I am asking this question based upon the specific case of open source software sites, but the concept should probably apply equally to other websites that serve as a "platform" for their users to publish and collaborate.
I have a number of open source software projects that I develop during my spare time on various large open source software (OSS) websites (think Github, SourceForge, ...).1
I sent some GDPR-related inquiries to them to find out about how I can make my project sites GDPR-ready. Something that appeared to be more or less a consensus was that for the representation of my projects that are displayed in the OSS websites' default layout, they are the "controller" and I am a "processor".
Now, if I am a processor, wouldn't those controllers have to make me sign a DPA? I am wondering especially for the case of forwarding notifications about activity related to my projects to my e-mail. Such notifications are likely to contain some kind of personal information (at least the name of a fellow user who did something related to my project).
Bonus question: Does that also mean I am not allowed to set up the e-mail forwarding to any of my existing (mostly Germany-based, if that makes any difference) e-mail accounts, but need to sign up a for a "business-level" (or whatever it's called) e-mail account somewhere so I can have a DPA with the e-mail provider?2
1: These websites are based in the U.S. This is not generally my preference, but there simply seems to be no comparable website for such services anywhere else.
2: It's indeed still unclear whether an e-mail provider counts as a processor for which a DPA is needed. If it turns out it does not, the second part of the question is a non-issue.
