Privacy Policy

Lynq is a workforce recruitment and deployment platform operated by BoonLynq (“BoonLynq”, “we”, “us”), with its principal place of business in Hyderabad, Telangana, India. Recruitment organisations use it to manage projects, candidates, interviews, offer letters, medical checks, visas and deployments, mainly for overseas employment in the GCC.

Different laws use different terms for the same roles. The party that decides why and how data is processed is a Data Fiduciary in India and a Controller under the GCC laws. The party that processes data on its behalf is a Data Processor. Our role depends on whose data it is:

• Customer data. For the candidate, client and staff data that a subscribing organisation (“Customer”) uploads, the Customer is the Controller and BoonLynq is its Processor. We process that data only to provide the service and on the Customer’s documented instructions.
• Our own data. For account holders’ login details, billing records, demo requests, support messages and website usage, BoonLynq is the Controller.

If you are a candidate and a recruitment agency or employer has added you to Lynq, that organisation decides how your data is used. Please contact it first. We will help it respond to you.

Because Lynq supports recruitment from India to the GCC, we have designed our data handling to meet all of the following laws, as amended from time to time:

• India: Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025; Information Technology Act, 2000.
• United Arab Emirates: Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data; DIFC Data Protection Law No. 5 of 2020 and ADGM Data Protection Regulations 2021 in those free zones; Federal Law No. 2 of 2019 on the Use of ICT in Health Fields for health data.
• Kingdom of Saudi Arabia: Personal Data Protection Law (Royal Decree No. M/19 of 1443H), its Implementing Regulations and the Regulation on Personal Data Transfer outside the Kingdom.
• State of Qatar: Law No. 13 of 2016 on the Protection of Personal Data Privacy; QFC Data Protection Regulations 2021 in the Qatar Financial Centre.
• State of Kuwait: CITRA Data Privacy Protection Regulation (2024); Law No. 20 of 2014 on Electronic Transactions.
• Kingdom of Bahrain: Law No. 30 of 2018 with respect to Personal Data Protection.
• Sultanate of Oman: Personal Data Protection Law (Royal Decree No. 6/2022) and its Executive Regulations (Ministerial Decision No. 34/2024).
• Elsewhere: the EU and UK General Data Protection Regulations, where a Customer or candidate falls within their scope.

Where these laws set different standards, we apply the more protective standard wherever practicable. Nothing in this policy limits a right that a mandatory law of your country gives you.

Account and organisation information

We collect organisation name, registration or licence number, country, and the authorised representative’s name, email and mobile number. For individual users (organisation admins, staff, clients, client staff and partner agencies) we collect name, work email, employee or login ID, role and permissions. Passwords are stored only as salted one-way hashes.

Candidate information (provided by Customers)

• Identity and contact details: full name, email, phone number, date of birth, gender and nationality.
• Travel and emigration eligibility: passport number and Indian emigration status (ECR / ECNR).
• Professional profile: résumé, position applied for, Gulf and overseas experience, skills, education, previous employers and certifications.
• Pipeline records: shortlisting, interview schedules and outcomes, selection decisions, remarks, and failure or revert history.
• Stage documents: offer letters and signed employment contracts, medical fitness reports, visa and work-permit documents, and travel tickets with travel dates.
• Other supporting documents a Customer chooses to upload, such as attested educational certificates or police clearance certificates.

Interviews and communications

We keep interview schedules, video-meeting links, join times and, where enabled, recordings (see section 7). We also keep emails, WhatsApp messages and in-app chat messages sent through Lynq, together with delivery status logs.

Payment information

Subscription payments are processed by Razorpay and Stripe. We receive and keep the plan, amount, currency, status and transaction references. We never receive or store full card numbers, CVV or banking credentials.

Connected accounts

If a Customer connects its own mailbox (Gmail, Outlook, Zoho or custom SMTP) or WhatsApp Business account, we store the credentials or access tokens needed to send messages on its behalf. They are encrypted at the application level before storage.

Technical information

We log IP address, browser and device type, session identifiers, request timestamps and error data. We use it to keep the service secure, detect abuse and fix faults.

The GCC laws give extra protection to “sensitive” data, also called data “of a special nature”. In overseas recruitment, the following categories fall into that group:

• Health data: medical fitness results from GCC-approved medical centres (booked through the Wafid platform, formerly GAMCA) or Qatar Visa Centres, and any re-medical outcome.
• Criminal record data: police clearance certificates, where a visa or employer requires one.
• Identity documents: passport details and national identity numbers.

We handle this data under stricter rules:

• It is processed only where a visa, work permit or deployment legally requires it, and only with the explicit consent or other legal basis that applicable law demands. The Customer is responsible for obtaining that consent from candidates.
• Only users the Customer has specifically authorised can see it. Files are served through signed download links that expire within minutes.
• Customers should upload only the minimum needed. For example, a fitness result such as “fit” or “unfit” is usually enough, rather than full clinical detail.

What we never collect. Lynq does not ask for religion, ethnicity, political opinions, trade union membership or biometric data. Biometric enrolment for GCC visas takes place directly on government or visa-centre systems, not in Lynq. Customers must not upload these categories unless a specific law requires them for an application.

We process personal data only on a legal basis that the applicable law recognises. Under the Qatari, Bahraini, Omani and Kuwaiti frameworks, consent carries particular weight. The Saudi and UAE laws also recognise processing needed to perform a contract, comply with the law, or pursue legitimate interests.

We do not use candidate data for our own marketing, and we do not build profiles of candidates across Customers. Each Customer’s data is kept separate from every other Customer’s.

Lynq uses AI services to save recruiters time:

• Résumé parsing. Uploaded CVs are processed to extract structured fields (skills, experience, education, employers). Contact details can be redacted from the shareable résumé.
• Content drafting. AI helps draft job descriptions and support tickets from the information you enter.

AI output is a suggestion that authorised users review and can edit. Lynq does not make decisions based solely on automated processing that have legal or similarly significant effects on candidates. Every shortlist, selection and rejection is made by a person. This respects the right, recognised under the UAE PDPL and similar laws, to object to purely automated decisions. Our AI providers (listed in section 8) process data under business API terms that prohibit training their models on it.

Interviews scheduled through Lynq run on Google Meet. Where a Customer enables recording, an automated recording participant joins the meeting, and the recording is saved to the Customer’s secure storage in Lynq.

• Recordings are used only to review and evaluate the interview, and to resolve disputes about it.
• Only users the Customer has authorised can open a recording, through a link that expires.
• Recording a person without consent can be a criminal offence under the privacy and cybercrime laws of several GCC states and of India. The Customer must tell candidates and interviewers in advance that the interview will be recorded, and must obtain their consent.
• A participant who does not want to be recorded should tell the organiser before the interview starts.

We do not sell or rent personal data. We share it only with the parties below, and only as needed to run the service.

Government and visa systems. Customers submit data to authorities themselves, for example on eMigrate, MoHRE, Musaned, Wafid or Qatar Visa Centres, or to embassies. Those submissions are the Customer’s own disclosures. Lynq does not transmit data to those systems on the Customer’s behalf.

We may also disclose personal data:

• within a Customer’s own workspace, to its staff, clients (such as the overseas employer) and partner agencies, according to the permissions the Customer sets;
• to Indian or GCC authorities where the law, a court order or a lawful government request requires it;
• to protect the rights, safety or property of our users, candidates, the public or BoonLynq;
• to a successor entity in a merger, acquisition or asset sale, which will remain bound by this policy.

Cross-border recruitment means data moves between countries by design. A candidate’s profile is created in India and shared with an employer in a GCC state, and our sub-processors run cloud infrastructure in several regions. Details of our hosting regions are available on request.

We transfer personal data only through a mechanism the applicable law recognises:

• an adequacy decision or approved-country list, where the law provides one (for example, Bahrain’s list of adequate jurisdictions);
• standard contractual clauses, including the clauses SDAIA has issued under the Saudi Regulation on Personal Data Transfer outside the Kingdom;
• necessity to carry out a contract with the candidate or in the candidate’s interest, such as processing an overseas job application and deployment;
• the individual’s explicit consent, where the law allows consent as a basis for transfer.

We do not transfer data to any country the Government of India has restricted under the DPDP Act, 2023.

Data localisation. Some GCC laws restrict where certain data may be stored. The best-known example is health data under the UAE’s Federal Law No. 2 of 2019 on the Use of ICT in Health Fields. Data processed by government-linked entities may also be subject to in-country requirements. If a Customer needs in-country hosting for any category of data, it must tell us before uploading that data, and we will agree on suitable arrangements in writing.

We keep personal data only as long as we need it:

• Customer data is kept for the life of the subscription. After an account ends, the Customer has 30 days to export its data. We then delete it or irreversibly anonymise it within 90 days, apart from backups, which expire on their normal cycle.
• Statutory records. Recruiting agents may have to keep records for longer, under the Emigration Rules, 1983 or GCC labour laws. That duty belongs to the Customer, which should export what it needs before its data is deleted.
• Sessions: refresh tokens expire automatically and are purged. Revoked sessions cannot be reused.
• One-time passcodes are purged automatically after they expire.
• Integration event logs (payment, messaging and meeting webhooks) are deleted automatically after 30 days.
• Invoices and payment records are kept for the period required by Indian tax and company law, generally 8 years.

We protect personal data with technical and organisational measures that include:

• TLS encryption in transit, and encryption at rest through our cloud providers;
• salted bcrypt hashing for passwords, and application-level encryption for third-party credentials;
• strict tenant isolation, so each organisation sees only its own data;
• permission-based access control inside every workspace;
• short-lived access tokens with refresh-token rotation and replay detection;
• signed file-upload and file-download links that expire after minutes;
• concurrency safeguards that stop conflicting changes to pipeline records.

No system is completely secure. If a personal data breach affects Customer data, we will notify the affected Customer without undue delay so it can meet its own reporting duties. Where we are the Controller, we will notify regulators and affected individuals within the time limits the law sets. For example, the Saudi PDPL requires notice to SDAIA within 72 hours. India’s DPDP framework requires notice to the Data Protection Board, and CERT-In requires reportable cyber incidents to be reported within 6 hours.

The rights you have depend on the law that applies to you. Across India and the GCC, they generally include the right to:

• be informed about how and why your data is processed;
• access your data and obtain a copy;
• have inaccurate or incomplete data corrected;
• have your data erased once it is no longer needed, subject to legal retention duties;
• withdraw consent at any time, without affecting processing already done;
• object to or restrict processing, including direct marketing and purely automated decisions (UAE, Saudi Arabia, Bahrain, Oman);
• receive your data in a portable format, where the law provides for it (for example, the UAE PDPL);
• nominate another person to exercise your rights if you die or become incapacitated (India);
• complain to us first, and then to the data protection regulator in your country (see section 13).

Account holders can send requests to privacy@boonindia.ai. Candidates should contact the recruiting organisation, which controls their data. If you write to us directly, we will pass your request to that organisation and support its response. We may need to verify your identity. We aim to respond within 30 days, or sooner where local law sets a shorter deadline.

The authorities and laws below apply to personal data processed in connection with each country. You may complain to the regulator of the country where you live or work, or where the processing takes place.

Lynq does not use advertising, cross-site tracking or third-party analytics cookies. The web app stores a small amount of data in your browser’s local storage: session credentials so you stay signed in, your organisation’s branding, and interface preferences such as dismissed notices. This data is strictly necessary for the app to work. Signing out or clearing your browser storage removes it.

Lynq is a business tool for people aged 18 or over. The GCC labour laws and India’s emigration rules strictly limit the employment of minors abroad, and some occupations have higher minimum ages. Customers must not use Lynq to recruit anyone under 18, or under the higher minimum age for a particular role or destination. We do not knowingly process children’s data. If we learn that we hold it without a lawful basis, we will delete it.

This policy is published in English. We will provide an Arabic translation on request. Where the law allows, the English version prevails if the two differ.

In line with the Information Technology Act, 2000, the Digital Personal Data Protection Act, 2023 and the GCC data protection laws, you can raise any concern about how we handle personal data with our Grievance Officer:

We acknowledge grievances within 48 hours and aim to resolve them within 30 days.

We may update this policy as our service or the law changes. For material changes, we will notify account holders by email or in the app at least 15 days before the changes take effect. We will post the updated policy on this page with a revised effective date.