BnR360 Subprocessor Disclosure

1. Purpose

1.1 This Disclosure identifies the categories of third party providers that BnR360 engages to deliver the Services and, where they process Customer Personal Data on BnR360's behalf, the manner in which BnR360 makes the detailed list available. It supplements the MSA, the Privacy Policy, the DPA, the AI Addendum and the Product Addenda (Sphere, NeuroHire, GenRapide, NexGen RFP, GenRapide Light).

2. The Detailed List Is Available on Request Only

2.1 BnR360 does not publish a detailed Subprocessor list. The current list is provided on reasonable request to: Customers, prospective enterprise Customers, and their procurement, privacy, security and legal teams.

2.2 To request it, email support@bnr360.com with the subject "Subprocessor Request" and state the organisation, the BnR360 product concerned and, if applicable, the reason for the request. BnR360 replies Monday to Friday during business hours, 7:00 a.m. to 4:00 p.m. EST. Where Applicable Law or the DPA fixes a deadline for providing the list, BnR360 will meet it.

2.3 BnR360 may require a confidentiality undertaking before supplying infrastructure or security detail whose disclosure could create a security risk.

3. Meaning of Subprocessor

3.1 A "Subprocessor" is a third party engaged by BnR360 that processes Customer Personal Data on BnR360's behalf in providing the Services. A vendor is not necessarily a Subprocessor. A provider may fall outside the term if it receives no Customer Personal Data, acts as an independent controller, or receives information directly from the Customer under a separate relationship. Classification depends on the actual processing arrangement, and an AI Provider is a Subprocessor only where it processes Personal Data in that capacity.

4. Categories and Principal Providers

4.1 BnR360 engages third parties for: cloud infrastructure and hosting, storage, databases and backups, AI and machine learning functionality, authentication, communications, security and monitoring, support, analytics, and payment related services.

4.2 The principal providers at the effective date are:

• Cloud infrastructure: Microsoft Azure and DigitalOcean.
• AI Providers: OpenAI, Google (Gemini) and DeepSeek.

4.3 Not every provider is used for every Customer, product, feature or request. A Customer should not assume that every AI request is processed by the same provider. BnR360 selects providers by reference to capability, performance, availability, security, cost, latency, geographic availability, Customer requirements and regulatory considerations.

4.4 DeepSeek is accessed through its own hosted service for certain AI Features of GenRapide and NexGen RFP, and data sent to it may be processed in the People's Republic of China. DeepSeek is not used for NeuroHire. It is not used for Special Category Data or for any Customer who has excluded it, and personal data of candidates, employees or bidder representatives and confidential bid information are not routed to it unless the Customer has enabled that routing as AI Addendum provides.

5. Payment and Billing

5.1 Aashaz Technology Inc. may act as BnR360's authorised billing, invoicing and payment collection agent and may receive limited Customer account and billing information. Whether it is a Subprocessor, a processor, or an independent controller depends on the processing concerned, and BnR360 will state its classification in the Customer specific list where it is a Subprocessor. Stripe processes payments and is connected to Aashaz's account. Stripe and other payment processors may receive limited billing information.

6. What the Detailed List Contains

6.1 On request BnR360 will state, where known: the provider, its function, the BnR360 product concerned, the general categories of data, its role (Subprocessor or other), the processing region, and whether it supplies AI functionality.

6.2 BnR360 may give a Customer specific list because products use different combinations of providers.

7. No Commitment Arising From Listing

7.1 Listing a provider is not a representation that the provider operates under zero data retention, does not train on data, or processes data in a particular country. Those matters vary by service, endpoint, contract and configuration and bind BnR360 only where stated in an Order Form or AI schedule.

7.2 The list is not a data residency commitment. A residency requirement (for example Canada, the European Union or Saudi Arabia) applies only if recorded in the Order Form.

7.3 Certifications and attestations held by a provider belong to that provider and do not make BnR360 certified.

7.4 BnR360's own policy is not to use identifiable Customer Data to train a general purpose AI model for unrelated customers. Third party AI Providers keep their own data handling terms, subject to the contract and configuration in use.

8. Flow Down and Transfers

8.1 Where a third party is a Subprocessor, BnR360 will bind it by a written contract that imposes data protection obligations required by Applicable Data Protection Law and the DPA, including confidentiality, security and processing restrictions.

8.2 Subprocessors may process data outside the Customer's country, including in the United States, Canada, Europe, Asia and other regions supported by the provider. Where Applicable Data Protection Law requires a transfer safeguard, BnR360 will use the mechanism set out in the DPA, which may include the EU Standard Contractual Clauses, the UK Addendum, the Swiss adaptation, or another recognised mechanism.

9. Changes and Objections

9.1 BnR360 may add, replace or remove Subprocessors. Where the DPA applies, BnR360 will give Customers who have asked to be notified at least fifteen (15) days' prior notice of a new Subprocessor that will process their Customer Personal Data, unless the DPA or the Order Form provides a different period or an urgent replacement is needed to protect security or availability.

9.2 A Customer may object on reasonable data protection grounds within the period and in the manner stated in the DPA. The parties will then discuss in good faith additional safeguards, an alternative configuration or provider, or restriction of the affected feature. The remedies in the DPA are the Customer's sole remedies for such objection.

10. Responsibility

10.1 Subject to clause 14 of the Master Subscription Agreement and to Applicable Law that cannot be excluded, including the liability of a processor for its sub processors under Article 28(4) of the GDPR where that Article applies, BnR360 is not responsible for the independent acts, omissions, outages, model behaviour, AI output, security incidents, retention practices or unlawful acts of any Subprocessor or other third party provider.

10.2 The Customer is responsible for deciding whether the BnR360 provider architecture meets its own regulatory, contractual and procurement requirements. BnR360 will supply reasonable information for that assessment.

11. Changes to this Disclosure and Contact

11.1 BnR360 may update this Disclosure as providers, products and laws change.

11.2 Contact: support@bnr360.com, subject "Subprocessor Request", or H#C-40, Karachi University Staff Town, Karachi, Pakistan.