acknowledge the BnR360 Privacy Policy."

A signed Order Form accepts this MSA in the same way.