If you publish a website, you are the data controller for this website. Serving a website necessarily implies processing (but not collection) of personal data.

You have chosen to host your website on GitHub Pages. Is GitHub then a joint controller with you, or is GitHub your processor with which you sign a DPA?

I recently asked GH customer support about this. Their response:

Our Privacy Statement, combined with our Terms of Service, is intended to serve as a data protection agreement for individual accounts — we specifically wrote our Privacy Statement to provide the information required by Article 28 of the GDPR, including a list of our subprocessors. Our Privacy Statement and our Terms of Service serve as our agreements with you, as the controller, instructing us as the processor, and you can always contact us to provide additional instruction. Should we receive a data subject request that relates to data we process on your behalf, we'll always let you know promptly and work with you to comply.

— Github, 2019-04-10, private communication

The Privacy Policy describes GH Pages as follows:

If you create a GitHub Pages website, it is your responsibility to post a privacy statement that accurately describes how you collect, use, and share personal information and other visitor information, and how you comply with applicable data privacy laws, rules, and regulations. Please note that GitHub may collect Technical Information from visitors to your GitHub Pages website, including logs of visitor IP addresses, to maintain the security and integrity of the website and service.

Under this theory:

• you are the controller, and GH is your processor
• the terms of service incl. GH privacy policy form an effective Data Processing Agreement
• you have instructed GH to collect Technical Information in the sense of the privacy policy, for the purpose of maintaining security and integrity of the website, which can be covered by legitimate interest
• you have not instructed/allowed GH to process any other data from your site

It is your call whether you subscribe to that theory. Note that GH organizations can opt-in to their corporate terms and sign an explicit DPA which will mostly contain the same provisions.

Does it matter that you don't have access to the Technical Information? No. Being a controller means that you decide the purposes and means of processing, not that you store data. You as a controller can always decide to point your domain name to a different server if you no longer want to use GH as a processor.

If you publish a website, you are the data controller for this website. Serving a website necessarily implies processing (but not collection) of personal data.

You have chosen to host your website on GitHub Pages. Is GitHub then a joint controller with you, or is GitHub your processor with which you sign a DPA?

In 2019, I asked GH customer support about this. Their response:

Our Privacy Statement, combined with our Terms of Service, is intended to serve as a data protection agreement for individual accounts — we specifically wrote our Privacy Statement to provide the information required by Article 28 of the GDPR, including a list of our subprocessors. Our Privacy Statement and our Terms of Service serve as our agreements with you, as the controller, instructing us as the processor, and you can always contact us to provide additional instruction. Should we receive a data subject request that relates to data we process on your behalf, we'll always let you know promptly and work with you to comply.

— Github, 2019-04-10, private communication

At the time, their Privacy Policy described GH Pages as follows:

If you create a GitHub Pages website, it is your responsibility to post a privacy statement that accurately describes how you collect, use, and share personal information and other visitor information, and how you comply with applicable data privacy laws, rules, and regulations. Please note that GitHub may collect Technical Information from visitors to your GitHub Pages website, including logs of visitor IP addresses, to maintain the security and integrity of the website and service.

(Update 2022: the privacy notice has since changed, and the quoted part is no longer part of the privacy notice.)

Under this theory:

• you are the controller, and GH is your processor
• the terms of service incl. GH privacy policy form an effective Data Processing Agreement
• you have instructed GH to collect Technical Information in the sense of the privacy policy, for the purpose of maintaining security and integrity of the website, which can be covered by legitimate interest
• you have not instructed/allowed GH to process any other data from your site

It is your call whether you subscribe to that theory. Note that GH organizations can opt-in to their corporate terms and sign an explicit DPA which will mostly contain the same provisions.

Does it matter that you don't have access to the Technical Information? No. Being a controller means that you decide the purposes and means of processing, not that you store data. You as a controller can always decide to point your domain name to a different server if you no longer want to use GH as a processor.