Legitimate InterestAssessment
Under Article 6(1)(f) of the GDPR, processing is lawful where it is necessary for the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject. The three-step test is purpose, necessity and balancing. This page documents how we apply that test.
Our legitimate interest is to operate a discovery tool that helps developers showcase their own publicly published professional work, and to help employers discover such public portfolios. We invite developers to claim their auto-generated public portfolio built from their public work. This is a recognised commercial and societal interest: improving labour market matching while respecting authorship and attribution of public artifacts.
Third-party interests served: employers seeking technical talent, the open-source ecosystem (more visibility and attribution for contributors), and the data subjects themselves, who receive a self-service portfolio they can claim, edit, hide or permanently delete.
Indexing publicly available artifacts is necessary to build a meaningful, verifiable public portfolio. There is no less intrusive alternative that achieves the same purpose: a self-declared profile alone is not verifiable, and a fully consent-based pre-collection cannot be reconciled with the public nature of the artifacts and the cold-start problem of a new discovery tool.
We minimise data: we collect only what is necessary (public metadata, declared languages, repository names), we never collect special categories of data, and we never collect from private repositories or non-public sources.
Reasonable expectations: the data we process has been deliberately published by the data subject under a public account in a professional context (commits, packages, model cards). A person publishing professional artifacts under their own name in a public repository can reasonably expect that those artifacts will be read, indexed and discussed by third parties in the same professional context.
Nature of the data: low sensitivity. We do not process special categories of data, financial data, location data or content of private communications.
Potential impact: low. We do not make automated decisions with legal or similarly significant effects, we do not score the value of a person, and we do not publish anything that was not already public on the source platform.
Safeguards reducing impact further: one-click erasure with no authentication, hard time-to-live of thirty (30) days for unclaimed portfolios, single transactional notification (no marketing series), do-not-re-index registry, no resale of personal data, no transfer to third parties for advertising or profiling purposes.
Conclusion: the legitimate interest is not overridden by the interests, rights and freedoms of data subjects, provided that the safeguards documented on this page and in our DPIA are maintained.
The only communication we send on the basis of legitimate interest to a person who has not registered is a single transactional notification informing the author that an auto-generated public portfolio has been built from their public work, and offering them the equivalent options to view, claim, edit or permanently delete it. We do not send marketing, advertising or product-promotion messages on this basis.
Under Article 21 of the GDPR you have the right to object at any time to processing of your personal data which is based on legitimate interest. If you object, we will stop processing your data unless we demonstrate compelling legitimate grounds which override your interests, rights and freedoms. In practice, on this Site, any objection received via the public erasure endpoint or via a one-click invitation link results in immediate, irreversible deletion of your data and addition of an irreversible identifier hash to our do-not-re-index registry.