Privacy Policy

1Information We Collect

We collect personal data that you provide directly to us, as well as data generated through your use of our websites and services. This includes:

Information you provide directly:

• Identity data — full name, username, date of birth
• Contact data — email address, phone number, mailing address
• Account data — login credentials, profile information, preferences
• Professional data — employment history, skills, portfolio links, CVs (for HireLink and careers applications)
• Business data — company name, business registration number, products, store information (for Blink Business vendors)
• Property data — property listings, agent licence numbers, location details (for Auctome agents)
• Financial data — payment method details, billing address, transaction history (processed via secure third-party payment gateways)
• Communication data — messages sent through our platforms, support tickets, contact form submissions

Information collected automatically:

• Technical data — IP address, browser type, device type, operating system, referring URLs
• Usage data — pages visited, features used, search queries, click-through data, session duration
• Location data — approximate location based on IP address; precise location only with your explicit permission
• Cookie data — see Section 5 for full details

2How We Use Your Information

We use the personal data we collect for the following purposes:

• Service delivery — to create and manage your account, process transactions, match freelancers with jobs (HireLink), facilitate product purchases (Blink Business), and display property listings (Auctome)
• Communication — to send transactional emails, service notifications, security alerts, and, where you have opted in, marketing communications
• Customer support — to respond to enquiries, resolve disputes, and provide technical assistance
• Safety and security — to detect, prevent, and address fraud, abuse, security incidents, and illegal activity
• Legal compliance — to fulfil our obligations under Nigerian law, including the PDPA 2010, and to respond to lawful requests from public authorities
• Service improvement — to analyse usage patterns, conduct internal research, and enhance the functionality and user experience of our platforms
• Business operations — for recruitment, partnership, and general corporate administration purposes

We will not use your personal data for purposes incompatible with those stated above without first obtaining your consent.

3Legal Basis for Processing

Under the Personal Data Protection Act 2010, we process your personal data on one or more of the following grounds:

• Consent — where you have given your clear, informed agreement to specific processing activities (e.g. marketing emails)
• Contractual necessity — where processing is necessary to perform a contract with you or to take steps at your request before entering a contract
• Legal obligation — where processing is necessary to comply with a legal obligation to which we are subject
• Legitimate interests — where processing is necessary for our legitimate business interests, provided those interests are not overridden by your rights and freedoms

You may withdraw consent at any time by contacting us at info@brainpower.my. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

4Sharing of Information

We do not sell, rent, or trade your personal data. We may share your information in the following limited circumstances:

• Within our group — between BrainPower Engineering Company Limited and its technology ventures (HireLink, Blink Business, Auctome) for consistent service delivery and administration
• Service providers — with trusted third-party vendors who provide services on our behalf (e.g. cloud hosting, payment processing, email delivery, analytics), bound by strict confidentiality obligations
• Business counterparties — on HireLink, limited contact details are shared between employers and hired freelancers; on Auctome, agent contact information is shared with buyers who submit enquiries
• Legal requirements — when required by law, court order, or government authority, or where necessary to protect the rights, property, or safety of BrainPower, our users, or the public
• Business transfers — in connection with a merger, acquisition, or sale of all or a portion of our assets, with appropriate confidentiality protections in place

All third parties with whom we share data are required to maintain appropriate security measures and to use the data only for the specified purposes.

5Cookies & Tracking Technologies

Our websites use cookies and similar tracking technologies to enhance your experience and collect usage data. The types of cookies we use include:

• Strictly necessary cookies — essential for the operation of our websites (e.g. session management, authentication). These cannot be disabled.
• Functional cookies — remember your preferences (e.g. language, theme selection) to personalise your experience
• Analytical cookies — help us understand how visitors interact with our websites (e.g. pages visited, time spent) using tools such as Google Analytics
• Marketing cookies — used to deliver relevant advertising and to track the effectiveness of campaigns, where you have consented

You may manage or disable non-essential cookies through your browser settings or a cookie consent tool. Note that disabling certain cookies may affect the functionality of our platforms.

6Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, to comply with legal obligations, and to resolve disputes. Our general retention principles are:

• Active accounts — personal data is retained for the duration of your account and for a reasonable period thereafter
• Transaction records — financial and transactional data is retained for a minimum of 7 years to comply with Nigerian financial record-keeping requirements
• Job applications — career application data is retained for up to 12 months after the relevant recruitment process concludes
• Communication logs — support communications are retained for up to 3 years
• Marketing data — retained until you withdraw consent or opt out

When data is no longer required, it is securely deleted or anonymised in accordance with our internal data disposal procedures.

7Your Rights

Under the Personal Data Protection Act 2010, you have the following rights regarding your personal data:

• Right of access — to request a copy of the personal data we hold about you
• Right of correction — to request that inaccurate or incomplete data be corrected
• Right to withdraw consent — to withdraw consent for processing activities based on consent, at any time
• Right to limit processing — to request that we limit the processing of your data in certain circumstances
• Right to object — to object to processing carried out on the basis of legitimate interests, including direct marketing

To exercise any of these rights, please contact our Data Protection Officer at info@brainpower.my with your full name, contact details, and a description of your request. We will respond within 21 days. We may need to verify your identity before processing your request.

8Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. These measures include:

• Encryption of data in transit using TLS/SSL protocols
• Encryption of sensitive data at rest
• Access controls and role-based permissions limiting data access to authorised personnel only
• Regular security assessments and vulnerability testing
• Staff training on data protection and information security
• Incident response procedures in the event of a data breach

While we take security seriously, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security, but we commit to notifying you and the relevant authorities without undue delay in the event of a breach that is likely to result in a risk to your rights and freedoms.

9Third-Party Links

Our websites and platforms may contain links to third-party websites, services, or applications that are not operated by BrainPower. These include external payment processors, social media platforms, and partner services.

We have no control over and assume no responsibility for the content, privacy policies, or practices of any third-party sites or services. We strongly encourage you to review the privacy policy of every website you visit. This Privacy Policy applies solely to information collected by BrainPower and its ventures.

10Children's Privacy

Our services are not directed at individuals under the age of 18. We do not knowingly collect personal data from children. If you are a parent or guardian and believe your child has provided us with personal data without your consent, please contact us immediately at info@brainpower.my and we will take steps to delete such information promptly.

11Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other operational factors. When we make material changes, we will:

• Update the "Last Updated" date at the top of this page
• Post a notice on our websites or send a notification to registered users
• Where required by law, obtain your consent before the changes take effect

Your continued use of our services after the effective date of any revision constitutes your acceptance of the updated Privacy Policy. We encourage you to review this page periodically.

12Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or our data practices, please contact us: