BnR360 Data Processing Addendum

1. Definitions

1.1 In this DPA: “Controller”, “Processor”, “Data Subject”, “Processing” and “Supervisory Authority” have the meanings in Data Protection Law, and include the equivalent terms (for example business, service provider, data owner, data user, organisation, personal information controller or personal data processor) used in a law that applies.

1.2 “Applicable Data Protection Law” means the Data Protection Law that applies to Customer Personal Data, and to each Party's processing of it.

1.3 “EU SCCs” means the standard contractual clauses annexed to Commission Implementing Decision (EU) 2021/914. “UK Addendum” means the International Data Transfer Addendum to the EU SCCs issued by the UK Information Commissioner under section 119A of the Data Protection Act 2018, in force from 21 March 2022. “Restricted Transfer” means a transfer of Customer Personal Data that Applicable Data Protection Law restricts unless a transfer mechanism applies.

1.4 “Personal Data Breach” means a Security Incident affecting Customer Personal Data.

2. Scope, roles and instructions

2.1 Schedule 1 describes the subject matter, nature, purpose and duration of the processing, the types of Customer Personal Data and the categories of Data Subjects.

2.2 Customer is the Controller (or equivalent) and BnR360 is the Processor (or equivalent). Where Customer is itself a processor for a third party, Customer warrants that its instructions, including the appointment of BnR360 and its Subprocessors, are authorised by the relevant controller, and BnR360 acts as a sub-processor.

2.3 BnR360 shall process Customer Personal Data only on Customer's documented instructions, which are: the Agreement; Customer's configuration and use of the Services; and further reasonable written instructions that are consistent with the Agreement. BnR360 may also process as required by law to which it is subject, and shall tell Customer of that legal requirement before processing unless the law prohibits it.

2.4 BnR360 will inform Customer if, in its opinion, an instruction infringes Applicable Data Protection Law, but is not obliged to carry out a legal assessment of instructions. BnR360 may suspend the instruction until Customer confirms or modifies it. BnR360 is not liable for processing in accordance with an instruction that it has so flagged and Customer has confirmed.

2.5 Any instruction that falls outside the Services as described, or that requires additional effort, may be charged at BnR360's then current rates.

3. Customer responsibilities

3.1 Customer is solely responsible for: the lawfulness of its processing and instructions; determining the legal basis; providing notices, obtaining consents and giving information to Data Subjects, including about the use of AI and of Subprocessors and AI Providers; the accuracy and quality of Customer Personal Data; assessing whether the Services suit its needs and legal duties; configuring retention, access and security options; and responding to Data Subjects and authorities as controller.

3.2 Customer shall not submit Customer Personal Data in a category excluded by clause 9.4 of the Master Subscription Agreement unless the Order Form or Product Addendum expressly supports it. If Customer does so, it must first have a legal basis and any condition of lawful processing for the special category, and is responsible for any resulting risk.

3.3 Customer acknowledges that BnR360 does not decide the purposes of processing, and that decisions about individuals are Customer's.

4. Personnel and confidentiality

BnR360 shall ensure that persons authorised to process Customer Personal Data are bound by confidentiality duties, in writing or by law, and receive appropriate training. Access is limited to what is needed to provide and support the Services.

5. Security

5.1 BnR360 shall implement and maintain the technical and organisational measures in Schedule 2, taking account of the state of the art, the costs, the nature, scope, context and purposes of processing and the risks to individuals.

5.2 Customer is responsible for assessing whether those measures are appropriate for its data and for implementing its own measures, including access controls, multi-factor authentication, secure use of integrations and exports, and training of Authorised Users.

5.3 BnR360 may update the measures if the update does not materially reduce the overall level of protection.

6. Subprocessors

6.1 General authorisation. Customer gives BnR360 general written authorisation to engage Subprocessors, including its affiliates, cloud infrastructure providers and AI Providers, to process Customer Personal Data in connection with the Services. The Subprocessors currently engaged include Microsoft Azure and DigitalOcean (cloud infrastructure) and OpenAI, Google (Gemini) and DeepSeek (AI Providers), with the functions and locations given in the list described in clause 6.2.

6.2 List on request. BnR360 does not publish its Subprocessor list. It will give the current list, with each Subprocessor's name, function and processing location, to Customer on request to support@bnr360.com with the subject Subprocessor Request, subject to the confidentiality obligations in the Agreement.

6.3 Notice of changes. BnR360 will give Customer at least 30 days' notice, by email to Customer's notice address, before authorising a new Subprocessor that will process Customer Personal Data, or replacing one. Notice may be limited to the fact that the list has been updated, with the details available on request. BnR360 may shorten the notice period to deal with an emergency, a security risk, or the loss of a Subprocessor's service, in which case Customer may object afterwards.

6.4 Objection. Customer may object in writing within 14 days of the notice, on reasonable data protection grounds, with reasons. The Parties will discuss the objection in good faith. If BnR360 cannot reasonably accommodate it, for example by changing the configuration, or by providing the Service without the Subprocessor, Customer may terminate the affected Service on written notice within 30 days, and BnR360 will refund prepaid Fees for the unused period. That is Customer's sole remedy for the objection. If Customer does not object in time, it is deemed to have authorised the change.

6.5 Flow-down. BnR360 shall bind each Subprocessor by a written contract (which may be the Subprocessor's standard terms where it does not negotiate them) that imposes data protection obligations that provide, in substance, the level of protection that Article 28(3) GDPR or equivalent law requires, to the extent the Subprocessor's service allows.

6.6 Responsibility. Where Applicable Data Protection Law, including Article 28(4) GDPR, makes a processor liable to the controller for a Subprocessor's failure to fulfil its data protection obligations, BnR360 remains liable only to the extent that law requires, subject to the limits and exclusions in the Master Subscription Agreement to the extent permitted. In all other cases clause 14 of the Master Subscription Agreement governs, and BnR360 is not responsible for a Third-Party Provider Event, including a Subprocessor's act or omission, failure or breach of law.

7. AI Providers

7.1 Customer Personal Data submitted to an AI Feature may be sent to the AI Providers that BnR360 selects for that feature and processed to produce the output.

7.2 BnR360 selects AI Provider interfaces and settings with reasonable care. It does not itself use Customer Personal Data to train or fine-tune models for other customers. It does not promise, unless the Order Form says so, that an AI Provider will not retain, log, monitor for abuse or use the data, or process it in a particular location, because those matters are governed by the AI Provider's terms.

7.3 DeepSeek is accessed through its own hosted service for certain AI Features of GenRapide and NexGen RFP, and data sent to it may be processed in the People’s Republic of China. BnR360 does not use DeepSeek for NeuroHire. BnR360 will not route Customer Personal Data, Special Category Data or confidential bid information to DeepSeek for a Customer unless Customer has enabled it, or the Order Form permits it, and Customer shall ensure it has the legal basis and has satisfied any transfer condition required. Customer may exclude DeepSeek in the Order Form. BnR360 is implementing zero data retention configurations with OpenAI and Google Gemini for customers with sensitive data, which apply only where the Order Form expressly provides them.

7.4 Customer may instruct BnR360 in the Order Form to exclude a named AI Provider for its account. BnR360 will use reasonable efforts to comply, and the exclusion applies only from the date confirmed in writing.

8. Personal Data Breach

8.1 BnR360 will notify Customer without undue delay after it becomes aware of a Personal Data Breach, and will aim to do so within 72 hours of confirming it, to Customer's security or notice email address. The notice will, to the extent known, describe the nature of the breach, categories and approximate numbers of Data Subjects and records, likely consequences, and measures taken or proposed. Information may be given in phases.

8.2 BnR360 shall take reasonable steps to contain and investigate the breach. Customer is responsible for notifying Supervisory Authorities and Data Subjects as controller. A notification or response is not an admission of fault or liability.

8.3 Where a breach arises in a Subprocessor, BnR360 will pass on the material information it receives, as clause 18.5 of the Master Subscription Agreement states.

9. Data Subject requests

9.1 BnR360 will, taking into account the nature of the processing, give Customer reasonable assistance, by appropriate technical and organisational measures where possible, in responding to requests by Data Subjects to exercise their rights. Many requests can be completed by Customer using the Service.

9.2 If BnR360 receives a request directly from a Data Subject that identifies Customer, it will, unless the law prohibits it, advise the Data Subject to contact Customer or pass the request to Customer. BnR360 will not respond further unless Customer instructs it or the law requires.

9.3 BnR360 may charge for assistance that goes beyond what is reasonable.

10. Impact assessments and regulators

10.1 BnR360 will give Customer reasonable assistance with data protection impact assessments, fundamental rights impact assessments for high-risk AI, and prior consultation with a Supervisory Authority, to the extent the assistance relates to the processing under this DPA and the information is reasonably available to BnR360.

10.2 If a Supervisory Authority or other regulator contacts BnR360 about Customer Personal Data, BnR360 will, unless the law prohibits it, tell Customer and cooperate on reasonable request. Each Party is responsible for its own compliance and response.

11. Audits and information

11.1 BnR360 will make available information reasonably necessary to demonstrate compliance with this DPA, including the Security and Trust Statement, summaries of third-party assessments and its written responses to a security questionnaire, which BnR360 will answer no more than once in any 12 months, unless there has been a Personal Data Breach or a regulator requires more.

11.2 If that information does not satisfy a legal audit right that Customer holds, Customer may, on at least 30 days' written notice, at its own cost and no more than once a year, conduct an audit, itself or through an independent auditor bound by confidentiality, during Business Days and Support Hours, in a way that does not unreasonably disrupt BnR360 or compromise the security or confidentiality of other customers' data or BnR360's systems. The scope is confined to BnR360's own facilities and records for the Services, and a Subprocessor's environment is audited only through the reports and rights that the Subprocessor offers. Customer shall give BnR360 a copy of any report, which is BnR360's Confidential Information.

11.3 BnR360 may charge for time spent on an audit beyond reasonable cooperation.

12. International transfers

12.1 Authorisation. Customer authorises BnR360 to transfer and process Customer Personal Data outside Customer's country, including in Pakistan and the countries where its Subprocessors operate, subject to this clause.

12.2 EU SCCs. Where Customer Personal Data subject to the GDPR is a Restricted Transfer to BnR360 in a country without an adequacy decision, the EU SCCs apply and are incorporated by reference, completed as follows: Module Two (controller to processor) applies, and where Customer is a processor Module Three applies; clause 7 (docking) is included; in clause 9(a), Option 2 (general authorisation) applies with the period of notice in clause 6.3; in clause 11, the optional language is not included; in clause 17, the law of Ireland applies; in clause 18(b), the courts of Ireland; Annex I is completed by Schedule 1 and Schedule 4; and Annex II by Schedule 2. For onward transfers to Subprocessors, BnR360 will use Module Three or another valid mechanism.

12.3 UK. Where the UK GDPR applies, the UK Addendum applies, with the EU SCCs as completed above as the Approved EU SCCs, and the Tables completed from Schedule 1 and Schedule 4. For Table 4, neither Party may end the Addendum when the Information Commissioner issues a revised version.

12.4 Switzerland. Where the Swiss Federal Act on Data Protection applies, the EU SCCs apply with references to the GDPR read as references to that Act, the competent authority being the Federal Data Protection and Information Commissioner, and the term Member State including Switzerland so that Data Subjects in Switzerland may enforce their rights.

12.5 Other jurisdictions. For a Restricted Transfer under another law, the Parties will, at Customer's request, enter into the transfer mechanism recognised by that law, such as standard contractual clauses approved by the relevant authority. Customer is responsible for any filing, approval or notification that law requires of the exporter. Schedule 4 lists regions and mechanisms.

12.6 Precedence. If this DPA conflicts with the EU SCCs or UK Addendum, those clauses prevail as to the transfer concerned. The limits in clause 15 do not limit the rights of Data Subjects under the EU SCCs.

12.7 Government access. BnR360 will review any request from a public authority for Customer Personal Data, notify Customer unless prohibited, challenge a request that it reasonably believes to be unlawful, and disclose the minimum necessary. BnR360 has not received a request that it must report, and Customer acknowledges that BnR360 cannot make representations about Third-Party Provider conduct.

13. Regional provisions

13.1 California and other US states. BnR360 is a service provider or processor. It shall: process Customer Personal Data only for the business purposes in the Agreement; not sell or share it; not retain, use or disclose it outside the direct business relationship or for any other purpose; not combine it with other personal data except as the law allows; comply with the law and give the same level of protection; notify Customer if it can no longer meet its obligations; and permit Customer to take reasonable steps to stop and remediate unauthorised use. BnR360 certifies that it understands and will comply with these restrictions.

13.2 Canada. BnR360 will protect personal information with safeguards appropriate to its sensitivity, and use it only for the purposes of the Agreement. Customer is responsible for consent and for notice of transfers outside Canada and of the risk of access by foreign authorities.

13.3 Middle East, South East Asia and Australia. BnR360 will process Customer Personal Data in accordance with Customer's instructions and the safeguards in this DPA. As between the Parties, Customer is responsible for assessing and meeting the transfer, registration, localisation, notification and impact assessment requirements in each country, and BnR360 will give the reasonable assistance clause 10 describes. Schedule 4 contains the position per region.

13.4 Pakistan. BnR360 will process Customer Personal Data in accordance with the laws of Pakistan applicable to it, and will comply with any data protection statute from its effective date.

14. Return and deletion

On termination or expiry, BnR360 will make Customer Personal Data available for export and will delete it on the schedule in clause 25 of the Master Subscription Agreement. BnR360 may keep Customer Personal Data to the extent required by law, in backups until their ordinary overwrite, and for legal claims, under the continuing protection of this DPA. BnR360 will delete on Customer's written instruction before then, subject to the same limits. Data held by Subprocessors is deleted according to their schedules, and BnR360 will request deletion where it is able.

15. Liability

15.1 Each Party's liability under this DPA is subject to clauses 14, 30, 33 and 34 of the Master Subscription Agreement, to the extent permitted by Applicable Data Protection Law. A Data Subject's rights against a Party under the EU SCCs, and liability that cannot be limited by law, are not limited.

15.2 Customer's obligations under clause 31 of the Master Subscription Agreement apply to claims by Data Subjects and regulators arising out of Customer's instructions, notices, consents, basis for processing or decisions.

16. Records and cooperation

Each Party shall keep the records of processing that Applicable Data Protection Law requires. Each shall cooperate in good faith with the other on compliance under this DPA. BnR360 may rely on Customer's confirmation of the legal basis and notices.

17. Term

This DPA starts with the Agreement and continues while BnR360 processes Customer Personal Data, including during the export and deletion periods. Clauses 12, 14, 15 and 17 survive.

18. Changes

BnR360 may update this DPA on notice under clause 43 of the Master Subscription Agreement to reflect changes in law, regulator guidance, approved transfer mechanisms or its services, without reducing the protection required by law. Where law requires a change to a transfer mechanism, Customer shall sign any document reasonably needed.

19. Precedence

This DPA prevails over the Master Subscription Agreement as to the processing of Customer Personal Data, subject to clause 3 of that Agreement. The EU SCCs and UK Addendum prevail over this DPA as clause 12.6 states.

20. Governing law and forum

This DPA is governed by the law that governs the Master Subscription Agreement and subject to the same forum clause, except that the EU SCCs, the UK Addendum and any other transfer mechanism are governed by the law and subject to the forum the mechanism specifies, and Applicable Data Protection Law applies as it mandatorily applies.

Schedule 1. Details of processing

Nature and purpose. Hosting, storage, retrieval, parsing, indexing, analysis, transformation, transcription, translation, summarisation, matching, scoring, drafting, display, transmission, backup, support and deletion of Customer Personal Data to provide the Products ordered, on Customer's instructions.

Duration. The term of the Agreement, plus the export and deletion periods in clause 25 of the Master Subscription Agreement.

Frequency. Continuous, for as long as Customer and its Authorised Users use the Services.

Customer Personal Data and Data Subjects by Product. NexGen RFP means the product shown elsewhere as NexGen | RFP. Special categories are processed only if Customer chooses to submit them.

Authorised Users in all Products. Name, work email, role, credentials, usage and security logs.

Schedule 2. Technical and organisational measures

BnR360 maintains measures of the following kind. Final statements of practice are in the Security and Trust Statement, which is informational.

• Governance. A named person responsible for information security; written security and acceptable use policies; annual review of risks; confidentiality undertakings from personnel.
• Access control. Role-based access on least privilege and need to know; unique accounts; prompt removal on departure; periodic access review.
• Customer account controls. Role permissions, Authorised User management and, multi-factor authentication for Customer accounts, available on request for all Products, and, where offered, single sign-on.
• Encryption. Encryption of Customer Data in transit using HTTPS with current versions of TLS, and at rest using encryption provided by the cloud infrastructure.
• Tenant separation. Logical separation of Customer Data between customers.
• Hosting. Production environments in Microsoft Azure and DigitalOcean, which provide physical and environmental security of data centres under their own controls.
• Logging and monitoring. Logging of authentication and administrative events and monitoring for anomalies; log protection from tampering.
• Vulnerability management. Patching on a risk basis, dependency scanning, periodic vulnerability assessment and, for material releases, review of changes before deployment.
• Secure development. Separation of development, test and production; code review; secrets kept out of source code; no production Customer Data in test environments except as needed and protected.
• Backup and recovery. Weekly backups held in separate protected storage, removed in the ordinary cycle and not restored after the Export Period ends, and a business continuity plan proportionate to the Services.
• Incident response. A documented process to detect, triage, contain, notify and learn from Security Incidents.
• Vendor management. Selection of Third-Party Providers with reasonable care; written confidentiality and data protection terms; review on a risk basis.
• AI-specific controls. Provider selection and configuration settings reviewed on a risk basis; input and output handling to reduce prompt injection and leakage between customers; restriction on routing to any AI Provider excluded by the Order Form; documented human-review prompts in Products used for hiring and procurement.
• Data minimisation and deletion. Collection limited to what the Product needs; configurable retention where offered; deletion on schedule under clause 25 of the Master Subscription Agreement.
• Personnel. Security awareness training on joining and periodically; background screening where lawful and proportionate.

BnR360 does not hold ISO 27001, SOC 2 or comparable certification as at 6 October 2026, and does not represent otherwise.

Schedule 3. Subprocessor disclosure and notice procedure

3.1 Categories. Cloud infrastructure; AI Providers; email and communications; identity and security tooling; analytics and crash reporting; customer support; payment processing.

3.2 Information on request. For each Subprocessor the list shows: name and legal entity; function and Products affected; location of processing; categories of Customer Personal Data; and, for Restricted Transfers, the transfer mechanism.

3.3 How to request. Email support@bnr360.com with the subject Subprocessor Request, from an address linked to Customer's account or a person identified in an Order Form. BnR360 replies in Support Hours and aims to provide the list within five Business Days of a verified request.

3.4 Notice of change. Notice under clause 6.3 of this DPA is given by email stating that the list has been updated. A Customer that wishes to receive notices at an additional address must tell BnR360 at support@bnr360.com.

3.5 Confidentiality. The list is BnR360's Confidential Information. It may be shared with Customer's regulators, auditors and advisers who need it, under duties of confidence.

Schedule 4. Transfer particulars and regional position

A. Parties (EU SCC Annex I.A and UK Addendum Table 1). Data exporter: Customer, with the contact and role in the Order Form. Data importer: BnR360 BnR360, H#C-40, Karachi University Staff Town, Karachi, Pakistan; contact support@bnr360.com. Role: processor. Where Customer is a processor, Module Three applies and BnR360 is a sub-processor.

B. Description of transfer (Annex I.B). As in Schedule 1. Sensitive data: only where Customer chooses to submit it, with the safeguards in Schedule 2 including restricted access, encryption and logging. Frequency: continuous. Retention: as in clause 14 of this DPA. Subprocessor transfers: as in Schedule 3, the subject matter, nature and duration being those in Schedule 1.

C. Competent supervisory authority (Annex I.C). If Customer is established in an EU Member State, the authority responsible for Customer. If Customer is not established in the Union but Article 3(2) GDPR applies, the authority of the Member State where its representative is established or, if none, where the Data Subjects are located. In the United Kingdom, the Information Commissioner's Office.

D. Regional position. Statements of law are as at 6 October 2026 and are for allocation of responsibility only.

E. UK Addendum particulars. Table 2 selects the Approved EU SCCs as completed in clause 12.2. Table 3 Annexes are Schedules 1, 2, 3 and 4. Table 4: neither Party may end the Addendum on a revised Approved Addendum.