Last updated: September 7, 2021
The Linux Foundation’s core purpose is to foster an ecosystem that supports the collaborative and public development of free and open source software projects (each, a “Project”). This privacy policy (“Privacy Policy”) describes our policies and procedures about the collection, use, disclosure and sharing, or other processing of your personal information when you use our websites (e.g., linuxfoundation.org, linux.com), our LFX platform (e.g., lfx.linuxfoundation.org) (“LFX”) or participate in or use our Project sites (collectively, the “Sites”), as well as when you interact with or participate in our events, programs, trainings and our other services and offerings, including services accessible through LFX (collectively, the “Services”). This Privacy Policy applies to activities by The Linux Foundation and its affiliates, subsidiaries and related entities (collectively “TLF,” “we” or “us”), including activities that we perform for other entities through management services agreements. The Privacy Policy does not apply to information collected about TLF employees or other TLF personnel.
For purposes of the GDPR, The Linux Foundation is the controller of your personal information. Where processing of personal information is undertaken by our affiliates, subsidiaries and related entities, they are a joint controller with The Linux Foundation for your personal information.
Capitalized terms that are not defined in this Privacy Policy have the meaning given them in our Terms of Use or, if you engage with LFX, then those defined in the LFX Platform Use Agreement (as applicable, the “Terms”). In this Privacy Policy, “personal information” includes references to “personal data” as defined under applicable laws. Your use of our Sites and Services, and any dispute over privacy, is subject to this Policy and the relevant Terms, including the applicable limitations on damages and the resolution of disputes. The Terms are incorporated by reference into this Policy.
Personal Information That TLF Collects
We collect personal information directly from individuals, from third parties, and automatically through the Sites and Services. You do not have to provide us your personal information. However, if you choose not to disclose certain information, we will not be able to provide you with access to certain services or features, including account registration, event registration, training and certification programs, or participation in certain aspects of our open source projects.
Registration Information. We collect personal information when you register for an account, a conference or other events or programs:
Linux Foundation ID, Account and Profile Information. Users may sign up for, request, or order our Services and may register to receive materials on our Sites. Users may also create a “Linux Foundation ID” (also called an “LF Login”), which is a single sign-on account which is used for common access to many of our Services, including LFX. Personal information collected on the Sites includes community forum content, profiles, photographs, names, forwarding information for “linux.com” email forwarding, unique identifiers (e.g., social media handles or usernames), information about your current and past employment affiliations, contact and billing information (e.g., email address, preferred pronoun, postal address, telephone, fax), and transaction information. In order to access certain personalized services on the Sites, you may be asked to also create and store a username and password for an account from TLF, and/or to link your Linux Foundation ID account with other providers’ social accounts (such as Facebook, Google, LinkedIn or GitHub). Also, in order to tailor TLF’s subsequent communications to users and continuously improve the Sites’ operations and services, TLF may also ask users to provide additional optional information regarding their interests, demographics, experience and detailed contact preferences.
LFX. To register for and participate in the LFX platform and related Services, users must have an active Linux Foundation ID and account (see above for information collected related to account registration). Depending on the Community Bridge Services in which users participate, we may also collect additional information relating to their use of those Services, including:
- LFX Crowdfunding: We collect information about financial contributions made, as well as and funds received through LFX. TLF generally only records the result of the transaction and any references to the transaction record provided by the third-party site. For example, when users make financial contributions to projects, we collect and process the donation amount, requested allocation category, and identifiers used to associate that donation with the donor and project in the project’s open and transparent public ledger. We also collect disbursement amount and category, recipient name and email, and identifiers related to disbursements of project funds for projects. Further, we use third-party services including Stripe an Expensify to facilitate funding and disbursements. If applicable, the third-party site may collect payment information directly to facilitate a transaction.
- LFX Mentorship: Users who register to participate as prospective or actual mentees or mentors may be asked to provide information, such as skills and interests, that are relevant to helping match mentees, mentors and projects for mentorships. TLF may ask users to provide residency details in order to confirm their ability to legally participate in a mentorship. Users may also optionally upload certain documents, such as resumes and cover letters, which may be provided at the user’s request to third party organizations that seek potential employment opportunities with users who graduate from mentorships. TLF may also ask users to provide additional optional information regarding demographics and socioeconomics, for the purpose of compiling, analyzing and disclosing aggregate statistics regarding diversity of participation in open source projects and communities (including in LFX projects and LFX Mentorship opportunities), to help track progress towards meeting TLF’s commitment to diversity initiatives.
Events Registration. When you register for one of our events (e.g., conferences and summits) to participate as an attendee, a speaker or a sponsor, we collect personal information that includes name, company, contact information, and other information. We may also collect other optional personal information such as likes, interests, preferred pronoun, dietary restriction, size preferences for conference attire gifts and other background information. In addition, if you provide it, we may collect (1) personal information about disabilities, medical conditions and allergies in order to provide appropriate accommodations for attendees, and (2) personal information about your citizenship, date of birth, and passport details if you request assistance from us with obtaining a visa letter to travel to one of our events.
For in-person events requiring attendees to be vaccinated against COVID-19, in order to provide a safer environment for attendees and staff, we may collect information to verify your identity and COVID-19 vaccination status. We may collect this information via direct verification of identity and vaccination status documents by TLF staff or third-party contractors, and/or through the use of third-party vaccination status apps and service providers.
Training and Certification Exam Registration. When you participate in one of our training or certification programs, we collect registration-related personal information that includes name, company, certifications, contact information, and other information depending on the circumstances.
Registration for Project Resources and TLF Resources. You can register to receive access to various resources provided by TLF and its Projects regarding the open source ecosystem, open source project development, collaboration and best practices. This includes providing us with personal information such as your email address and name to receive newsletters, mailing list postings and social media postings, to view webinars, and to access other resources made available by TLF and its Projects.
Your Contributions to Open Source Projects.
Attribution, Provenance and Integrity. When you contribute source code, documentation or other content to one of our Projects (whether on your own behalf or through contributions made as part of your employment services to your employer), we collect and store the information and content that you contribute. This includes the contents of those contributions, as well as information required to confirm the provenance of intellectual property contained in those contributions, and personal information that you make publicly available in the record of the contribution pursuant to sign-offs under the Developer Certificate of Origin (https://developercertificate.org/). Some Projects require additional agreements or information pursuant to their intellectual property policies; in such cases we collect and store information related to your acceptance of those agreements. We may also collect information relating to your participation in technical, governance or other Project-related meetings.
Other Project-related Content. The content you provide in relation to Projects also includes materials that you make publicly available in connection with Project development, collaboration and communication, such as on mailing lists, blogs, Project wiki pages and issue trackers, and related services.
Applicants for TLF Internships or Employment. We collect and store personal information relating to individuals who apply to participate in one or more of our Project-related internships, or for employment with TLF. Separately, as described above, LFX Mentorship provides a platform for mentors and mentees to connect and conduct mentorships; however, these mentorships are not offered by, supervised by or administered by TLF, and participation in a mentorship does not constitute a form of employment or internship with or any related rights towards TLF. The personal information collected and stored for TLF Project-related internships, or for employment with TLF, may include your name, address, or other contact information. In addition, if you choose to provide it, we may collect personal information regarding your membership in a diverse or underrepresented group.
Your Content. We collect and store the information and content that you post to the Sites, including your questions, answers, comments, forum postings, and responses to surveys. Please see the section on Publicly Available Information for how the information you post will be viewed on our Sites.
Communications. When you communicate with us (via email, phone, through the Sites or otherwise), we may maintain a record of your communication.
Payment Information. To purchase Services (including registering for events, training and certification exams), users may be asked to be directed to a third-party site, such as Stripe, to pay for their purchases. If applicable, the third-party site may collect payment information directly to facilitate a transaction. TLF generally only records the result of the transaction and any references to the transaction record provided by the third-party site.
Automatically Collected Information. In addition, TLF may automatically collect the following information about users’ use of the Sites or Services through cookies, web beacons, and other technologies: your domain name; your browser type and operating system; web pages you view; when you open certain emails we send; links you click; your IP address; your country of location; the length of time you visit our Sites and or use our Services; and the referring URL, or the webpage that led you to our Sites. We may combine this information with other information that we have collected about you, including, where applicable, your user name, name, and other personal information. For some parts of the Sites, we use the FullStory service to record session replays of a user’s interaction with the Sites for debugging purposes. Please see our Cookie Policy for more information about our use of cookies.
De-identified Information. We may de-identify and aggregate certain personal information we collect such that the information no longer identifies or can be linked to a particular user or an individual data subject (“De-identified Information”), subject to the terms of any applicable user agreements. We may use this information to improve our Services, analyze trends, publish market research, and for other marketing, research or statistical purposes, and may disclose such information to third parties for these specific purposes.
Performing Services for Nonprofit Entities in a Managed Services Relationship. For certain of its Projects that are structured as separate legal entities, TLF performs services as a managed services provider. In such cases, TLF collects and processes the same types of personal information as described above, doing so in the furtherance of performing services for those Project entities.
Purposes and Legal Bases for Our Using of Your Personal Information
Purposes and Legitimate Interests
TLF uses the personal information we collect for our legitimate business interests, which include the following purposes:
- Providing our Sites and Services. To provide the Services and our Sites (including LFX and its service offerings, and Project Sites), to communicate with you about your use of our Sites and Services, to respond to your inquiries, provide troubleshooting of the Sites and for other purposes to support users and the community.
- Operating our Open Source Projects. To enable communication between and among open source developers in the community; to facilitate and document Project governance and technical decision-making; to maintain, and make publicly available on a perpetual basis, records regarding intellectual property provenance and license compliance for Project contributions; and for related activities to further TLF’s core purpose of fostering an ecosystem that supports the collaborative and public development of free and open source software projects. See the “Attribution, Provenance and Integrity” section above for more information.
- Maintain our Training and Certification Programs. To maintain records about who has attended or registered to attend training programs, take certification exams and received certain certifications.
- Event Administration. To plan, organize, and facilitate access to events and related services and activities, and to carry out informative and safe events for participants, including attendees, speakers and sponsors. If you provide us information about disabilities, medical conditions and allergies, we will use this information in order to provide appropriate accommodations for attendees and to ensure their health and safety; we will not use this information for other purposes, unless required by law or as necessary to defend our legal rights. If you request assistance from us for obtaining a visa letter to travel to one of our events and provide us with information required for such assistance (such as your citizenship, date of birth, and passport details), we will use this information in order to assist with providing you a visa letter; we will not use this information for other purposes, unless required by law or as necessary to defend our legal rights. For in-person events requiring attendees to be vaccinated against COVID-19, we use information regarding your COVID-19 vaccination status to provide a safer environment for attendees and staff, in order to confirm vaccination status before permitting access to the event venue space.
- Internship and Employment Applications. To select participants for our Project-related internship programs or for employment, including the evaluation and selection of interns and employees from among applicants (not to be confused with LFX Mentorships). If you choose to provide information regarding your membership in a diverse or underrepresented group, we will use this information in connection with internship diversity programs we may operate; we will not use this information for other purposes, unless required by law or as necessary to defend our legal rights.
- Personalization. To tailor the content and information that we may send or display to you on our Sites and in our Services, to offer location customization and personalized help and instructions and to otherwise personalize your experiences.
- Marketing and Promotions. For marketing and promotional purposes, such as to send you news and newsletters, special offers, and promotions, or to otherwise contact you about Projects, Services, events, trainings or other information we think may interest you related to TLF, and, subject to applicable law, our affiliates, subsidiaries and managed services entities.
- Advertising. For targeting advertising to you on our Sites and third-party sites and measuring the effectiveness and reach of ads and services (through third-party ad networks and services).
- Analytics. To gather metrics to better understand how users access and use our Sites and Services and participate in our Projects; to evaluate and improve the Sites, including personalization, to develop new services; and to understand metrics regarding the community health of our Projects. If a user voluntary provides and explicitly consents to our processing of personal information regarding their demographics and socioeconomics, we process such personal information for the specific purposes for which you have consented, which may include for the purpose of compiling, analyzing and disclosing aggregate statistics regarding diversity of participation in open source projects and communities (including in LFX projects and LFX Mentorship opportunities), to help track progress towards meeting TLF’s commitment to diversity initiatives and subject to your consent.
- Compliance. To comply with legal obligations and requests. For example, to comply with laws that compel us to disclose information to public authorities, courts, law enforcement or regulators, maintain records for a certain period, or maintain records demonstrating enforcement and sublicensing of our trademarks and those of our Projects.
- Business and Legal Operations. As part of our general business and legal operations (e.g., accounting, record keeping, and for other business administration purposes), and as necessary to establish, exercise and defend (actual and potential) legal claims.
- Prevent Misuse. Where we believe necessary to investigate, prevent or take action regarding illegal activities, suspected fraud, situations involving potential threats to the safety of any person or violations of the relevant Terms or this Privacy Policy.
Purposes and Legal Bases