Well, they are seperate entities so the loophole exists for how the US handles it but in the EU there is no loophole.
>In any case, the real question is perhaps commercialness
Last I checked you don't need commercial elements like ads, donations or anything like that to be considered commercial. Running your own git server with open registrations would be considered commercial (there is additional seperation in that you don't have to pay taxes unless you are profit-interested).
>I strongly suspect the GDPR applies to some noncommercial activity too-
Monitoring of any kind that is strictly outside private interest.