Privacy Policy
Effective Date: November 21, 2019The OpenJS Foundation’s core purpose is to foster an ecosystem that supports the collaborative andpublic development of free and open source software projects (each, a “Project”). This privacy policy(“Privacy Policy”) describes our policies and procedures about the collection, use, disclosure and sharing,or other processing of your personal information when you use OpenJS Foundation websites (e.g.,
openjsf.org) ), or participate in or use our Project sites (collectively, the “Sites”), as well as when you
interact with or participate in our events, programs, trainings and our other services and offerings(collectively, the “Services”).
For purposes of the GDPR, the OpenJS Foundation (sometimes referred to by “we” or “our” below) is thecontroller of your personal information. Where processing of personal information is undertaken on ourbehalf by The Linux Foundation, they are a joint controller with the OpenJS Foundation for your personal
information
Capitalized terms that are not defined in this Privacy Policy have the meaning given them in our Terms ofUse (as applicable, the “Terms”), available at https://terms-of-use.openjsf.org. In this Privacy Policy,“personal information” includes references to “personal data” as defined under applicable laws. Your useof our Sites and Services, and any dispute over privacy, is subject to this Policy and the relevant Terms,
including the applicable limitations on damages and the resolution of disputes. The Terms areincorporated by reference into this Policy.
The most recent version of this document can be found at https://privacy-policy.openjsf.org.

Personal Information That OpenJS Foundation Collects
We collect personal information directly from individuals, from third parties, and automatically throughthe Sites and Services. You do not have to provide us your personal information. However, if you choose
not to disclose certain information, we will not be able to provide you with access to certain services orfeatures, including account registration, event registration, training and certification programs, orparticipation in certain aspects of our open source projects.

Registration Information.
We collect personal information when you register for an account, a conference or other events orprograms:

System ID, Account and Profile Information.
Users may sign up for, request, or order our Services and may register to receive materials on our Sites.
Users may also be asked to create a “Linux Foundation ID”, which is a single sign-on account which isused for common access to many of our Services. Personal information collected on the Sites includes
community forum content, profiles, photographs, names, unique identifiers (e.g., social media handles orusernames), contact and billing information (e.g., email address, postal address, telephone, fax), andtransaction information. In order to access certain personalized services on the Sites, you may be asked toalso create and store a username and password for an account from The Linux Foundation. Also, in orderto tailor subsequent communications to users and continuously improve the Sites’ operations and services,
OpenJS Foundationmay also ask users to provide additional optional information regarding their interests,
demographics, experience and detailed contact preferences.

Events Registration.
When you register for one of our events (e.g., conferences and summits) to participate as an attendee, a
speaker or a sponsor, we collect personal information that includes name, company, contact information,and other information. We may also collect other optional personal information such as likes, interests,
dietary restriction, size preferences for conference attire gifts and other background information. In
addition, if you provide it, we may collect (1) personal information about disabilities, medical conditions
and allergies in order to provide appropriate accommodations for attendees, and (2) personal information
about your citizenship, date of birth, and passport details if you request assistance from us with obtaining
a visa letter to travel to one of our events.

Training and Certification Exam Registration.
When you participate in one of our training or certification programs, we collect registration-related
personal information that includes name, company, certifications, contact information, and otherinformation depending on the circumstances.

Registration for Project Resources and OpenJS Foundation Resources.
You can register to receive access to various resources provided by OpenJS Foundation and its Projects
regarding the open source ecosystem, open source project development, collaboration and best practices.
This includes providing us with personal information such as your email address and name to receive
newsletters, mailing list postings and social media postings, to view webinars, and to access otherresources made available by OpenJS Foundation and its Projects.

Your Contributions to Open Source Projects.
Attribution, Provenance and Integrity. When you contribute source code, documentation or other content
to one of our Projects (whether on your own behalf or through contributions made as part of youremployment services to your employer), we collect and store the information and content that you
contribute. This includes the contents of those contributions, as well as information required to confirm
the provenance of intellectual property contained in those contributions, and personal information thatyou make publicly available in the record of the contribution pursuant to sign-offs under the Developer
Certificate of Origin (https://developercertificate.org/). Some Projects require additional agreements orinformation pursuant to their intellectual property policies; in such cases we collect and store information2

related to your acceptance of those agreements. We may also collect information relating to yourparticipation in technical, governance or other Project-related meetings.
Other Project-related Content. The content you provide in relation to Projects also includes materials thatyou make publicly available in connection with Project development, collaboration and communication,such as on mailing lists, blogs, Project wiki pages and issue trackers, and related services.
Applicants for OpenJS Foundation Internships or Employment. We collect and store personal information
relating to individuals who apply to participate in one or more of our Project-related internships. The
personal information collected and stored for Project-related internships, may include your name, address,
or other contact information. In addition, if you choose to provide it, we may collect personal information
regarding your membership in a diverse or underrepresented group.
Your Content. We collect and store the information and content that you post to the Sites, including yourquestions, answers, comments, forum postings, and responses to surveys. Please see the section on
Publicly Available Information for how the information you post will be viewed on our Sites.
Communications. When you communicate with us (via email, phone, through the Sites or otherwise), we
may maintain a record of your communication.
Payment Information. To purchase Services (including registering for events, training and certification
exams), users may be asked to be directed to a third-party site, such as Stripe, to pay for their purchases.
If applicable, the third-party site may collect payment information directly to facilitate a transaction.
OpenJS Foundation generally only records the result of the transaction and any references to thetransaction record provided by the third-party site.
Automatically Collected Information. In addition, OpenJS Foundation may automatically collect thefollowing information about users’ use of the Sites or Services through cookies, web beacons, and othertechnologies: your domain name; your browser type and operating system; web pages you view; links you
click; your IP address; the length of time you visit our Sites and or use our Services; and the referring
URL, or the webpage that led you to our Sites. We may combine this information with other informationthat we have collected about you, including, where applicable, your user name, name, and other personal
information. Please see our Cookie Policy for more information about our use of cookies.
De-identified Information. We may de-identify and aggregate certain personal information we collectsuch that the information no longer identifies or can be linked to a particular user or an individual data
subject (“De-identified Information”), subject to the terms of any applicable user agreements. We may use
this information to improve our Services, analyze trends, publish market research, and for othermarketing, research or statistical purposes, and may disclose such information to third parties for these
specific purposes.

3Purposes and Legal Bases for Our Using of Your Personal
Information
Purposes and Legitimate Interests
OpenJS Foundation and the Linux Foundation use the personal information we collect for our legitimate
business interests, which include the following purposes:● Providing our Sites and Services. To provide the Services and our Sites (including Project Sites),
to communicate with you about your use of our Sites and Services, to respond to your inquiries,
provide troubleshooting of the Sites and for other purposes to support users and the community.

● Operating our Open Source Projects. To enable communication between and among open source
developers in the community; to facilitate and document Project governance and technicaldecision-making; to maintain, and make publicly available on a perpetual basis, records regarding
intellectual property provenance and license compliance for Project contributions; and for related
activities to further our core purpose of fostering an ecosystem that supports the collaborative andpublic development of free and open source software projects. See the “Attribution, Provenanceand Integrity” section above for more information.

● Maintain our Training and Certification Programs. To maintain records about who has attended orregistered to attend training programs, take certification exams and received certain certifications.

● Event Administration. To plan, organize, and facilitate access to events and related services andactivities, and to carry out informative and safe events for participants, including attendees,
speakers and sponsors. If you provide us information about disabilities, medical conditions andallergies, we will use this information in order to provide appropriate accommodations forattendees and to ensure their health and safety; we will not use this information for otherpurposes, unless required by law or as necessary to defend our legal rights. If you request
assistance from us for obtaining a visa letter to travel to one of our events and provide us withinformation required for such assistance (such as your citizenship, date of birth, and passportdetails), we will use this information in order to assist with providing you a visa letter; we will not
use this information for other purposes, unless required by law or as necessary to defend our legal
rights.

● Internship Applications. To select participants for our Project-related internship programs,
including the evaluation and selection of interns and employees from among applicants. If you
choose to provide information regarding your membership in a diverse or underrepresented
group, we will use this information in connection with internship diversity programs we may
operate; we will not use this information for other purposes, unless required by law or asnecessary to defend our legal rights.

4

● Personalization. To tailor the content and information that we may send or display to you on ourSites and in our Services, to offer location customization and personalized help and instructions
and to otherwise personalize your experiences.

● Marketing and Promotions. For marketing and promotional purposes, such as to send you news
and newsletters, special offers, and promotions, or to otherwise contact you about Projects,
Services, events, trainings or other information we think may interest you related to OpenJS
Foundation, and, subject to applicable law, our service providers.

● Advertising. For targeting advertising to you on our Sites and third-party sites and measuring theeffectiveness and reach of ads and services (through third-party ad networks and services).

● Analytics. To gather metrics to better understand how users access and use our Sites and Services
and participate in our Projects; to evaluate and improve the Sites, including personalization, todevelop new services; and to understand metrics regarding the community health of our Projects.
If a user voluntary provides and explicitly consents to our processing of personal information
regarding their demographics and socioeconomics, we process such personal information for the
specific purposes for which you have consented, which may include for the purpose of compiling,
analyzing and disclosing aggregate statistics regarding diversity of participation in open source
projects and communities, to help track progress towards meeting OpenJS Foundation’scommitment to diversity initiatives and subject to your consent.

● Compliance. To comply with legal obligations and requests. For example, to comply with lawsthat compel us to disclose information to public authorities, courts, law enforcement or regulators,
maintain records for a certain period, or maintain records demonstrating enforcement andsublicensing of our trademarks and those of our Projects.

● Business and Legal Operations. As part of our general business and legal operations (e.g.,
accounting, record keeping, and for other business administration purposes), and as necessary toestablish, exercise and defend (actual and potential) legal claims.

● Prevent Misuse. Where we believe necessary to investigate, prevent or take action regarding
illegal activities, suspected fraud, situations involving potential threats to the safety of any person
or violations of the relevant Terms or this Privacy Policy.

Purposes and Legal Bases
Purposes of Processing(see above)

Legal Bases of Processing (EU Users)

5

●
●

Providing our Sites andServices●●●●

Operating our Open
Source Projects
●
●

●
●

Internship and
Employment Applications

●
●

●
●

Event Administration

Offer Training andCertification Programs

●
●

●
●

Our Legitimate Business Interests
Where Necessary to Enter into or Perform a Contract with You(upon your request, or as necessary to make the Services
available)
Compliance with Law
Where permitted, with Your Consent (where we process any
sensitive personal information you voluntarily provide – e.g.,
for diversity-related purposes)

Our Legitimate Business Interests
Where Necessary to Enter into or Perform a Contract with You(upon your request, or as necessary to enable your participationin the Projects or to make the Services available)
Compliance with Law
As Necessary to Establish, Exercise and Defend Legal Claims

Our Legitimate Business Interests
Where Necessary to Enter into or Perform a Contract with You(upon your request, or as necessary relating to Your application
for an internship)Compliance with Law
Where permitted, with Your Consent (where we process any
sensitive personal information you voluntarily provide – e.g.,
for diversity-related purposes)
Our Legitimate Business Interests
Where Necessary to Enter into or Perform a Contract with You(upon your request, or as necessary to make the Services
available)
Compliance with Law
With Your Consent (in particular regarding your sensitive
personal information – e.g., disability and medical conditions
and information related to a visa letter request)

Our Legitimate Business Interests
Where Necessary to Enter into or Perform a Contract with You(upon your request, or as necessary to make the Services
available)

6Personalization●

Our Legitimate Business Interests●●

Our Legitimate Business Interests, and those of the LinuxFoundation
With Your Consent●●

Our Legitimate Business Interests
With Your Consent●●

Our Legitimate Business Interests
Where permitted, with Your Consent (where we process any
sensitive personal information you voluntarily provide – e.g.,
for diversity-related purposes)

Compliance●●●

Our Legitimate Business Interests
Compliance with Law
As Necessary to Establish, Exercise and Defend Legal Claims

Business and Legal
Operations●●●

Our Legitimate Business Interests
Compliance with Law
As Necessary to Establish, Exercise and Defend Legal Claims

Prevent Misuse●●●

Our Legitimate Business Interests
Compliance with Law
As Necessary to Establish, Exercise and Defend Legal ClaimsMarketing andPromotions

Advertising

Analytics

Sharing of Personal Information
We disclose personal information as set forth below, and where individuals have otherwise consented:● Publicly Available Information, including Your Contributions to Open Source Projects. User
names, other user ids, email addresses and other attribution information related to the information

7

and contributions that a User posts in conjunction with or subject to an Open Source license are
publicly available in the relevant Project source code repositories. Your contributions to Open
Source Projects, and certain of your other Content such as comments and messages posted to
public forums, are available to other participants and users of our Projects and of our Services,and may be viewed publicly. In some cases you may be able to provide Project orcontribution-related information directly to third-party sites and services; these third parties are
independent data controllers and their use of your personal information is subject to their own
policies.

● Service Providers. We may share your information with third party service providers who use thisinformation to perform services for us, such as payment processors, hosting providers, auditors,
advisors, contractors and consultants. In addition, The Linux Foundation performs services for
OPenJS Foundation as a managed services provider with regards to our Projects. In such cases,
we may share with The Linux Foundation the same types of data as described above, doing so in
the furtherance of performing Services for those Projects. The Linux Foundation’s privacy policy
is available at https://www.linuxfoundation.org/privacy/.

● Organizational Events. We may disclose or transfer information, including personal information,as part of any merger, sale, and transfer of our assets, or restructuring of all or part of our business
operations, bankruptcy, or similar event, including in negotiations, due diligence, and integrations
related to such transactions.

● Event Participants. If you register for an event, we may ask for your consent to share yourpersonal information with third party sponsors and other participants; for example, to facilitate
your ability to swipe your badge to easily sign up for or participate in activities, events and gifts
offered by third parties participating in the event, or to give you the option to be listed on theattendee list that is available to other attendee, sponsors and participants. We will not share yourevent information with third parties without your consent, and in particular you have the choice
whether or not to permit your badge to be swiped by any third party participating in the event.

● Training and Program Sponsors. If you participate in one of our certification or training programs
that a third party has sponsored or engaged us to provide to you and others (e.g., your employers),
we may receive attendee list information from them and may share information about yourcompletion of the program, including confirmation of your participation and your certification
exam results, as applicable; these third parties are independent data controllers and their use ofyour personal information is subject to their own policies. You may also elect to provide third
parties (e.g., your employers or your prospective employers) with information that will enable
them to look up your certification exam status; if you do so, we may share your certification exam
status with such third parties.

● Legally Required. We may disclose your information if we are required to do so by law(including to law enforcement in the U.S. and other jurisdictions).

8

● Protection of Rights. We may disclose information where we believe it necessary to respond toclaims asserted against us or, comply with legal process (e.g., subpoenas or warrants), enforce oradminister our agreements and terms, for fraud prevention, risk assessment, investigation, andprotect the rights, property or safety of OpenJS Foundation, its Users, participants in its events or
Projects, or others.

● Anonymized and Aggregated Information. We may share aggregate or De-identified information
with third parties for research, marketing, analytics and other purposes, provided suchinformation does not identify a particular individual.

Cookies, Tracking, and Interest-Based Ads
We and our third-party providers use cookies, clear GIFs/pixel tags, JavaScript, local storage, log files,
and other mechanisms to automatically collect and record information about your usage and browsing
activities on our Site and across third party sites or online services. We may combine this information
with other information we collect about users. Below, we provide a brief summary of these activities. For
more detailed information about these mechanisms and how we collect activity information, see our
Cookie Policy.

● Cookies. These are small files with a unique identifier that are transferred to your browser
through our websites. They allow us to remember users who are logged in, to understand how
users navigate through and use the Sites, and to display personalized content and targeted ads(including on third party sites and applications).

● Pixels, web beacons, clear GIFs. These are tiny graphics with a unique identifier, similar infunction to cookies, which we track browsing activities. We use these as part of our Training
Affiliate Program. We also use these in our emails to let us know when they have been opened or
forwarded, so we can gauge the effectiveness of our communications.

● Analytics Tools. We may use internal and third-party analytics tools, including Google Analytics.
The third-party analytics companies we work with may combine the information collected withother information they have independently collected from other websites and/or other online
products and services. Their collection and use of information is subject to their own privacy
policies.
Please note that OpenJS Foundation does not respond to browser “do not track” signals or other similar
mechanisms intended.
Targeted Ads. As discussed in our Cookie Policy, we may work with third party advertisers to display
more relevant ads on our website and on third party sites; these third parties may display ads to you basedon your visit to our Sites and other third party sites. For more information about this and how you can opt
out of such ads, please see our Cookie Policy.

9

Data Security
We have implemented commercially reasonable precautions designed to protect the information wecollect from loss, misuse, and unauthorized access, disclosure, alteration, and destruction. Please be awarethat despite our best efforts, no data security measures can guarantee 100% security.
You should take steps to protect against unauthorized access to your passwords, phone, and computer by,among other things, signing off after using a shared computer, choosing robust passwords that nobody
else knows or can easily guess, not using a password for more than one site or service, and keeping yourlog-ins and passwords private. We are not responsible for any lost, stolen, or compromised passwords orfor any activity on your account via unauthorized password activity. We ask you to promptly notify us if
you become aware that any information provided by or submitted to our Sites or through our Services islost, stolen, or used without permission at privacy@openjsf.org.

Marketing Choices
You may opt out of or withdraw your consent to receive direct marketing emails from us by using theunsubscribe or opt out mechanisms included in our marketing emails or by emailingprivacy@openjsf.org. You may also unsubscribe from mailing lists via the applicable mailing list’s
subscription website or, in some cases, by using the unsubscribe mechanisms included in such emails.

Retention of Your Personal Information
We generally keep personal information only for as long as required to fulfill the purposes for which it
was collected. However, in some circumstances, we may retain personal information for other periods oftime, for instance where we are required to do so in accordance with legal, tax and accounting
requirements, or if required to do so by a legal process, legal authority, or other governmental entity
having authority to make the request, for so long as required. In specific circumstances, we may also
retain your personal information for longer periods of time corresponding to a statute of limitation, so that
we have an accurate record of your dealings with us in the event of any complaints or challenges.

International Transfers
If you are located within the European Economic Area, the United Kingdom or Switzerland, you shouldnote that your personal information will be transferred to countries outside these jurisdictions, including
the United States where OpenJS Foundation is located. The U.S. is deemed by the European Union toprovide inadequate data protection. However, we have put in place European Commission approved
Standard Contractual Clauses to provide for adequate safeguards to protect personal informationtransferred outside these jurisdictions, including between OpenJS Foundation and service providers. In
addition, if personal information is transferred to third party service providers located outside thesejurisdictions, we will take steps to ensure that your personal information receives the same level ofprotection as if it remained within these jurisdictions, including by entering into data transfer agreements,

10

using the European Commission approved Standard Contractual Clauses or other safeguards as approvedby the European Commission. You have a right to obtain details of the mechanism under which yourpersonal information is transferred outside of the EU by emailing gdpr@openjsf.org.

Children’s Privacy
Except as specifically indicated within a Site, we do not knowingly collect or solicit personal informationfrom anyone under the age of sixteen (16), or knowingly allow such persons to register. If we becomeaware that we have collected personal information from a child under the relevant age without parental
consent, we take steps to delete that information. Where we specifically indicate that we collect personal
information from children under 16, we will obtain the parent or guardian’s consent and provide adequate
notice.

Links to Third Party Sites and Services
The Sites may contain links to third party sites or online services. Please refer to the privacy policies of
the relevant third party websites or services to find out more about how they process and handle personal
information.

Your Rights
Access and Amendment. You may contact our privacy coordinator, as set forth below, to access or amend
your personal information.
Additional Rights. Individuals in the European Economic Area (and other jurisdictions where applicable)
have additional rights under applicable law:

● to obtain a copy of your personal information together with information about how and on what
legal basis that personal information is processed;● to rectify inaccurate personal information (including to have incomplete personal information
completed);● to erase your personal information (in limited circumstances, such as where it is no longer
necessary in relation to the purposes for which it was collected or processed);● to restrict processing of your personal information under certain circumstances;● to export certain personal information in machine-readable format to a third party (or to you)when we justify our processing on the basis of your consent or the performance of a contract withyou and the processing is carried out by automated means;11

● to withdraw your consent to our processing of your personal information (where that processing
is based on your consent, without affecting the lawfulness of processing based on consent before
its withdrawal);● to obtain, or see a copy of the appropriate safeguards under which your personal information istransferred to a third country or international organization; and● to object to our use and processing of your personal information that is conducted on the basis of
our legitimate interest. You also have the right to object at any time to any processing of yourpersonal information for direct marketing purposes, including profiling for marketing purposes.
Lodging a Complaint. You also have the right to lodge a complaint with your local supervisory authority
for data protection, or privacy regulator. A list of data protection supervisory authorities is available here.
Submitting a Request. To exercise the above rights or contact us with questions or complaints regarding
our treatment of your personal information, contact us at gdpr@openjsf.org. Please note that we may
request proof of identity, and we reserve the right to charge a fee where permitted by law, especially ifyour request is manifestly unfounded or excessive. We will respond to your request within the applicable
timeframes set out by law.

California Privacy Rights
California law permits users who are California residents to request and obtain from us once a year, freeof charge, a list of the third parties to whom we have disclosed their personal information (if any) for theirdirect marketing purposes in the prior calendar year, as well as the types of personal information disclosed
to those parties. If you are a California resident and would like to request this information, please submit
your request in an email to privacy@openjsf.org. We may ask you to verify your California residency.

Contact Us
If you have any questions about our practices or this Privacy Policy, please contact us at
privacy@openjsf.org, or write to us at: OpenJS Foundation, Attn: Legal Department, 1 Letterman Drive,
Building D, Suite D4700, San Francisco, CA 94129.

Changes to the Privacy Policy
This Policy is current as of the effective date set forth above. If we change our privacy policies andprocedures, we will post those changes on this page and/or continue to provide access to a copy of theprior version. If we make any changes to this Privacy Policy that materially change how we treat yourpersonal information, we will endeavor to provide you with reasonable notice of such changes, such as
via prominent notice on our Sites or to your email address of record, and where required by law, we willobtain your consent or give you the opportunity to opt out of such changes.

12