Privacy Policy

1 Who we are

Bridge91 Corporate Services Private Limited (“Bridge91”, “we”, “us”) was incorporated in India in 2026, with corporate identity number (CIN) U78300TS2026PTC223471. Its registered office is at 3rd Floor, D.No. 1-89/1/42, Sri Ram Nagar Colony, Madhapur, Hyderabad, Shaikpet, Telangana, India, 500081. We are an Employer of Record for India. We also provide Bridge91 CoR (Contractor on Record), Talent Sourcing, Talent Lifecycle Management, Business Operations (Finance, Tax, Governance and Importer of Record), Workspace and Bridge91 Elevate.

We decide why and how the personal data described here is used, except where we say we act on a client’s instructions, so we are responsible for it: the “controller” under the EU and UK GDPR where they apply, and the “Data Fiduciary” under India’s Digital Personal Data Protection Act, 2023 (the DPDP Act). For any question about this policy or your data, write to privacy@bridge91.com.

2 Who this policy covers

Visitors to bridge91.com; people who email us or book a call; people at our clients, prospects, suppliers and partners; the people we employ or engage for clients, including new hires; and candidates we consider for roles.

Our web-based portal at portal.bridge91.com has its own notices, for client users and for employees and new hires. They give more detail and apply alongside this policy.

3 What we collect

When you visit the site. Cloudflare, which hosts the site, receives your IP address, browser details and the pages you request, as any web host does, and Cloudflare Web Analytics counts visits without cookies. If you accept analytics, Google Analytics and PostHog also receive the pages you view, where you came from, your device and browser, your approximate location, how you scroll and click, and technical details such as page errors and loading times. PostHog also makes session recordings, which replay your path through the pages with what you type into fields masked, and, if we run one, may show you a short survey. Our Cookie Policy has the detail.

Our calculators work in your browser, and we do not receive the figures you enter, though if you have accepted analytics a session recording can show the results on screen.

When you contact us or book a call. Your name, email address, company, role and what you tell us. Calls are booked on Cal.com. If you use our costing form for Indian companies, your answers travel to Cal.com in the booking page’s web address and become your booking notes.

When you work with us. Business contact details, contracts, correspondence, and billing and payment records. For company, tax and customs work, the details of directors, shareholders and signatories that the law requires.

When you use the portal. Your account details, sign-in records (time, IP address and country) and an audit log of what you do there.

When we employ or engage you for a client. Identity and contact details, PAN, bank, salary and tax details, PF and ESI numbers, earlier employment this tax year, leave and reimbursement records, the equipment issued to you and where it is delivered, and supporting documents. We do not ask for your Aadhaar number when you join. You may give a masked copy of your Aadhaar card as proof of identity and address. If an Aadhaar number is already on your payroll record, our portal shows only its last four digits. A few details are sensitive, such as disability status, which can lower your tax; we ask only what tax and labour law make relevant. Group Health Insurance needs your details, and those of any family members the policy covers. When we help with a claim, we also receive the medical information the claim needs. Contractors under Bridge91 CoR give us their contract, invoice, GST and bank details.

When you are a candidate. Your CV, contact details, experience, pay and our interview notes, from you, from people who refer you, or from the talent platforms and partners we search.

4 How we use it, and why

Where the EU or UK GDPR applies, these are our legal bases:

• Deliver the site and keep it secure

  Legal basis

  Our legitimate interest in a safe website

• Count visits without cookies

  Legal basis

  Our legitimate interest in knowing which pages are read

• Analytics with cookies

  Legal basis

  Your consent, which you can withdraw at any time

• Remember your cookie choice

  Legal basis

  Our legal duty to respect and record it

• Reply to you and arrange calls

  Legal basis

  Our legitimate interest in answering enquiries, or steps you ask for before a contract

• Provide our services, invoice and keep accounts

  Legal basis

  Our contract, and our legal duties on tax and company records

• Run the portal and protect accounts

  Legal basis

  Our contract with your company, our legitimate interest in security, and our legal duty to keep security logs

• Employ people for clients

  Legal basis

  The employment contract, and our legal duties as employer

• Find and present candidates

  Legal basis

  Our legitimate interest, and yours, in filling a role

• Answer lawful requests, defend claims

  Legal basis

  Our legal duties, and our legitimate interest in protecting our rights

Under Indian law we use personal data with your consent, or for a purpose the law allows without it, such as data you give us for a stated purpose, employment, or a legal obligation. The DPDP Act’s main duties begin on 13 May 2027. Until then the Information Technology Act, 2000 and its 2011 rules on sensitive personal data apply, and this policy is published under them.

If we send you news about our services, we do so only where the law allows, and every such email lets you stop them. We make no decisions about you by automated means alone, and we do not profile you for advertising.

5 Our role as your employer

When we employ someone for a client, we are that person’s legal employer in India. We decide how their employment, payroll, tax and statutory records are handled and we answer for them under Indian law, so for that data we are the Data Fiduciary, or in GDPR terms an independent controller. Where a client asks us to do something for its own purposes, such as preparing a report on its team, we act on its instructions for that task. The client directs the person’s daily work and is responsible for the data it holds itself. Our agreement with each client sets out the detail.

New hires give their details through a secure, emailed onboarding link, after reading a notice written for them. Employees see payslips and Form 16 in Zoho Payroll’s employee portal. Before you join, the client sees your name, job, joining date and onboarding progress, never your PAN, bank details or documents. After you join, it sees your pay figures and payslips.

6 Who receives your data

We do not sell personal data or share it for advertising. We share it only as each purpose needs: with the service providers below, under contracts that let them use it only to serve us; with government bodies, such as the Income Tax Department, EPFO, ESIC and the state, company, GST and customs authorities, as the law requires; with banks, insurers and their administrators; with partners who deliver part of a service you or your company asked for, such as background verification, recruitment platforms, logistics, and property, design and build; with our auditors, lawyers and other professional advisers; with the client a person works for, or a candidate’s prospective client; with your new employer, if your employment moves to a client’s own Indian company under Bridge91 Elevate; where we need to establish or defend legal claims; and with a successor if our business is reorganised or sold, under the same protections.

• Cloudflare

  What it does for us

  Hosts this site and the portal, counts visits, stores portal files

  Where

  Worldwide network; portal files in the EU

• Google

  What it does for us

  Email, calendars and documents; analytics if you accept; portal sign-in

  Where

  United States and other countries

• PostHog

  What it does for us

  Analytics and session recordings, if you accept

  Where

  United States

• Cal.com

  What it does for us

  Call booking

  Where

  United States

• WhatsApp (Meta)

  What it does for us

  Support messages with signed clients, if you use it

  Where

  United States and other countries

• Zoho

  What it does for us

  Payroll, and our own accounts

  Where

  India

• Neon

  What it does for us

  The portal’s database

  Where

  Germany (Frankfurt)

• Amazon Web Services

  What it does for us

  Encrypted backups and security logs

  Where

  Ireland, with an encrypted copy in India

• GitHub

  What it does for us

  Runs the portal’s nightly backup job

  Where

  United States

• Resend

  What it does for us

  Sends the portal’s emails

  Where

  United States

• Sentry

  What it does for us

  Reports portal errors, with personal details removed

  Where

  Germany

7 International transfers

We are in India, we serve clients abroad, and our providers work in the countries shown above, so personal data moves between India, the EU, the United States and the country you are in.

Where the EU or UK GDPR applies to a transfer to a country without an adequacy decision, we rely on the European Commission’s standard contractual clauses, with the UK Addendum for UK data, or on the EU-US Data Privacy Framework and its UK Extension where the recipient is certified. India has no EU or UK adequacy decision, so when a client in the EU or the UK sends us personal data, we include the standard contractual clauses, with the UK Addendum for UK data, in our agreement with it. Write to privacy@bridge91.com for a copy.

Indian law allows these transfers where our contract with you or your company needs them, or with your consent, and the Indian Government has not restricted transfers to any country.

8 How long we keep it

• Your cookie choice: in your browser until you change it or clear your browser storage. We ask again after 12 months.
• Analytics: Google Analytics deletes data tied to individual visitors after at most 14 months. PostHog keeps session recordings and other analytics data only as long as they help us improve the site, within the retention limits of our PostHog plan.
• Enquiries and bookings that lead nowhere: as long as we need them to follow up with you.
• Client, supplier and partner records: for the relationship and 8 years after it ends, as Indian company and tax law require.
• Portal accounts: while your company uses Bridge91. An account is switched off when you leave or your company asks; its audit log stays as the record of what was done.
• Employment, payroll and tax records: while you work through us and 8 years after you leave. The portal deletes bank details 30 days after we confirm Zoho Payroll holds them.
• Candidates: as long as we may reasonably consider you for a role, unless you join through us or ask us to delete your details sooner.
• Portal security logs: at least 180 days, and no longer than we need them to investigate security incidents.
• Backups: what we delete stays in encrypted backups until they expire, at most 40 days later.

Cloudflare keeps the request data it handles for a limited period under its own policies. When a period ends we delete or anonymise the data, unless a legal claim or a regulator needs it kept.

9 Your rights

Wherever you are, you can ask us for a copy of the personal data we hold about you and who we shared it with; to correct, complete or update it; to delete it where we no longer need it and the law does not require us to keep it; to stop using it for a purpose you object to, such as news about our services; and to withdraw a consent, such as to analytics, as easily as you gave it. Withdrawing does not affect what we did before.

In the EU and the UK you can also ask us to restrict our use of your data, to give it to you in a portable form, and to stop processing based on our legitimate interests. In India, from 13 May 2027, you can also nominate someone to use your rights if you die or cannot act yourself.

Write to privacy@bridge91.com. We may ask you to confirm who you are. We reply within one month. If a request is complex, or we receive many, we may take up to two months more, and we tell you within the first month if we do. If the law requires us to keep something, such as payroll records, we tell you what and why.

10 Complaints and grievances

Our Grievance Officer handles concerns about how we use personal data. Write to privacy@bridge91.com, or by post to our Grievance Officer at our registered office, 3rd Floor, D.No. 1-89/1/42, Sri Ram Nagar Colony, Madhapur, Hyderabad, Shaikpet, Telangana, India, 500081, and we will address your grievance within one month of receiving it.

If we have not resolved your grievance, from 13 May 2027 you can complain to the Data Protection Board of India. In the EU, you can complain to the data protection authority where you live, work or think the problem arose; in the UK, to the Information Commissioner’s Office (ico.org.uk). We would welcome the chance to put things right first.

11 How we protect it

We use measures that are standard for a business of our size: encrypted connections, and access limited to the people who need it. In the portal, PAN and bank details are encrypted, only team members an administrator has named can see them in full, and each time one does we record who, when and why. Backups are encrypted.

We hold no security certification, such as ISO 27001 or SOC 2, and no system is perfectly secure. If a breach affects your personal data, we will report it to the authorities, and tell you, where and as the law requires.

12 Children

The site and our services are for businesses and working adults, not for anyone under 18, and we do not knowingly collect personal data from children. If the group health policy covers an employee’s children, we receive the children’s details from that parent and use them only for that cover.

13 If you are in the United States

We do not sell personal data, or share it for cross-context behavioural or targeted advertising. Wherever you live in the United States, you can ask us to access, correct or delete your personal data at privacy@bridge91.com, and we will not treat you differently for asking. Someone you authorise in writing may ask for you.

14 Changes to this policy

We post any change here with a new date. If a change materially affects how we use your data, we will also point it out on the site or by email.