GitHub General Privacy Statement

Use & Processing · Company practice

For organization-provided accounts, GitHub acts as a Data Processor following the organization's instructions

In that case GitHub functions as a Data Processor and follows the Data Controller's instructions on how your Personal Data is processed. A Data Protection Agreement governs the relationship between GitHub and the organization. For details about their privacy practices, the source tells you to refer to the privacy statement of the organization providing your account.

Supporting quotations

In such circumstances, GitHub functions as a Data Processor, adhering to the Data Controller's instructions regarding your Personal Data's processing. A Data Protection Agreement governs the relationship between GitHub and the Data Controller. For further details regarding their privacy practices, please refer to the privacy statement of the organization providing your account.

Qualifications & exceptions

• Only for accounts provided by an organization.

Not stated here

• The terms of the Data Protection Agreement are not part of this paragraph.

Cross-references

• qualified by (model-proposed): With organization-granted product access, GitHub is controller only for activities in a Data Protection Agreement — The processor card says GitHub acts as a Data Processor for organization-provided accounts. The product-access paragraph adds that where the organization grants access to GitHub products, GitHub is the Data Controller for specific processing activities defined in a Data Protection Agreement, and this Statement governs those limited purposes.

Use & Processing · Context

GitHub lists the ways it may process your Personal Data, which vary with your interface, features and access tools

The Statement says the Personal Data it processes depends on how you interact with and access the Services: the interface (web, desktop, mobile apps), the features used (such as pull requests, Codespaces, GitHub Copilot) and your preferred access tools, like your IDE. The section that follows describes "all the potential ways" GitHub may process Personal Data.

Supporting quotations

The Personal Data we process depends on your interaction and access methods with our Services, including the interfaces (web, desktop, mobile apps), features used (pull requests, Codespaces, GitHub Copilot), and your preferred access tools (like your IDE). This section details all the potential ways GitHub may process your Personal Data:

Qualifications & exceptions

• The processing that applies to you depends on your interaction and access methods.

Cross-references

• referred to by (model-proposed): California disclosures: categories collected in the last 12 months, their sources and the purposes — The California disclosures say the business or commercial purposes of collecting personal information are as summarized in the Statement under Processing Purposes, which is the section the purposes cards describe.

Use & Processing · Company practice

GitHub uses Personal Data for billing, accounting, compensation and aggregated internal reporting and planning

"Business Operations": GitHub uses Personal Data for activities like billing, accounting and compensation. This includes creating aggregated statistical data for internal reporting, financial reporting, revenue planning, capacity planning and forecast modeling, including product strategy.

Supporting quotations

Business Operations: We use Personal Data for activities like billing, accounting, and compensation. This includes creating aggregated statistical data for internal reporting, financial reporting, revenue planning, capacity planning, and forecast modeling (including product strategy).

Use & Processing · Company practice

GitHub uses Personal Data to tell you about new Services, offers and promotions, and to send administrative messages

"Communication": GitHub uses Personal Data to inform you about new Services, features, offers, promotions and other pertinent information. It also covers sending confirmations, invoices, technical notices, updates, security alerts and administrative messages.

Supporting quotations

Communication: We use Personal Data to inform you about new Services, features, offers, promotions, and other pertinent information. This also includes sending confirmations, invoices, technical notices, updates, security alerts, and administrative messages.

Use & Processing · Company practice

GitHub uses Personal Data to customize the Service and to evaluate enterprise business ads and promotions

"Personalization": GitHub uses Personal Data to customize the Service to your preferences, to evaluate the effectiveness of enterprise business ads and promotional communications, and to ensure a seamless and consistent user experience.

Supporting quotations

Personalization: We use Personal Data to customize the Service to your preferences, to evaluate the effectiveness of enterprise business ads and promotional communications, and to ensure a seamless and consistent user experience.

Use & Processing · Company practice

GitHub uses Personal Data to deliver and update the Services as you configure them and to personalize recommendations

"Service Provision": GitHub uses Personal Data to deliver and update the Services as configured and used by you, and to make ongoing personalized experiences and recommendations.

Supporting quotations

Service Provision: We use Personal Data to deliver and update our Services as configured and used by You, and to make ongoing personalized experiences and recommendations.

Use & Processing · Company practice

GitHub uses Personal Data to fix technical issues and to keep the Services up to date and performant

"Troubleshooting": GitHub uses Personal Data to identify and resolve technical issues. "Ongoing Service Performance": Personal Data helps keep the Services up to date and performant and meet user productivity, reliability, efficacy, quality, privacy, accessibility and security needs.

Supporting quotations

Troubleshooting: We use Personal Data to identify and resolve technical issues.

Ongoing Service Performance: Personal Data helps us keep the Services up to date and performant, and meet user productivity, reliability, efficacy, quality, privacy, accessibility and security needs.

Use & Processing · Company practice

GitHub uses Personal Data to develop and improve products, including AI and machine learning and training models

"Product Development and Improvement": GitHub uses Personal Data to develop and improve its products, services and technologies, including artificial intelligence and machine learning technologies. This includes improving features, developing new offerings, enhancing safety and security capabilities, and training models. GitHub says it applies appropriate technical safeguards, including aggregation and de-identification techniques where feasible, to protect your privacy while enabling these improvements.

Supporting quotations

Product Development and Improvement: We use Personal Data to develop and improve our products, services, and technologies, including artificial intelligence and machine learning technologies. This includes improving features, developing new offerings, enhancing safety and security capabilities, and training models.

We apply appropriate technical safeguards, including aggregation and de-identification techniques where feasible, to protect your privacy while enabling these improvements.

Qualifications & exceptions

• Aggregation and de-identification safeguards are applied "where feasible", so they are not promised in every case.

Not stated here

• The source does not say which Personal Data, or whose content, is used for model training, or whether an opt-out exists in this section.

Use & Processing · Company practice

GitHub uses Personal Data to deliver training, consulting and implementation services, and to improve them

GitHub uses Personal Data to deliver "Professional Services": training, consulting or implementation, including technical support, professional planning, advice, guidance, data migration, deployment and solution or software development. It also uses Personal Data to improve the delivery, efficacy, quality and security of Professional Services and the underlying products, based on issues found while providing them, including fixing software defects.

Supporting quotations

Delivering Professional Services: We use Personal Data to deliver training, consulting or implementation (“Professional Services”). This includes providing technical support, professional planning, advice, guidance, data migration, deployment, and solution/software development services.

Improving Professional Services: Enhancing delivery, efficacy, quality, and security of Professional Services and the underlying product(s) based on issues identified while providing Professional Services, including fixing software defects, and otherwise keeping the Professional Services up to date and performant.

Qualifications & exceptions

• Applies to Professional Services, not to all use of the Services.

Use & Processing · Company commitment

GitHub says it practices data minimization and uses the minimum Personal Information required for these activities

After listing the purposes, the Statement says that when carrying out these activities GitHub practices data minimization and uses the minimum amount of Personal Information required. The source does not define the minimum or describe how it is measured.

Supporting quotations

When carrying out these activities, GitHub practices data minimization and uses the minimum amount of Personal Information required.

Not stated here

• The source does not say how the minimum is determined or checked.

Use & Processing · User right or choice

Where GitHub relies on consent you can withdraw it at any time

Consent: GitHub processes data when you have explicitly consented. When consent is the legal basis, you have the right to withdraw it at any time. The source says the procedures for withdrawal are detailed in the Statement and available on GitHub's website.

Supporting quotations

Consent: We process data when you have explicitly consented to such processing. When we rely on consent as the legal basis, you have the right to withdraw your consent for data processing at any time. The procedures for withdrawal are detailed in this Statement and available on our website.

Qualifications & exceptions

• Applies where consent is the legal basis; listed among the bases for EEA and UK end users.

Not stated here

• The source does not set out the withdrawal procedure in this passage.

Use & Processing · Company practice

GitHub stores and processes Personal Data in many places, including your region, the United States and other countries

GitHub stores and processes Personal Data in a variety of locations, including your local region, the United States, and other countries where GitHub, its affiliates, subsidiaries or subprocessors have operations.

Supporting quotations

GitHub stores and processes Personal Data in a variety of locations, including your local region, the United States, and other countries where GitHub, its affiliates, subsidiaries, or subprocessors have operations.

Use & Processing · Company practice

GitHub says it collects this information to provide services, run its business, improve products and promote safety

GitHub says it collects this information for various purposes: identifying accessibility gaps and offering targeted support, fostering diversity and representation, providing services, troubleshooting, conducting business operations such as billing and security, improving products and supporting research, communicating important information, ensuring personalized experiences, and promoting safety and security.

Supporting quotations

We collect this information for various purposes. This includes identifying accessibility gaps and offering targeted support, fostering diversity and representation, providing services, troubleshooting, conducting business operations such as billing and security, improving products and supporting research, communicating important information, ensuring personalized experiences, and promoting safety and security.

Use & Processing · User right or choice

CO, CT and VA residents may opt out of certain profiling; GitHub says it does not engage in it under Colorado law

Residents of Colorado, Connecticut and Virginia have the right to opt out of profiling in furtherance of decisions that produce legal or similarly significant effects concerning the consumer. GitHub says it does not engage in such profiling as defined by Colorado law, so there is no need to opt out. The source refers only to the Colorado definition; it does not say how Connecticut or Virginia law define profiling.

Supporting quotations

If you live in Colorado, Connecticut, or Virginia you have some additional rights:

You have the right to opt out of profiling in furtherance of decisions that produce legal or similarly significant effects concerning the consumer. GitHub does not engage in such profiling as defined by Colorado law, so there’s no need to opt out.

Qualifications & exceptions

• The statement that GitHub does not engage in such profiling refers to the definition in Colorado law.

Not stated here

• The source does not say whether GitHub's profiling status is the same under Connecticut or Virginia law.