本文档译自英文。 如果本文档的此版本与英文版本之间有任何冲突、不确定性或明显的不一致,以英文版为准。 如果您有改进我们翻译的建议,请在我们的网站政策仓库中开一个议题

GitHub Data Protection Addendum

本文内容

Did this doc help you?

Version Effective Date: July 20, 2020

INTRODUCTION

The parties agree that the GitHub Data Protection and Security Exhibit (together, the "Data Protection Addendum" or “DPA”) sets forth their obligations with respect to the processing and security of Customer Personal Data in connection with the GitHub Enterprise Cloud hosted service (the “Service”). GitHub makes the commitments in this DPA to all customers using the Service. Separate terms, including different privacy and security terms, govern Customer’s use of non-GitHub products.

In the event of any conflict or inconsistency between the DPA and any other terms in Customer’s agreements with GitHub, the DPA shall prevail. The provisions of the DPA supersede any conflicting provisions of the GitHub Privacy Statement that otherwise may apply to processing of Customer Personal Data as defined herein. For clarity, consistent with Clause 10 of the Standard Contractual Clauses in Attachment 1, the Standard Contractual Clauses prevail over any other terms in the DPA.

GITHUB DATA PROTECTION

1. 定义。

1.1 The "Applicable Data Protection Laws" means certain laws, regulations, regulatory frameworks, or other legislations relating to the processing and use of Customer Personal Data, as applicable to Customer's use of GitHub and the GitHub Service, including:

a. 《欧盟通用数据保护条例 2016/679》("GDPR"),以及生效且适用的任何实施中或相应的等效国家法律或法规;以及

b. The California Consumer Privacy Act of 2018, Cal. 民事 Code §§1798.100 et seq. ("CCPA"); and

c. The UK Data Protection Act 2018 and implementation of GDPR contained therein.

1.2 "Controller," "Data Subject," "Member State," "Personal Data," "Personal Data Breach," "Processing," "Processor," and "Supervisory Authority" have the meanings given to them in the Applicable Data Protection Laws. 如果发生冲突,GDPR 中的含义优先。

1.3 “客户个人数据”是指客户为控制方的任何个人数据,无论是客户提供给 GitHub 处理还是 GitHub 履行其在本协议下义务的过程中产生的个人数据。 包括诸如帐单信息、IP 地址、公司电子邮件地址以及客户作为控制方的任何其他个人数据。

1.4 “客户仓库数据”是指客户在其任何私有仓库中上传或创建的任何数据或信息。

1.5 “数据泄露”是指个人数据泄露或者任何其他已确认或合理怀疑的客户受保护数据泄露。

1.6 “最终用户”是指控制 GitHub 帐户并且已同意 GitHub 服务条款及其个人数据被 GitHub 传输、存储或处理的个别数据主体。 例如,客户每个有 GitHub 帐户的员工或承包商也是 GitHub 最终用户。

1.7 数据处理“允许的目的”是指按本协议“GitHub 隐私声明”及本附录 A 所述提供服务的有限和特定目的,或者数据主体授权使用客户个人数据的目的。

1.8 “受保护数据”包括 GitHub 根据本协议代表客户处理的任何客户个人数据和任何客户仓库数据。

1.9 "Sensitive Data" means any Customer Personal Data revealing racial or ethnic origin; political opinions, religious or philosophical beliefs or trade union membership; processing of genetic data or biometric data for the purposes of uniquely identifying a natural person; data concerning health, a natural person's sex life or sexual orientation; and data relating to offences, criminal convictions, or security measures.

2. 身份与合规。

2.1 Data Processing.

GitHub acts as a Processor in regard to any Customer Personal Data it receives in connection with the Agreement, and GitHub will process Customer Personal Data only for Permitted Purposes in accordance with Customer's instructions as represented by the Agreement and other written communications. 如果 GitHub 无法遵守客户的指示,比如由于与适用数据保护法律冲突,或者适用数据保护法律或其他法律要求处理,则 GitHub 将在允许的范围内通知客户。 GitHub 在美国或欧盟处理所有客户个人数据;但 GitHub 的子处理方可能在美国或欧盟以外处理数据。 此外,GitHub 可作为任何客户仓库数据的处理方。

2.2 Data Controllers.

GitHub receives Customer Personal Data both from Customer and directly from Data Subjects who create End User accounts. 客户其直接传输到 GitHub 的客户个人数据的唯一控制方。

2.3 GitHub Compliance; Data Transfers.

GitHub will comply with Applicable Data Protection Laws in relation to the processing of Customer Personal Data.

All transfers of Customer Personal Data out of the European Union, European Economic Area, United Kingdom, and Switzerland to provide the Service shall be governed by the Standard Contractual Clauses in Attachment 1 (Standard Contractual Clauses). GitHub will abide by the requirements of European Economic Area and Swiss data protection law regarding the collection, use, transfer, retention, and other processing of Customer Personal Data from the European Economic Area, United Kingdom, and Switzerland. All transfers of Customer Personal Data to a third country or an international organization will be subject to appropriate safeguards as described in Article 46 of the GDPR and such transfers and safeguards will be documented according to Article 30(2) of the GDPR.

In addition, GitHub is certified to the EU-U.S. and Swiss-U.S. In addition, GitHub is certified to the EU-U.S. and Swiss-U.S. Privacy Shield Frameworks and the commitments they entail, although GitHub does not rely on the EU-U.S. Privacy Shield Framework as a legal basis for transfers of Personal Data in light of the judgment of the Court of Justice of the EU in Case C-311/18. GitHub agrees to notify Customer if it makes a determination that it can no longer meet its obligation to provide the same level of protection as is required by the Privacy Shield principles. GitHub agrees to notify Customer if it makes a determination that it can no longer meet its obligation to provide the same level of protection as is required by the Privacy Shield principles.

3. 数据保护。

3.1 Purpose Limitation.

GitHub will process and communicate the Protected Data only for Permitted Purposes, unless the Parties agree in writing to an expanded purpose.

3.2 Data Quality and Proportionality.

GitHub will keep the Customer Personal Data accurate and up to date, or enable Customer to do so. GitHub 将采取商业上合理的措施来确保其代表客户收集的任何受保护数据充分、相关且传输和处理符合相关目的。 在任何情况下 GitHub 都不会有意代表客户收集敏感数据。 客户同意,GitHub 服务未预期存储敏感数据;如果客户选择将敏感数据上传到服务,则客户必须遵守 GDPR 第 9 条或适用数据保护法律中的同等条款。

3.3 Data Retention and Deletion.

Upon Customer's reasonable request, unless prohibited by law, GitHub will return, destroy, or deidentify all Customer Personal Data and related data at all locations where it is stored after it is no longer needed for the Permitted Purposes within thirty days of request. GitHub 可在适用数据保护法律需要的范围内保留客户个人数据及相关数据,并且仅保留适用数据保护法律要求的范围和期限,但 GitHub 要确保客户个人数据仅用于适用数据保护法律指定的目的,而不能用于其他目的,同时客户个人数据仍受适用数据保护法律的保护。

3.4 Data Processing.

GitHub provides the following information, required by Article 28(3) of the GDPR, regarding its processing of Customer's Protected Data:

a. 客户个人数据处理的主题和期限在协议和本附录中描述。

b. 客户个人数据的处理性质和目的在本附录第 3.1 条描述。

c. 要处理的客户个人数据类型在“GitHub 隐私声明”中描述,包括用户名、密码、电子邮件地址和 IP 地址等客户个人数据。 GitHub 还处理客户帐户记帐所需的信息,但不处理或存储信用卡信息。 客户可选择向 GitHub 提供其他客户个人数据,如客户的配置文件设置,或者将客户个人数据上传到其 GitHub 仓库。

d. 与客户个人数据相关的数据主体类别是客户本身及其最终用户。

e. 客户的义务和权利在协议和本附录中描述。

4. 安全和审核义务。

4.1 Technical and Organizational Security Measures.

Taking into account the state of the art, the costs of implementation, and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, GitHub will implement appropriate technical and organizational measures to ensure a level of security appropriate to the risks, such as against accidental or unlawful destruction, or loss, alteration, unauthorized disclosure or access, presented by processing the Protected Data. GitHub 将定期监控是否符合这些措施,并在协议整个期限内继续采取适当的保护措施。 有关 GitHub 与安全保护相关的责任,请参阅 GitHub 安全附录第 1.1 条。

4.2 Incident Response and Breach Notification.

GitHub will comply with the Information Security obligations in the GitHub Security Exhibit and the Applicable Data Protection Laws, including Data Breach notification obligations. 有关 GitHub 与数据泄露及通知相关的责任,请参阅 GitHub 安全附录第 1.2 条。

4.3 GitHub Personnel.

GitHub represents and warrants that it will take reasonable steps to ensure that all GitHub personnel processing Protected Data have agreed to keep the Protected Data confidential and have received adequate training on compliance with this Addendum and the Applicable Data Protection Laws.

4.4 Records.

GitHub will maintain complete, accurate, and up to date written records of all categories of processing activities carried out on behalf of Customer containing the information required under the Applicable Data Protection Laws. 在协助不会对 GitHub 的安全性或个别数据主体的隐私权利产生风险的范围内,GitHub 将应客户要求向其提供合理需要的这些记录,比如帮助客户证明其遵守适用数据保护法律。 要详细了解 GitHub 的要求以便在发生安全事件时提供协助,请参阅 GitHub 安全附录的第 1.2 条。

4.5 Compliance Reporting.

GitHub will provide security compliance reporting in accordance with Section 2.3 of the GitHub Security Exhibit and privacy compliance reporting in accordance with Section 2.3 of the GitHub Security Exhibit. 客户同意,适用数据保护法律(包括适用的 GDPR 第 28(3)(h) 条)授予的任何信息和审核权利将通过这些合规报告来满足,并且仅限于不提供充分信息的 GitHub 合规报告条款的范围,或者客户必须响应监管或监督机构审核的范围。 GitHub 安全附录第 3.1 条描述双方与监管或监督机构审核相关的责任。

4.6 Assistance.

GitHub will provide reasonable assistance to Customer with concerns such as data privacy impact assessments, Data Subject rights requests, consultations with Supervisory Authorities, and other similar matters, in each case solely in relation to the processing of Customer Personal Data and taking into account the nature of processing.

5. 受保护数据的使用和披露。

5.1 No Use in Marketing.

GitHub will not use the Protected Data for the purposes of advertising third-party content, and will not sell the Protected Data to any third party except as part of a merger or acquisition.

5.2 GitHub Privacy Statement.

The GitHub Privacy Statement, publicly available at https://docs.github.com/articles/github-privacy-statement, provides detailed notice of GitHub's privacy and data use practices, including its use of cookies, its dispute resolution process, and further details about GitHub's GDPR compliance.

6. 再处理和向外传输。

6.1 Protection of Data.

GitHub is liable for onward transfers of Protected Data to its subprocessors, such as its third-party payment processor. In the event that GitHub does transfer the Protected Data to a third-party subprocessor, or GitHub installs, uses, or enables a third party or third-party services to process the Protected Data on GitHub's behalf, GitHub will ensure that the third-party subprocessor is bound by written agreement that requires them to provide at least the same level of confidentiality, security, and privacy protection as is required of GitHub by this DPA and the Applicable Data Protection Laws.

6.2 Acceptance of GitHub Subprocessors.

Customer authorizes GitHub to appoint (and permit each subprocessor appointed in accordance with this Section 6 to appoint) subprocessors in accordance with Section 6 and any other restrictions in the Agreement. GitHub 自本附录生效日期起可继续使用当前使用的再处理方。

Customer provides a general consent for GitHub to engage onward subprocessors, conditional on GitHub's compliance with the following requirements:

a. Any onward subprocessor must agree in writing to only process data in a country that the European Commission has declared to have an "adequate" level of protection; or to only process data on terms equivalent to the Standard Contractual Clauses, or pursuant to a Binding Corporate Rules approval granted by competent European data protection authorities, or pursuant to compliant and valid EU-US Privacy Shield and Swiss-U.S. Privacy Shield certifications; and

b. GitHub 将外部再处理方对客户个人数据的访问严格限于仅执行此服务所需,并且 GitHub 会禁止再处理方出于任何其他目的而处理客户个人数据。

6.4 Disclosure of Subprocessor Agreements.

GitHub maintains a list of onward subprocessors it has engaged to process Customer Personal Data at https://docs.github.com/articles/github-subprocessors-and-cookies, including the categories of Customer Personal Data processed, a description of the type of processing the subprocessor performs, and the location of its processing. GitHub 将应客户的书面申请而向客户提供再处理方清单以及规范他们处理客户个人数据的条款。 根据再处理方保密性限制,GitHub 在向客户提供清单和条款之前可能会删除任何机密或商业敏感信息。 在 GitHub 不能向客户披露机密或敏感信息的情况下,双方同意,GitHub 将提供其合理可以提供的与其再处理协议相关的所有信息。

6.5 Objection to Subprocessors.

GitHub will provide thirty (30) days' prior written notice of the addition or removal of any subprocessor, including the categories listed in Section 6.4, by announcing changes on its https://github.com/github/site-policy site. 如果客户对 GitHub 新增再处理方持有合理的异议,客户必须及时书面通知 GitHub。 GitHub 将尽可能采取商业合理的努力为受影响的服务提供替代解决方案,以避免招异议的再处理方处理数据。 如果 GitHub 无法提供替代解决方案而双方在九十天内无法解决冲突,客户可终止协议。

7. 终止。

7.1 暂停。

In the event that GitHub is in breach of its obligations to maintain an adequate level of security or privacy protection, Customer may temporarily suspend the transfer of all Customer Personal Data or prohibit collection and processing of Customer Personal Data on Customer's behalf until the breach is repaired or the Agreement is terminated.

7.2 Termination with Cause.

In addition to any termination rights Customer has under the Agreement, Customer may terminate the Agreement without prejudice to any other claims at law or in equity in the event that:

a. GitHub 通知客户无法再履行其隐私保护义务;

b. 根据第 7.1 条,所有客户个人数据的传输、收集或处理已经临时暂停超过一个月;

c. GitHub 实质性或持续违反本附录下的任何保证或表示;

d. GitHub 不再经营业务、解散、破产或清盘;或

e. 客户根据第 6.5 条反对再处理方,并且 GitHub 在九十天内无法提供替代解决方案。

7.3 Breach.

Failure to comply with the material provisions of this Addendum is considered a material breach under the Agreement.

7.4 Failure to perform.

In the event that changes in law or regulation render performance of this Addendum impossible or commercially unreasonable, the Parties may renegotiate the Addendum in good faith. 如果重新协调无法解决问题,或者双方无法达成协议,则双方可在三十天后终止协议。

7.5 Notification.

In the event that GitHub determines that it can no longer meet its privacy obligations under this Addendum, GitHub will notify Customer in writing immediately.

7.6 Modifications.

GitHub may modify this Addendum from time to time as required by the Applicable Data Protection Laws, with thirty days' notice to Customer.

7.7 Termination Requirements.

Upon Termination, GitHub must:

a. 采取合理、适当的措施停止处理客户个人数据;

b. 在终止后的九十天内,删除或去识别 GitHub 根据第 3.3 条代表客户存储的任何客户个人数据;以及

c. 向客户提供合理的保证,确保 GitHub 已履行其在第 7.7 条中的义务。

8. 数据处理责任。

8.1 Limitations.

Except as limited by the Applicable Data Protection Laws, any claims brought under this Addendum will be subject to the terms of the Agreement regarding Limitations of Liability.

Attachment 1 – The Standard Contractual Clauses (Processors)

Execution of the applicable agreement by Customer includes execution of this Attachment 1 to the GitHub Data Protection Addendum, which is countersigned by GitHub, Inc.

In countries where regulatory approval is required for use of the Standard Contractual Clauses, the Standard Contractual Clauses cannot be relied upon under European Commission 2010/87/EU (of February 2010) to legitimize export of data from the country, unless Customer has the required regulatory approval.

For the purposes of Article 46(2) of the General Data Protection Regulation (EU 2016/679) for the transfer of personal data to processors established in third countries which do not ensure an adequate level of data protection, Customer (as data exporter) and GitHub (as data importer, whose signature appears below), each a “party,” together “the parties,” have agreed on the following Contractual Clauses (the “Clauses” or “Standard Contractual Clauses”) in order to adduce adequate safeguards with respect to the protection of privacy and fundamental rights and freedoms of individuals for the transfer by the data exporter to the data importer of the personal data specified in Appendix 1.

Clause 1: Definitions

(a) 'personal data', 'special categories of data', 'process/processing', 'controller', 'processor', 'data subject' and 'supervisory authority' shall have the same meaning as in the General Data Protection Regulation (EU 2016/679) on the protection of individuals with regard to the processing of personal data and on the free movement of such data;

(b) 'the data exporter' means the controller who transfers the personal data;

(c) 'the data importer' means the processor who agrees to receive from the data exporter personal data intended for processing on his behalf after the transfer in accordance with his instructions and the terms of the Clauses and who is not subject to a third country's system ensuring adequate protection within the meaning of Article 45(2) of the General Data Protection Regulation (EU 2016/679);

(d) 'the subprocessor' means any processor engaged by the data importer or by any other subprocessor of the data importer who agrees to receive from the data importer or from any other subprocessor of the data importer personal data exclusively intended for processing activities to be carried out on behalf of the data exporter after the transfer in accordance with his instructions, the terms of the Clauses and the terms of the written subcontract;

(e) 'the applicable data protection law' means the legislation protecting the fundamental rights and freedoms of individuals and, in particular, their right to privacy with respect to the processing of personal data applicable to a data controller in the Member State in which the data exporter is established;

(f) 'technical and organisational security measures' means those measures aimed at protecting personal data against accidental or unlawful destruction or accidental loss, alteration, unauthorised disclosure or access, in particular where the processing involves the transmission of data over a network, and against all other unlawful forms of processing.

Clause 2: Details of the transfer

The details of the transfer and in particular the special categories of personal data where applicable are specified in Appendix 1 below which forms an integral part of the Clauses.

Clause 3: Third-party beneficiary clause

  1. The data subject can enforce against the data exporter this Clause, Clause 4(b) to (i), Clause 5(a) to (e), and (g) to (j), Clause 6(1) and (2), Clause 7, Clause 8(2), and Clauses 9 to 12 as third-party beneficiary.

  2. The data subject can enforce against the data importer this Clause, Clause 5(a) to (e) and (g), Clause 6, Clause 7, Clause 8(2), and Clauses 9 to 12, in cases where the data exporter has factually disappeared or has ceased to exist in law unless any successor entity has assumed the entire legal obligations of the data exporter by contract or by operation of law, as a result of which it takes on the rights and obligations of the data exporter, in which case the data subject can enforce them against such entity.

  3. The data subject can enforce against the subprocessor this Clause, Clause 5(a) to (e) and (g), Clause 6, Clause 7, Clause 8(2), and Clauses 9 to 12, in cases where both the data exporter and the data importer have factually disappeared or ceased to exist in law or have become insolvent, unless any successor entity has assumed the entire legal obligations of the data exporter by contract or by operation of law as a result of which it takes on the rights and obligations of the data exporter, in which case the data subject can enforce them against such entity. Such third-party liability of the subprocessor shall be limited to its own processing operations under the Clauses.

  4. The parties do not object to a data subject being represented by an association or other body if the data subject so expressly wishes and if permitted by national law.

Clause 4: Obligations of the data exporter

The data exporter agrees and warrants:

(a) that the processing, including the transfer itself, of the personal data has been and will continue to be carried out in accordance with the relevant provisions of the applicable data protection law (and, where applicable, has been notified to the relevant authorities of the Member State where the data exporter is established) and does not violate the relevant provisions of that State;

(b) that it has instructed and throughout the duration of the personal data processing services will instruct the data importer to process the personal data transferred only on the data exporter's behalf and in accordance with the applicable data protection law and the Clauses;

(c) that the data importer will provide sufficient guarantees in respect of the technical and organisational security measures specified in Appendix 2 below;

(d) that after assessment of the requirements of the applicable data protection law, the security measures are appropriate to protect personal data against accidental or unlawful destruction or accidental loss, alteration, unauthorised disclosure or access, in particular where the processing involves the transmission of data over a network, and against all other unlawful forms of processing, and that these measures ensure a level of security appropriate to the risks presented by the processing and the nature of the data to be protected having regard to the state of the art and the cost of their implementation;

(e) that it will ensure compliance with the security measures;

(f) that, if the transfer involves special categories of data, the data subject has been informed or will be informed before, or as soon as possible after, the transfer that its data could be transmitted to a third country not providing adequate protection within the meaning of the General Data Protection Regulation (EU 2016/679);

(g) to forward any notification received from the data importer or any subprocessor pursuant to Clause 5(b) and Clause 8(3) to the data protection supervisory authority if the data exporter decides to continue the transfer or to lift the suspension;

(h) to make available to the data subjects upon request a copy of the Clauses, with the exception of Appendix 2, and a summary description of the security measures, as well as a copy of any contract for subprocessing services which has to be made in accordance with the Clauses, unless the Clauses or the contract contain commercial information, in which case it may remove such commercial information;

(i) that, in the event of subprocessing, the processing activity is carried out in accordance with Clause 11 by a subprocessor providing at least the same level of protection for the personal data and the rights of data subject as the data importer under the Clauses; and

(j) that it will ensure compliance with Clause 4(a) to (i).

Clause 5: Obligations of the data importer

The data importer agrees and warrants:

(a) to process the personal data only on behalf of the data exporter and in compliance with its instructions and the Clauses; if it cannot provide such compliance for whatever reasons, it agrees to inform promptly the data exporter of its inability to comply, in which case the data exporter is entitled to suspend the transfer of data and/or terminate the contract;

(b) that it has no reason to believe that the legislation applicable to it prevents it from fulfilling the instructions received from the data exporter and its obligations under the contract and that in the event of a change in this legislation which is likely to have a substantial adverse effect on the warranties and obligations provided by the Clauses, it will promptly notify the change to the data exporter as soon as it is aware, in which case the data exporter is entitled to suspend the transfer of data and/or terminate the contract;

(c) that it has implemented the technical and organisational security measures specified in Appendix 2 before processing the personal data transferred;

(d) that it will promptly notify the data exporter about:

(i) any legally binding request for disclosure of the personal data by a law enforcement authority unless otherwise prohibited, such as a prohibition under criminal law to preserve the confidentiality of a law enforcement investigation,

(ii) any accidental or unauthorised access, and

(iii) any request received directly from the data subjects without responding to that request, unless it has been otherwise authorised to do so;

(e) to deal promptly and properly with all inquiries from the data exporter relating to its processing of the personal data subject to the transfer and to abide by the advice of the supervisory authority with regard to the processing of the data transferred;

(f) at the request of the data exporter to submit its data processing facilities for audit of the processing activities covered by the Clauses which shall be carried out by the data exporter or an inspection body composed of independent members and in possession of the required professional qualifications bound by a duty of confidentiality, selected by the data exporter, where applicable, in agreement with the supervisory authority;

(g) to make available to the data subject upon request a copy of the Clauses, or any existing contract for subprocessing, unless the Clauses or contract contain commercial information, in which case it may remove such commercial information, with the exception of Appendix 2 which shall be replaced by a summary description of the security measures in those cases where the data subject is unable to obtain a copy from the data exporter;

(h) that, in the event of subprocessing, it has previously informed the data exporter and obtained its prior written consent;

(i) that the processing services by the subprocessor will be carried out in accordance with Clause 11; and

(j) to send promptly a copy of any subprocessor agreement it concludes under the Clauses to the data exporter.

Clause 6: Liability

  1. The parties agree that any data subject who has suffered damage as a result of any breach of the obligations referred to in Clause 3 or in Clause 11 by any party or subprocessor is entitled to receive compensation from the data exporter for the damage suffered.

  2. If a data subject is not able to bring a claim for compensation in accordance with paragraph 1 against the data exporter, arising out of a breach by the data importer or his subprocessor of any of their obligations referred to in Clause 3 or in Clause 11, because the data exporter has factually disappeared or ceased to exist in law or has become insolvent, the data importer agrees that the data subject may issue a claim against the data importer as if it were the data exporter, unless any successor entity has assumed the entire legal obligations of the data exporter by contract of by operation of law, in which case the data subject can enforce its rights against such entity. The data importer may not rely on a breach by a subprocessor of its obligations in order to avoid its own liabilities.

  3. If a data subject is not able to bring a claim against the data exporter or the data importer referred to in paragraphs 1 and 2, arising out of a breach by the subprocessor of any of their obligations referred to in Clause 3 or in Clause 11 because both the data exporter and the data importer have factually disappeared or ceased to exist in law or have become insolvent, the subprocessor agrees that the data subject may issue a claim against the data subprocessor with regard to its own processing operations under the Clauses as if it were the data exporter or the data importer, unless any successor entity has assumed the entire legal obligations of the data exporter or data importer by contract or by operation of law, in which case the data subject can enforce its rights against such entity. The liability of the subprocessor shall be limited to its own processing operations under the Clauses.

Clause 7: Mediation and jurisdiction

  1. The data importer agrees that if the data subject invokes against it third-party beneficiary rights and/or claims compensation for damages under the Clauses, the data importer will accept the decision of the data subject:

(a) to refer the dispute to mediation, by an independent person or, where applicable, by the supervisory authority;

(b) to refer the dispute to the courts in the Member State in which the data exporter is established.

  1. The parties agree that the choice made by the data subject will not prejudice its substantive or procedural rights to seek remedies in accordance with other provisions of national or international law.

Clause 8: Cooperation with supervisory authorities

  1. The data exporter agrees to deposit a copy of this contract with the supervisory authority if it so requests or if such deposit is required under the applicable data protection law.

  2. The parties agree that the supervisory authority has the right to conduct an audit of the data importer, and of any subprocessor, which has the same scope and is subject to the same conditions as would apply to an audit of the data exporter under the applicable data protection law.

  3. The data importer shall promptly inform the data exporter about the existence of legislation applicable to it or any subprocessor preventing the conduct of an audit of the data importer, or any subprocessor, pursuant to paragraph 2. In such a case the data exporter shall be entitled to take the measures foreseen in Clause 5(b).

Clause 9: Governing Law.

The Clauses shall be governed by the law of the Member State in which the data exporter is established.

Clause 10: Variation of the contract

The parties undertake not to vary or modify the Clauses. This does not preclude the parties from adding clauses on business related issues where required as long as they do not contradict the Clause.

Clause 11: Subprocessing

  1. The data importer shall not subcontract any of its processing operations performed on behalf of the data exporter under the Clauses without the prior written consent of the data exporter. Where the data importer subcontracts its obligations under the Clauses, with the consent of the data exporter, it shall do so only by way of a written agreement with the subprocessor which imposes the same obligations on the subprocessor as are imposed on the data importer under the Clauses. Where the subprocessor fails to fulfil its data protection obligations under such written agreement the data importer shall remain fully liable to the data exporter for the performance of the subprocessor's obligations under such agreement.

  2. The prior written contract between the data importer and the subprocessor shall also provide for a third-party beneficiary clause as laid down in Clause 3 for cases where the data subject is not able to bring the claim for compensation referred to in paragraph 1 of Clause 6 against the data exporter or the data importer because they have factually disappeared or have ceased to exist in law or have become insolvent and no successor entity has assumed the entire legal obligations of the data exporter or data importer by contract or by operation of law. Such third-party liability of the subprocessor shall be limited to its own processing operations under the Clauses.

  3. The provisions relating to data protection aspects for subprocessing of the contract referred to in paragraph 1 shall be governed by the law of the Member State in which the data exporter is established.

  4. The data exporter shall keep a list of subprocessing agreements concluded under the Clauses and notified by the data importer pursuant to Clause 5 (j), which shall be updated at least once a year. The list shall be available to the data exporter's data protection supervisory authority.

Clause 12: Obligation after the termination of personal data processing services

  1. The parties agree that on the termination of the provision of data processing services, the data importer and the subprocessor shall, at the choice of the data exporter, return all the personal data transferred and the copies thereof to the data exporter or shall destroy all the personal data and certify to the data exporter that it has done so, unless legislation imposed upon the data importer prevents it from returning or destroying all or part of the personal data transferred. In that case, the data importer warrants that it will guarantee the confidentiality of the personal data transferred and will not actively process the personal data transferred anymore.

  2. The data importer and the subprocessor warrant that upon request of the data exporter and/or of the supervisory authority, it will submit its data processing facilities for an audit of the measures referred to in paragraph 1.

Appendix 1 to the Standard Contractual Clauses

Data exporter: Customer is the data exporter.

Data importer: The data importer is GitHub, Inc., a global producer of software and services.

Data subjects: Data subjects include the data exporter’s representatives and end-users including employees, contractors, collaborators, and customers of the data exporter. Data subjects may also include individuals attempting to communicate or transfer personal information to users of the services provided by data importer. GitHub acknowledges that, depending on Customer’s use of the Service, Customer may elect to include personal data from any of the following types of data subjects in the Customer Personal Data:

  • Employees, contractors and temporary workers (current, former, prospective) of data exporter;
  • Dependents of the above;
  • Data exporter's collaborators/contact persons (natural persons) or employees, contractors or temporary workers of legal entity collaborators/contact persons (current, prospective, former);
  • Users (e.g., customers, clients, patients, visitors, etc.) and other data subjects that are users of data exporter's services;
  • Partners, stakeholders or individuals who actively collaborate, communicate or otherwise interact with employees of the data exporter and/or use communication tools such as apps and websites provided by the data exporter;
  • Stakeholders or individuals who passively interact with data exporter (e.g., because they are the subject of an investigation, research or mentioned in documents or correspondence from or to the data exporter); or
  • Professionals with professional privilege (e.g., doctors, lawyers, notaries, religious workers, etc.).

Categories of data: The personal data transferred that is included in e-mail, documents and other data in an electronic form in the context of the Service. GitHub acknowledges that, depending on Customer’s use of the Service, Customer may elect to include personal data from any of the following categories in the Customer Personal Data:

  • Authentication data (for example, username, email, password);
  • Contact information (for example, email);
  • Unique identification numbers and signatures (IP addresses, unique identifier in tracking cookies or similar technology).
  • Other unique identifying information. Data subjects may include more data such as real names, avatar images, and other personal information;

Special categories of data (if appropriate): The data importer does not intentionally collect or process any special categories of data in carrying out its services to the data exporter.

However, because the data importer provides storage services and does not control the categories of data it stores, the data exporter may choose to transfer special categories of data. Consequently, the data exporter is solely responsible for ensuring that it complies with all obligations imposed by applicable laws and regulations relating to the collection and processing of any special categories of data, including obtaining the explicit consent of the data subject prior to processing sensitive personal data.

Processing operations: The personal data transferred will be subject to the following basic processing activities: GitHub uses personal data for the limited purposes set forth in the GitHub Privacy Statement, available at https://docs.github.com/articles/github-privacy-statement, and the “Data Processing” section of the DPA. Subcontractors: In accordance with the DPA, the data importer may hire other companies to provide limited services on data importer’s behalf, such as providing customer support. Any such subcontractors will be permitted to obtain Customer Personal Data only to deliver the services the data importer has retained them to provide, and they are prohibited from using Customer Personal Data for any other purpose.

Appendix 2 to the Standard Contractual Clauses

Description of the technical and organizational security measures implemented by the data importer in accordance with Clauses 4(d) and 5(c):

1. Personnel. Data importer’s personnel will not process Customer Personal Data without authorization. Personnel are obligated to maintain the confidentiality of any Customer Personal Data and this obligation continues even after their engagement ends.

2. Data Privacy Contact. The data privacy officer of the data importer can be reached at the following address: GitHub, Inc. Attn: Privacy 88 Colin P. Kelly Jr. Street San Francisco, CA 94107 USA

3. Technical and Organization Measures. The data importer has implemented and will maintain appropriate technical and organizational measures, internal controls, and information security routines intended to protect Customer Personal Data, as defined in the GitHub Security Exhibit, against accidental loss, destruction, or alteration; unauthorized disclosure or access; or unlawful destruction as follows: The technical and organizational measures, internal controls, and information security routines set forth in the GitHub Security Exhibit are hereby incorporated into this Appendix 2 by this reference and are binding on the data importer as if they were set forth in this Appendix 2 in their entirety. Signature of GitHub, Inc. appears below.

Signing the Standard Contractual Clauses, Appendix 1 and Appendix 2 on behalf of the data importer

Screen Shot 2020-07-20 at 2 20 29 PM

Lynn Hashimoto, Head of Product & Regulatory Legal

GitHub, Inc.

SECURITY EXHIBIT

1. 信息安全计划。

1.1 安全管理。

Throughout the duration of the Agreement, GitHub will maintain and enforce a written information security program ("Security Program") that aligns with industry recognized frameworks; includes security safeguards reasonably designed to protect the confidentiality, integrity, availability, and resilience of Customer Protected Data; is appropriate to the nature, size, and complexity of GitHub's business operations; and complies with the Applicable Data Protection Laws and other specific information security related laws and regulations that are applicable to the geographic regions in which GitHub does business.

a. 安全官。 GitHub 指定了资深员工负责监管和执行其安全计划,以及负责关于信息安全事务的治理和内部沟通。

b. 安全计划更改。 GitHub 不会对其安全计划做出对任何客户受保护数据安全性有不利影响的更改,根据适用的法律和法规,更改需发出通知。

c. GitHub 将保持标准的安全行业做法,包括但不限于:

  • 漏洞管理计划
  • 安全开发培训、审查和代码编写实践
  • 生产系统逻辑和物理访问控制
  • 外部技术评估和审核
  • 安全政策、标准和标准操作程序
  • 安全和隐私意识培训

1.2 Security Incident Management.

Throughout the duration of the Agreement, and where applicable, GitHub will provide a Security incident management program as follows:

a. 安全可用性和上报。 GitHub 将维护适当的全天候安全联系和上报流程,以确保客户和员工可以向 GitHub 安全团队提交问题。

b. 事件响应。 If GitHub becomes aware of a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data (each a "Security Incident"), GitHub will promptly and without undue delay (1) notify Customer of the Security Incident; (2) investigate the Security Incident and provide Customer with detailed information about the Security Incident; (3) take reasonable steps to mitigate the effects and to minimize any damage resulting from the Security Incident.

c. 通知。 安全事件通知将通过 GitHub 选择的方式提交给客户的一个或多个管理员。 客户独自负责确保客户的管理员监控并回应任何通知。 客户独自负责履行事件通知法律下适用于客户的义务,并且履行与任何安全事件相关的任何第三方通知义务。

d. 合理协助。 GitHub 将采取商业合理的努力协助客户履行其在适用法律或法规下的义务,以向相关的监管机构和数据主体通知该等安全事件。

1.3 Due Diligence over Subcontractors and Vendors.

GitHub will maintain appropriate due diligence when utilizing subcontractors and vendors. GitHub 将维护至少三年的供应商评估报告和任何评估工作。

1.4 Data Center Physical Safeguards.

To the extent GitHub utilizes third party vendors to host production environments, GitHub will select vendors that comply with physical security controls outlined in industry standards and that issue an annual external audit report such as SOC 2 or ISO 27001 certification. 对电信区域、机箱或机架或者网络设备及其他“数据传输线路”或设备的访问的控制如下:

a. 访问将由一个或多个入口的胸卡读取器控制;

b. 仅用作出口的大门只有“单向”球形门拉手或安装有防护杆出口装置;

c. 所有大门配备有门报警器触点;

d. 所有出口门都有视频监控;以及

e. 所有读卡和视频系统都会连接到发电机或 UPS 备份系统。

2. 信息申请和合规报告。

2.1 Requests for Information.

Upon Customer's written request and no more than once annually, GitHub will respond to one request for information to assess security and compliance risk-related information. 回应将在收到申请后三十天内以书面形式提供,任何申请需要澄清时待定。

2.2 Response Contents.

GitHub will include in its annual response relevant audit reports for production datacenter, IaaS, PaaS or private hosting providers, as deemed relevant by GitHub, in its sole discretion and based on data and services rendered.

2.3 GitHub Security Audit Report.

GitHub will execute external audits to produce a SOC1, type 2, audit report and a SOC2, type 2, audit report. GitHub 将在协议期限内继续每年至少执行一次审核并发布相应的报告。

3. 配合监管审计。

Should Customer realize a regulatory audit or an audit in response to a Supervisory Authority that requires participation from GitHub, GitHub will fully cooperate with related requests by providing access to relevant knowledgeable personnel, documentation, and application software. 客户对任何此类监管或主管机关审计具有以下责任:

a. 客户必须确保使用独立第三方(意指监管者或监管者的代表),并且客户不能访问与其不相关的发现和数据。

b. 该等审计通知必须是书面的,并且要及时提供给 GitHub,等待监管者通知,并且允许适当人员提供协助。 当监管机构未提前向客户通知审计或调查时,GitHub 将及时按照监管机构的要求回应。

c. 任何第三方审计机构必须在监管机构允许的范围向 GitHub 披露任何发现和建议的措施。

d. 在监管审计时,只允许在正常上班时间(太平洋时间)访问。

e. 在法律允许的范围内,客户必须对通过 GitHub 任何该等审计收集的性质为机密的任何信息保密。

Did this doc help you?