A school or employer that supplies your account becomes Data Controller and can manage it and access your data
When a school or employer supplies your GitHub account, that organization takes the role of Data Controller for most Personal Data used in the Services. This lets it manage and administer your account, including adjusting privacy settings, and access and use your Personal Data, including details of how you use the Services and your content and files.
Supporting quotations
When a school or employer supplies your GitHub account, they assume the role of Data Controller for most Personal Data used in our Services.
Manage and administer your GitHub account, including adjusting privacy settings.
Access and utilize your Personal Data, which includes details on how you use the Services, as well as your content and files.
Qualifications & exceptions
Applies only to accounts supplied by an organization such as a school or employer.
The organization is controller for "most" Personal Data, not all; GitHub stays controller for specific activities defined in the Data Protection Agreement.
Sharing & Disclosure · Context
Third-party extensions, integrations and links follow the third parties' own privacy policies
When you use third-party extensions or integrations, or follow references and links within GitHub's Services, the third parties' privacy policies apply to Personal Data you provide to or consent to share with them, and their privacy statements govern how that data is processed.
Supporting quotations
When you use third-party extensions, integrations, or follow references and links within our Services, the privacy policies of these third parties apply to any Personal Data you provide or consent to share with them.
Their privacy statements will govern how this data is processed.
Qualifications & exceptions
Covers Personal Data you provide or consent to share with the third party; those policies are not supplied here.
Sharing & Disclosure · Company practice
Third-party buttons and content such as Twitter or LinkedIn links may send browser information to those companies
The Services may contain links or buttons leading to third-party services like Twitter or LinkedIn. Using these features may result in data collection, and engaging with them may automatically send certain browser information to those companies. GitHub refers you to those companies' privacy statements.
Supporting quotations
Our Services may contain links or buttons that lead to third-party services like Twitter or LinkedIn.
Use of these features may result in data collection. Engaging with these buttons, tools, or content may automatically send certain browser information to these companies.
Please review the privacy statements of these companies for more information.
Qualifications & exceptions
The transfer is described as something that "may" happen when you engage with these features.
Not stated here
The browser information sent is not specified, and the third parties' statements are not supplied.
Sharing & Disclosure · Company practice
GitHub may disclose data in good faith to prevent fraud, abuse or attacks, or to protect GitHub and users
GitHub may disclose Personal Data to abuse and fraud prevention entities based on a good-faith belief that it is needed to prevent fraud, abuse or attacks on the Services, or to protect the safety of GitHub and its users.
Supporting quotations
We may share Personal Data with the following recipients:
Abuse and Fraud Prevention Entities: We may disclose Personal Data based on a good faith belief it is needed to prevent fraud, abuse, or attacks on our Services, or to protect the safety of GitHub and our users.
Qualifications & exceptions
The trigger is GitHub's own good-faith belief, not a legal request.
Not stated here
The recipient entities are not named.
Sharing & Disclosure · Company practice
Affiliates, including Microsoft, may receive data for marketing, advertising and AI training, among other purposes
Personal Data may be shared with GitHub affiliates, including Microsoft, for customer service, marketing and advertising, order fulfillment, billing, technical support, legal and compliance obligations, product development and improvement (including training and improving artificial intelligence and machine learning technologies), and for other purposes described in the affiliates' own privacy statements. GitHub says affiliates will process the data in line with applicable law and their privacy commitments.
Supporting quotations
We may share Personal Data with the following recipients:
Personal Data may be shared with GitHub affiliates, including Microsoft, to facilitate customer service, marketing and advertising, order fulfillment, billing, technical support, legal and compliance obligations, product development and improvement (including training and improving artificial intelligence and machine learning technologies), and for other purposes described in their respective privacy statements.
When we share data with affiliates, they will process it in accordance with applicable law and their privacy commitments.
Qualifications & exceptions
Affiliates may also use the data for "other purposes described in their respective privacy statements", which are not supplied here, so the purposes are not limited to the listed ones.
Not stated here
Which affiliates besides Microsoft receive data, and which data, is not stated.
Sharing & Disclosure · Company practice
If an organization adds you to its account, GitHub may share your data with that organization
If an organization adds you to its GitHub account, GitHub might share Personal Data with that organization to fulfill the commercial relationship. In that case your use of the Services is covered by a data protection agreement and terms between your organization and GitHub.
Supporting quotations
We may share Personal Data with the following recipients:
If an organization adds you to their GitHub account, we might share Personal Data with that organization to fulfill the commercial relationship.
In such a case, your use of the Services is protected by a data protection agreement and terms between your organization and GitHub
Qualifications & exceptions
The data protection agreement and terms with the organization are not supplied.
Sharing & Disclosure · Company practice
Data may be disclosed in a sale, merger or other strategic business transaction
GitHub might disclose Personal Data, within the limits of the law and in line with this Statement, for strategic business transactions such as a sale or merger.
Supporting quotations
We may share Personal Data with the following recipients:
Corporate Transaction Entities: we might disclose Personal Data within the limits of the law and in accordance with this Privacy Statement for strategic business transactions such as sales or a merger.
Qualifications & exceptions
Disclosure is limited to what the law allows and to this Statement's terms.
Sharing & Disclosure · Company practice
Partners and resellers may receive your data where allowed, with your consent when required
GitHub works with third parties offering sales, consulting, support and technical services for its Services, and may share your data with these partners and resellers where allowed, and with your consent when required.
Supporting quotations
We may share Personal Data with the following recipients:
We cooperate with third-parties that offer sales, consulting, support, and technical services for our Services.
We may share your data with these partners and resellers where allowed, and with your consent when required.
Qualifications & exceptions
Consent is sought only "when required"; otherwise sharing happens "where allowed".
Not stated here
When consent is required is not specified.
Sharing & Disclosure · Company practice
Vendors handle hosting, marketing, advertising, analytics, payments and security under contract
GitHub may use vendors to provide services on its behalf, including hosting, marketing, advertising, social, analytics, support ticketing, credit card processing and security services. GitHub says they are bound by contractual obligations to ensure the security, privacy and confidentiality of your information. A list of Subprocessors is published on a linked page that is not supplied.
Supporting quotations
We may share Personal Data with the following recipients:
We may use vendors to provide services on our behalf, including hosting, marketing, advertising, social, analytics, support ticketing, credit card processing, or security services.
They are bound by contractual obligations to ensure the security, privacy, and confidentiality of your information.
Qualifications & exceptions
The subprocessor list is on a linked page that is not supplied.
Sharing & Disclosure · Restriction or exception
On your instruction, GitHub may share data with Marketplace apps; you are responsible for what you share
Upon your instruction, GitHub may share Personal Data with third-party applications available on its Marketplace. You are responsible for the data you instruct GitHub to share with these applications.
Supporting quotations
We may share Personal Data with the following recipients:
Upon your instruction, we may share Personal Data with third-party applications available on our Marketplace. You are responsible for the data you instruct us to share with these applications.
Sharing & Disclosure · User right or choice
Depending on your settings, your data may be shared with other users and the public
Depending on your account settings, GitHub may share Personal Data with other users and the public. You control what information is made public and can change it under User Settings in your profile. Anything you share in a collaborative context may become publicly accessible.
Supporting quotations
We may share Personal Data with the following recipients:
Depending on your account settings, we may share Personal Data with other users of the Services and the public. You control what information is made public.
Please be aware that any information you share in a collaborative context may become publicly accessible.
Qualifications & exceptions
Information shared in a collaborative context may become public regardless of profile settings.
Sharing & Disclosure · Company practice
GitHub and its partners share collected or inferred information with third parties for these cookie purposes
GitHub and/or its partners also share the information collected or inferred through cookies and similar technologies with third parties for the cookie purposes described, including targeted advertising.
Supporting quotations
We and/or our partners also share the information we collect or infer with third parties for these purposes.
Qualifications & exceptions
In the saved version this cookie text follows the "Other translations" heading without a heading of its own; it is read as the Statement's cookie section.
"These purposes" refers back to the cookie purposes, which include targeted advertising.
Not stated here
The third parties are not named.
Sharing & Disclosure · Company commitment
If GitHub detects a Global Privacy Control signal, it will not share your data; GitHub says it does not sell data
You can use the Global Privacy Control (GPC) to communicate privacy preferences. If GitHub detects the GPC signal from your device, it will not share your data; GitHub also states that it does not sell your data.
Supporting quotations
You may use the Global Privacy Control (GPC) to communicate your privacy preferences. If GitHub detects the GPC signal from your device, GitHub will not share your data (we do not sell your data).
These choices are specific to the browser you are using.
Qualifications & exceptions
Applies when GitHub detects the signal from your device; the choices are browser-specific.
"Will not share your data" is not defined here; other sections describe sharing with service providers, affiliates and authorities.
Not stated here
Which kinds of sharing a GPC signal stops is not specified.
Under US state rights, GitHub says it shares information with service providers for operations such as hosting
Under the right to know data recipients, GitHub says it shares your information with service providers for legitimate business operations, such as data storage and hosting, and points to a "Sharing Your Information" section below for details.
Supporting quotations
US State Specific Information
We share your information with service providers for legitimate business operations, such as data storage and hosting.
For more details, please see “Sharing Your Information” below.
Qualifications & exceptions
Applies to residents of certain US states with their own privacy laws; the states are not all named in this section.
This short description mentions only service providers; the California disclosures and the general sharing section list more recipients, including advertising networks and affiliates.
Not stated here
No section titled "Sharing Your Information" appears below in the saved version; the closest is "Sharing of Personal Data" earlier in the Statement.
Cross-references
contrast (model-proposed): California: identifiers, network activity and inferences were shared with ad, analytics and social networks — contrast: The US-state recipients right mentions only service providers for operations such as hosting, while the California disclosures say identifiers, network activity and inferences were "shared" with advertising networks, analytics providers and social networks. Read together, the shorter description is not a complete list of recipients.
Sharing & Disclosure · User right or choice
Opt out of sharing via the footer "Do Not Share My Personal Information" link or Global Privacy Control
To opt out of the sharing of your personal information, you can click the "Do Not Share My Personal Information" link in the footer of GitHub's websites or use the Global Privacy Control if available. Authorized agents can also submit opt-out requests for you.
Supporting quotations
US State Specific Information
To opt out of the sharing of your personal information, you can click on the "Do Not Share My Personal Information" link on the footer of our Websites or use the Global Privacy Control ("GPC") if available. Authorized agents can also submit opt-out requests on your behalf.
Qualifications & exceptions
Applies to residents of certain US states with their own privacy laws; the states are not all named in this section.
California: all listed categories were disclosed for business purposes to partners, providers and social sites
GitHub discloses that in the last 12 months it disclosed, for a business purpose, identifiers and contact information, demographic information (such as gender and rough geographic location), payment and commercial information, network activity, geolocation, audio, electronic, visual or similar information, and inferences. Each category went to third-party business partners and service providers, third-party sites or platforms such as social networking sites, and other third parties described in the Sharing of Personal Data section.
Supporting quotations
California
We also make the following disclosures for purposes of compliance with California privacy law:
We disclosed the following categories of personal information for a business purpose in the last 12 months: identifiers/contact information, demographic information (such as gender and rough geographic location), payment information, commercial information, Internet or other electronic network activity information, geolocation data, audio, electronic, visual or similar information, and inferences drawn from the above.
We disclosed each category to third-party business partners and service providers, third-party sites or platforms such as social networking sites, and other third parties as described in the Sharing of Personal Data section of our Privacy Statement.
Qualifications & exceptions
California disclosure covering the last 12 months.
Sharing & Disclosure · Context
California: identifiers, network activity and inferences were shared with ad, analytics and social networks
As defined by applicable law, GitHub says it "shared" identifiers and contact information, internet or network activity information and inferences in the last 12 months with advertising networks, data analytics providers and social networks, to help with marketing, advertising and audience measurement.
Supporting quotations
California
We also make the following disclosures for purposes of compliance with California privacy law:
As defined by applicable law, we “shared” the following categories of personal information in the last 12 months: identifiers/contact information, Internet or other electronic network activity information, and inferences drawn from the above. We shared each category to or with advertising networks, data analytics providers, and social networks.
The business or commercial purpose of sharing personal information is to assist us with marketing, advertising, and audience measurement.
Qualifications & exceptions
"Shared" is used in the sense of applicable law, which the Statement does not define here.
You can opt out of this sharing via the footer link or Global Privacy Control.
Sharing & Disclosure · Company commitment
GitHub does not sell or share the personal information of known minors under 16
In its California disclosures GitHub states that it does not "sell" or "share" the personal information of known minors under 16 years of age.
Supporting quotations
We do not “sell” or “share” the personal information of known minors under 16 years of age.
Qualifications & exceptions
Limited to "known" minors under 16; "sell" and "share" are used in their legal sense.
Sharing & Disclosure · Company commitment
California Shine the Light: GitHub says it does not disclose personal information for third parties' direct marketing
Under California Civil Code section 1798.83 (the "Shine the Light" law), California Customers may ask whether a business disclosed personal information to third parties for those parties' direct marketing. GitHub says it does not make such disclosures as defined by that law. California Customers can ask for more information by emailing privacy[at]github[dot]com; businesses must answer one request per customer each year and may not have to answer requests sent another way.
Supporting quotations
Under California Civil Code section 1798.83, also known as the “Shine the Light” law,
Please be aware that we do not disclose personal information to any third parties for their direct marketing purposes as defined by this law.
California Customers may request further information about our compliance with this law by emailing (privacy[at]github[dot]com). Please note that businesses are required to respond to one request per California Customer each year and may not be required to respond to requests made by means other than through the designated email address.
Qualifications & exceptions
"Direct marketing purposes" is used as defined by the cited California law, which is not supplied.
Separately, GitHub discloses that it "shared" some categories with advertising networks for marketing and advertising (gh-ps-095); the two statements use different legal terms.
Cross-references
contrast (model-proposed): California: identifiers, network activity and inferences were shared with ad, analytics and social networks — contrast: GitHub says it does not disclose personal information for third parties' own direct marketing under the Shine the Light law, yet it also says it "shared" some categories with advertising networks for its own marketing and advertising. The statements use different legal terms; the first concerns third parties' direct marketing, the second sharing for GitHub's advertising.
Sharing & Disclosure · Company commitment
Nevada: GitHub says it does not sell covered information under Chapter 603A
GitHub says it does not sell your covered information as defined under Chapter 603A of the Nevada Revised Statutes. Questions can go to privacy[at]github[dot]com.
Supporting quotations
We do not sell your covered information, as defined under Chapter 603A of the Nevada Revised Statutes.
Qualifications & exceptions
"Covered information" and "sell" have the meaning in the cited Nevada law, which is not supplied.