This Privacy Policy (“Privacy Policy”) is designed to provide data subjects (individuals) with information on the processing of their personal data (any information relating to them) when they interact with the Nebius websites (nebius.com, nebius.ai) or web-resources connected with them (“Websites”).

This Privacy Policy is based on the provisions of data protection laws, which may be applicable in the country of your residence, including the General Data Protection Regulation (GDPR) and other laws.

Terms and definitions in this Privacy Policy shall have meaning that is given to them in applicable data protection laws.

1. Data controller1. Data controller

The data controller with regard to personal data processed under this Policy is Nebius B.V. (Gustav Mahleraan 300, 1082ME Amsterdam, the Netherlands) or its affiliated companies located worldwide (each of them collectively referred to as “Nebius” or “we”). You can find more specific information about data controller in the terms of use and/or privacy notice of the service you are interested in.

You can contact Nebius on any questions relating to the processing of personal data under this Privacy Policy by email at privacy@nebius.com, or any other method approved by Nebius.

2. Purposes and legal bases for processing2. Purposes and legal bases for processing

Under this Privacy Policy, Nebius processes personal data to:

• ensure smooth operation of the Website;

• inform current and potential customers, as well as other website visitors about Nebius activities and provided services;

• communicate with data subjects regarding their requests or sending them marketing and informational materials;

• improve functioning of the Website and Nebius products in general;

• comply with applicable laws and protect its legal rights.

When doing so, Nebius relies on

• the necessity of the processing for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;

• the necessity of the processing of personal data to comply with its legal obligations;

• the necessity of the processing of personal data for the purposes of the legitimate interests pursued by Nebius;

• consent of a data subject to process his or her personal data.

Please note that direct marketing communications with you shall be made only upon your prior opt-in consent, and you will have an opportunity to opt-out at any time using the “unsubscribe” button in messages you receive from us.

The legitimate interests of Nebius consist of (1) compliance with applicable laws and regulations; (2) marketing of the Nebius services and other products (except for the cases, where consent is required); (3) improvement of the Nebius services; (4) provision of security of the Nebius services; (5) protection of Nebius’ legal rights. You can get more information on the legitimate interests pursued by Nebius and relevant balancing tests by sending a request with the use of contact details specified in section 1 of this Privacy Policy.

We do not process your personal data for other purposes that are not covered by this Privacy Policy.

3. Categories of processed personal data3. Categories of processed personal data

Under this Policy, Nebius processes the following categories of personal data:

Personal data collected directly from the data subject:Personal data collected directly from the data subject:

• full name;

• email address;

• phone number;

• company Name;

• job title;

• other information voluntarily provided by the data subject in feedback forms on the Website.

Automatically collected personal data:Automatically collected personal data:

Certain information is collected automatically when you interact with the Website, such as device’s internet protocol address, browser type, browser version, type and device ID, geographical location based on the IP address, statistics on page views and time spent on pages, log files, information obtained through cookies or similar technologies.

4. Recipients of personal data4. Recipients of personal data

We may disclose certain personal data to the following recipients to the extent required or permitted by applicable law and/or based on your consent:

• affiliate entities which are a part of Nebius group of companies;

• partners assisting us in gathering statistical and aggregated information about how users interact with the Website;

• service providers who assist us in our activities, such as: IT services, legal advisers, accountants, suppliers of payment processing services, providers of cloud services for hosting and storage of information related to the Website, sales and marketing services;

• partners otherwise assisting in achievement of the purposes mentioned in the section 2 of this Privacy Policy;

• public authorities if strictly required for the purpose of fulfilling legal obligations;

• other third parties when it is required to satisfy applicable laws.

In the event that Nebius goes through a business transition, such as a merger, acquisition by another company, or sale of all or a portion of its assets, your personal data may be among the assets transferred and it will be transferred only subject to restrictions similar to those contained herein or as otherwise be required by applicable laws and regulations.

5. Transfers to third countries5. Transfers to third countries

Nebius transfers personal data to countries where its affiliated entities and partners are located. Some of these countries do not provide for a sufficient level of protection of data subjects’ rights under the applicable data protection laws. If this is the case, Nebius employs necessary measures in order to ensure lawfulness of such transfer.

You can get more information on the mechanisms of transfers to third countries by Nebius by sending a request using the contact details specified in section 1 of this Privacy Policy.

6. Storage periods6. Storage periods

We will retain your personal data for as long as is necessary to fulfil the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law. Non-personally information may be retained and used by Nebius without limitation.

7. Third Party services7. Third Party services

The Website may contain links to third party websites and services, which are outside Nebius control and are not covered by this Privacy Policy. Nebius is not responsible for the privacy practices of such websites and services, and encourages you to review their privacy notices.

8. Safeguards to protect your information8. Safeguards to protect your information

We take a great care in implementing and maintaining reasonable and appropriate security procedures consistent with prevailing industry standards to protect your personal data.

While we take reasonable precautions against possible security breaches, no website or internet transmission is completely secure, and we cannot guarantee (i) that unauthorized access, hacking, data loss, or other breaches shall never occur; and (ii) the security of your data; any transmission is at your own risk. Nebius urges you to take steps to keep your personal data safe, including your account password, and your authorizations.

9. Rights of data subjects9. Rights of data subjects

In respect of your personal data, you have the rights to:

Access	You can ask Nebius to confirm whether or not we process your personal data. If so, you can access these personal data and ask us to explain certain details of the processing.
Rectification	You can ask Nebius to correct inaccurate personal data concerning you. If it complies with the purposes of the processing, you can ask us to rectify incomplete or inaccurate personal data.
Erasure (“The right to be forgotten”)	You can ask Nebius to erase personal data concerning you under applicable law. For example, this applies if (1) the personal data is no longer necessary in relation to the purposes for which it was processed; (2) you withdraw consent to the processing and there is no other legal ground for the processing; (3) the personal data has been unlawfully processed.
Restrictions on processing	You can ask us Nebius to mark the stored personal data with the aim to limit its processing in the future under applicable law. This applies if (1) you contest the accuracy of the personal data; (2) you ask to restrict the use of the personal data when its processing is unlawful; (3) you need personal data to protect your rights when we no longer need such personal data; (4) you have objected the processing based on the legitimate interests pursued by Nebius or by a third party.
Objection to processing (where provided to the data subjects under applicable laws)	You can object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on the legitimate interests pursued by Nebius or by a third party. We shall no longer process the personal data unless we demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defense of legal claims.
Portability (where provided to the data subjects under applicable laws)	When the processing is based on your consent or on the agreement with you, you can receive personal data, which you have provided to us, in a structured, commonly used and machine-readable format and can freely transmit those data to another controller. Where technically feasible, you can also ask us to transmit the personal data directly to another controller.

To exercise their rights, you can contact Nebius using the contact details specified in section 1 of this Privacy Policy.

10. Withdrawal of consent10. Withdrawal of consent

Where processing is based on consent (or explicit consent), you have the right to withdraw consent at any time. The withdrawal of consent does not affect the lawfulness of the processing based on consent before its withdrawal. To withdraw consent, you can contact Nebius using the contact details specified in section 1 of this Privacy Policy.

11. Right to lodge a complaint with a supervisory authority11. Right to lodge a complaint with a supervisory authority

When provided by applicable laws, you have the right to lodge a complaint with a supervisory authority in the area of data protection in the place of your residence.

12. Necessity to provide personal data12. Necessity to provide personal data

We only collect such personal data that is necessary for us to achieve the purposes described in section 2 of the Privacy Policy. However, there are no statutory or contractual requirements obliging data subjects to provide us personal data processed under this Privacy Policy.

13. Tracking Technologies and cookies13. Tracking Technologies and cookies

We use cookies and similar tracking technologies to track the activity on the Website and store certain information.

For more information about the cookies we use and your choices regarding cookies, please visit our Cookie Policy.

14. Changes to this Policy14. Changes to this Policy

Nebius may change this Privacy Policy from time to time at its sole discretion. If so, we may notify you about these changes by an appropriate method. If there is no explicit notification, you may always review the up-to-date version of this Privacy Policy located at https://nebius.ai/privacy-policy.