Data Protection Privacy Policy

1. Account Registration and Profile Management

Management of Member accounts and profiles

Cyberr processes personal data to enable Members to create and manage their accounts and to build and maintain their professional profile on the Platform.

More information

1. Purposes of the processing. Cyberr processes your personal data to:
   • allow you to register for and manage access to your Cyberr account;
   • enable you to create, complete and update your professional profile;
   • display your profile to other Members, Visitors and, where applicable, to enterprise customers of the Platform, in accordance with your settings;
   • provide the core functionalities of the Platform under our User Agreement.
2. Personal data processed.
   • Registration data: name, email address, password, general location (e.g. city or country).
   • Profile data (provided by you): photo, current position, work experience, education, skills, certifications, endorsements, recommendations, contact details and any other information you choose to add to your profile.
   • Technical data: IP address, device identifier, browser type and version, operating system, language preferences.

   You are not required to provide any information beyond the mandatory registration data. However, a more complete profile will help you benefit fully from the Platform. Please do not post or add personal data to your profile that you would not want to be publicly available.

3. Legal basis for the processing.
   • Performance of a contract with you [Article 6(1)(b) GDPR]: the processing is necessary to provide you with the services under our User Agreement.
   • Consent [Article 6(1)(a) GDPR]: for optional profile information and visibility settings that go beyond the core service.
4. Categories of recipients of the personal data.
   • Other Members and Visitors of the Platform, in accordance with your profile visibility settings.
   • Enterprise customers using the Platform's recruitment or business tools, in accordance with your settings.
   • Cyberr staff responsible for Platform operations and support.
   • Technical service providers (hosting and infrastructure: Lovable Cloud / Supabase; payment processing: Stripe; data enrichment: Mixrank; analytics: Google Analytics; advertising: Google Ads, LinkedIn Insight Tag; CRM and email marketing: HubSpot).
5. Storage duration. Your personal data is retained for as long as your account is active. Upon account closure, your data is generally deleted within 30 days, except where longer retention is required by law (in particular accounting and tax records, retained for 7 years under Luxembourg law) or for the establishment, exercise or defence of legal claims.
6. Rights of the data subject. You have the right to access your personal data and to obtain a copy (Article 15 GDPR), to obtain the rectification of inaccurate or incomplete personal data (Article 16 GDPR), to obtain the erasure of your personal data under the conditions set out in Article 17 GDPR, to obtain the restriction of processing under the conditions set out in Article 18 GDPR, to data portability (Article 20 GDPR), and, where processing is based on consent, to withdraw your consent at any time without affecting the lawfulness of processing carried out before such withdrawal. For any questions or requests regarding the exercise of your rights, please contact the DPO of Cyberr.
7. Complaint. If you consider that the processing of your personal data by Cyberr infringes the GDPR, you can lodge a complaint with the National Data Protection Commission (CNPD), 15, Boulevard du Jazz, L-4370 Belvaux, Luxembourg (www.cnpd.lu).

2. Networking and Connections

Management of connections between Members

Cyberr processes personal data to enable Members to build and manage their professional network on the Platform.

More information

1. Purposes of the processing. Cyberr processes your personal data to:
   • allow you to send, receive and manage connection requests;
   • suggest relevant connections based on your profile, contacts and activity on the Platform;
   • display your connections list to other Members, in accordance with your settings;
   • enable you to invite non-Members to join the Platform.
2. Personal data processed.
   • Profile data (name, photo, position, location, skills).
   • Connections list.
   • Contact information uploaded or synced by you (e.g. address book imports).
   • Activity data related to networking (connection requests sent and received, invitations).
3. Legal basis for the processing.
   • Performance of a contract [Article 6(1)(b) GDPR]: the networking functionality is a core element of the service provided under our User Agreement.
   • Legitimate interest [Article 6(1)(f) GDPR]: suggesting relevant connections to enhance your experience on the Platform. Cyberr has balanced its interest against your rights and considers that the limited impact and your ability to control your settings justify this processing.
4. Categories of recipients of the personal data.
   • Other Members, in accordance with your settings.
   • Cyberr staff responsible for Platform operations.
   • Technical service providers (Lovable Cloud / Supabase hosting).
5. Storage duration. Connection data is retained for as long as your account is active and deleted within 30 days of account closure.
6. Rights of the data subject. You have the rights set out in Section 1(6) above. In addition, where processing is based on legitimate interest, you have the right to object to the processing under the conditions set out in Article 21 GDPR.
7. Complaint. See Section 1(7) above.

3. Messaging

Management of messages between Members

Cyberr processes personal data to enable Members to communicate with each other through the Platform's messaging functionality.

More information

1. Purposes of the processing. Cyberr processes your personal data to:
   • enable you to send and receive private messages to and from other Members;
   • provide message notifications;
   • detect and prevent abusive or harmful content in messages, in accordance with our Community Guidelines.
2. Personal data processed.
   • Sender and recipient identification data (name, profile information).
   • Message content.
   • Metadata (date, time, read receipts where applicable).
3. Legal basis for the processing.
   • Performance of a contract [Article 6(1)(b) GDPR]: messaging is part of the core service.
   • Legitimate interest [Article 6(1)(f) GDPR]: detecting and preventing abusive or harmful content to protect the safety of Members and the integrity of the Platform.
4. Categories of recipients of the personal data.
   • The other party or parties to the conversation.
   • Cyberr staff, where necessary for moderation or support purposes.
   • Technical service providers (Lovable Cloud / Supabase hosting).
5. Storage duration. Messages are retained for as long as the relevant accounts are active and deleted within 30 days of account closure.
6. Rights of the data subject. See Section 1(6) above. Right to object (Article 21 GDPR) applies where processing is based on legitimate interest.
7. Complaint. See Section 1(7) above.

4. News Feed and Content Sharing

Management of content published and shared on the Platform

Cyberr processes personal data to enable Members to publish, view and interact with professional content on the Platform.

More information

1. Purposes of the processing. Cyberr processes your personal data to:
   • enable you to create, publish and share posts, articles, comments and other content;
   • display content in the news feed of other Members and, where applicable, to Visitors;
   • personalise your news feed based on your profile, connections, activity and stated interests;
   • enable social interactions (likes, comments, shares, follows);
   • notify your network of your activity, in accordance with your settings.
2. Personal data processed.
   • Profile data (name, photo, position).
   • Content you publish (posts, articles, comments, images, videos).
   • Activity data (likes, shares, comments, follows, content views).
   • Technical data (device, browser, IP address).
3. Legal basis for the processing.
   • Performance of a contract [Article 6(1)(b) GDPR]: content sharing is a core functionality of the Platform.
   • Legitimate interest [Article 6(1)(f) GDPR]: personalising your news feed and providing notifications to enhance the relevance and usefulness of the Platform.
4. Categories of recipients of the personal data.
   • Other Members and, for publicly shared content, Visitors.
   • Cyberr staff responsible for moderation and Platform operations.
   • Technical service providers (Lovable Cloud / Supabase hosting).
   • Third-party search tools may index publicly available content.
5. Storage duration. Content is retained for as long as your account is active. Upon deletion of content by you, it is removed from the Platform; however, copies made by other users or cached by third-party services are outside Cyberr's control. On account closure, residual content is deleted within 30 days.
6. Rights of the data subject. See Section 1(6) above. Right to object applies where processing is based on legitimate interest.
7. Complaint. See Section 1(7) above.

5. Job Postings and Recruitment

Management of job postings, applications and recruitment features

Cyberr processes personal data to enable Members to post and discover job opportunities and to submit and manage job applications.

More information

1. Purposes of the processing. Cyberr processes your personal data to:
   • enable employers and recruiters to post job openings on the Platform;
   • enable Members to search for, view and apply for job opportunities;
   • enable Members to upload CVs/resumes;
   • match job seekers with relevant opportunities based on their profile and preferences;
   • enable recruiters and employers to search for and contact potential candidates, in accordance with Members' settings;
   • enable Members to signal that they are open to job opportunities.
2. Personal data processed.
   • Profile data.
   • CV/resume data uploaded by the Member.
   • Job preferences and "open to work" status.
   • Job search activity (searches, applications, saved jobs).
   • Application-related data exchanged between the Member and the recruiter or employer.
   • Contact details provided to recruiters or employers in connection with a specific application.
3. Legal basis for the processing.
   • Performance of a contract [Article 6(1)(b) GDPR]: job search and recruitment features are core functionalities of the Platform.
   • Consent [Article 6(1)(a) GDPR]: for making your CV/resume and "open to work" status visible to recruiters or employers.
   • Legitimate interest [Article 6(1)(f) GDPR]: matching job seekers with relevant opportunities to create economic opportunity for Members.
4. Categories of recipients of the personal data.
   • Recruiters and employers using the Platform, in accordance with your settings.
   • Cyberr staff responsible for Platform operations.
   • Technical service providers (Lovable Cloud / Supabase hosting).
5. Storage duration. CV/resume data and job application data are retained for as long as your account is active, unless you delete them earlier. On account closure, this data is deleted within 30 days.
6. Rights of the data subject. See Section 1(6) above. Where processing is based on consent, you may withdraw your consent at any time. Right to object applies where processing is based on legitimate interest.
7. Complaint. See Section 1(7) above.

6. Groups and Events

Management of groups and events on the Platform

Cyberr processes personal data to enable Members to create, join and participate in groups and events.

More information

1. Purposes of the processing. Cyberr processes your personal data to:
   • enable you to create, manage and participate in groups;
   • enable you to create, manage, register for and participate in events;
   • display group memberships and event participations on your profile, in accordance with your settings.
2. Personal data processed.
   • Profile data (name, photo, position).
   • Group membership and event registration data.
   • Content posted within groups.
   • Event-related data (registration, attendance).
3. Legal basis for the processing.
   • Performance of a contract [Article 6(1)(b) GDPR].
   • Consent [Article 6(1)(a) GDPR]: for displaying group and event participation on your profile.
4. Categories of recipients of the personal data.
   • Other group members or event participants.
   • Group administrators and event organisers.
   • Cyberr staff.
   • Technical service providers (Lovable Cloud / Supabase hosting).
5. Storage duration. Group and event data is retained for as long as your account is active and deleted within 30 days of account closure.
6. Rights of the data subject. See Section 1(6) above.
7. Complaint. See Section 1(7) above.

7. Enterprise Services

Management of enterprise and B2B features

Cyberr offers tools for organisations (employers, recruiters) to search for candidates, manage talent and promote their activities on the Platform.

More information

1. Purposes of the processing. Cyberr processes your personal data to:
   • enable enterprise customers to search for and contact Members matching their criteria;
   • provide enterprise customers with limited profile information (name, headline, current position, general location), in accordance with your settings;
   • enable enterprise customers to manage their interactions with candidates and contacts through the Platform.
2. Personal data processed.
   • Profile data accessible to enterprise customers in accordance with your settings.
   • Activity data related to interactions with enterprise customers.
   • Data stored by enterprise customers about you within the Platform's enterprise tools.

   Cyberr does not provide your contact information to enterprise customers without your consent.

3. Legal basis for the processing.
   • Performance of a contract [Article 6(1)(b) GDPR].
   • Legitimate interest [Article 6(1)(f) GDPR]: enabling enterprises to find talent and enabling Members to be discovered for professional opportunities.
   • Consent [Article 6(1)(a) GDPR]: for sharing contact information with enterprise customers.
4. Categories of recipients of the personal data.
   • Enterprise customers, in accordance with your settings.
   • Cyberr staff.
   • Technical service providers (Lovable Cloud / Supabase hosting; Mixrank for data enrichment).
5. Storage duration. Enterprise interaction data is retained for as long as your account is active and deleted within 30 days of account closure.
6. Rights of the data subject. See Section 1(6) above.
7. Complaint. See Section 1(7) above.

8. Newsletter and Marketing Communications

Management of the newsletter and marketing emails

Cyberr delivers newsletters and marketing communications to inform Members about Platform updates, cybersecurity-related content, events and new features.

More information

1. Purposes of the processing. Cyberr processes your personal data to:
   • send you newsletters about Platform updates, cybersecurity news, events and professional content;
   • send you marketing communications about Cyberr features and services;
   • measure the delivery and engagement with these communications (open rates, click-through rates).
2. Personal data processed.
   • Email address.
   • Communication preferences.
   • Newsletter engagement data (delivery status, open/click data, unsubscription).
3. Legal basis for the processing.
   • Consent [Article 6(1)(a) GDPR]: subscription to the newsletter requires your prior consent. You may withdraw your consent at any time.
   • Legitimate interest [Article 6(1)(f) GDPR]: for service-related communications (e.g. security notices, terms updates), which are necessary for the proper functioning of the Platform and which you cannot opt out of.
4. Categories of recipients of the personal data.
   • Cyberr staff responsible for communications.
   • Email delivery service providers (HubSpot for marketing emails; transactional email provider for service messages).
5. Unsubscribe. You may unsubscribe from the newsletter at any time by clicking the unsubscribe link included in every email, by adjusting your communication preferences in your account settings, or by contacting the DPO. Your email address and associated data will be deleted from the mailing list within 30 days of your unsubscription.
6. Storage duration. Newsletter subscription data is retained for as long as you remain subscribed and deleted within 30 days of unsubscription.
7. Rights of the data subject. See Section 1(6) above.
8. Complaint. See Section 1(7) above.

9. Contact and Support Requests

Management of information requests and support tickets

Members and Visitors may contact Cyberr for information, support or to report issues. Cyberr processes the personal data necessary to respond to such requests.

More information

1. Purposes of the processing and legal basis. Cyberr processes personal data submitted through contact forms, support tickets or email in order to respond to your requests and provide customer support.
   • Performance of a contract [Article 6(1)(b) GDPR]: where the request relates to the use of the Platform by a Member.
   • Legitimate interest [Article 6(1)(f) GDPR]: where the request comes from a Visitor or relates to general enquiries.
2. Personal data processed.
   • Mandatory: name, email address, subject matter of the request.
   • Optional: phone number, any additional information you provide in the body of your request.

   We recommend that you only provide information that is necessary for processing your request. In particular, sensitive personal data (within the meaning of Article 9 GDPR) should not be included unless indispensable.

3. Categories of recipients of the personal data.
   • Cyberr staff responsible for support and operations.
   • Technical service providers (HubSpot for ticketing and CRM).
4. Storage duration. Personal data contained in support requests is kept for a period of 24 months from the date of closure of the request.
5. Rights of the data subject. See Section 1(6) above.
6. Complaint. See Section 1(7) above.

10. Safety, Security and Investigations

Protection of the Platform and its users

Cyberr processes personal data to ensure the safety and security of the Platform and to detect, prevent and investigate fraudulent, harmful or unlawful activity.

More information

1. Purposes of the processing. Cyberr processes your personal data to:
   • protect Members, Visitors and others from security threats, fraud, abuse, spam and other harmful activity;
   • enforce our User Agreement and Community Guidelines;
   • detect and prevent fake accounts, bots and inauthentic behaviour;
   • respond to legal requests from law enforcement or regulatory authorities, where required by law;
   • investigate violations of our policies.
2. Personal data processed.
   • Account and profile data.
   • Activity data and usage logs.
   • Technical data (IP address, device identifiers, browser information).
   • Communications data, where necessary for investigation purposes.
   • Reports submitted by Members about other Members.
3. Legal basis for the processing.
   • Legitimate interest [Article 6(1)(f) GDPR]: ensuring the safety, security and integrity of the Platform and protecting Members, Visitors and Cyberr.
   • Compliance with a legal obligation [Article 6(1)(c) GDPR]: where disclosure is required by law, court order or regulatory request.
4. Categories of recipients of the personal data.
   • Cyberr staff responsible for trust and safety.
   • Law enforcement and regulatory authorities, where required by law.
   • Technical service providers (Lovable Cloud / Supabase hosting; anti-fraud and abuse-detection tooling).
5. Storage duration. Safety and security records are retained in line with applicable legal limitation periods, typically up to 10 years where necessary for the establishment, exercise or defence of legal claims.
6. Rights of the data subject. See Section 1(6) above. Note that certain rights (e.g. erasure, restriction) may be limited where processing is necessary for the establishment, exercise or defence of legal claims or for compliance with a legal obligation.
7. Complaint. See Section 1(7) above.

11. Recruitment by Cyberr

Management of job applications to Cyberr

Cyberr processes personal data included in applications submitted to its human resources service in order to select candidates for vacancies within Cyberr or its partners.

More information

1. Purposes of the processing. Cyberr processes the personal data contained in applications submitted to it in order to select candidates for vacant positions with a view to possible recruitment.
2. Personal data processed.
   • Identification data (name, contact details).
   • Cover letter.
   • Curriculum vitae.
   • Copies of diplomas, certificates and any other documents provided by the applicant.
3. Legal basis for the processing.
   • Pre-contractual measures [Article 6(1)(b) GDPR]: processing is necessary to take steps at the request of the data subject prior to entering into an employment contract.
4. Categories of recipients of the personal data.
   • Cyberr management and human resources staff.
5. Storage duration. Unsuccessful applications are deleted at the end of the recruitment process, save that, with the candidate's consent, applications may be retained for a period of up to 6 months to allow for reconsideration. Successful applications leading to recruitment are retained as part of the employee's personnel file in accordance with applicable Luxembourg labour law.
6. Rights of the data subject. See Section 1(6) above.
7. Contact details for the DPO. For any questions about the processing of your personal data by Cyberr in connection with the management of your application, you may contact the DPO at dataprivacy@cyberr.ai or by post at the address indicated at the top of this notice.
8. Complaint. See Section 1(7) above.

12. International Data Transfers

Cyberr is established in Luxembourg. Personal data may be transferred outside the EU/EEA where our service providers (in particular Stripe, Mixrank, Google Analytics, Google Ads, LinkedIn Insight Tag and HubSpot) host or process data outside the EU/EEA.

Where personal data is transferred outside the EU/EEA, Cyberr ensures that appropriate safeguards are in place in accordance with Chapter V of the GDPR, including:

• transfers to countries benefiting from an adequacy decision by the European Commission;
• Standard Contractual Clauses adopted by the European Commission;
• any other appropriate safeguard under Article 46 GDPR.

You may obtain a copy of the relevant safeguards by contacting the DPO.

13. Cookies

Cyberr uses cookies and similar technologies on its website and mobile application. We use:

• Essential cookies: required for authentication and basic Platform functionality.
• Analytics: Google Analytics, to understand Platform usage patterns. Analytics data is anonymised after 26 months.
• Advertising: Google Ads, LinkedIn Insight Tag, for targeted recruitment campaigns.
• Marketing: HubSpot, for email marketing and CRM.

You can manage cookie preferences through your browser settings. Disabling non-essential cookies will not affect core Platform functionality. For full details including categories, providers, lifetimes and how to manage your preferences see our Cookie Policy, or contact us at dataprivacy@cyberr.ai.

14. Changes to this Privacy Policy

Cyberr may update this Privacy Policy from time to time. If we make material changes, we will notify you through the Platform or by other appropriate means before the changes become effective. Your continued use of the Platform after the effective date of the updated Privacy Policy constitutes your acknowledgement of the updated terms.

15. Contact

For any questions regarding this Privacy Policy or the processing of your personal data by Cyberr, please contact:

Cyberr S.à r.l.
16, rue Beck
L-1222 Luxembourg
E-mail: dataprivacy@cyberr.ai

Data Protection Officer:
E-mail: dataprivacy@cyberr.ai

Supervisory Authority:
Commission nationale pour la protection des données (CNPD)
15, Boulevard du Jazz
L-4370 Belvaux, Luxembourg
www.cnpd.lu