GitHub General Privacy Statement

Account & Service Control · Company practice

If a school or employer supplies your GitHub account, it becomes Data Controller for most of your Personal Data

When an organization such as your employer or school provides your GitHub account, that organization takes the role of Data Controller for most Personal Data used in the Services, and this Statement's direct applicability to you changes. The source says this lets the organization manage and administer your account, including adjusting privacy settings, and access and use your Personal Data, including details on how you use the Services and your content and files. GitHub says it remains dedicated to preserving your privacy rights and points you to the organization's own privacy statement for its practices.

Supporting quotations

End User Notice: Organization-Provided GitHub Accounts

When a school or employer supplies your GitHub account, they assume the role of Data Controller for most Personal Data used in our Services.

Manage and administer your GitHub account, including adjusting privacy settings.

Access and utilize your Personal Data, which includes details on how you use the Services, as well as your content and files.

Should you access a GitHub Service through an account provided by an organization, such as your employer or school, the organization becomes the Data Controller, and this Privacy Statement's direct applicability to you changes.

Qualifications & exceptions

• Stated as "most Personal Data" in the first paragraph; the later paragraph says the organization becomes the Data Controller without that qualifier.
• This applies to accounts supplied by an organization, not to personal accounts you open yourself.

Not stated here

• The source does not say which Personal Data the organization does not control.
• The organization's own privacy statement is not part of this source.

Account & Service Control · User right or choice

Depending on where you live, you may have rights to access your data and to learn what was collected in 12 months

The Statement says that, depending on your residence location, you may have specific legal rights regarding your Personal Data. Two are the right to access the data collected about you and the right to request detailed information about the specific types of Personal Data collected over the past 12 months, including data disclosed for business purposes. Which rights you actually have depends on the law where you live; the Statement does not say which locations qualify.

Supporting quotations

Depending on your residence location, you may have specific legal rights regarding your Personal Data:

The right to access the data collected about you

The right to request detailed information about the specific types of Personal Data we've collected over the past 12 months, including data disclosed for business purposes

Qualifications & exceptions

• Depends on your residence location.
• The detailed-information right covers the past 12 months.

Not stated here

• The source does not say which residence locations carry each right.

Account & Service Control · User right or choice

You may have qualified rights to correct, erase or limit, and object to the processing of, your Personal Data

The listed rights include the right to rectify or update inaccurate or incomplete Personal Data under certain circumstances, the right to erase or limit processing under specific conditions, and the right to object to processing as allowed by applicable law. Each is qualified in the text, and the Statement does not spell out the circumstances or conditions.

Supporting quotations

The right to rectify or update inaccurate or incomplete Personal Data under certain circumstances

The right to erase or limit the processing of your Personal Data under specific conditions

The right to object to the processing of your Personal Data, as allowed by applicable law

Qualifications & exceptions

• Rectification applies "under certain circumstances".
• Erasure or limiting applies "under specific conditions".
• Objection applies "as allowed by applicable law".

Not stated here

• The circumstances and conditions are not specified in this list.

Account & Service Control · User right or choice

You may have the right to withdraw consent and to receive your data in a machine-readable format where feasible

The listed rights also include withdrawing consent where processing is based on your consent, and receiving your collected Personal Data in a structured, commonly used and machine-readable format so it can be transferred to another company, where technically feasible.

Supporting quotations

The right to withdraw consent, where processing is based on your consent

The right to receive your collected Personal Data in a structured, commonly used, and machine-readable format to facilitate its transfer to another company, where technically feasible

Qualifications & exceptions

• Consent withdrawal applies only where processing is based on consent.
• Portability applies where technically feasible.

Account & Service Control · Procedure

To exercise these rights, email privacy[at]github[dot]com; GitHub may ask for extra information to verify your identity

To exercise the rights listed, you send an email to privacy[at]github[dot]com and follow the instructions provided. For security, GitHub may request extra information to verify your identity before addressing your request. For feedback or concerns you can contact the Data Protection Officer at dpo[at]github[dot]com.

Supporting quotations

To exercise these rights, please send an email to privacy[at]github[dot]com and follow the instructions provided. To verify your identity for security, we may request extra information before addressing your data-related request. Please contact our Data Protection Officer at dpo[at]github[dot]com for any feedback or concerns.

Qualifications & exceptions

• GitHub may ask for extra information to verify your identity before acting.

Account & Service Control · Procedure

You can contact GitHub by contact form or by emailing the Data Protection Officer; two postal addresses are given

The Statement says to contact GitHub via its contact form or by emailing the Data Protection Officer at dpo[at]github[dot]com. Two addresses are listed: GitHub B.V. in Amsterdam, The Netherlands, and GitHub, Inc. in San Francisco, California, United States.

Supporting quotations

Contact us via our contact form or by emailing our Data Protection Officer at dpo[at]github[dot]com. Our addresses are:

GitHub B.V. Prins Bernhardplein 200, Amsterdam 1097JB The Netherlands

GitHub, Inc. 88 Colin P. Kelly Jr. St. San Francisco, CA 94107 United States

Account & Service Control · User right or choice

US state residents can request details of the personal information collected and ask for corrections

The Statement lists rights common to US state privacy laws. One is knowledge and correction: you may request details on the specific personal information GitHub has collected about you and ask it to correct inaccurate information, by contacting GitHub. You can also access and edit basic account information in your settings.

Supporting quotations

These rights are common to the US State privacy laws:

Right to Knowledge and Correction: You have the right to request details on the specific personal information we’ve collected about you and the right to correct inaccurate information. You can exercise this right by contacting us. You can also access and edit basic account information in your settings.

Qualifications & exceptions

• Described as rights "common to the US State privacy laws"; whether a specific state grants each right is not stated.

Account & Service Control · User right or choice

Two free requests in any 12-month period; GitHub commits to respond within 45 days, extendable by 45 more

Under "Right to a Timely Response", GitHub says you are allowed two free requests in any 12-month period and commits to respond to a request within 45 days. In complex cases it may extend its response time by an additional 45 days. The Statement does not say what happens with requests beyond two in a 12-month period.

Supporting quotations

Right to a Timely Response: You are allowed to make two free requests in any 12-month period. We commit to responding to your request within 45 days. In complex cases, we may extend our response time by an additional 45 days.

Qualifications & exceptions

• Two free requests in any 12-month period.
• Response in 45 days, extendable by an additional 45 days in complex cases.

Not stated here

• The source does not say whether additional requests are refused or charged.

Account & Service Control · Company commitment

GitHub says it will not hold it against you when you exercise your privacy rights

Under "Non-Discrimination", GitHub says it will not hold it against you when you exercise any of your rights, and encourages you to review your privacy settings and contact it with questions. The source does not describe what treatment this covers beyond that statement.

Supporting quotations

Non-Discrimination: We will not hold it against you when you exercise any of your rights.

Account & Service Control · Procedure

US state requests go to privacy[at]github[dot]com; GitHub may verify identity; agents need signed permission

To make an access, deletion, correction or opt-out request, you send an email to privacy[at]github[dot]com and follow the instructions provided. GitHub may need to verify your identity before processing your request. If you use an authorized agent, GitHub asks that they have your signed permission or power of attorney as required.

Supporting quotations

Exercising your Privacy Rights

To make an access, deletion, correction, or opt-out request, please send an email to privacy[at]github[dot]com and follow the instructions provided. We may need to verify your identity before processing your request. If you choose to use an authorized agent to submit a request on your behalf, please ensure they have your signed permission or power of attorney as required.

Qualifications & exceptions

• GitHub may verify your identity first.
• An authorized agent needs your signed permission or power of attorney "as required".

Account & Service Control · Procedure

Questions about privacy practices for California residents, and general concerns, can be emailed to GitHub

For questions about its privacy practices with respect to California residents, the Statement says to email privacy[at]github[dot]com. For any questions or concerns about its privacy practices, you can also email the Data Protection Officer at dpo[at]github[dot]com.

Supporting quotations

If you have any questions about our privacy practices with respect to California residents, please send an email to privacy[at]github[dot]com.

If you have any questions or concerns about our privacy practices, please email our Data Protection Officer at dpo[at]github[dot]com.

Account & Service Control · User right or choice

Colorado, Connecticut and Virginia residents can appeal if GitHub denies a rights request

If you live in Colorado, Connecticut or Virginia, the Statement says you have additional rights. One is the right to appeal if GitHub denies your rights request; GitHub says it will provide the information needed to submit an appeal at that time.

Supporting quotations

If you live in Colorado, Connecticut, or Virginia you have some additional rights:

If we deny your rights request, you have the right to appeal that decision. We will provide you with the necessary information to submit an appeal at that time.

Qualifications & exceptions

• Applies to residents of Colorado, Connecticut and Virginia.

Not stated here

• The appeal process itself is not described; the Statement says the information is provided when a request is denied.