Snapshot 256474
Normalized text
Scripts and page chrome removed; this is what change detection compares.
Skip to main content Introduction This Privacy Policy applies to the personal data that Nebius Group N.V. and its relevant subsidiaries listed in Section 14 (“Nebius,” “we,” “us,” or “our”) collects as a controller in connection with our websites, services, and related activities, including when you: Visit or interact with our corporate websites, product websites, documentation, or any Nebius domains or subdomains, including https://nebius.com/, https://tokenfactory.nebius.com/, and other Nebius subdomains. Use, access, or manage our services, including Nebius cloud services, APIs, developer tools, and Nebius Token Factory, where we process personal data as a controller. Subscribe to our updates and marketing communications. Register for or participate in our webinars, workshops, training sessions, marketing programs, events, or promotional activities. Apply to or participate in our partner program, including through the Nebius Partner Portal, or are named by one of our partners in information it shares with us. For details, please see our Partner Program Privacy Notice at https://docs.nebius.com/legal/partner-privacy-notice, which supplements this Privacy Policy. Apply for, participate in, or otherwise engage with our programs, competitions, challenges, grants, credits, startup programs, or similar initiatives, including the Nebius Startup Program. Engage with us in person, for example when you visit our offices, attend industry conferences where we exhibit, or meet our representatives. Inquire about or engage in commercial transactions with us whether for sales, support, consulting, or other business purposes. Are contacted by our sales or marketing representatives, including where we obtained your business contact details from a third party, such as an event organizer, a business data provider or a publicly accessible professional profile. See our Business Contact and Sales Outreach Privacy Notice for details. Interact with us on social media, through our branded LinkedIn pages or other official channels. After reading this Privacy Policy, please review the State- or Country-Specific Provisions at the end, which may supplement or - where required by law - take precedence over any conflicting terms. This Privacy Policy does not apply to: Job applicants. If you are applying for a position with Nebius, please see our separate HR Privacy Policy: https://docs.nebius.com/legal/hr-privacy-policy Third-party offerings. Any products, services, or content provided by third parties even other Nebius Group entities are governed by their own privacy policies. This Privacy Policy does not apply to personal data that we process solely on behalf of our customers as a processor under a separate data processing agreement. Terms and Definitions This Privacy Policy uses the key terms as defined by the EU General Data Protection Regulation (GDPR). Unless we explicitly state otherwise, these terms carry the same meanings and must be interpreted in accordance with the GDPR. Under the “Learn more” button, you can review detailed definitions of the terminology we use. Learn more GDPR: This term stands for General Data Protection Regulation, the EU Regulation (EU) 2016/679 of the European Parliament and of the Council, adopted on 27 April 2016 and in force since 25 May 2018. It sets uniform rules across the European Union for the processing of personal data and the protection of individuals’ privacy rights. Personal data: This term means any information relating to an identified or identifiable natural person (“data subject”). Controller: This term means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data. Performance of the contract: This term refers to the legal basis provided under Article 6(1)(b) of the GDPR. It means that the processing of personal data is necessary for the performance of a contract between you as a data subject and us, or to take steps at your request before entering into a contract. Consent: This term means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which they, by a statement or by a clear affirmative action, signify agreement to the processing of personal data relating to them. Legal obligation: This term refers to the legal basis provided under Article 6(1)(c) of the GDPR. It means that the processing of personal data is necessary for compliance with a legal obligation to which we, as the controller, are subject. Legitimate interest: This term refers to the legal basis provided under Article 6(1)(f) of the GDPR. It means that the processing of personal data is necessary for the legitimate interests pursued by us or a third party. However, we want to clarify that we do not rely on this legal basis unless we have determined that our interests are not overridden by your interests or fundamental rights and freedoms as the data subject that require protection of personal data. The standard contractual clauses approved by the EU Commission: This term refers to the appropriate safeguard for transfer of personal data to a third country provided under Article 46(2)(c) of the GDPR. For the purposes hereof, a third country is a country which is not in the EEA territory and is not recognized by the EU Commission as a country that ensures an adequate level of protection. 1. Personal Data We Collect 1.1. Personal Data You Provide to Us Registration. When you register to use our Services, you provide us with the following data: Full name Contact information, such as email address and phone number Job title Company name Company size Industry Account, organization, project, team, workspace, role, permission, and access-management information User identifiers, usernames, profile information, and account settings Any other information you supply in the registration form or account settings API Keys, Credentials and Developer Access. When you create, manage, or use API keys, tokens, service credentials, access permissions, roles, invitations, or similar developer-access features, we may collect and process data associated with those features, including user identifiers, account and organization identifiers, access settings, permission levels, timestamps, usage status, and related security or audit information. Third-Party Authentication. If you choose to sign up using your Google or GitHub account (or another supported third-party account), you authorize us to receive, store, and use any information that you have permitted the third party to share via its API. This may include, for example, your name, email address, profile picture, and any other data you have agreed to share. Service Payments. When you pay for our Services, we collect and process: Payment details Billing address (street, city, state/province, postal code, country) Tax/VAT identification, if required for invoicing Transaction records (dates, amounts, invoice/order numbers, payment status) Additional payment-related details you provide Contact, Sales and Product Inquiries. We collect the following information through the web form you complete to contact us or to submit your request or query to us, along with any other details you choose to provide: First name Last name Email address Phone number Job title Company name Company website Scenario, product, service, model, infrastructure, inference, fine-tuning, deployment, integration, or business use case you are interested in Any other information you decide to share Partner Programs and Partner Portal. When you apply to or participate in our partner programs, we collect your name, business contact details, job title, company information, account details, and information you provide in applications, deal registrations, support requests, training and communications with us. We also receive from our partners the business contact details of individuals at their prospective and existing customers, and of individuals identified in the onboarding and know-your-customer information partners provide about their customers. Nebius Certification Program. If you take a Nebius Certification exam (operated by our affiliate EdTech Plus B.V. / Nebius Academy) and, when booking the exam, opt in to receiving marketing communications from us, we receive the following data from the exam platform: first name, last name, email address, country, certificate name, exam date and exam result. We do not receive exam answers or proctoring recordings. Webinars, Events, Promotional Activities, Gifts and Merchandise. When you register for or participate in our webinars, workshops, training sessions, marketing programs, events, promotional activities, or request or receive gifts, merchandise or other promotional items from us, we may collect and process: Full name Contact information, such as email address and phone number Job title Company name Country, region or city Event, webinar or session registration details, including attendance status and participation information Delivery information, such as postal address, recipient name and phone number, where needed to send gifts, merchandise or other promotional items Any other information you decide to share with us in the relevant registration form or communication Support Communications. We collect any information you provide when you communicate with us by email, live chat, support tickets, community channels, or other means, including the content of your messages and any associated details. This may include account identifiers, organization or project identifiers, service configuration details, diagnostic information, logs, screenshots, attachments, error messages, and other information you choose to provide so that we can respond to your request, troubleshoot issues, and administer our Services. Partner Applications and Authorized Data Sharing. If you choose to connect, authorize, access or use a partner application, we may collect and process information related to that authorization and sharing. This may include: Your information, such as name, email address, company name and type of the request, other information you would like to share with a partner. Know Your Customer (KYC). We may ask you to provide information to verify your identity as part of our KYC procedures. This helps us comply with legal and regulatory requirements. You might be asked to submit: A partially obscured copy of your government-issued ID, showing only: Your photograph Your full name and surname Your nationality The place and type of document The first four digits of the document number Any other information necessary to complete our KYC checks 1.2. Personal Data We Collect Automatically: Service Use and Technical Data. When you use our Services, we automatically collect and generate metadata and technical data needed to provide, secure, administer, troubleshoot, bill for, and improve those Services. This may include: User, account, organization, project, role, and authentication identifiers API key and credential metadata, permission settings Resource, service, endpoint, model, feature usage, and configuration details Request and response metadata, including timestamps, status codes, error codes, latency, usage counts, quotas, and rate-limit information Performance, reliability, availability, diagnostic, error, and crash information Other technical details related to the operation, maintenance, security, troubleshooting, billing, and administration of our Services Cookies and Similar Technologies. For more details on this matter, please refer to Section 8 hereof. 1.3. Submissions on Behalf of Others When you provide information on behalf of another person or entity whether during registration or through any other interaction you confirm that you are authorized to: Supply and process the submitted details for that person or entity; Grant us the right to collect, use, and retain their information in accordance with this Privacy Policy. By submitting third‑party information, you confirm that you have a lawful basis to share it with us and that you have informed the individual concerned about this Privacy Policy. 1.4. Personal Data We Receive from Third Parties We also obtain personal data from sources other than you, in particular: from our partners, where they register a sales opportunity with us or provide information about their customers; from business data providers that compile professional contact information from publicly accessible and other lawful sources, which we use to complete and verify company and business contact records; from publicly accessible professional sources, such as your organization’s website or a professional networking profile you have made public; from organizers of third-party events we sponsor; from compliance data providers, where we perform know-your-customer and sanctions screening; and from third-party identity providers, where you choose to sign in to our Services through them, limited to the profile information you have authorized them to share. Where we obtain your personal data from partners, business data providers, public professional sources or event organizers, we use only business contact details and professional information relating to your role, and we inform you at the latest when we first contact you, including through this Privacy Policy, our Partner Program Privacy Notice and our Business Contact and Sales Outreach Privacy Notice. You can ask us at any time about the specific source of your data. 1.5. Sensitive Personal Data We do not intentionally collect sensitive personal data (e.g., information revealing race, ethnicity, political opinions, religion, or similar) and ask that data subjects refrain from submitting such information. 2. Why We Process Your Personal Data We collect and use personal data where necessary and proportionate for the following purposes: Responding to requests and inquiries: to process your requests, respond to your questions, provide appropriate feedback, and take steps needed to enter into or perform an agreement with you. Providing and administering our Services: to create, update, manage, and personalize your account; authenticate users; manage organizations, projects, roles, permissions, API keys, credentials, quotas, credits, billing, and service access; process payments; provide support; send service-related notices; and operate, maintain, and deliver our Services, including cloud services, AI infrastructure services, APIs, developer tools, consoles, dashboards, and Token Factory services. Operating, securing, and improving our Services: to monitor performance, reliability, availability, latency, capacity, errors, and service quality; troubleshoot issues; develop, optimize, and secure our Services; and detect, prevent, and investigate fraud, abuse, unauthorized access, security incidents, policy violations, or unlawful activity. Websites, analytics, and personalization: to improve the performance, content, and functionality of our websites and Services; analyze trends; measure usage; understand customer and user needs; and tailor our websites, Services, and communications to user preferences. Partner programs and Partner Portal: to assess partner applications; create and manage Partner Portal accounts; administer our partner programs; review and manage deal registrations submitted by partners, including evaluating and pursuing the opportunities they present; perform know-your-customer, sanctions and export-control checks; provide partner training and certifications; keep our partner and customer records complete and accurate; support partner participation; and communicate with partner representatives. Events, programs, and promotional activities: to register you for, administer, and follow up on webinars, workshops, training sessions, events, marketing programs, startup programs, competitions, challenges, grants, credits, promotional campaigns, and similar activities. Gifts, rewards, and merchandise: to provide, deliver, or otherwise make available gifts, merchandise, rewards, credits, or other promotional items that you request or are eligible to receive. Third-party services and integrations: to enable third-party services, partner applications, integrations, marketplace offerings, or authorized data sharing that you request or authorize, as further described in the applicable agreement or service terms. Research and aggregated insights: to conduct analytics, statistics, development, and research, including by creating aggregated or non-identifiable insights that may be shared with partners, affiliates, service providers, or other third parties. Compliance and legal obligations: to comply with applicable laws, regulations, judicial orders, administrative requirements, sanctions, export control, tax, accounting, KYC, and other legal or regulatory obligations. Rights, safety, and dispute resolution: to protect and enforce our rights, privacy, security, systems, property, business, users, and others; conduct audits and internal checks; resolve disputes; and establish, exercise, or defend legal claims. Marketing communications: with your consent where required by law, to send promotional updates, newsletters, information about new features, events, special offers, and other communications we believe may be relevant to you. We may also contact business professionals about Nebius services relevant to their professional role on the basis of our legitimate interest, in compliance with applicable electronic marketing rules (including obtaining prior consent where required). You can object to or opt out of direct marketing at any time, free of charge, by using the unsubscribe link in our communications or by contacting us, and we will then stop processing your personal data for that purpose. We rely on different legal bases depending on the purpose of processing, including performance of a contract, compliance with legal obligations, our legitimate interests, and consent where required by applicable law. Consent where required by law. Where applicable law requires your consent, we will ask for it separately before processing your personal data, for example through a consent form or cookie banner. Simply accessing or browsing our websites does not constitute consent. You may withdraw your consent at any time; withdrawal will not affect the lawfulness of processing carried out before you withdrew it. Learn more about the purposes for which we process your personal data and our lawful bases for doing so, using several examples Purpose of processing Legal Basis Example Send you our marketing newsletters Consent Monthly newsletter about new Nebius Cloud features, sent only after prior opt‑in Improve website performance and content Legitimate interest to improve website performance and content and optimize user experience Analyzing page‑load times on the Nebius portal and optimizing server responses Analyze trends Legitimate interest in analyzing usage trends to anticipate infrastructure needs, and deliver data-driven service enhancements Aggregating GPU to forecast infrastructure scaling needs Comply with applicable laws and regulations Legal obligation Retaining financial records to meet tax audit requirements Deliver our services: create/update/personalize your account; process payments; handle support; send service notifications; finalize contracts with you Contract performance Registering a new Nebius Cloud customer, charging the subscription fee, and notifying them of successful renewal Verify identity during onboarding (KYC checks) Legal obligation Performing customer verification checks to comply with anti‑money‑laundering regulations Contact you about Nebius services relevant to your professional role (business-to-business sales outreach) Legitimate interest in promoting our services to business customers, or consent where required by local law A Nebius sales representative emailing an engineering lead whose company recently registered for a Nebius AI Cloud account, or whose business contact details we obtained from a business data provider Review a deal registration submitted by a partner Legitimate interest in evaluating and pursuing business opportunities presented to us A partner registers an opportunity naming the IT director of its customer; Nebius reviews it and may contact the IT director 3. To Whom We Disclose Your Personal Data We may share certain personal data with the following recipients, as required or permitted by applicable law and our legitimate interests: Nebius Group: For the purposes of providing and developing our services, we may share your personal data within the Nebius Group. Service providers: We engage third‑party providers to help deliver our Services such as for maintenance, auditing, payment processing, customer support, marketing, and development. These providers may access the personal data they need solely to perform their tasks on our behalf, and they’re contractually prohibited from using or disclosing it for any other purpose. If you purchase Nebius services, we may also use a payment provider who may independently collect additional information about you (for example, for fraud prevention or compliance with legal requirements). Marketing and analytics providers: With your prior consent, we may share data with marketing and analytics providers (e.g., Google Analytics) to understand and improve how you use our website(s). Partners: Where a Nebius partner has registered a sales opportunity or named you as a contact, we share with that partner the status and outcome of its registration and information about the opportunity. Our partners act as separate controllers of the personal data they hold and process the data we exchange under data sharing terms in their agreement with us. Legal Disclosures: We may disclose your information if required by law, subpoena, or other legal process - or whenever we have a good‑faith belief that disclosure is necessary to: Investigate, prevent, or take action on suspected or actual unlawful activities, or to assist law‑enforcement agencies. Enforce our agreements with you. Defend against third‑party claims or allegations. Protect the security or integrity of our services or those of our affiliates. Safeguard the rights, safety, or property of Nebius, our users, employees, or others. Change in Control or Sale: We can also share your personal data as part of a sale, merger or change in control, or in preparation for any of these events. Any other entity which buys us or part of our business will have the right to continue to use your data, but only in the manner set out in this Privacy Policy or as required by law. 4. Your Rights According to the GDPR, you have certain rights as a data subject, including the right to access, right to data portability, right to rectification, right to withdraw consent, right to object, right to erasure, right to restriction of processing, right to lodge a complaint, and right to contact a Data Protection Authority (DPA). Please be aware that there may be limitations or exceptions to these rights, depending on the specific circumstances and legal requirements. If anything is unclear, please don’t hesitate to contact us and ask any questions. Below, you can find more information about these rights and how you can exercise them. Learn more Right of Access You may request access to the personal data we hold about you. We’ll provide details about how and why we process your data, the categories of data involved, any recipients, and other relevant information. Right to Data Portability You may receive the personal data you’ve provided to us in a structured, commonly used, machine‑readable format, and you can request that we transmit it directly to another controller where technically feasible. Right to Rectification If you believe your personal data is inaccurate or incomplete, you may request that we correct or update it. Right to Withdraw Consent If our processing relies on your consent, you can withdraw it at any time. Withdrawal won’t affect the lawfulness of any processing carried out before you withdrew consent. Right to Object You can object to our processing based on legitimate interests or for direct marketing. We will stop processing unless we have compelling legitimate grounds or a legal requirement to continue. Objections to direct marketing are always honored. Right to Erasure (“Right to Be Forgotten”) You may request deletion of your personal data unless processing is necessary for freedom of expression and information, compliance with a legal obligation, public‑interest tasks, or the establishment, exercise, or defence of legal claims. Right to Restrict Processing You may request that we suspend processing of your personal data if: You contest its accuracy; The processing is unlawful, and you oppose erasure; We no longer need it, but you require it to establish, exercise, or defend legal claims; or You have objected to processing pending verification of our legitimate grounds. Automated Decision-Making We do not make decisions based solely on automated processing, including profiling, that produce legal or substantial effects concerning you. Right to Lodge a Complaint You may lodge a complaint with the supervisory authority in your country of residence, or with our lead supervisory authority - the Dutch Data Protection Authority (Autoriteit Persoonsgegevens), if you believe we have infringed your rights. You can find a list of local data protection authorities here; for Israel – https://www.gov.il/en/departments/the_privacy_protection_authority/govil-landing-page. We will respond to your request without undue delay and in any event within one month of receipt. Where necessary, considering the complexity and number of requests, we may extend this period by up to two further months, in which case we will inform you of the extension and the reasons within the first month. By submitting a request, you confirm that you are the individual to whom the data relates or are authorized to act on their behalf. If we have reasonable doubts about your identity, we may ask for additional information to verify it. Where required by law, we may need to share your request and our response with third parties, including regulatory authorities. 5. Retention of Your Personal Data We retain your personal data only for as long as it is necessary to fulfil the scopes described in this Privacy Policy. The exact length of time may vary depending on the type of data, the scope of processing, the category of users involved and - most importantly- whether we are compelled to retain certain personal data due to, for example, tax requirements or other legal obligations under applicable law, fraud‑prevention or safety considerations. When we process partially obscured copies of your ID for KYC purposes, we retain them for a maximum of 18 months in order to maintain the necessary records for our yearly audits. Please consider that non‑personal data may be retained and used by Nebius without limitation, in particular for archiving purposes, public‑interest, statistical, historical or scientific research purposes. 6. Overseas Personal Data Transfers We store your personal data in our data centers in various locations, including, but not limited to, the European Union, Iceland, the United Kingdom, Israel and the United States. However, as a global organization, we may also process and transfer your personal data to other group companies or to third parties around the world for the purposes set out in this Privacy Policy - specifically, to fulfil our agreements with you, to respond to your requests, or, where applicable, based on your consent. Where we transfer your personal data to a country that the European Commission has recognised as providing an adequate level of protection (such as Israel), we rely on that adequacy decision. Whenever we transfer your personal data to other countries outside the EU and EEA, we ensure its protection by implementing appropriate safeguards, including: adopting the European Commission’s Standard Contractual Clauses (and their approved equivalents for Switzerland and the UK), or other approved transfer mechanisms; encrypting personal data in transit; maintaining internal policies to restrict access and promote awareness. For an overview of data‑protection standards by country, please visit https://www.cnil.fr/en/data-protection-around-the-world. 7. Data Privacy Framework 7.1. Participation in Data Privacy Framework Your personal data may be transferred to and processed in countries other than the country in which you are resident. These countries may have data protection and privacy laws that are different to the laws of your country. We have taken appropriate safeguards to require that your personal data will remain protected in accordance with this Privacy Policy. These include implementing the European Commission’s Standard Contractual Clauses for transfers of personal data between our group companies, which require all group companies to protect personal data they process from the European Economic Area (EEA) in accordance with European Union data protection law. Nebius complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF) as set forth by the U.S. Department of Commerce. Nebius has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (EU-U.S. DPF Principles) with regard to the processing of personal data received from the European Union in reliance on the EU-U.S. DPF. If there is any conflict between the terms in this Privacy Policy and the EU-U.S. DPF Principles the Principles shall govern. To learn more about the Data Privacy Framework (DPF) program, and to view our certification, please visit https://www.dataprivacyframework.gov/. 7.2. Types of personal data collected Please refer to the Section 1 “Personal Data We Collect” to find out about the types of personal data collected by Nebius under the Data Privacy Framework. 7.3. Commitment to be subject to the Data Privacy Framework Principles Nebius is committed to being subject to the Data Privacy Framework Principles for all personal data received from the European Union in reliance on the relevant part(s) of the Data Privacy Framework program. 7.4. Purposes for collection and use of personal data Please refer to Section 2 “Why We Process Your Personal Data” to find out about the purposes for which Nebius collects and uses personal data under the Data Privacy Framework. 7.5. How to contact us about any inquiries or complaints regarding Data Privacy Framework compliance In compliance with the EU-U.S. DPF Nebius commits to resolve DPF Principles-related complaints about our collection and use of your personal information. EU individuals with inquiries or complaints regarding our handling of personal data received in reliance on the EU-U.S. DPF should first contact Nebius at: DPO’s contact details: Marina Benassi Coslovi, privacy@nebius.com Address: Burgerweeshuispad 101, 1076ER Amsterdam, The Netherlands Email: privacy@nebius.com Phone: +31 202066970 7.6. independent dispute resolution In compliance with the EU-U.S. DPF Nebius commits to cooperate and comply respectively with the advice of the panel established by the EU data protection authorities (DPAs) regarding unresolved complaints concerning our handling of personal data received in reliance on the EU-U.S. DPF to the EU-U.S. DPF. 7.7. The type or identity of third parties to which we disclose personal information under the Data Privacy Framework, and the purposes for which we do so Please refer to the Section 3 “To Whom We Disclose Your Personal Data” to find out about the type or identity of third parties to which we disclose personal data under the Data Privacy Framework, and the purposes for which we do so. 7.8. Your right to access your personal data You also have the right to access any personal data that relates to you and which is processed under the Data Privacy Framework. Further information about this right can be found in Section 4 “Your Rights” above. 7.9. Your choices regarding use of your personal data Under the Data Privacy Framework: You have the right to opt out of the disclosure of your “non sensitive” personal data to third party controllers and/or to the use of it for a purpose that is materially different from the purpose(s) for which it was originally collected or subsequently authorized by you. You have the right to only have “sensitive” personal data about you disclosed to third party controllers and/or used for a purpose that is materially different from the purpose(s) for which it was originally collected or subsequently authorized by you through exercise of opt-in choice. For personal data processing that is controlled by Nebius, these choices can be exercised by contacting Nebius through the methods noted in Section 15 “Contact Us”. 7.10. Subjection to the investigatory and enforcement powers of the Unite States Federal Trade Commission (FTC) The Federal Trade Commission has jurisdiction over Nebius compliance with the EU-U.S. Data Privacy Framework (EU-U.S. DPF). 7.11. Possible use of binding arbitration You have the possibility, under certain conditions, to invoke binding arbitration for complaints regarding Data Privacy Framework compliance not resolved by any of the other Data Privacy Framework mechanisms. For additional information about this, please see here. 7.12. Requirement to disclose personal data in response to lawful requests by public authorities Please be aware that Nebius may be required to disclose personal data that relates to you (and which is protected under the Data Privacy Framework) in response to lawful requests by public authorities including to meet national security or law enforcement requirements. 7.13. Nebius liability in cases of onward transfers to third parties Nebius may transfer personal data for the purposes described in the Section 3 “To Whom We Disclose Your Personal Data” to a third party acting as a data controller or as an agent. If we intend to disclose personal data to a third party acting as a data controller or as an agent we will comply with, and protect, personal data as provided in the Accountability for Onward Transfer Principle of the Data Privacy Framework. Nebius remains liable for the processing of personal data received under the Data Privacy Framework and subsequently transferred to a third party acting as an agent if the agent processes such personal data in a manner inconsistent with the Data Protection Framework principles, unless we prove that we are not responsible for the event giving rise to the damage. 7.14. Nebius U.S. Entities Covered by Data Privacy Framework Certification Nebius complies with the EU-US Data Privacy Framework. To learn more, see the relevant sections (Section 7 and 14) of the current Privacy Policy, and visit the U.S. Department of Commerce’s Data Privacy Framework website. For the purposes of our Data Privacy Framework certification, the below subsidiaries of Nebius are in scope: Nebius Inc., 103 Foulk Road, Suite 202, Wilmington, DE 19803, United States ADC Tech Inc., 103 Foulk Road, Suite 202, Wilmington, DE 19803, United States 8. Cookies As outlined in our Cookie Policy, we use cookies and similar technologies such as pixels, ad tags and local storage to improve your experience, provide convenience, maintain security and serve you tailored ads. For simplicity, we call all these tools “cookies.” In practice, cookies support functions like authentication, security, feature enablement, advertising and analytics. There are two types of cookies: first‑party cookies set by us, and third‑party cookies set by our vetted partners. We collect marketing and analytics cookies based on your consent obtained via the cookie banner. If you’ve granted consent for cookies, you may modify or withdraw that consent at any time via the “Manage cookies” option on our websites. Third‑Party Services Certain features of the websites are provided by third parties. Subject to your cookie consent, these providers may collect information about your online activity to deliver personalized advertisements for products and services that might interest you. Where we and such a third party jointly determine the purposes and means of this collection, we act as joint controllers for the collection and transmission of your data; subsequent processing by the third party is governed by its own privacy policy. Please consult each third party’s privacy policy for more details. 9. Security of Your Personal Data Nebius maintains a dedicated security team and employs a combination of technical, administrative and physical controls, appropriate to the risk, to safeguard the personal data we process. We regularly test, assess and update these measures to keep them effective and aligned with current standards. However, no system is completely impervious to attack, and no internet transmission can be guaranteed secure. While we strive to protect your data, we cannot promise that unauthorized access, hacking, data loss or other breaches will never occur. If a personal data breach occurs, we will notify the competent supervisory authority and, where required, affected individuals in accordance with applicable law. 10. State- or Country-Specific Provisions 10.1. United States of America A. Privacy Information for California Residents This section of the Privacy Policy applies only to California residents. If you are a California resident, this section will prevail over other parts of the Privacy Policy in case of any discrepancies. To avoid any misunderstanding, personal information has the same meaning as personal data. Personal Information Collected over the Last 12 Months Personal information we collected directly from you: Categories of data collected Data collected from you and why it was collected Characteristics of protected classifications under California or Federal law We do not intentionally collect any information on your protected classifications Commercial information Records of services with Nebius Precise Geolocation Data We do not collect precise geolocation data Financial Information Payment and Billing Information. Please note that Nebius relies on third‑party payment providers to handle your payments and does not retain your payment information Biometric Data We do not collect biometric data Audio, electronic, visual, thermal, olfactory, or similar information Audio may be recorded during online calls, provided that the party being recorded has given their consent Internet/Network Activity Internet Protocol address (IP address), browser type and language, sending and exiting pages, information about the date and time stamps, information about visits, logs Professional or Employment-related Information Field of activity or occupation, job title, and company name Education Information We do not collect Education Information Device Information Operating system, browser type, device ID (with consent) Categories of Personal Information Sold in the last 12 months We do not sell your personal information to third parties. Categories of Personal Information Disclosed over the last 12 months Categories of Data Disclosed Types of Entities to Which Data Was Disclosed Reason for Disclosure of Data Categories of Recipients Commercial information, Financial information, Internet/Network Activity Professional or Employment-related Information, Audio Information, Device Information Please see section 3 with the detailed description Please see section 2 with the detailed description Please see section 3 with the detailed description Information we sell Nebius does not sell your personal information to third parties. “Sale” excludes transfers that occur as part of a merger, acquisition, asset sale or other similar business transaction involving all or part of Nebius. In such cases, your personal information may be transferred to the acquiring entity. If a transaction will materially change how we process your personal information, we will notify you beforehand. Your California Privacy Rights We have implemented policies and procedures to help facilitate the exercise of privacy rights available to California residents under applicable law. If you are a California resident, you are entitled to the rights described in Section 4 of this Privacy Policy. In addition, you may be entitled to the following: Disclosure of Direct Marketers Learn more California law allows California residents once a year to request information regarding our disclosure of your personal information, if any, to third parties for those third parties’ direct marketing purposes during the preceding calendar year. This information includes:a. The categories of information we disclosed to third parties for their direct marketing purposes during the immediately preceding calendar year;b. The names and addresses of third parties that received the information; andc. If the nature of the third party’s business cannot be determined from their name, to obtain examples of the products or services marketed. Right to Information About Collecting, Selling, Sharing, or Disclosing Personal Information Learn more Upon receipt of a verifiable request, you may obtain a list of: the specific pieces of your personal information that Nebius holds; the categories of personal information collected about you, sold to third parties, or disclosed to third parties for business purposes; the categories of personal information sold within the last 12 months; the categories of sources from which personal information is collected; the business or commercial purpose for collecting or selling personal information; and the categories of third parties with whom personal information is shared, sold, or disclosed for a business purpose. Right to Opt-Out of the Sale of Personal Information Learn more California residents have the right to opt-out of the sale of their personal information under certain circumstances. Right to Non-Discrimination Learn more As defined under relevant law, you have a right to non-discrimination in the services or quality of services you receive from us for exercising your rights.Please contact us with the use of contact details specified in Section 15 of this Privacy Policy if you wish to exercise these rights. Note that we may ask you to verify your identity - such as by requiring you to provide information about yourself - before responding to such requests. Submitting a Verifiable Request under the CCPA Learn more California residents have certain rights regarding their personal information under the California Consumer Privacy Act of 2018 (“CCPA”). Nebius will respond to an individual’s “verifiable request” to exercise their rights under the CCPA - that is, when Nebius has received a request purporting to be from a particular individual, and Nebius has been able to verify the individual’s identity. The need to verify an individual’s identity is crucial to protecting your information and ensuring that it is not shared with someone pretending to be you or not authorized to act on your behalf.You may submit a verifiable request using the contact details specified in Section 15 of this Privacy Policy. To process your request, we will ask you to provide information to help us verify your identity. This information may include your name, address, whether you have an account with Nebius, and any other information deemed necessary to reasonably verify your identity.Once we have your submission, we will compare the information you provide to the information we have on file to verify your identity. If necessary, we may request additional information if we have difficulty confirming your identity.We will not share your information or fulfil any requests if we are unable to confirm that a request is a “verifiable request”. If we cannot verify your identity, we will not be able to process your request. Submitting a request through an authorized agent Learn more Under California law, a California resident can appoint an “authorized agent” to submit certain verifiable requests on their behalf, such as the right to know what information we collect or to request the deletion of the consumer’s information. An authorized agent may submit a request by following the steps outlined above.However, the agent must identify the consumer they are acting on behalf of and provide the information necessary for us to verify the consumer’s identity. Additionally, we will require the authorized agent to submit proof of their authorization to act on the consumer’s behalf.To ensure the security and privacy of your information, we will request that you provide written consent for the person acting as your authorized agent. This consent may include us contacting you directly to confirm that the individual claiming to be your agent has your permission to access or delete your information. We will also verify your identity independently to ensure that an unauthorized person is not attempting to exercise your rights without permission.We will not share your information or honour any requests in situations where you have not provided written authorization for an agent to act on your behalf, or where we are unable to verify your identity. Submitting a Request for Removal of Minor Information Learn more To request the removal of information about a minor from Nebius, parents or guardians may submit a request with the subject line “Removal of Minor Information.” This request must come from the minor’s parent or guardian; minors themselves may not submit information to us via email.Your submission should include the following details: the nature of your request the identity of the content or information to be removed whether the content or information is found the location of the content or information (e.g., providing the URL of the specific web page where the content or information is found) a statement that the request is related to the “Removal of Minor Information” your name, street address, city, state, ZIP code, and email address If we become aware that a minor has provided personal data or otherwise used by Nebius in violation of the Privacy Policy, we will take steps to remove that information.Please note that our websites and services are not intended for use by individuals under the age of 18. Our Policy on “Do Not Track” Signals under the California Online Protection Act We do not support Do Not Track (DNT). DNT is a preference you can set in your web browser to inform websites that you do not wish to be tracked. You can enable or disable DNT by visiting the “Preferences” or “Settings” section of your web browser. Please note that third parties may collect data about you. We cannot control how third parties respond to Do Not Track signals or other similar mechanisms. The collection and use of data by third parties, and their responsiveness to Do Not Track signals, is governed by their respective privacy policies. B. Privacy Information for Residents of other States (Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Tennessee, Texas, Utah, and Virginia): Unless otherwise stated by the law of your state of residence, the provisions in Chapter A “Privacy Information for California Residents” will apply to the processing of your data. If you have questions related to your rights or any other aspects of this Privacy Policy, please contact us using the methods outlined in Section 15. Your Rights under various United Sates state data privacy laws such as the Colorado Privacy Act, Connecticut Data Privacy Act, Delaware Personal Data Privacy Act, Indiana Consumer Data Protection Act, Iowa Consumer Data Protection Act, Kentucky Consumer Data Protection Act, Maryland Online Data Privacy Act, Minnesota Consumer Data Privacy Act, Montana Consumer Data Privacy Act, Nebraska Data Privacy Act, New Hampshire SB 255, New Jersey SB 332, Oregon Consumer Privacy Act, Tennessee Information Protection Act, Texas Data Privacy and Security Act, Utah Consumer Privacy Act, and the Virginia Consumer Data Protection Act. For residents from the states of Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Tennessee, Texas, Utah, or Virginia this section allows you to exercise your rights under the applicable state law. Right to Confirm: The right to confirm whether your personal data is being processed. Right to Access / Disclosure: The right to have access to your personal data upon simple request – that is, you may receive a copy of such data upon receipt of a verifiable request, along with other information related to the processing of your data. Right to Data Portability: the right to obtain, move, copy, or transfer data as defined by applicable law. Right to Correction/Rectification: The right to correct your personal data if you find it is inaccurate, incomplete or obsolete. Right to Deletion: The right to obtain the deletion of your personal data in the situations set forth by applicable data protection law. Right to Opt-Out: The right to opt out of the processing of your personal data for targeted advertising, as defined by applicable law as well as the right to opt out of the processing of sensitive data as defined by applicable law. Certain applicable laws also permit the right to opt out of the sale of personal data and profiling. Right to Appeal: You may also have the right to appeal the denial of any of these rights by submitting a form that will be provided to you if we deny a data request. Submitting a Verifiable Request under the United States’ State Laws. Learn more Residents of the above-mentioned states have certain rights regarding their personal information under applicable law. Nebius will respond to an individual’s “verifiable request” to exercise their rights under these applicable laws - that is, when Nebius has received a request purporting to be from a particular individual, and Nebius has been able to verify the individual’s identity. The need to verify an individual’s identity is crucial to protecting your information and ensuring that it is not shared with someone pretending to be you or not authorized to act on your behalf.You may submit a verifiable request using the contact details specified in Section 15 of this Privacy Policy. To process your request, we will ask you to provide information to help us verify your identity. This information may include your name, address, whether you have an account with Nebius, and any other information deemed necessary to reasonably verify your identity.Once we have your submission, we will compare the information you provide to the information we have on file to verify your identity. If necessary, we may request additional information if we have difficulty confirming your identity.We will not share your information or fulfil any requests if we are unable to confirm that a request is a “verifiable request”. If we cannot verify your identity, we will not be able to process your request.Not all requests will be fulfilled. Nebius is committed to complying with each and every data privacy protection law. However, in some circumstances, consumers are not entitled to certain requests. Nebius will hear all appeals if an appeal right is permitted under applicable law (e.g. the Tennessee Information Protection Act). C. Profiling Disclosure We do not engage in profiling of consumers in furtherance of automated decisions that produce legal or similarly significant effects, as those terms are defined under the Colorado Privacy Act. D. Data Protection Assessments Nebius will conduct all necessary data protection assessments for all applicable processing or other activities when required by applicable law. 10.2. Israel This section provides additional information for residents of Israel in accordance with the Protection of Privacy Law, 5741-1981 as amended by Amendment No. 13, 5774–2024 (the “PPL”). Terminology: For the purpose of this section, the term “Information” is used, which is equivalent to “Personal Data” under the GDPR. Local Representative: For purposes of the Protection of Privacy Law, our appointed local representative in Israel is: Nebius Israel Ltd Yigal Alon Street 94, 1 Alon Tower, 39 floor, Tel-Aviv, Israel (Attn: Privacy Office) Email: privacy@nebius.com Supervisory Authority: You have the right to lodge a complaint with the Israeli Privacy Protection Authority at any time by using the contact details specified here. 11. Children Our websites and services are not intended for use by individuals under the age of 18. We do not knowingly collect or process personal data from anyone under 18. If you are a parent or guardian of a minor and believe we have collected their data, you may contact us to exercise their rights as described in this Privacy Policy. 12. Difficulty Accessing this Privacy Policy If you have a disability and cannot access our Privacy Policy online, please contact us (using the details in Section 15) to request a copy in an alternative, more accessible format. We will not collect or process any health‑related or other special category of personal data in connection with such requests. 13. Changes Our business is continually evolving, and we may update this Privacy Policy to reflect those changes. We’ll post any revised version on our website, so we encourage you to review it periodically. If we make any material changes, we will notify you. 14. Nebius Subsidiaries Nebius B.V., Burgerweeshuispad 101, 1076ER Amsterdam, The Netherlands Nebius Israel Ltd, Yigal Alon Street 94, 1 Alon Tower, 39 floor, Tel-Aviv, Israel Nebius Inc., 103 Foulk Road, Suite 202 Wilmington, DE 19803 United States 15. Contact Us If you have any questions or concerns about your privacy, you may contact us or our Group Data Protection officer by writing to us at: Nebius B.V., Burgerweeshuispad 101, 1076ER Amsterdam, The Netherlands (Attn: Privacy Office), or by emailing us at privacy@nebius.com. Publication date: November 11, 2026 Effective date: November 11, 2026 Web address: https://docs.nebius.com/legal/privacy Previous versions of the document Previous version of the document: https://docs.nebius.com/legal/archive/privacy-20261109Previous version of the document: https://docs.nebius.com/legal/archive/privacy-20261020Previous version of the document: https://docs.nebius.com/legal/archive/privacy-20260521Previous version of the document: https://docs.nebius.com/legal/archive/privacy-20251105Previous version of the document: https://docs.nebius.com/legal/archive/privacy-20250916Previous version of the document: https://docs.nebius.com/legal/archive/privacy-20250821Previous version of the document: https://docs.nebius.com/legal/archive/privacy-20250401Previous version of the document: https://docs.nebius.com/legal/archive/privacy-20240828 Was this page helpful?