PRIVACY POLICY
PERSONAL DATA PROCESSING POLICY
Effective date of the current edition: 21.09.2026
1. General Provisions
1.1. This Personal Data Processing Policy (hereinafter referred to as the "Policy") has been developed in pursuance of the requirements of clause 2 of part 1 of Article 18.1 of Federal Law No. 152-FZ of 27.07.2006 "On Personal Data" in order to ensure the protection of the rights and freedoms of man and citizen during the processing of their personal data, including the protection of the rights to inviolability of private life, personal and family secrecy.
1.2. The Operator is LLC "Cyberia Labs" (125047, Moscow, intra-city territory Municipal District Tverskoy, 4th Lesnoy Lane, building 4) (hereinafter referred to as the "Operator", "Cyberia").
1.3. This Policy applies to personal data, as understood under applicable law, that Cyberia may obtain about you in the course of your use of websites, programs, products and/or services owned by Cyberia.
1.4. Cyberia, as the personal data operator, undertakes:
— to provide to the personal data subject, at their request, information concerning the processing of their personal data;
— to organize the processing of personal data in the manner established by applicable legislation;
— to respond to appeals and requests of personal data subjects and their legal representatives in accordance with the requirements of legislation;
— to report to the competent authority for the protection of the rights of personal data subjects, at the request of that authority, the necessary information within 10 days from the date of receipt of such request;
— to publish or otherwise ensure unrestricted access to this Policy;
— to terminate the transfer (provision, access) of personal data, terminate processing and destroy personal data in the manner and in the cases provided for by legislation.
1.5. Cyberia, as the personal data operator, has the right:
— to provide personal data of personal data subjects to third parties if this is provided for by applicable legislation;
— to refuse to provide information about personal data in the cases provided for by the legislation of the Russian Federation in the field of personal data;
— to use personal data of the personal data subject without their consent in the cases provided for by the legislation of the Russian Federation in the field of personal data.
1.6. The personal data subject has the following rights:
— to request information concerning the processing of their personal data;
— to demand clarification of their personal data, blocking or destruction thereof if the personal data are incomplete, outdated, inaccurate, unlawfully obtained or are not necessary for the declared purpose of processing;
— to withdraw their consent to the processing of personal data;
— to take other measures provided for by the legislation of the Russian Federation in the field of personal data to protect their rights.
1.7. To exercise their rights, the personal data subject may contact Cyberia in the manner determined by Section 10 of the Policy.
1.8. This Policy is executed in the Russian language. The English version of the Policy is provided for convenience of reference only and shall not have legal effect. In the event of any discrepancy between the Russian and English versions of the Policy, the Russian version shall prevail.
2. Categories of Personal Data Subjects
Depending on the nature of interaction with the Operator, personal data of the following categories of persons are processed:
2.1. Website Visitors — persons viewing the Operator's websites.
2.2. Subscribers — persons who have subscribed to the Operator's information mailings through forms on the websites or during events.
2.3. Counterparties and Their Representatives — representatives of legal entities with which the Operator interacts within the framework of concluding and performing contracts (managers, accountants, lawyers).
2.4. Users — persons (identified by Counterparties) using the functionality of the Operator's programs and services.
2.5. Candidates of Users — job applicants whose data are entered into the Operator's services (ATS Garmony, CV Parser and similar) by Users of these services. The Operator processes such data as a processor on the instruction of the User.
2.6. Job Applicants — persons applying for vacant positions directly in the Operator's organization.
2.7. Employees, relatives of employees, former employees.
2.8. Office Visitors.
3. Purposes of Personal Data Processing
3.1. Recruiting (including selection of candidates for vacant positions, conducting interviews, offering employment (offer), including creation of a talent pool).
Data: surname, name, patronymic, year of birth, month of birth, date of birth, gender, email address, residential address, telephone number, citizenship, other personal data, information about education; Work experience, Qualifications, Knowledge of foreign languages, Work permit, Data from the resume.
3.2. Ensuring the activities of Employees (including performance of the employment contract, assistance in training, promotion at work, control of the quantity and quality of work performed, ensuring personal safety, ensuring the safety of property, calculation and payment of wages, calculation and transfer of taxes and insurance contributions, organization of business trips, provision of corporate communications, provision of corporate taxi services, provision of a salary account and bank card, payment of voluntary medical insurance, provision of corporate benefits and social package, maintenance of military records).
Data: surname, name, patronymic, year of birth, month of birth, date of birth, gender, email address, residential address, registration address, telephone number, SNILS, INN, citizenship, data of the identity document, data of the identity document outside the Russian Federation, data of the document contained in the birth certificate, information about labor activity (including work experience, data on current employment indicating the name and settlement account of the organization), attitude to military duty, information about military records, other personal data, information about education, information about health status; Work experience, Qualifications, Knowledge of foreign languages, Work permit, INN in the country of citizenship, Compulsory medical insurance policy number, Division and position in the Company, Information about marital status and family members, Details of the pension certificate, Availability of benefits, status of pensioner, Information about wages, taxes and contributions, Bank details, Visa to the destination country, Contact details of close relatives, Information about being on a business trip, Income statement from the previous place of work, Marriage certificate, Photograph, Certificate from the university.
3.3. Provision of services (software products).
Data: surname, name, patronymic, year of birth, month of birth, date of birth, gender, email address, residential address, registration address, telephone number, citizenship, readiness for relocation and business trips, desired position, specialization, employment type, schedule, salary and job search status, education, certificates, languages, skills, achievements, total length of service, work experience, other personal data; INN (for individual entrepreneurs), Position and place of work (for representatives of potential Clients), Bank details.
3.4. Ensuring personal and property security (issuance of passes).
Data: surname, name, patronymic, data of the identity document.
3.5. Interaction with counterparties (including conclusion and performance of contracts, verification of good faith, exercise of due diligence).
Data: surname, name, patronymic, email address, telephone number, SNILS, INN, data of the identity document, position, other personal data; Details of the power of attorney.
3.6. Promotion of the operator's products.
Data: surname, name, patronymic, email address, telephone number.
3.7. Data analytics for improving and developing the operator's activities.
Data: information about visits to the website; Internet Protocol address (IP address); browser type and language; date and time stamps; other information about the visitor's behavior on the operator's website.
4. Processing of Cookies
4.1. Cookies are small files, usually consisting of letters and numbers, downloaded to a device when visiting certain websites.
4.2. To ensure the correct operation of the Websites, Cyberia processes cookies that help improve the efficiency of interaction with the websites, remember user settings and provide a personalized user experience.
4.3. By their purpose, cookies are divided into:
4.3.1. Essential cookies — essential cookies are necessary to ensure the correct operation of the websites and electronic services. Such services may include selecting the country and language, maintaining login status, ensuring security, etc. This category of cookies cannot be disabled.
4.3.2. Analytical (performance) cookies — cookies necessary for collecting information about how data subjects use the websites and services. These cookies make it possible to improve the quality and consumer properties of the websites and services; to improve navigation in order to make the websites more convenient and responsive to users' needs, as well as to correct technical errors as they arise and to ensure the security of the websites and services.
4.3.3. Other cookies — these cookies are used to collect information about users' search preferences.
4.4. If cookies are processed on Cyberia's websites, the User is notified of this upon their first visit to the website by means of a corresponding pop-up cookie banner.
4.5. The User may independently manage cookies (including deleting them) by setting the appropriate settings of the User's device and web browser.
5. Transfer of Data to Third Parties
5.1. Within the framework of organizing the operation of the websites and electronic services, the Operator may transfer personal data to the following categories of persons:
5.1.1. Hosting and cloud infrastructure providers for hosting websites and ensuring the operation of the Operator's programs and services.
The list includes, but is not limited to:
— ООО «НУБЕС» (INN 9706005293)
Address: 115404, Moscow, 1st Stekolnaya Street, building 7, structure 2;
— ООО «Облачные технологии» (INN 7736279160)
Address: 117312 Moscow, Vavilova Street, building 23, structure 1, room No. 1.207;
— ООО «Мобильные телесистемы» (INN 7740000076)
Address: 109147, Russia, Moscow, Marksistskaya Street, building 4, structure 1.
Processing of data by the specified persons is carried out in accordance with their data processing policies.
5.1.2. Analytics and advertising services for collecting depersonalized or aggregated statistics on website traffic and advertising effectiveness.
Yandex.Metrica service of ООО «ЯНДЕКС» (INN: 7736207543)
Address: 119021, Russia, Moscow, Leo Tolstoy Street, building 16.
5.1.3. Payment systems for processing transactions (data transfer is limited to the volume necessary for making the payment).
5.2. The Operator does not carry out cross-border transfer of personal data. If it intends to carry out cross-border transfer of personal data, the Operator, before the start of such transfer, notifies the competent authority for the protection of the rights of personal data subjects, as well as makes corresponding changes to the Policy.
6. Legal Grounds for Personal Data Processing
6.1. Personal data shall be processed with the consent of the data subject to the processing of their personal data, except in the following cases:
- The processing of personal data is necessary for achieving the purposes provided for by an international treaty of the Russian Federation or by law, for the performance of the functions, powers, and duties imposed on the operator by the legislation of the Russian Federation.
- The processing of personal data is carried out in connection with a person's participation in constitutional, civil, administrative, or criminal proceedings, or proceedings in arbitration courts.
- The processing of personal data is necessary for the administration of justice, the execution of a judicial act, an act of another body or official, subject to enforcement in accordance with the legislation of the Russian Federation on enforcement proceedings.
- The processing of personal data is necessary for the performance of a contract to which the data subject is a party or a beneficiary or guarantor, as well as for the conclusion of a contract at the initiative of the data subject or a contract under which the data subject will be a beneficiary or guarantor.
- The processing of personal data is necessary for the exercise of the rights and legitimate interests of the operator or third parties, or for achieving socially significant purposes, provided that this does not violate the rights and freedoms of the data subject.
- The processing of personal data subject to publication or mandatory disclosure in accordance with federal law is carried out.
6.2. No processing is carried out of biometric personal data or special categories of personal data of website visitors relating to racial or national affiliation, political views, religious or philosophical beliefs, or intimate life.
7. Procedure and Conditions for Personal Data Processing
7.1. Processing of personal data of personal data subjects is carried out by the Operator strictly in accordance with the following principles:
— processing of personal data is carried out on a lawful and fair basis;
— processing of personal data is limited to the achievement of specific, predetermined and lawful purposes;
— combining databases containing personal data, the processing of which is carried out for purposes incompatible with each other, is not permitted;
— only personal data that meet the purposes of their processing are subject to processing;
— the content and volume of processed personal data correspond to the declared purposes of processing, the Operator does not process excessive personal data;
— during processing, the accuracy of personal data, their sufficiency, and, where necessary, their currency in relation to the purposes of processing personal data are ensured;
— the adoption of measures to delete or clarify incomplete or inaccurate data is ensured;
— storage of personal data is carried out in a form that allows determining the personal data subject, no longer than required by the purposes of processing personal data, unless the storage period of personal data is established by a federal law or the Policy;
— processed personal data are destroyed upon achievement of the purposes of processing or in the event of loss of necessity to achieve these purposes, unless otherwise provided by the applicable legislation of the Russian Federation.
7.2. The Operator performs the following actions with personal data: collection, recording, systematization, accumulation, storage, clarification (update, change), extraction, use, transfer (dissemination, provision, access), blocking, deletion, destruction.
7.3. The Operator receives personal data personally from the personal data subject or from a concluded contract to which the personal data subject is a party.
7.4. If the processing of personal data is based on the consent of the subject in the absence of the need to obtain written consent, consent may be given by the subject themselves or their representative in any form that allows confirming the fact of its receipt.
7.5. In cases where personal data were not received from the subject or their legal representative, the Operator, before starting the processing of such personal data, notifies the subject of the processing of their data.
Notification of the subject about the processing of personal data received not from them is not carried out in the following cases:
— the subject has been notified of the processing of their data by the corresponding operator;
— personal data were received by the Operator on the basis of a federal law or in connection with the performance of a contract to which the personal data subject is a party or a beneficiary or guarantor;
— processing of personal data permitted by the subject for dissemination is carried out in compliance with the prohibitions and conditions established by such subject;
— provision to the personal data subject of the information contained in the notification about the processing of personal data violates the rights and legitimate interests of third parties.
7.6. When instructing a third party to process personal data, the Operator concludes a corresponding data processing agreement with that person. At the same time, the Operator in such data processing agreement obliges the person carrying out the processing of personal data to observe the principles and rules of personal data processing provided for by the applicable legislation of the Russian Federation.
7.7. The Operator undertakes and obliges other persons who have obtained access to personal data not to disclose to third parties and not to disseminate personal data without the consent of the subject, unless otherwise provided by the applicable legislation of the Russian Federation.
8. Measures to Ensure the Security of Personal Data
8.1. The security of personal data processed by the Operator is ensured through the implementation of legal, organizational and technical measures necessary for the full fulfillment of the requirements of applicable legislation in the field of personal data protection.
8.2. The Operator ensures the preservation of personal data and takes all possible measures excluding access to personal data by unauthorized persons.
8.3. The User's personal data shall not be transferred to third parties, except in cases provided for by applicable law, including where the data subject has given the Operator consent to the transfer of data to a third party, for the performance of obligations under a civil-law contract.
8.4. The security of personal data is achieved, among other things, by:
8.4.1. Development and implementation of measures to prevent unauthorized and accidental access to personal data;
8.4.2. Appointment of a person responsible for ensuring the security of personal data in information systems;
8.4.3. Restriction of the categories of persons having access to personal data;
8.4.4. Organization and implementation of a role-based access control system to personal data;
8.4.5. Development of a personal data protection system;
8.4.6. Restriction of physical access of unauthorized persons to the Operator's premises in which work with personal data is carried out;
8.4.7. Evaluation of the effectiveness of the applied measures to ensure the security of personal data.
9. Period of Personal Data Processing
9.1. The period of personal data processing is determined by the achievement of the purposes for which the personal data were collected, unless another period is provided for by a contract or applicable legislation.
9.2. The Operator carries out storage of personal data in a form that allows determining the personal data subject, no longer than required by the purposes of processing personal data, unless the storage period of personal data is established by a federal law or a contract to which the personal data subject is a party, beneficiary or guarantor.
9.3. The condition for termination of personal data processing may be the achievement of the purposes of personal data processing, expiration of the consent of the personal data subject, withdrawal of consent by the personal data subject or a demand for termination of personal data processing, as well as detection of unlawful processing of personal data.
10. Consideration of Requests of Personal Data Subjects or Their Representatives
10.1. The personal data subject or their legal representative has the right to receive information concerning the processing of their personal data, including information containing:
— confirmation of the fact of processing of personal data by the Operator;
— legal grounds and purposes of personal data processing;
— methods of personal data processing;
— name and location of the Operator, information about persons who have access to personal data or to whom personal data may be disclosed on the basis of a contract with the Operator or on the basis of a federal law;
— list of processed personal data relating to the corresponding subject, and the source of their receipt;
— periods of personal data processing, including periods of their storage;
— procedure for the exercise by the personal data subject of the rights provided for by Federal Law No. 152 "On Personal Data";
— information about the carried out or intended cross-border transfer of data;
— information about the methods of fulfillment by the Operator of the obligations established by Article 18.1 of Federal Law No. 152 "On Personal Data";
— other information provided for by Federal Law No. 152 "On Personal Data" or other federal laws.
10.2. The personal data subject or their legal representative has the right to demand from the Operator clarification of personal data, blocking or destruction thereof if the personal data are incomplete, outdated, inaccurate, unlawfully obtained or are not necessary for the declared purpose of processing, as well as to take the measures provided for to protect their rights.
10.3. The information specified in clause 10.1 of the Policy is provided to the personal data subject by the Operator in an accessible form, and it must not contain personal data relating to other personal data subjects, except in cases where there are lawful grounds for disclosing such personal data.
10.4. The information specified in clause 10.1 of the Policy is provided to the personal data subject or their representative by the Operator within ten business days from the moment of the appeal or receipt by the Operator of the request of the subject or their representative. An appeal or request may be sent to the Operator's address specified in clause 1.2 of the Policy, or to the email address: labs_feedback@cyberia-tech.com. The request must contain:
— number of the main identity document of the personal data subject or their legal representative;
— information about the date of issue of the specified document and the body that issued it;
— information confirming the participation of the personal data subject in relations with the Operator or information otherwise confirming the fact of processing of personal data by the Operator;
— signature of the personal data subject or their legal representative.