—> DRAFT VERSION
This Privacy Policy clarifies the nature, scope and purpose of the processing of personal data from committers (contributors with an ASF account).
With regard to the terminology we use here, e.g. “Processing” or “Responsible”, we refer to the definitions in Article 4 of the European Union’s General Data Protection Regulation (GDPR).
1. Contact Details of the Controller and Company Data Protection Officer
This privacy policy applies to data processing by:
The Apache Software Foundation
V. P. Data Privacy
1000 N West Street, Suite 1200
Wilmington, DE 19801
U.S.A.
E-Mail: vp-privacy@apache.org
2. Collection, Storage, and Use of Personal Data
We collect some of your information when you join the Apache Software Foundation as a committer. This is to ensure that contributions to our codebases and other critical parts of the ASF are well-documented for Intellectual Property provenance. For this reason, we require you to fill out a form (ICLA) with your personal data.
1. Information Submitted on the ICLA Form
NOTE: For your privacy protection, avoid copying others when submitting your document to the secretary.
Full Name
This should be your legal name used for signing documents. It is used as the legal basis for the ICLA contract. Unless you opt for a public name, your full name will be made public.
Public name
This will be your publicly known name. If you are elected as a committer, your public name will be displayed along with your Apache id at Committer List. It is also used unrestrictedly in our internal tools.
Postal Address
This should be your personal residence address and will be used to differentiate your document from others that may have similar names.
Country
This refers to the country of your residence and is used in the same manner as your postal address.
This will serve as your forwarding address for mail received at your ASF email address. Although you can change this email address later, it will remain in our records.
Preferred Apache ID
This may be used for creating your Apache account and will become publicly visible once your account is created (see Public Name above). Any email sent to id@apache.org will be forwarded to your current email address. Please note that changing your Apache ID later may be very difficult or impossible. If you value your privacy, avoid using your real name or any personal data for your ID.
Notify project
The project you list first will be notified about whether your document was accepted or rejected, but not about its content.
Access to the data mentioned in the ICLA
The ICLA data will be maintained by the ASF Secretary team. The Infrastructure team will have access while maintaining the systems. The PMC Chairs and Members have access to Full Name, Public Name, and Email components of ICLA data to create your ASF user ID and grant project access.
Deletion of ICLA data
Given the legal requirements of demonstrating where code originates and our rights to publish it, we cannot remove submitted ICLAs. Since code contributions are forked and synced across numerous codebases, attempts to delete them would be unsuccessful and excessive.
Deletion of ICLA data from deceased persons
Deceased persons are not protected by the GDPR or similar privacy laws.
Use of SVN for Personal Data Publication
Certain files, such as members.txt, allow committers to optionally publish their personal information. These files are utilized by various tools to disseminate information publicly on the internet.
Although additions to these files can theoretically be reversed, thereby stopping further internet publication, it’s essential to remember that due to the SVN’s inherent nature, previous versions of the file will persist in the SVN history and could be retrievable for those with access, mostly the ASF membership.
Past versions of this file or similar ones are accessible to ASF Membership. If you prioritize your privacy, we advise against using SVN to publish your personal data.
Github and ASF account IDs
The Infrastructure team will see the connection between your Github ID and your ASF account ID. Given the Open Source nature of work, it cannot be excluded that others will find out about this connection as well.