GitHub General Privacy Statement

Data Access & Collection · Company practice

GitHub collects Personal Data from you, automatically from your device, and from third parties

The Statement says Personal Data is collected in three ways: directly from you, automatically from your device, and from third parties. What GitHub processes depends on how you interact with the Services (such as web interfaces or desktop and mobile applications), the features you use (such as pull requests, Codespaces or GitHub Copilot) and how you access the Services, for example your preferred IDE. The lists that follow detail each channel.

Supporting quotations

Personal Data is collected from you directly, automatically from your device, and also from third parties.

The Personal Data GitHub processes when you use the Services depends on variables like how you interact with our Services (such as through web interfaces, desktop or mobile applications), the features you use (such as pull requests, Codespaces, or GitHub Copilot) and your method of accessing the Services (your preferred IDE)

Qualifications & exceptions

• The data processed varies with the interface, the features used and the access method.

Data Access & Collection · Company practice

On account opening GitHub collects your handle, name, email, password, and payment and transaction information

GitHub collects "Account Data" when you open an account: your GitHub handle, name, email address, password, payment information and transaction information.

Supporting quotations

Account Data: We collect certain information when you open an account such as your GitHub handle, name, email address, password, payment information and transaction information.

Qualifications & exceptions

• Collected when you open an account.

Data Access & Collection · Company practice

GitHub collects Personal Data included in the code, inputs, AI outputs, text, files and feedback you provide

"User Content and Files": when you use the Services, GitHub collects the Personal Data that is part of what you provide, such as code, inputs, AI outputs, text, documents, images or feedback. This describes collection of Personal Data within your content; it does not say here what GitHub does with it, which the purposes and sharing sections address.

Supporting quotations

User Content and Files: When you use our Services, we collect Personal Data included as part of the information you provide such as code, inputs, AI outputs, text, documents, images, or feedback.

Qualifications & exceptions

• Covers Personal Data included in information you provide while using the Services.

Data Access & Collection · Company practice

In some cases you provide ethnicity, gender or similar demographic details, which GitHub collects

GitHub lists "Demographic information" among the data it collects from you: in some cases you provide ethnicity, gender or similar demographic details. The source does not say when or how GitHub asks for this information.

Supporting quotations

Demographic information: In some cases, you provide us with ethnicity, gender, or similar demographic details.

Qualifications & exceptions

• Only "in some cases".

Not stated here

• The source does not say in which situations demographic details are requested or whether providing them is optional.

Data Access & Collection · Company practice

Information you submit through surveys, reviews or interactive features is collected as Feedback Data

"Feedback Data" is information you submit through surveys, reviews or interactive features.

Supporting quotations

Feedback Data: This consists of information you submit through surveys, reviews, or interactive features.

Data Access & Collection · Company practice

GitHub collects information to build your profile, such as a photo, extra email addresses, job title or biography

To create a user profile, GitHub collects information that may include a photo, additional email addresses, job title or biography. The list is introduced by "may include", so it is not stated to be complete.

Supporting quotations

Profile Information: We collect information to create a user profile, which may include a photo, additional email addresses, job title, or biography.

Qualifications & exceptions

• The listed items are examples ("may include").

Data Access & Collection · Company practice

Information you provide for promotional communications, such as name, email and company name, is collected

"Sales and Marketing Data" is information you provide for promotional communications, such as your name, email address and company name.

Supporting quotations

Sales and Marketing Data: This includes information provided for promotional communications, such as name, email address, and company name.

Data Access & Collection · Company practice

When you seek customer support, GitHub collects details such as code, text or multimedia files

"Support Data" is what you provide when you seek customer support, such as code, text or multimedia files.

Supporting quotations

Support Data: When you seek customer support, we collect details like code, text, or multimedia files.

Qualifications & exceptions

• Collected when you seek customer support.

Data Access & Collection · Company practice

GitHub uses cookies and similar technologies for essential functions like storing settings and recognizing you

GitHub says it uses cookies and similar technologies to provide essential functionality, such as storing settings and recognizing you while you use the Services. These are described as essential; the cookies section later separates required from non-essential uses.

Supporting quotations

Essential Cookies and Similar Tracking Technologies: We use cookies and similar technologies to provide essential functionality like storing settings and recognizing you while using our Services.

Data Access & Collection · Company practice

Depending on jurisdiction, GitHub may use analytics and third-party ad cookies, in some places only after consent

GitHub says that, depending on your jurisdiction, it may use online analytics products that use cookies to analyze how de-identified users use the Services and to enhance your experience. It may also employ third-party cookies to gather data for interest-based advertising. In some jurisdictions it uses non-essential cookies only after obtaining your consent. The source points to the cookies section for details and controls.

Supporting quotations

Non-essential Cookies: Depending on your jurisdiction, we may use online analytics products that use cookies to help us analyze how de-identified users use our Services and to enhance your experience when you use the Services. We may also employ third-party Cookies to gather data for interest-based advertising. In some jurisdictions, we only use non-essential cookies after obtaining your consent. See this section for more details and control options.

Qualifications & exceptions

• Varies by jurisdiction.
• In some jurisdictions non-essential cookies are used only after consent.

Not stated here

• The source does not list which jurisdictions require consent.

Data Access & Collection · Company practice

GitHub emails may carry web beacons that report device type, email client, opens and link clicks

GitHub's emails may contain web beacons that provide information on your device type, email client, email reception, opens and link clicks.

Supporting quotations

Email Marketing Interactions: Our emails may have web beacons that offer information on your device type, email client, email reception, opens, and link clicks.

Qualifications & exceptions

• Applies to emails that contain web beacons ("may have").

Data Access & Collection · Company practice

Depending on a Service's functionality, GitHub collects regional geolocation data

Depending on a Service's functionality, GitHub collects regional geolocation data. The source says "regional", and does not describe precise location collection in this list.

Supporting quotations

Geolocation Information: Depending on the Service's functionality, we collect regional geolocation data.

Qualifications & exceptions

• Depends on the functionality of the Service.

Data Access & Collection · Company practice

GitHub collects usage data such as IP address, device details, session details, request times and contributions

"Service Usage Information" covers your interactions with the Services: IP address, device information, session details, date and time of requests, device type and ID, operating system and application version, information about your contributions to repositories, and how specific features or Services perform.

Supporting quotations

Service Usage Information: We collect data about your interactions with the Services, such as IP address, device information, session details, date and time of requests, device type and ID, operating system and application version, information related to your contributions to repositories, and performance of specific features or Services.

Data Access & Collection · Company practice

GitHub logs your website activity: referring site, visit time, pages viewed and links clicked

GitHub automatically logs data about your interactions with its websites: the referring site, date and time of visit, pages viewed and links clicked.

Supporting quotations

Website Usage Data: We automatically log data about your Website interactions, including the referring site, date and time of visit, pages viewed, and links clicked.

Data Access & Collection · Company practice

Other users can give GitHub information about you, and company accounts can identify you as a representative

Other users may share information about you when they submit issues and comments. GitHub may also receive information about you if you are identified as a representative or administrator on your company's account.

Supporting quotations

Information from Other Users of the Services: Other users may share information about you when they submit issues and comments. We may also receive information about you if you are identified as a representative or administrator on your company's account.

Qualifications & exceptions

• Applies to issues and comments submitted by others, and to company accounts that identify you as a representative or administrator.

Data Access & Collection · Company practice

GitHub may acquire information about you from publicly available sources

GitHub says it may acquire information about you from publicly available sources. The source does not say which sources or what information.

Supporting quotations

Publicly Available Sources: We may acquire information about you from publicly available sources.

Not stated here

• The source does not name the public sources or the kinds of information obtained.

Data Access & Collection · Company practice

When you or an administrator link third-party services, GitHub receives information based on your settings there

When you or your administrator integrate third-party apps or services with the Services, GitHub receives information based on your settings with those services. This can include details like your name and email from services such as Google for authentication. What GitHub receives depends on the third party's settings and privacy policies, and GitHub tells you to review them.

Supporting quotations

Services you linked to your GitHub account: When you or your administrator integrate third-party apps or services with our Services, we receive information based on your settings with those services. This can include details like your name and email from services like Google for authentication. The information we receive depends on the third-party's settings and privacy policies.

Qualifications & exceptions

• What is received depends on the third party's settings and privacy policies.

Not stated here

• The source gives name and email only as examples; the full range of data depends on each third party.

Data Access & Collection · Company practice

GitHub may receive information about you from vendors, resellers, partners or affiliates

GitHub may receive information about you from third parties such as vendors, resellers, partners or affiliates, for the purposes outlined in the Statement.

Supporting quotations

Vendors, Partners, and Affiliates: We may receive information about you from third parties, like vendors, resellers, partners, or affiliates for the purposes outlined in this statement.

Qualifications & exceptions

• For the purposes outlined in this Statement.

Not stated here

• The source does not say what information these parties provide.

Data Access & Collection · User right or choice

Visual Studio Code in Codespaces and github.dev collects some telemetry by default; you can opt out in VS Code settings

GitHub Codespaces and github.dev offer Visual Studio Code in a web browser, where some telemetry is collected by default. Details are on the VS Code website. To opt out, go to File > Preferences > Settings in VS Code; opting out syncs the preference across all future web sessions in Codespaces and github.dev.

Supporting quotations

Visual Studio Code (GitHub Codespaces): GitHub Codespaces and github.dev offer Visual Studio Code in a web browser, where some telemetry is collected by default.

To opt out, go to File > Preferences > Settings in the top left menu of VS Code. Opting out will sync this preference across all future web sessions in GitHub Codespaces and github.dev.

Qualifications & exceptions

• Telemetry is on by default; opting out applies to future web sessions.

Not stated here

• The VS Code telemetry details are on a linked website that is not supplied.

Data Access & Collection · Company practice

The Services are not intended for under-13s, and GitHub says it does not intentionally gather their Personal Data

GitHub says its Services are not intended for individuals under the age of 13 and that it does not intentionally gather Personal Data from them. If you become aware that a minor has provided Personal Data, you can notify GitHub through a linked contact page.

Supporting quotations

Our Services are not intended for individuals under the age of 13. We do not intentionally gather Personal Data from such individuals. If you become aware that a minor has provided us with Personal Data, please

notify us

Qualifications & exceptions

• Stated for individuals under 13; GitHub says it does not "intentionally" gather their data.

Not stated here

• The linked contact page for notifying GitHub is not supplied here, so how a report is handled is unknown.
• The Statement does not say what GitHub does if it learns it has collected a child's data.

Data Access & Collection · Company practice

GitHub uses cookies to provide, secure and improve the Service: login, preferences, fraud prevention and statistics

GitHub says it uses cookies to provide, secure and improve its Service or to develop new features. Its examples are to keep you logged in, remember your preferences, identify your device for security and fraud purposes (including as needed to maintain the integrity of the Service), compile statistical reports, and provide information and insight for future development of GitHub. A linked page on cookies on GitHub describes the cookies it sets, why, and their expiration; that page is not supplied here.

Supporting quotations

GitHub uses cookies to provide, secure and improve our Service or to develop new features and functionality of our Service. For example, we use them to (i) keep you logged in, (ii) remember your preferences, (iii) identify your device for security and fraud purposes, including as needed to maintain the integrity of our Service, (iv) compile statistical reports, and (v) provide information and insight for future development of GitHub.

Qualifications & exceptions

• The five uses are introduced as examples ("for example").

Not stated here

• The linked "cookies on GitHub" page, which lists the specific cookies and their expiration, is not part of this source.

Data Access & Collection · Company practice

On Enterprise Marketing Pages, GitHub may use non-essential cookies to personalize and to serve and measure ads

For Enterprise Marketing Pages, GitHub says it may use non-essential cookies to gather information about enterprise users' interests and online activities, to personalize their experiences (including making ads, content, recommendations and marketing more relevant), and to serve and measure the effectiveness of targeted advertising and other marketing. Examples of such pages include resources.github.com, where additional cookies such as advertising IDs may be used for sales and marketing purposes, and the cookies section states GitHub will place non-essential cookies on pages where it markets to enterprise customers. If you disable the non-essential cookies on those pages, the ads, content and marketing you see may be less relevant.

Supporting quotations

For Enterprise Marketing Pages, we may also use non-essential cookies to (i) gather information about enterprise users’ interests and online activities to personalize their experiences, including by making the ads, content, recommendations, and marketing seen or received more relevant and (ii) serve and measure the effectiveness of targeted advertising and other marketing efforts. If you disable the non-essential cookies on the Enterprise Marketing Pages, the ads, content, and marketing you see may be less relevant.

When visiting Enterprise Marketing Pages, like resources.github.com, these and additional cookies, like advertising IDs, may be used for sales and marketing purposes.

GitHub will place non-essential cookies on pages where we market products and services to enterprise customers, for example, on resources.github.com.

Qualifications & exceptions

• Applies to Enterprise Marketing Pages, described as pages where GitHub markets products and services to enterprise customers, such as resources.github.com.
• Disabling non-essential cookies there makes the ads and marketing you see less relevant; it is not stated to stop all data collection.

Not stated here

• The source does not list every page counted as an Enterprise Marketing Page.

Cross-references

• contrast (model-proposed): If your browser sends Do Not Track, GitHub says it will not set non-essential cookies or load resources that do — The Do Not Track card says GitHub will not set non-essential cookies if your browser sends a DNT signal, listed among controls for all websites. The enterprise marketing card says GitHub will place non-essential cookies on pages where it markets to enterprise customers. The source does not say whether the DNT commitment applies on those pages, so the two pull in different directions without a stated resolution.

Data Access & Collection · Company practice

GitHub emails may contain a pixel tag that tells GitHub whether you opened the email and your IP address

GitHub's emails to users may contain a pixel tag, a small clear image that can tell GitHub whether you have opened an email and what your IP address is. GitHub says it uses the tag to make its email communications more effective and to make sure it is not sending you unwanted email.

Supporting quotations

Our emails to users may contain a pixel tag, which is a small, clear image that can tell us whether or not you have opened an email and what your IP address is. We use this pixel tag to make our email communications more effective and to make sure we are not sending you unwanted email.

Qualifications & exceptions

• Applies to emails that contain a pixel tag ("may contain").

Data Access & Collection · Company practice

GitHub uses web beacons, local storage and mobile analytics along with cookies to operate and provide the Services

GitHub says it uses cookies and similar technologies, such as web beacons, local storage and mobile analytics, to operate and provide the Services. The Statement then defines cookies, web beacons, mobile identifiers and flash cookies.

Supporting quotations

We use cookies and similar technologies, such as web beacons, local storage, and mobile analytics, to operate and provide our Services.

Data Access & Collection · Context

A cookie is a small text file that can uniquely identify your browser and lets a web server recognize it over time

The Statement defines cookies as small text files stored by your browser on your device. A cookie can be read when your browser connects to a web server in the domain that placed it. The text may contain a string of numbers and letters that may uniquely identify your device, and can contain other information, which lets the server recognize your browser over time.

Supporting quotations

Cookies are small text files stored by your browser on your device. A cookie can later be read when your browser connects to a web server in the same domain that placed the cookie. The text in a cookie contains a string of numbers and letters that may uniquely identify your device and can contain other information as well. This allows the web server to recognize your browser over time, each time it connects to that web server.

Data Access & Collection · Company practice

Mobile identifiers work like cookies; on Enterprise Marketing pages they may support sales and marketing collection

Mobile identifiers for analytics can be accessed and used by apps on mobile devices much as websites use cookies. When you visit Enterprise Marketing pages such as resources.github.com on a mobile device, these may allow GitHub and its third-party analytics and advertising partners to collect data for sales and marketing purposes.

Supporting quotations

Mobile identifiers for analytics can be accessed and used by apps on mobile devices in much the same way that websites access and use cookies. When visiting Enterprise Marketing pages, like resources.github.com, on a mobile device these may allow us and our third-party analytics and advertising partners to collect data for sales and marketing purposes.

Qualifications & exceptions

• The sales and marketing collection is described for visits to Enterprise Marketing pages on a mobile device ("may allow").

Data Access & Collection · Company practice

GitHub may also use flash cookies (Local Shared Objects) to store information about your use of the Services

GitHub says it may also use so-called "flash cookies", also known as Local Shared Objects, to collect and store information about your use of the Services. It notes that flash cookies are commonly used for advertisements and videos.

Supporting quotations

We may also use so-called “flash cookies” (also known as “Local Shared Objects” or “LSOs”) to collect and store information about your use of our Services. Flash cookies are commonly used for advertisements and videos.

Qualifications & exceptions

• Stated as "may also use".

Data Access & Collection · Company practice

Required cookies cover login, language, shopping cart, performance, page load times and audience measurement

In the cookie table, "Required Cookies" are described as used to perform essential website functions and provide the services. Examples given are logging you in, saving language preferences, providing a shopping cart experience, improving performance, routing traffic between web servers, detecting screen size, determining page load times, improving user experience and audience measurement. GitHub says these cookies are necessary for its websites to work. Note that "audience measurement" is listed among the uses of required cookies.

Supporting quotations

Required Cookies GitHub uses required cookies to perform essential website functions and to provide the services. For example, cookies are used to log you in, save your language preferences, provide a shopping cart experience, improve performance, route traffic between web servers, detect the size of your screen, determine page load times, improve user experience, and for audience measurement. These cookies are necessary for our websites to work.

Qualifications & exceptions

• The uses are introduced as examples ("for example").

Data Access & Collection · Company practice

Third parties may use analytics cookies on GitHub websites, and some analytics cookies also personalize ads

In the cookie table, "Analytics" cookies are used by third parties GitHub allows, to understand how you use its websites (for example, which pages you visit and how many clicks you need to accomplish a task). GitHub adds that it also uses some analytics cookies to provide personalized advertising.

Supporting quotations

Analytics We allow third parties to use analytics cookies to understand how you use our websites so we can make them better. For example, cookies are used to gather information about the pages you visit and how many clicks you need to accomplish a task. We also use some analytics cookies to provide personalized advertising.

Qualifications & exceptions

• Some, not all, analytics cookies are also used for personalized advertising.

Data Access & Collection · Company practice

Advertising cookies track ad clicks and purchases after clicks and show ads based on prior ads, interests and browsing

In the cookie table, GitHub and third parties use "Advertising" cookies to show you new ads based on ads you have already seen. The cookies also track which ads you click or purchases you make after clicking an ad. The row says this is done both for payment purposes and to show ads more relevant to you, and gives examples: detecting when you click an ad and showing ads based on your social media interests and website browsing history.

Supporting quotations

Advertising In addition, GitHub and third parties use advertising cookies to show you new ads based on ads you've already seen. Cookies also track which ads you click or purchases you make after clicking an ad. This is done both for payment purposes and to show you ads that are more relevant to you. For example, cookies are used to detect when you click an ad and to show you ads based on your social media interests and website browsing history.

Qualifications & exceptions

• Tracking of purchases applies to purchases made after clicking an ad.

Data Access & Collection · User right or choice

Pages that serve non-essential cookies have a footer link to cookie settings that you can use at any time

The Statement lists several ways to disable non-essential cookies. Under the sub-heading about GitHub Enterprise Marketing Pages, it says any GitHub page that serves non-essential cookies will have a link in the footer to cookie settings, where you can express your preferences at any time by updating your settings. The sub-heading mentions Enterprise Marketing Pages while the sentence says "any GitHub page", so the source does not make clear whether the link appears only on Enterprise Marketing Pages.

Supporting quotations

You have several options to disable non-essential cookies:

Specifically on GitHub Enterprise Marketing Pages

Any GitHub page that serves non-essential cookies will have a link in the page’s footer to cookie settings. You can express your preferences at any time by clicking on that link and updating your settings.

Qualifications & exceptions

• Appears on pages that serve non-essential cookies.
• Listed under the sub-heading "Specifically on GitHub Enterprise Marketing Pages".

Not stated here

• The source does not say whether the footer link is limited to Enterprise Marketing Pages or appears on every GitHub page that serves non-essential cookies.

Data Access & Collection · User right or choice

Some users can also manage non-essential cookies through a consent banner to accept, manage or reject all

The Statement says some users will also be able to manage non-essential cookies via a cookie consent banner, with options to accept, manage and reject all non-essential cookies. It does not say which users see the banner.

Supporting quotations

Some users will also be able to manage non-essential cookies via a cookie consent banner, including the options to accept, manage, and reject all non-essential cookies.

Qualifications & exceptions

• Only "some users".

Not stated here

• The source does not say which users are offered the banner.

Data Access & Collection · Company commitment

If your browser sends Do Not Track, GitHub says it will not set non-essential cookies or load resources that do

Under general controls "for all websites", the Statement says that if your browser sends a Do Not Track (DNT) signal, GitHub will not set non-essential cookies and will not load third-party resources which set non-essential cookies. The source does not say whether this applies on Enterprise Marketing Pages, where the cookies section separately says GitHub will place non-essential cookies on pages where it markets to enterprise customers.

Supporting quotations

Generally for all websites

If your browser sends a Do Not Track (DNT) signal, GitHub will not set non-essential cookies and will not load third party resources which set non-essential cookies.

Qualifications & exceptions

• Listed among general controls under "Generally for all websites".

Not stated here

• The source does not reconcile this DNT commitment with its statement that non-essential cookies are placed on enterprise marketing pages.

Cross-references

• contrast (model-proposed): On Enterprise Marketing Pages, GitHub may use non-essential cookies to personalize and to serve and measure ads — The Do Not Track card says GitHub will not set non-essential cookies if your browser sends a DNT signal, listed among controls for all websites. The enterprise marketing card says GitHub will place non-essential cookies on pages where it markets to enterprise customers. The source does not say whether the DNT commitment applies on those pages, so the two pull in different directions without a stated resolution.

Data Access & Collection · User right or choice

Browser cookie settings and tracking or content blockers can limit non-essential cookies

The Statement lists other controls: many browsers provide cookie controls that may limit the types of cookies you encounter; a browser extension designed to block tracking, such as Privacy Badger, may disable non-essential cookies set by a website or third parties; and a browser extension that blocks unwanted content, such as uBlock Origin, will disable non-essential cookies to the extent that content that sets them is blocked. These are tools you set up yourself rather than GitHub commitments.

Supporting quotations

Many browsers provide cookie controls which may limit the types of cookies you encounter online.

non-essential cookies set by a website or third parties may be disabled.

non-essential cookies will be disabled to the extent that content that sets non-essential cookies will be blocked.

Qualifications & exceptions

• Effect depends on the browser or extension and what it blocks ("may", "to the extent").

Data Access & Collection · Procedure

Cookie choices are specific to the browser you use, so repeat them on other devices and browsers

The Statement says these choices are specific to the browser you are using. If you access the Services from other devices or browsers, take the same actions there so your choices apply to the data collected through them.

Supporting quotations

These choices are specific to the browser you are using. If you access our Services from other devices or browsers, take these actions from those systems to ensure your choices apply to the data collected when you use those systems.

Qualifications & exceptions

• Choices apply only to the browser where you make them.

Data Access & Collection · Company practice

GitHub may collect identifiers, demographic, payment, commercial, internet activity and geolocation data and inferences

In its notice of collection, GitHub says it may collect various categories of personal information about website visitors and users of its Services (which include its applications, software, products or services): identifiers and contact information, demographic information, payment information, commercial information, internet or electronic network activity information, geolocation data, audio, electronic, visual or similar information, and inferences drawn from such information.

Supporting quotations

We may collect various categories of personal information about our website visitors and users of "Services" which includes GitHub applications, software, products, or services. That information includes identifiers/contact information, demographic information, payment information, commercial information, internet or electronic network activity information, geolocation data, audio, electronic, visual, or similar information, and inferences drawn from such information.

Qualifications & exceptions

• Stated as "may collect" for website visitors and users of the Services.

Data Access & Collection · Company practice

California disclosures: categories collected in the last 12 months, their sources and the purposes

For California privacy law compliance, GitHub says that in the last 12 months it collected these categories of personal information: identifiers and contact information, demographic information (such as gender), payment card information associated with you, commercial information, internet or other electronic network activity information, geolocation data, audio, electronic, visual or similar information, and inferences drawn from the above. The sources are directly from you, automatically, or from third parties. The business or commercial purposes are those summarized above and in the Statement under Processing Purposes.

Supporting quotations

We also make the following disclosures for purposes of compliance with California privacy law:

We collected the following categories of personal information in the last 12 months: identifiers/contact information, demographic information (such as gender), payment card information associated with you, commercial information, Internet or other electronic network activity information, geolocation data, audio, electronic, visual or similar information, and inferences drawn from the above.

The sources of personal information from whom we collected are: directly from you, automatically or from third parties.

The business or commercial purposes of collecting personal information are as summarized above and in our Privacy Statement under Processing Purposes.

Qualifications & exceptions

• Covers the last 12 months and is made for compliance with California privacy law.

Cross-references

• refers to (model-proposed): GitHub lists the ways it may process your Personal Data, which vary with your interface, features and access tools — The California disclosures say the business or commercial purposes of collecting personal information are as summarized in the Statement under Processing Purposes, which is the section the purposes cards describe.