diff --git a/Policies/github-terms/github-marketplace-developer-agreement.md b/Policies/github-terms/github-marketplace-developer-agreement.md index 932397b9..da95c3c9 100644 --- a/Policies/github-terms/github-marketplace-developer-agreement.md +++ b/Policies/github-terms/github-marketplace-developer-agreement.md @@ -11,148 +11,129 @@ topics: --- -**THESE TERMS AND CONDITIONS (THE "AGREEMENT") GOVERN YOUR PARTICIPATION IN GITHUB’S MARKETPLACE PROGRAM. BY ENROLLING TO PARTICIPATE IN THE MARKETPLACE PROGRAM OR BY CLICKING “I ACCEPT” BELOW, YOU ARE CONFIRMING THAT YOU UNDERSTAND THIS AGREEMENT, AND THAT YOU ACCEPT ALL OF ITS TERMS AND CONDITIONS. IF YOU ARE ENTERING INTO THIS AGREEMENT ON BEHALF OF A COMPANY OR OTHER LEGAL ENTITY, YOU REPRESENT THAT YOU HAVE THE LEGAL AUTHORITY TO BIND THE ENTITY TO THIS AGREEMENT, IN WHICH CASE “YOU” WILL MEAN THE ENTITY YOU REPRESENT.** +**These terms and conditions (the "Agreement") govern your participation in GitHub’s Marketplace. By enrolling to participate in the Marketplace or by clicking “I Accept” below, you are confirming that you understand this agreement, and that you accept all of its terms and conditions. If you are entering into this Agreement on behalf of a company or other legal entity, you represent that you have the legal authority to bind the entity to this agreement, in which case “You” will mean the entity you represent.** -Effective Date: August 24, 2021 +Effective Date: May 17, 2024 ## 1. DEFINITIONS -Capitalized terms utilized in this Agreement and not defined herein shall have the meaning set forth in the GitHub Terms of Service located at [https://docs.github.com/articles/github-terms-of-service](/site-policy/github-terms/github-terms-of-service) (the “Terms” or “ToS”). +Capitalized terms utilized in this Agreement and not defined shall otherwise have the meaning provided in the GitHub Terms of Service located at [https://docs.github.com/articles/github-terms-of-service](/site-policy/github-terms/github-terms-of-service). Those Terms of Service are referred to as the “Terms” or “ToS”. -"Action" means a mechanism that allows you to implement custom logic without having to create an application to perform a particular task with GitHub. +"Action" means a workflow that allows you to implement custom logic to perform a particular task with GitHub without having to create an application. -“Brand Features” means the trade names, trademarks, service marks, logos, domain names, and other distinctive brand features of each party, respectively, as owned (or licensed) by such party from time to time. +“Brand Features” means the trademarks and similar intellectual property of each party. -"Developer" means you, and you are the company or individual who has created the software, content, and digital materials for use in connection with GitHub and accessible via Marketplace. +"Developer" or "You" means the company or individual who has created the Developer Application. -"Developer Application" or "Developer Product" means the Software, content and digital materials created by You for use in connection with GitHub and accessible via Marketplace and includes Actions. +"Developer Application" or "Developer Product" means the software, related content and other digital materials created by You for use in connection with GitHub and accessible via Marketplace. This includes Actions, GitHub Copilot Extensions, and other applications or products that use or interact with generative artificial intelligence (AI) technology. -“End User” means any person, company or other legal entity that will acquire licenses to Developer Product via the GitHub Marketplace. +“End User” means any person, company or other legal entity that will acquire licenses to a Developer Product via the GitHub Marketplace. -“GitHub API” means GitHub’s proprietary application program interface. Access to and use of the GitHub API is governed by the ToS. +“GitHub API” means any proprietary application programming interface developed by GitHub, and includes the GitHub Copilot API. Access to and use of a GitHub API is governed by the ToS. “GitHub Marketplace” or “Marketplace” means the proprietary online marketplace site operated by GitHub where Developer Products may be delivered to End Users. “Listing” means the content provided for listing the Developer Product on GitHub Marketplace. -“Taxes” means any federal, state, local or foreign income, gross receipts, franchise, estimated, alternative minimum, sales, use, transfer, value added, excise, real or personal property, withholding or other tax, of any kind whatsoever, including any interest, penalties or additions to tax or additional amounts in respect of the foregoing.” +“Taxes” means any tax, of any kind or sort regardless of origin, including interest or penalties thereon. + +“Token” means the credentials Developer must obtain to access a GitHub API. “Usage Data” means Marketplace related data generated in connection with End User use of GitHub Marketplace and licensure of Developer Products, including but not limited to usage statistics and aggregated sales data. Usage Data does not include and specifically excludes banking and payment information. ## 2. PURPOSE AND LICENSE GRANT -**2.1** This Agreement sets forth the terms and conditions pursuant to which Developer may publish Listings on GitHub Marketplace for purchase of Developer Products by End Users and use in connection with GitHub.com. This Agreement is applicable to Developer Products distributed for free and Developer Products for which End Users are charged a fee. Developer agrees to use the GitHub Marketplace solely for purposes permitted by this Agreement or as otherwise allowed by applicable law. As between GitHub and Developer, Developer is solely responsible for Developer Products. +**2.1** This Agreement sets forth the terms that govern a Developer publishing Listings on GitHub Marketplace for End Users to use Developer Products. This Agreement is applicable to all Developer Products, regardless if distributed for free or for a fee. Developer agrees to use the GitHub Marketplace solely for the purposes permitted by this Agreement. Developer is solely responsible for its Developer Products. -**2.2** Developer grants to GitHub a non-exclusive, worldwide, transferable, sublicensable, fully paid-up, royalty-free license to (a) host, link to, reproduce, modify, publicly perform, publicly display, test, distribute, make available, license and otherwise use the Listing; (b) reproduce, perform, display, use and access the Listing for administration and demonstration purposes in connection with the operation and marketing of the Marketplace; and (c) reproduce, display, distribute and otherwise use any Developer Brand Features furnished by Developer to GitHub under this Agreement solely for use in connection with the Marketplace and in order to fulfill its obligations under the Agreement. +**2.2** Developer grants to GitHub a non-exclusive, worldwide, transferable, sublicensable, fully paid-up, royalty-free license to process the Listing in any fashion (including testing and displaying it on Marketplace), and to display Developer’s Brand Features in connection with Marketplace. -**2.3** In addition to the licenses granted above, GitHub may include Developer Brand Features furnished by Developer to GitHub under this Agreement in any presentations, communications, marketing materials, press releases, customer lists (including, without limitation any customer lists, posted to GitHub websites), publicity campaigns and other advertising collateral for purposes of marketing the Marketplace. If Developer discontinues the distribution of specific Developer Products on the Marketplace, GitHub will, after a commercially reasonable period of time, cease use of the discontinued Developer Products’ Brand Features. Nothing in this Agreement gives Developer a right to use any GitHub Brand Features. +**2.3** In addition to the licenses granted above, GitHub may include Developer Brand Features in any material marketing Marketplace. If Developer stops distributing a Developer Product on Marketplace, GitHub will stop use of the discontinued products’ Brand Features. -**2.4** Developer grants to each End User a non-exclusive, worldwide right or license to perform, display, and use the Developer Products and any content contained in, accessed by or transmitted through the Developer Products in connection with the Marketplace. Developer must include a separate end user license agreement (“EULA”) in its Developer Products that will govern the End User’s rights to the Developer Products in lieu of the foregoing sentence. Developer acknowledges and agrees that the applicable EULA for each Developer Product is solely between Developer and the End User. GitHub shall not be responsible, nor have any liability whatsoever, under any EULA. +**2.4** Developer must include a separate end user license agreement (“EULA”) in its Developer Products that will govern the End User’s rights to the Developer Products. Developer acknowledges and agrees that the applicable EULA for each Developer Product is solely between Developer and the End User. GitHub shall not be responsible, nor have any liability whatsoever, under any EULA. -**2.5** Except for the license rights granted in this Agreement, (a) Developer retains all rights in the Developer Products; (b) each party retains all rights it has independent of this Agreement, including rights under the US Copyright Act or similar laws of other jurisdictions; and (c) each party owns all rights, title and interest in its respective Brand Features. Each party is responsible for protecting and enforcing its own respective rights and neither party has an obligation to do so on the other’s behalf. +**2.5** Except for the license rights granted in this Agreement, (a) Developer retains all rights in the Developer Products; (b) each party retains all rights it has independent of this Agreement, including rights under the US Copyright Act or similar laws of other jurisdictions; and (c) each party owns all rights, title and interest in its respective Brand Features. Each party is responsible for protecting and enforcing its own rights and neither party has an obligation to do so on the other’s behalf. -**2.6** Developer acknowledges and agrees that GitHub shall be entitled to provide Developer’s name, address and other contact details to any third party that reasonably, in GitHub’s sole determination, claims that Developer does not possess all of the necessary intellectual property rights in or to the Developer Products. +**2.6** GitHub shall be entitled to provide Developer’s name, address and other contact details to any third party as required by law or that reasonably, in GitHub’s sole determination, claims that Developer does not possess all of the necessary intellectual property rights in or to the Developer Products. ## 3. RESTRICTIONS AND RESPONSIBILITIES -Notwithstanding any of the requirements set forth in Section 2, Purpose and License Grant, above, Developer acknowledges and agrees that its use of the Marketplace and participation in the Program is explicitly conditioned on Developer’s adherence to this Agreement, including without limitation, the restrictions and compliance requirements set forth in this Section 3. +Notwithstanding any of the requirements set forth in Section 2 (Purpose and License Grant) above, Developer's use of Marketplace is explicitly conditioned on Developer’s adherence to this Agreement, including the restrictions and compliance requirements set forth below. + +**3.1** Developer agrees it will protect the privacy and legal rights of all End Users with respect to the use of Developer Products. If an End User provides Developer with, or the Developer Product otherwise collects, discloses, accesses or uses, End User Personal Data, then the Developer must (a) inform End Users that such information will be available to the Developer Products; (b) provide a legally adequate privacy notice and protection to End Users; (c) obtain valid End User consent as required, and (d) comply with all other data privacy obligations applicable to Developer. -**3.1** Developer agrees it will protect the privacy and legal rights of all End Users. If an End User provides Developer with, or the Product otherwise collects, discloses, accesses or uses, End User names, passwords or other personal information, then the Developer must (a) inform End Users that such information will be available to the Developer Products; and (b) provide legally adequate privacy notice and protection to End Users. Further, Developer Products may only use the information for the limited purpose for which Developer has obtained permission from End User. If Developer Products store or transmit personal or sensitive information provided by or obtained from End Users, then Developer must ensure all such activity is done so securely and must respond promptly to complaints, removal requests, and “do not contact” requests from GitHub or Marketplace End Users +**3.2** In order to use and access a GitHub API, Developer must obtain a Token by becoming a subscriber. Developer may not share its Token with any third party, shall keep its Token and all login information secure, and shall use the Token as Developer’s sole means of accessing a GitHub API. -**3.2** In order to use and access the GitHub API, Developer must obtain API credentials (a “Token”) by becoming a subscriber. Developer may not share its Token with any third party, shall keep such Token and all login information secure and shall use the Token as Developer’s sole means of accessing the GitHub API. +**3.3** Developer will not engage in any activity with Marketplace, including attempting to distribute any Developer Product, that violates GitHub's Terms of Service including [Acceptable Use Policies](https://docs.github.com/en/site-policy/acceptable-use-policies/github-acceptable-use-policies). Additionally, Developer will not attempt to distribute any Developer Product that: -**3.3** Developer acknowledges and agrees that it will not engage in any activity with the Marketplace, including the distribution of Developer Products, that violates Marketplace policies or that: +- 1\. Contains or installs any active malware or exploits, or uses our platform for exploit delivery (such as part of a command and control system); +- 2\. Enables the unauthorized download of streaming content or media; or +- 3\. Diverts End Users or provides links to any other site that mimics Marketplace or passes itself off as Marketplace -- 1\. Violates any applicable laws or regulations or promotes unlawful activities; -- 2\. Contains or installs any active malware or exploits, or uses our platform for exploit delivery (such as part of a command and control system); -- 3\. Interferes with, disrupts, damages, harms, or accesses in an unauthorized manner the machines, systems, hardware, servers, networks, devices, data or other property or services of any third party; -- 4\. Includes false or misleading content; -- 5\. Infringes on any proprietary right of any party, including patent, trademark, trade secret, copyright, right of publicity, or other rights; -- 6\. Is libelous, defamatory, or fraudulent; -- 7\. Enables the unauthorized download of streaming content or media; -- 8\. Displays or links to illegal content; -- 9\. harasses, abuses, threatens, or incites violence toward any individual or group, including GitHub employees, officers, and agents, or any End Users; -- 10\. Is or contains sexually obscene content; -- 11\. Is discriminatory or abusive toward any individual or group; -- 12\. Diverts End Users or provides links to any other site that mimics the Marketplace or passes itself off as the Marketplace. +**3.4** With respect to Developer Products that interact with generative AI technology, including GitHub Copilot Extensions, Developer will: -**3.4** Developer shall not, under any circumstances, through Developer Products or otherwise, repackage or resell the Marketplace, GitHub API or Usage Data. Developer is not permitted to use the GitHub API or any Usage Data in any manner that does or could potentially undermine the security of the Service, the GitHub API, Usage Data or any other data or information stored or transmitted using the Marketplace. In addition, Developer shall not, and shall not attempt to, interfere with, modify or disable any features, functionality or security controls of the Marketplace or the GitHub API, defeat, avoid, bypass, remove, deactivate or otherwise circumvent any protection mechanisms for the Marketplace or the GitHub API, or reverse engineer, decompile, disassemble or derive source code, underlying ideas, algorithms, structure or organizational form from the Marketplace or the GitHub API. +- 1\. Test the Developer Product using various inputs to ensure that outputs do not violate this Agreement; +- 2\. Notify users when they are interacting with generative AI content; +- 3\. Have a mechanism for End Users to report feedback to GitHub and Developer related to errors, bugs, improper, or undesired outputs; and +- 4\. Inform End Users the appropriate use cases, best practices, and limitations of the Developer Product. + +**3.5** Developer shall not by any means repackage or resell Marketplace, a GitHub API, Personal Data, or Usage Data. Developer is not permitted to use a GitHub API or any Personal Data or Usage Data in any manner that does or could undermine the security of the Service, a GitHub API, Usage Data or any other data or information stored or transmitted using Marketplace. In addition, Developer shall not (a) interfere with, modify or disable any features, functionality or security controls of Marketplace or a GitHub API; (b) circumvent in any fashion any protection mechanisms for Marketplace or a GitHub API; or (c) reverse engineer, decompile, disassemble or derive the source code, underlying ideas, algorithms, structure or organizational form from Marketplace or a GitHub API. -**3.5** Developer acknowledges that Developer is solely responsible, and that GitHub has no responsibility or liability of any kind, for the content, development, operation, support or maintenance of Developer Products. Without limiting the foregoing, Developer will be solely responsible for -- (i) the technical installation and operation of its Developer Products; +**3.6** Developer acknowledges that Developer is solely responsible, and that GitHub has no responsibility or liability of any kind, for any aspect of Developer Products. Developer will be solely responsible for: +- (i) providing End Users instructions on installing and using its Developer Products; - (ii) creating and displaying information and content on, through or within its Developer Products; - (iii) ensuring that its Developer Products do not violate or infringe the intellectual property rights of any third party; - (iv) ensuring that Developer Products are not offensive, profane, obscene, libelous or otherwise illegal; -- (v) ensuring that its Developer Products do not contain or introduce malicious software into the Marketplace, the GitHub API, any Usage Data or other data stored or transmitted using the Marketplace; and +- (v) ensuring that its Developer Products do not contain or introduce malicious software into Marketplace, a GitHub API, any Usage Data or other data stored or transmitted using Marketplace; and - (vi) ensuring that its Developer Products are not designed to or utilized for the purpose of sending commercial electronic messages to any GitHub.com users, agents or End Users without their consent. -**3.6** Developer will respect and comply with the technical and policy-implemented limitations of the GitHub API and the restrictions of this Agreement in designing and implementing Developer Products. Without limiting the foregoing, Developer shall not violate any explicit rate limitations on calling or otherwise utilizing the GitHub API. - -**3.7** GitHub reserves the right to terminate this Agreement immediately if GitHub determines that Developer has breached any requirement or obligation of this Section 3. +**3.7** Developer will respect and comply with the technical and policy-implemented limitations of a GitHub API and the restrictions of this Agreement in designing and implementing Developer Products. Developer shall not violate any explicit rate limitations on calling or otherwise utilizing a GitHub API. -**3.8** Nothing in this Agreement shall prevent either party from developing and/or publishing applications that are similar or otherwise compete with the other party's applications. +**3.8** Nothing in this Agreement shall prevent either party from developing and/or publishing applications that are similar or otherwise compete with the other party's applications. ## 4. TAKEDOWNS -**4.1** Your Takedowns. Upon providing GitHub with thirty (30) days written notice in advance of the 1st day of the succeeding calendar month, you may remove your Listings from future distribution via Marketplace, but you must comply with this Agreement for any Listing distributed through Marketplace, including but not limited to refund requirements. Removing your Listing from future distribution via Marketplace does not (a) affect the license rights of End Users who have previously purchased or installed your Listing or (b) change your obligation to deliver or support Listing that has been previously purchased or installed by users. - -Notwithstanding the foregoing, in no event will GitHub maintain on any portion of Marketplace any Listing that you have removed from Marketplace and provided written notice to GitHub that such removal was due to: - -- (i) an allegation of infringement, or actual infringement, of any copyright, trademark, trade secret, trade dress, patent or other intellectual property right of any person, -- (ii) an allegation of defamation or actual defamation, -- (iii) an allegation of violation, or actual violation, of any third party's right of publicity or privacy, or -- (iv) an allegation or determination that such Listing does not comply with applicable law. - -If you remove a Listing from Marketplace pursuant to clauses (i), (ii), (iii) or (iv) of this Section 4.1, and an End User purchased such Listing within a year before the date of takedown, GitHub is not responsible for refund(s) to the affected buyer of any amount paid by such End Customer during the year before the date of takedown for such affected Listing. +**4.1** Your Takedowns. Upon providing GitHub with thirty (30) days written notice, you may remove your Listing from future distribution via Marketplace. You must continue to comply with this Agreement for any Listing already distributed through Marketplace including but not limited to refund requirements. Removing your Listing from future distribution via Marketplace does not (a) affect the license rights of End Users who have previously purchased or installed your Listing or (b) change your obligation to deliver or support Listing that has been previously purchased or installed by users. If you remove your Listing, GitHub will not disclose your reason for the removal. -**4.2** GitHub Review and Takedowns. While GitHub is not obligated to monitor the Listing or their content, GitHub may at any time review or test your Listing for compliance with this Agreement, the Marketplace program policies, and any other applicable terms, obligations, laws, or regulations. GitHub retains the right to refuse to include a Listing on Marketplace in its sole discretion. You may be required to provide information about yourself (such as identification or contact details) as part of the registration process for Marketplace, or as part of your continued use of Marketplace. You agree that any information you give to Marketplace will always be accurate, correct and up to date. As part of the specification for your Listing, GitHub may ask that you include in the file for your Listing information such as your name and email address. GitHub may use this information when featuring the Listing in our directory or for other uses. +**4.2** GitHub Review and Takedowns. GitHub may review or test your Listing for compliance with this Agreement, GitHub ToS, and any other applicable terms, obligations, laws, or regulations. GitHub retains sole and absolute discretion over what Listings are included on Marketplace. You may be required to provide information about yourself (such as identification or contact details) as part of the registration process for Marketplace, or as part of your continued use of Marketplace. You agree that any information you give to Marketplace will be accurate, correct and up to date. As part of the specification for your Listing, GitHub may ask that you include in the file for your Listing information such as your name and email address. GitHub may use this information when featuring the Listing in our directory or for other uses. -If GitHub is notified by you or otherwise becomes aware and determines in its sole discretion that a Listing or any portion thereof or your Brand Features -- (a) violates the intellectual property rights or any other rights of any third party; -- (b) violates any applicable law or is subject to an injunction; -- (c) is pornographic, obscene or otherwise violates GitHub's hosting policies or other terms of service as may be updated by GitHub from time to time in its sole discretion; -- (d) is being distributed by you improperly; -- (e) may create liability for GitHub or any third party; -- (f) is deemed by GitHub to be malicious or defective; -- (g) violates the terms of this Agreement or the Marketplace program policies; -- (h) the display of the Listing is impacting the integrity of GitHub servers (i.e., users are unable to access such content or otherwise experience difficulty); -- (i) is deemed by GitHub to add undue risk to Marketplace End Users’ data or impair the user experience of Marketplace or GitHub; -- (j) is subject to user complaints in regards to your breach of your EULA, or -- (k) otherwise violates the Terms or this Agreement, +If GitHub is notified by you or otherwise becomes aware and determines, in its sole discretion, that a Listing or any portion thereof or your Brand Features: -GitHub may: prevent the Listing from being made available on Marketplace; remove the Listing from Marketplace; flag, filter, or modify related materials (including but not limited to descriptions, screenshots, or metadata); or reclassify the Listing at its sole discretion. GitHub reserves the right to suspend or bar any Listing from Marketplace at its sole discretion. +- (a) violates the terms of this Agreement or the ToS; +- (b) the display of the Listing is impacting the integrity of GitHub servers (i.e., users are unable to access such content or otherwise experience difficulty); +- (c) is deemed by GitHub to add undue risk to Marketplace End Users’ data or impair the user experience of Marketplace or GitHub; or +- (d) is subject to End User complaints in regards to your breach of your EULA, -In the event that your Listing is involuntarily removed because it is defective, malicious, infringes intellectual property rights of another person, defames, violates a third party's right of publicity or privacy, or does not comply with applicable law, and an end user purchased such Listing within a year before the date of takedown: +GitHub may: suspend the transfer of Personal Data to your Developer Product; prohibit the collection and processing of Personal Data via your Developer Product; remove the Listing from Marketplace; flag, filter, or modify related materials (including but not limited to descriptions, screenshots, or metadata); or reclassify the Listing at its sole discretion. If GitHub takes any of these actions on your Listing, you may appeal GitHub's action through the [GitHub Appeal and Reinstatement Process](https://docs.github.com/en/site-policy/acceptable-use-policies/github-appeal-and-reinstatement) -- (i) you must refund to the affected buyer all amounts paid by such End Customer during the year before the date of takedown for such affected Listing. -- (ii) GitHub may, at its sole discretion, withhold from your future sales the amount in subsection (i) above. - -**4.3** From time to time, GitHub may check for available updates to Listing, including but not limited to bug fixes or enhanced functionality. If you update your Listing to Marketplace, you agree that such update will be automatically requested, downloaded, and installed without further notice to you. GitHub makes no guarantees regarding the timing of such updates. For the avoidance of doubt, updates to Listing are subject to the same terms and conditions as the Listing, including without limitation Section 4.2 of this Agreement (GitHub Review and Takedowns). +**4.3** Developer Product Updates. From time to time, GitHub may check for available updates to any Listing, including but not limited to bug fixes or enhanced functionality. If you update your Listing to Marketplace, you agree that such update will be automatically requested, downloaded, and installed without further notice to you. GitHub makes no guarantees regarding the timing of such updates. Updates to a Listing are subject to the same terms and conditions as the Listing. **4.4** End-User Takedowns. If an End-User uses your Developer Product in a way that violates the Terms, then we have the right to suspend or terminate that End-User's access to the Developer Product without any liability to you. ## 5. REPRESENTATIONS, WARRANTIES AND COVENANTS -**5.1** Developer represents and warrants that Developer has notified all users of such Developer Applications that their account data will be transmitted outside the Service and Developer terms will control the privacy, security or integrity of such account data. Developer further represents and warrants that to the extent Developer’s Applications store, process or transmit account data, neither Developer nor Developer’s Application will, without appropriate prior user consent or except to the extent required by applicable law, -- (i) modify the content of account data in a manner that adversely affects the integrity of account data; -- (ii) disclose account data to any third party; or -- (iii) use account data for any purpose other than providing the Developer Application functionality to users of such Developer Application. Developer shall maintain and handle all account data in accordance with privacy and security measures reasonably adequate to preserve the confidentiality and security of all account data and all applicable privacy laws and regulations. +**5.1** Developer must inform End Users of the Personal Data that will be transmitted to the Developer Application from the Service and that Developer terms will control the privacy, security or integrity of such Personal Data. To the extent Developer’s Applications store, process or transmit Personal Data, neither Developer nor Developer’s Application will, without appropriate prior user consent or except to the extent required by applicable law, +- (i) modify the content of Personal Data in a manner that adversely affects the integrity of the Personal Data; +- (ii) disclose the Personal Data to any third party; or +- (iii) use the Personal Data for any purpose other than providing the Developer Application functionality to users of such Developer Application. + +Developer shall maintain and handle all Personal Data in accordance with privacy and security measures reasonably adequate to preserve the confidentiality and security of all such Personal Data and all applicable privacy laws and regulations. **5.2** Developer agrees that it will comply with the GitHub Data Protection Addendum. -**5.3** Developer represents, warrants and covenants that: (i) its Developer Products and Developer Brand Features do not and will not violate, misappropriate or infringe upon the intellectual property rights of any third party; (ii) Developer will comply with all applicable local, state, national and international laws and regulations, including, without limitation, all applicable export control laws, and maintain all licenses, permits and other permissions necessary to develop, implement and distribute its Developer Products; and (iii) its Developer Products do not and will not contain or introduce into the Marketplace, the GitHub API, any Usage Data or other data stored or transmitted using the Marketplace, any malicious software; (vi) its Developer Products are not designed to or utilized for the purpose of sending commercial electronic messages to any GitHub customers, agents or End Users without their consent; (vi) it has all right, power and authority to grant the licenses granted to GitHub and End Users herein; (vii) it acknowledges GitHub’s right to charge transaction and/or listing fees as provided in Section 6 herein; any images and text that are used to market the Developer Products or that Developer has uploaded to the Marketplace are truthful, accurate and not intended to mislead or confuse the End User. +**5.3** You Support Your Developer Product. Developer will be solely responsible for support and maintenance of your Developer Products and any complaints about your Developer Products. Your support contact information will be displayed in each application detail page and made available to users for customer support purposes. Failure to provide adequate support for your Developer Products may result in reduced product exposure, or in some cases removal from Marketplace or anywhere else on GitHub.com where previously purchased or downloaded Developer Products are stored on behalf of users. -**5.4** DISCLAIMER OF WARRANTIES. ALL ASPECTS OF THE MARKETPLACE AND THE GITHUB API, INCLUDING ALL SERVER AND NETWORK COMPONENTS ARE PROVIDED ON AN “AS IS” AND “AS AVAILABLE” BASIS, WITHOUT ANY WARRANTIES OF ANY KIND TO THE FULLEST EXTENT PERMITTED BY LAW, AND GITHUB EXPRESSLY DISCLAIMS ANY AND ALL WARRANTIES, WHETHER EXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, ANY IMPLIED WARRANTIES OF MERCHANTABILITY, TITLE, FITNESS FOR A PARTICULAR PURPOSE, AND NON- INFRINGEMENT. DEVELOPER ACKNOWLEDGES THAT GITHUB DOES NOT WARRANT THAT THE MARKETPLACE OR GITHUB API WILL BE UNINTERRUPTED, TIMELY, SECURE, ERROR-FREE OR FREE FROM VIRUSES, MALWARE, OR WORMS (OTHERWISE KNOWN AS COMPUTER CODE OR OTHER TECHNOLOGY SPECIFICALLY DESIGNED TO DISRUPT, DISABLE, OR HARM YOUR SOFTWARE, HARDWARE, COMPUTER SYSTEM, OR NETWORK), AND NO INFORMATION OR ADVICE OBTAINED BY DEVELOPER FROM GITHUB OR THROUGH THE MARKETPLACE OR GITHUB API SHALL CREATE ANY WARRANTY NOT EXPRESSLY STATED IN THESE TERMS. GITHUB IS NOT RESPONSIBLE FOR AND SPECIFICALLY DISCLAIMS ANY LIABILITY FOR ANY UNAUTHORIZED USE OF DEVELOPER PRODUCTS OUTSIDE THE MARKETPLACE. +**5.4** Developer represents and warrants that: (i) its Developer Products and Developer Brand Features do not and will not violate, misappropriate or infringe upon the intellectual property rights of any third party; (ii) Developer will comply with all applicable laws and regulations, including this Agreement and GitHub's Terms of Service, and maintain all permissions necessary to develop, implement, and distribute its Developer Products; (iii) its Developer Products do not and will not contain or introduce any malicious software; (iv) its Developer Products are not designed to or utilized for the purpose of sending commercial electronic messages to any GitHub customers, agents or End Users without their consent; (v) Developer has all right, power and authority to grant the licenses granted to GitHub and End Users herein; and (vi) any images and text that are used to market the Developer Products or that Developer has uploaded to Marketplace are truthful, accurate and not intended to mislead or confuse the End User. -## 6. PRICING AND PAYMENT TERMS +**5.5** Disclaimer of Warranties. All aspects of Marketplace and GitHub API, including all server and network components, are provided on an “as is” and “as available” basis, without any warranties of any kind. GitHub expressly disclaims any and all warranties to the fullest extent permitted by law, whether express or implied, including, but not limited to, any implied warranties of merchantability, title, fitness for a particular purpose, and non-infringement. Developer acknowledges that GitHub does not warrant that Marketplace or a GitHub API will be uninterrupted, timely, secure, error-free, or free from viruses, malware, or worms (otherwise known as computer code or other technology specifically designed to disrupt, disable, or harm your software, hardware, computer system, or network), and no information or advice obtained by developer from GitHub or through Marketplace or a GitHub API shall create any warranty not expressly stated in these terms. GitHub is not responsible for, and specifically disclaims any liability for, any unauthorized use of Developer Products outside Marketplace. -**6.1** GitHub will be the merchant of record for Developer Products purchased by End Users via Marketplace. +## 6. PAID APPLICATIONS OR PRODUCTS -**6.2** Prices for Marketplace Listings of Developer Applications will be set in US Dollars (USD). Developer has complete control over setting pricing for each Listing, and once set, such pricing cannot be changed. You may retire a pricing plan for an existing Listing and add a new pricing plan for such Listing, provided that such new pricing plan shall not negatively impact existing End Users. The prices you set for Developer Products will determine the amount of payment you will receive. GitHub will remit 95% of the sale price in USD without reduction for Taxes except for any withholding taxes that are required under applicable law. The remaining 5% of the sales price will be allotted to and retained by GitHub. At the end of each month and upon reaching a minimum value of $500 USD, GitHub will remit your share of payments. +**6.1** GitHub will be the merchant of record for Developer Products purchased by End Users via Marketplace. -**6.3** Refund Requirements. You will be responsible for specifying the terms and conditions regarding refunds to your End Users. In no event shall GitHub be responsible for providing any support for refunds, nor shall GitHub be liable for payment of any refund. +**6.2** Registration. Developer will be required to provide information about yourself (such as identification or contact details) as part of the registration process for Marketplace, or as part of your continued use of Marketplace including, but not limited to: (i) name, (ii) address, (iii) telephone number, (iv) e-mail address, and (v) payment account details. GitHub may publicize Developer’s information on Marketplace and retain Developer’s registration information as required by applicable law. +**6.3** Pricing. Prices for Listings of Developer Applications will be set in US Dollars (USD). Developer has complete control over setting pricing for each Listing. The prices you set for Developer Products will determine the amount of payment you will receive. GitHub will remit 95% of the sale price in USD without reduction for Taxes except for any withholding taxes that are required under applicable law. The remaining 5% of the sales price will be allotted to and retained by GitHub. At the end of each month and upon reaching a minimum value of $500 USD, GitHub will remit your share of payments. -**6.4** You Support Your Developer Product. You will be solely responsible for support and maintenance of your Developer Products and any complaints about your Developer Products. Your support contact information will be displayed in each application detail page and made available to users for customer support purposes. Failure to provide adequate support for your Developer Products may result in less prominent product exposure, or in some cases removal from Marketplace or anywhere else on GitHub.com where previously purchased or downloaded Developer Products are stored on behalf of users. +**6.3** Refunds. You will be responsible for specifying the terms and conditions regarding refunds to your End Users. In no event shall GitHub be responsible for providing any support for refunds, nor shall GitHub be liable for payment of any refund. ## 7. OWNERSHIP @@ -160,37 +141,37 @@ Subject to the limited licenses expressly provided in this Agreement, nothing in ## 8. LIMITATION OF LIABILITY -UNDER NO CIRCUMSTANCES AND UNDER NO LEGAL THEORY (WHETHER IN CONTRACT, TORT, NEGLIGENCE OR OTHERWISE) WILL GITHUB, OR ITS AFFILIATES, OFFICERS, DIRECTORS, EMPLOYEES, AGENTS, OR SUPPLIERS BE LIABLE TO DEVELOPER OR ANY THIRD PARTY UNDER THIS AGREEMENT FOR ANY INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, CONSEQUENTIAL, PUNITIVE OR OTHER SIMILAR DAMAGES, INCLUDING LOST PROFITS, LOST SALES OR BUSINESS, LOST DATA, BUSINESS INTERRUPTION OR ANY OTHER LOSS INCURRED BY DEVELOPER OR ANY THIRD PARTY IN CONNECTION WITH THIS AGREEMENT, REGARDLESS OF WHETHER DEVELOPER HAS BEEN ADVISED OF THE POSSIBILITY OF OR COULD HAVE FORESEEN SUCH DAMAGES NOTWITHSTANDING ANYTHING TO THE CONTRARY IN THIS AGREEMENT, GITHUB’S AGGREGATE LIABILITY TO DEVELOPER OR ANY THIRD PARTY ARISING OUT OF THIS AGREEMENT SHALL NOT EXCEED SIX (6) MONTHS’ SPEND. +Under no circumstances and under no legal theory (whether in contract, tort, negligence or otherwise) will GitHub, or its affiliates, officers, directors, employees, agents, or suppliers be liable to developer or any third party under this agreement for any indirect, incidental, special, exemplary, consequential, punitive or other similar damages, including lost profits, lost sales or business, lost data, business interruption or any other loss incurred by Developer or any third party in connection with this Agreement, regardless of whether Developer has been advised of the possibility of or could have foreseen such damages notwithstanding anything to the contrary in this Agreement, GitHub’s aggregate liability to Developer or any third party arising out of this Agreement shall not exceed $500 (five hundred) USD. ## 9. INDEMNIFICATION -**9.1** To the maximum extent permitted by applicable law, Developer agrees to defend, indemnify and hold harmless GitHub, its affiliates and their respective directors, officers, employees and agents from and against any and all claims, actions, suits or proceedings, as well as any losses, liabilities, damages, costs and expenses (including reasonable attorneys’ fees) arising from or relating to (a) Developer’s use of the Marketplace in violation of this Agreement, the Terms or any applicable laws or regulations; (b) Developer’s Products that infringe any copyright, trademark, trade secret, patent or other intellectual property right of any third party; (c) any loss or disclosure of data or personal information by Developer Products; and (d) Developer’s EULA (or ToS). +To the maximum extent permitted by applicable law, Developer agrees to defend, indemnify and hold harmless GitHub, its affiliates and their respective directors, officers, employees and agents from and against any and all claims, actions, suits or proceedings, as well as any losses, liabilities, damages, costs and expenses (including reasonable attorneys’ fees) arising from or relating to (a) Developer’s use of Marketplace in violation of this Agreement, the Terms or any applicable laws or regulations; (b) Developer’s Products that infringe any copyright, trademark, trade secret, patent or other intellectual property right of any third party; (c) any loss or disclosure of data or Personal Data by Developer Products; and (d) Developer’s EULA (or ToS). ## 10. TERMINATION **10.1** This Agreement will continue to apply until terminated by either party as set forth below. -**10.2** Either party may terminate this Agreement for any reason upon providing written notice to the other forty-five (45) days prior to the immediately following calendar month. During such 45 day period the terms in effect at the time such notice of termination has been provided shall govern for the duration of the 45-day notice period until the date of actual termination. +**10.2** Either party may terminate this Agreement for any reason upon thirty (30) days written notice. During the 30 day period the terms in effect at the time of the notice of termination shall govern. **10.3** GitHub may terminate this Agreement at any time if (a) you have breached any provision of this Agreement or (b) GitHub is required to do so by law. -**10.4** Effects of Termination by Developer. Upon receiving forty-five (45) days’ advanced written notice of termination from Developer, Developer will be disabled from taking on new customers via Marketplace. Any outstanding fees shall be remitted upon termination and removal of the Developer Product from Marketplace. If termination is initiated as a result of a GitHub modification to these terms (Section 11), the terms in effect immediately prior to such modification shall govern for the duration of the 45-day notice period until the date of actual termination. +**10.4** Effects of Termination by Developer. Upon receiving thirty (30) days’ advanced written notice of termination from Developer, Developer will be disabled from taking on new customers via Marketplace. Any outstanding fees shall be remitted upon termination and removal of the Developer Product from Marketplace. If termination is initiated as a result of a GitHub modification to these terms (Section 11), the terms in effect immediately prior to such modification shall govern the duration of the 30-day notice period. -**10.5** The obligations in Sections 2, 3, 4, 5, 8, 9 and 12-18 will survive any expiration or termination of this Agreement. +**10.5** The obligations in Sections 2, 3, 4, 5, 8, 9, 12-18, and Data Protection Addendum will survive any expiration or termination of this Agreement. ## 11. MODIFICATION -Developer acknowledges and agrees that GitHub may modify this Agreement, Marketplace, the GitHub API, the General API Policies, GitHub Privacy Policy, the GitHub Developer Program ToS, and the GitHub.com ToS from time to time (a “Modification”). All Modifications shall be communicated through Marketplace, the GitHub website at www.GitHub.com or through a form of direct communication from GitHub to Developer. Developer further acknowledges and agrees that such Modifications may be implemented at any time and without any notice to Developer. Developer shall, within forty-five (45) days from the date of first notice of any Modification(s) (or such shorter period of time specified in the notice of the Modification(s)) (the “Conformance Period”) comply with such modification(s) by implementing and using the most current version of the GitHub API in the most current version of the Developer Products and making any changes to Developer Products that may be required as a result of such Modification(s). Developer acknowledges that a Modification may have an adverse effect on Developer Products, including but not limited to changing the manner in which applications communicate with the GitHub API. GitHub shall have no liability of any kind to Developer or any End User with respect to such Modifications or any adverse effects resulting from such Modifications. Developer’s continued access to or use of Marketplace or the GitHub API following the Conformance Period shall constitute binding acceptance of the Modification(s) at issue. +Developer acknowledges and agrees that GitHub may modify this Agreement, Marketplace Terms of Service, a GitHub API, the General API Policies, GitHub Privacy Statement, the GitHub Developer Program Terms of Service, and the GitHub.com ToS from time to time (a “Modification”). All Modifications shall be communicated through Marketplace, the GitHub website at www.GitHub.com or through a form of direct communication from GitHub to Developer. Developer further acknowledges and agrees that such Modifications may be implemented at any time and without any notice to Developer. Developer shall, within thirty (30) days from the date of first notice of any Modification(s) (or such shorter period of time specified in the notice of the Modification(s)) (the “Conformance Period”) comply with such modification(s) by implementing and using the most current version of a GitHub API in the most current version of the Developer Products and making any changes to Developer Products that may be required as a result of such Modification(s). Developer acknowledges that a Modification may have an adverse effect on Developer Products, including but not limited to changing the manner in which applications communicate with a GitHub API. GitHub shall have no liability of any kind to Developer or any End User with respect to such Modifications or any adverse effects resulting from such Modifications. Developer’s continued access to or use of Marketplace or a GitHub API following the Conformance Period shall constitute binding acceptance of the Modification(s). ## 12. ASSIGNMENT; ENTIRE AGREEMENT; REVISIONS **12.1** Developer may not, directly or indirectly, by operation of law or otherwise, assign all or any part of this Agreement or Developer’s rights under this Agreement or delegate performance of Developer’s duties under this Agreement without GitHub’s prior written consent. The rights granted in this Agreement may be assigned or transferred by GitHub without Developer’s prior approval. In addition, GitHub may delegate its responsibilities or obligations under this Agreement without Developer’s consent. -**12.2** This Agreement, together with the Terms, constitute the entire agreement between the parties with respect to the subject matter of this Agreement. GitHub’s failure to enforce at any time any provision of this Agreement does not constitute a waiver of that provision or of any other provision of this Agreement. +**12.2** This Agreement, together with the ToS, constitute the entire agreement between the parties with respect to the subject matter of this Agreement. GitHub’s failure to enforce at any time any provision of this Agreement does not constitute a waiver of that provision or of any other provision of this Agreement. ## 13. SEVERABILITY -If any provision in this Agreement is held by a court of competent jurisdiction to be unenforceable, such provision shall be modified by the court and interpreted so as to best accomplish the original provision to the fullest extent permitted by law, and the remaining provisions of this Agreement shall remain in effect. +If any part of this Agreement is held to be unenforceable, the rest of the Agreement will remain in full force and effect. ## 14. RELATIONSHIP OF THE PARTIES @@ -198,80 +179,80 @@ The parties are independent contractors. This Agreement does not create a partne ## 15. NOTICE -All notices to be provided by GitHub to Developer under this Agreement may be delivered in writing (i) by nationally recognized overnight delivery service (“Courier”) or U.S. mail to the contact mailing address provided by Developer to GitHub; or (ii) electronic mail to the electronic mail address provided by Developer. Developer must give notice to GitHub in writing by Courier or U.S. Mail to the following address: GitHub, Inc., Attn: Legal Department, 88 Colin P. Kelly Jr. Street, San Francisco, CA 94107 USA. All notices shall be deemed to have been given immediately upon delivery by electronic mail, or if otherwise delivered upon receipt or, if earlier, two (2) business days after being deposited in the mail or with a Courier as permitted above. +Notices to GitHub may be submitted via email to legal@support.github.com. If Customer wishes to formally service notice on GitHub, it must be made through GitHub’s registered agent: GitHub, Inc. c/o Corporation Service Company 2710 Gateway Oaks Drive, Suite 150N Sacramento, CA 95833-3505. Notices must be in writing and will be treated as delivered on the date received at the address, date shown on the return receipt, email transmission date, or date on the courier confirmation of delivery. All notices to be provided by GitHub to Developer under this Agreement may be delivered in writing (i) by nationally recognized overnight delivery service (“Courier”) or U.S. mail to the contact mailing address provided by Developer to GitHub; or (ii) electronic mail to the electronic mail address provided by Developer. ## 16. GOVERNING LAW -This Agreement shall be governed by the laws of the State of California without regard to conflict of law principles. Developer hereby expressly agrees to submit to the exclusive personal jurisdiction of the federal and state courts of the State of California, San Francisco County, for the purpose of resolving any dispute relating to this Agreement. Notwithstanding the foregoing, GitHub shall be entitled to seek injunctive remedies or other types of urgent legal relief in any jurisdiction. +This Agreement will be governed by and construed in accordance with the laws of the State of California and federal laws of the United States. Any legal action or proceeding will be brought exclusively in the federal or state courts located in the Northern District of California. The parties consent to personal jurisdiction and venue there. ## 17. EXPORT RESTRICTIONS -DEVELOPER PRODUCTS DISTRIBUTED VIA MARKETPLACE MAY BE SUBJECT TO EXPORT CONTROLS OR RESTRICTIONS BY THE UNITED STATES OR OTHER COUNTRIES OR TERRITORIES. DEVELOPER AGREES TO COMPLY WITH ALL APPLICABLE US AND INTERNATIONAL EXPORT LAWS AND REGULATIONS. THESE LAWS MAY INCLUDE RESTRICTIONS ON DESTINATIONS, CONTENT AND/OR END USERS. +Developer Products distributed via Marketplace may be subject to export controls or restrictions by the United States or other countries or territories. Developer agrees to comply with all applicable US and international export laws and regulations. These laws may include restrictions on destinations, content and/or End Users. ## 18. USAGE DATA -In order to operate and improve Marketplace, GitHub may collect Usage Data from Marketplace and GitHub API or anywhere previously purchased or downloaded Developer Products are stored on behalf of End Users by GitHub. The Usage Data will be maintained in accordance with GitHub’s then in effect privacy policies. Limited Usage Data may be available for use by Developer in GitHub’s sole discretion. +In order to operate and improve Marketplace, GitHub may collect Usage Data from Marketplace or a GitHub API or anywhere previously purchased or downloaded Developer Products are stored on behalf of End Users by GitHub. The Usage Data will be maintained in accordance with GitHub’s then in effect Privacy Statement. Limited Usage Data may be available for use by Developer in GitHub’s sole discretion. + +## 19. PRE-RELEASE ACCESS + +If you have a Listing on a portion of Marketplace that is in a beta or similar pre-release status, your use of that portion is governed by GitHub’s [Pre-release License Terms](https://docs.github.com/en/site-policy/github-terms/github-pre-release-license-terms). -# Addendum1: Data Protection Addendum +# Addendum 1: Data Protection Addendum This Data Protection Addendum (this “Addendum”) is attached to and made a part of the GitHub Marketplace Developer Agreement between you and GitHub (the “Agreement”). Terms not defined in this Addendum have the meanings ascribed to them in the Agreement. In the event of a conflict or inconsistency, the terms of this Addendum will supersede those of the Agreement. **A1-1. Purpose and Scope** -GitHub maintains personal information from individuals all over the world, some of whom are residents of countries and areas with strong data protection laws. This Addendum establishes your responsibilities when you receive and process any protected data from GitHub. +GitHub maintains Personal Data from individuals all over the world, some of whom are residents of countries and areas with strong data protection laws. This Addendum establishes your responsibilities when you receive and process any such Personal Data from GitHub. **A1-2. Definitions** -- a. “Applicable Data Protection Laws” means any laws, regulations, regulatory frameworks, or other legislations relating to the processing and use of Personal Information, as applicable to the Agreement, including: +- (a) “Applicable Data Protection Laws” means any laws, regulations, regulatory frameworks, or other legislations relating to the processing and use of Personal Data, as applicable to the Agreement, including: - The EU General Data Protection Regulation 2016/679 (“GDPR”), along with any implementing or corresponding equivalent national laws or regulations; - The California Consumer Privacy Act of 2018, Cal. Civ. Code §§1798.100 et seq. ("CCPA"); and - The UK Data Protection Act 2018 and implementation of GDPR contained therein. -- b. “Personal Information” means any information which relates to an individual GitHub End User, customer or employee which could, alone or together with other information, personally identify him or her, whether supplied by GitHub for processing by the Developer or whether generated by the Developer in the course of performing its obligations under this Agreement. -- c. “Processing” means any operation or set of operations performed on GitHub Protected Data, whether by manual or automatic means, including collection, recording, organization, storage, adaptation, alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, blocking, erasure, or destruction. -- d. “Protected Data” means any confidential information transferred by GitHub to the Developer about a GitHub End User, including the Personal Information, metadata, Usage Data, or other data or information that is associated with GitHub End Users. +- (b) “Personal Data” means any information which relates to an individual GitHub End User, customer or employee which could, alone or together with other information, identify them, whether supplied by GitHub for processing by the Developer or whether generated by the Developer in the course of performing its obligations under this Agreement. +- (c) “Processing” means any operation or set of operations performed on Personal Data, whether by manual or automatic means, including collection, recording, organization, storage, adaptation, alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, blocking, erasure, or destruction. **A1-3. Compliance with Data Transfer Laws** -- a. GitHub Compliance. GitHub complies with Applicable Data Protection Laws. GitHub relies on Standard Contractual Clauses ("SCCs") for all transfers out of the European Union, European Economic Area, United Kingdom, and Switzerland to provide its services. In addition, GitHub is certified to the EU-U.S. and Swiss-U.S. Privacy Shield Frameworks and the commitments they entail, although GitHub does not rely on the EU-U.S. Privacy Shield Framework as a legal basis for transfers of Personal Information in light of the judgment of the Court of Justice of the EU in Case C-311/18. GitHub will only transfer Personal Information to the Developer for the limited and specified purposes for which it was collected. -- b. Developer Compliance. Developer represents and warrants that it will (i) comply with Applicable Data Protection Laws; and (ii) abide by the requirements of European Economic Area and Swiss data protection law regarding the collection, use, transfer, retention, and other processing of Personal Information from the European Economic Area, United Kingdom, and Switzerland. All transfers of Personal Information to a third country or an international organization will be subject to appropriate safeguards as described in Article 46 of the GDPR and such transfers and safeguards will be documented according to Article 30(2) of the GDPR. +- (a) GitHub Compliance. GitHub complies with Applicable Data Protection Laws. GitHub relies on Standard Contractual Clauses ("SCCs") for all transfers out of the European Union, European Economic Area, United Kingdom, and Switzerland to provide its services. GitHub also complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) as set forth by the U.S. Department of Commerce. GitHub has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (EU-U.S. DPF Principles) with regard to the processing of Personal Data received from the European Union in reliance on the EU-U.S. DPF and from the United Kingdom (and Gibraltar) in reliance on the UK Extension to the EU-U.S. DPF. GitHub has certified to the U.S. Department of Commerce that it adheres to the Swiss-U.S. Data Privacy Framework Principles (Swiss-U.S. DPF Principles) with regard to the processing of Personal Data received from Switzerland in reliance on the Swiss-U.S. DPF. +- (b) Developer Compliance. Developer represents and warrants that it will (i) comply with Applicable Data Protection Laws; and (ii) abide by the requirements of European Economic Area and Swiss data protection laws regarding the collection, use, transfer, retention, and other processing of Personal Data from the European Economic Area, United Kingdom, and Switzerland. All transfers of Personal Data to a third country or an international organization will be subject to appropriate safeguards as described in Article 46 of the GDPR and such transfers and safeguards will be documented according to Article 30(2) of the GDPR. **A1-4. Data Protection** -- a. Notice. Developer must identify itself as the collector and processor of all data it collects from the End User. Developer must not hold itself out as collecting any Personal Information on GitHub’s behalf. Developer must provide sufficient notice of its privacy practices to the End User, such as by posting a privacy policy. -- b. Purpose Limitation. - - i. GitHub will provide Developer with Protected Data elements for the purpose of establishing and facilitating a relationship between the Developer and the End User, and permitting Developer to provide services to the End User. Developer must limit its usage of the Protected Data to that purpose, unless the End User agrees to allow different uses. - - ii. Developer must process and communicate the Protected Data to third parties only for the limited and specific purposes of providing its services to the End User as described in its agreement with the End User, unless the End User agrees to allow different uses. -- c. Data Quality and Proportionality. Developer must keep the Protected Data accurate and up to date. -- d. Security. Developer must take all reasonable security measures appropriate to the risks, such as against accidental or unlawful destruction, or accidental loss, alteration, unauthorized disclosure or access, presented by processing the Protected Data. -- e. Data Retention and Deletion. Upon GitHub’s reasonable request, unless prohibited by law, Developer must return or destroy all Personal Information and related data at all locations where it is stored after it is no longer needed for the limited and specified purposes for which it was collected. -- f. Subprocessing and Onward Transfer. Developer is liable for onward transfers of Protected Data to its subprocessors. In the event that Developer must transfer the Protected Data to a third party, or Developer installs, uses, or enables third party services to process the Protected Data on Developer’s behalf, Developer must ensure that the third party will provide at least the same level of privacy protection as is required herein. +- (a) Notice. Developer must provide End Users their privacy policy which identifies itself as responsible for the collection, processing, privacy, security, and integrity of all data it collects from the End User. Developer must not hold itself out as collecting any Personal Data on GitHub’s behalf. Developer’s privacy policy must provide End User’s all legally required information regarding access, collection, storage, and processing purpose of Personal Data, with whom the Personal Data is shared, and in which country or countries the Personal Data will be stored. +- (b) Purpose Limitation. + - (i) GitHub will provide Developer with Personal Data elements for the purpose of establishing and facilitating a relationship between the Developer and the End User, and permitting Developer to provide services to the End User. Developer must limit its usage of the Personal Data to that purpose, unless the End User agrees to allow different uses. + - (ii) Developer must process and communicate the Personal Data to third parties only for the limited and specific purposes of providing its services to the End User as described in its agreement with the End User, unless the End User agrees to allow different uses. +- (c) Data Quality and Proportionality. Developer must keep the Personal Data accurate and up to date. Developer must only collect Personal Data appropriate and necessary to provide the service. +- (d) Security. Developer must take all reasonable security measures appropriate to the risks, such as against accidental or unlawful destruction, or accidental loss, alteration, unauthorized disclosure or access, presented by processing the Personal Data. +- (e) Data Retention and Deletion. Upon GitHub’s reasonable request, unless prohibited by law, Developer must return or destroy all Personal Data and related data at all locations where it is stored after it is no longer needed for the limited and specified purposes for which it was collected. +- (f) Subprocessing and Onward Transfer. Developer is liable for onward transfers of Personal Data to its subprocessors. In the event that Developer must transfer the Personal Data to a third party, or Developer installs, uses, or enables third party services to process the Personal Data on Developer’s behalf, Developer must ensure that the third party will provide at least the same level of privacy protection as is required herein. -**A1-5. Use of Protected Data** +**A1-5. Use of Personal Data** -- a. Permitted Use. Developer may process the Protected Data only for the purposes set out in Section 4(b)(i), and no other purpose. -- b. No Use in Marketing. Developer must not use the Protected Data for the purposes of advertising any third party goods or services, and may not sell the Protected Data to any third party. -- c. Automated Decisions. In the event that the Developer makes automated decisions affecting GitHub customers’ rights, including employment, credit, or health, the Developer must provide notice to the individuals. +- (a) Permitted Use. Developer may process the Personal Data only for the purposes set out in Section 4(b)(i), and no other purpose. +- (b) No Use in Marketing. Developer must not use the Personal Data for the purposes of advertising any third party goods or services, and may not sell the Personal Data to any third party. +- (c) Automated Decisions. In the event that the Developer makes automated decisions affecting End User’s rights, including employment, legal, credit, or health, the Developer must provide notice to the End User. **A1-6. Compliance** -On request, Developer will make its Privacy Statement, Privacy Policy, Privacy Notice, or any similar documentation available. Developer will also provide notice of any relevant compliance reports, including Privacy Shield compliance. +Developer will make its Privacy Statement, Privacy Policy, Privacy Notice, or any similar documentation available to GitHub and End User. Developer will also provide notice of any relevant compliance reports. **A1-7. Termination** -- a. Suspension. In the event that Developer is in breach of its obligations to maintain an adequate level of privacy protection, GitHub may temporarily suspend the transfer of Protected Data or prohibit collection and processing of Protected Data on GitHub’s behalf until the breach is repaired or the Agreement is terminated. -- b. Termination With Cause. GitHub may terminate the Agreement without prejudice to any other claims at law or in equity in the event that: - - i. the Developer notifies GitHub that it can no longer meet its privacy obligations; - - ii. the transfer, collection, or processing of Protected Data has been temporarily suspended for longer than one month pursuant to 7(a); - - iii. the Developer is in substantial or persistent breach of any warranties or representations under this Data Protection Addendum; - - iv. the Developer is no longer carrying on business, is dissolved, enters receivership, or a winding up order is made on behalf of Developer. -- c. Breach. Failure to comply with the provisions of this Data Protection Addendum is considered a material breach under the Master Services Agreement. -- d. Notification. -In the event that Developer determines that it can no longer meet its privacy obligations under this Agreement, it must notify GitHub immediately. +- (a) Takedown. In the event that Developer is in breach of its obligations to maintain an adequate level of privacy protection, GitHub may take action in accordance with Section 4 (Takedowns) or Section 10 (Termination). +- (b) Termination. GitHub may terminate this Agreement without prejudice to any other claims at law or in equity in the event that: + - (i) the Developer notifies GitHub that it can no longer meet its privacy obligations, including loss of Developer Privacy Shield certification; + - (ii) the transfer, collection, or processing of Personal Data has been temporarily suspended for longer than one month pursuant to 7(a); + - (iii) the Developer is in substantial or persistent breach of any warranties or representations under this Data Protection Addendum; + - (iv) the Developer is no longer carrying on business, is dissolved, enters receivership, or a winding up order is made on behalf of Developer. +- (c) Notification. In the event that Developer determines that it can no longer meet its privacy obligations under this Agreement, it must notify GitHub immediately. In the event that Developer was certified under Privacy Shield and allows that certification to lapse or otherwise cannot remain certified under Privacy Shield, Developer must notify GitHub immediately. -- e. Modifications. GitHub may modify this Addendum from time to time as required by law, with thirty days’ notice to Developer. If Developer is unable to comply with the modifications to the Addendum, GitHub may terminate the Agreement. -- f. Upon Termination, Developer must: - - i. take reasonable and appropriate steps to stop processing of the Protected Data; - - ii. within thirty days of termination, delete any Protected Data Developer stores on GitHub’s behalf; and - - iii. provide GitHub with reasonable assurance that Developer has stopped processing the Protected Data and deleted the stored Protected Data. +- (d) Upon Termination, Developer must: + - (i) take reasonable and appropriate steps to stop processing of Personal Data; + - (ii) within thirty days of Termination, delete any Personal Data Developer stores on GitHub’s behalf; and + - (iii) provide GitHub with reasonable assurance that Developer has stopped processing the Personal Data and deleted stored Personal Data. **A1-8. Liability for Data Processing** -- a. Direct Liability. Developer will be liable to GitHub for actual damages caused by any breach of this Addendum subject to the terms in Section 8, Limitation on Liability of the Marketplace Developer Agreement. +- Direct Liability. Developer will be liable to GitHub for actual damages caused by any breach of this Addendum subject to the terms in Section 8, Limitation on Liability.