Privacy Policy

Effective date: October 15,  2026

Last updated: October 15,  2026

Support Shepherd, LLC dba Somewhere ("Somewhere," "we," "us," or "our") explains in this policy how we collect, use, disclose, retain, and protect personal information, and how you can exercise your privacy rights.

Contents

1. Who we are and when this policy applies
2. Personal information and its sources
3. Why we use personal information
4. Lawful bases under European data protection laws
5. Who receives personal information
6. Website cookies, advertising, and marketing choices
7. Retention, security, and international transfers
8. Somewhere Time Tracker — contractors and enrolled application users
9. Privacy requests and general choices
10. EU/EEA, United Kingdom, and Switzerland
11. United States privacy rights and California disclosures
12. Other regional rights
13. Children and young people
14. Updates and contact details

1. Who we are and when this policy applies

This policy applies to Somewhere.com and other Somewhere websites, forms, applications, and services that link to it; our recruitment and client relationships; and related enquiries, support, events, and marketing. It covers visitors, prospective and existing clients, business contacts, applicants, candidates, and contractors to the extent we process their information in those activities.

This policy applies to our relevant activities worldwide. Section 10 explains supplementary protections for the European Union and the rest of the European Economic Area (EEA), the United Kingdom (UK), and Switzerland where those laws apply. Section 11 explains US rights where the relevant law applies. People in Canada, Latin America, Africa, South and Southeast Asia, and other regions may also have mandatory rights under the laws applicable to them.

Section 8 applies only to contractors or other designated work users enrolled in Somewhere Time Tracker, users of its browser extension, and authorized users of its web application. Ordinary website visitors and applicants are not subject to Time Tracker browser monitoring merely because they visit Somewhere.com, apply for a role, or receive recruitment communications.

Somewhere is the controller when it determines why and how information is used for its own website, recruitment, service administration, and legal obligations. A client or prospective employer also has responsibilities for processing it controls. If we process information solely on a client's documented instructions, that client is the controller and we act as its processor. Section 8.7 explains the roles relevant to Time Tracker.

Additional service, employment, or regional notices may provide more detail. A specific notice governs the activity it expressly addresses, subject to applicable law; it does not authorize unrelated uses of Time Tracker information. Third-party sites, employers, and independently operated services have their own notices.

Providing this notice, using our services, or acknowledging it does not itself provide blanket consent to every use of information or waive any mandatory privacy right.

2. Personal information and its sources

The information collected depends on your relationship with us and the features you use. We collect the following categories for the purposes described in Section 3.

Information from a client, administrator, sign-in provider, or recruitment contact is information from a third party. Where applicable law requires a notice for indirectly collected data, we provide the required information within the applicable deadline, including the source and relevant categories.

Sensitive information. We do not ask you to include sensitive information in ordinary enquiries or Time Tracker task descriptions. Authentication information and information revealing health, beliefs, union membership, or other protected characteristics can have additional legal protections. A recorded website domain may reveal sensitive facts even without the full URL or page content. We use such information only for an identified lawful purpose and with the additional consent or legal condition required by the applicable law.

2.1 Optional social and third-party sign-in

Where a service offers third-party sign-in and you choose it, we receive the profile information made available under that service's permissions and your choices. This may include your name, email address, profile picture, and other profile information authorized for that service. Time Tracker's Google and Microsoft sign-in fields are limited to those described in Section 8.4.

We use received sign-in information only for the purposes disclosed here or clearly explained in the relevant service. You can manage the provider's access permissions and privacy preferences through its account settings. The provider's own processing is governed by its privacy notice. Time Tracker's sign-in fields and limits are stated in Section 8.4.

Information received from Google APIs is handled in accordance with the Google API Services User Data Policy, including its Limited Use requirements: https://developers.google.com/terms/api-services-user-data-policy. This commitment is separate from the Chrome extension policy described in Section 8.10.

3. Why we use personal information

We use relevant information to:

• Create and authenticate accounts, deliver requested services, and administer client and user relationships.
• Consider applications, communicate about roles, arrange placements, and administer contractor engagements where relevant to our services.
• Handle enquiries, support requests, orders, payments, returns, and service communications, including necessary account administration and notices about changes to services, terms, or policies.
• Enable user-to-user communications where you choose a feature that provides them, and process the content you submit for that feature.
• Operate and secure our websites and services, diagnose problems, prevent fraud, and investigate misuse.
• Understand website use and improve the general website and services, subject to the controls in Section 6.
• Send permitted marketing and event communications and measure their effectiveness, in accordance with your choices and applicable law.
• Meet specific legal obligations, maintain necessary records, and establish, exercise, or defend legal claims.
• Protect a person's life or physical safety in an emergency where the relevant legal conditions apply.

Time Tracker information is subject to the narrower purposes in Section 8. We do not use extension activity data for general marketing, advertising, unrelated analytics, or unrelated product development. Any change to a processing purpose requires the notice, assessment, and consent or other authorization required by law; posting a revised policy alone does not authorize an incompatible use.

We tell you when particular information is necessary for a contract, a requested service, or a legal requirement. If required information is not provided, we may be unable to deliver that specific service. Optional marketing choices do not determine access to a service that does not require them.

4. Lawful bases under European data protection laws

Where the EU GDPR or UK GDPR applies, we identify a lawful basis for each processing purpose. Contract necessity means necessity for a contract with the individual or steps requested by that individual; a contract with a client does not automatically supply that basis for a contractor's information. Legitimate interests require a necessity and balancing assessment, including reasonable expectations and the effect on your rights.

The purpose-specific basis for detailed Time Tracker monitoring is addressed in Section 8.7. A notice acknowledgment or browser installation does not automatically establish freely given GDPR consent. Where consent is used, it must be specific, informed, and freely given, and you can withdraw it without affecting the lawfulness of processing before withdrawal. We do not switch bases merely to bypass a withdrawal or objection.

Sensitive or special-category information requires any additional condition applicable to it, beyond an ordinary lawful basis. 

5. Who receives personal information

We disclose only the information relevant to the purpose and recipient, subject to applicable law and appropriate contractual protections.

We use an applicant-tracking and recruitment-management service provider to store and manage candidate applications, CVs, and links to interview recordings. Candidate interview videos are stored with a video-hosting service provider and shared with relevant clients for recruitment decisions. We send interview-recording links to relevant clients. Anyone who obtains a link can view the recording, including if the link is forwarded; viewing is not restricted to individually authorized client accounts. A separate onboarding and workforce-administration service provider handles onboarding documentation, including identity documents, and payroll administration. A customer-relationship management service provider supports client relationship management and ongoing client projects. These providers process the information relevant to their respective services. Payroll processing is separate from Time Tracker's extension tracking.

Some providers act on our instructions under data-processing agreements. A payment provider, sign-in provider, client, or other recipient may be an independent controller for activities it determines itself. We identify the applicable role and obligations in the relevant agreements and notices.

6. Website cookies, advertising, and marketing choices

The general website uses necessary cookies and similar technologies for operation, security, and preferences. We also use Google Analytics for website analytics. When active, Google Analytics derives approximate geographic information from IP addresses, including country or region and, where enabled, city. Its settings can also enable Demographics and Interests Reporting; the information collected depends on the enabled features and applicable choices. These website analytics services are not used by Time Tracker. Detailed cookie information and available controls are provided at https://somewhere.com/legal/cookie-policy and through the website's Consent Preferences control.

Where law requires consent, optional technologies are not activated until you make the relevant affirmative choice. You may reject or change optional categories and withdraw consent through the preference controls. Deleting or blocking necessary cookies may prevent some requested features from working.

Disclosures to advertising providers may amount to a sale, sharing for cross-context behavioral advertising, or targeted advertising under US law even when no money is paid for the information. Section 11 addresses those choices. We honor Global Privacy Control (GPC) and other legally recognized opt-out preference signals as required by applicable law. The older Do Not Track (DNT) setting is not the same as GPC; the general website does not currently respond to DNT signals.

You can stop marketing emails using their unsubscribe link and marketing texts by replying STOP or UNSUBSCRIBE, where supported, or by contacting privacy@somewhere.com. We may still send necessary account, security, support, and engagement messages. We do not provide mobile contact information or text-message opt-in records to third parties or affiliates for their own marketing; providers may process necessary information to deliver and support our communications.

Time Tracker has a different technology boundary: the app uses a necessary sign-in cookie and the extension uses local storage as described in Section 8. It does not use analytics or advertising trackers or third-party tracking cookies.

7. Retention, security, and international transfers

7.1 Retention

For the general website and services, retention is determined by the purpose, whether an account or relationship remains active, relevant statutory recordkeeping periods, the need to resolve a specific dispute, and applicable limitation periods. We delete or anonymize information when the identified need ends, subject to lawful exceptions. Marketing suppression records may remain to honor your opt-out. Restricted backups follow the relevant deletion cycle and are not used as ordinary active records.

7.2 Security

We use technical and organizational measures appropriate to the information and risks, including access controls and protections for service communications. Time Tracker transmits information over HTTPS and limits signed-in access by role. No system eliminates all risk. If a personal-data breach occurs, we assess it, take appropriate steps, and notify affected people and regulators where and within the timescales required by applicable law. This does not limit any legal duty or remedy.

7.3 International transfers

Somewhere is based in the United States, and Time Tracker records are stored there. Authorized development contractors may access the profile-management console from locations worldwide. Authorized clients may access their assigned dashboards, including timesheets and enabled activity reports, from locations worldwide and while travelling. Such access requires authenticated accounts and remains limited by role and the engagement boundaries in Section 8.6. US storage does not mean access is confined to the United States. Our facilities, providers, and access by separate organizations may involve processing in other countries with different levels of data protection. Time Tracker providers identified in Section 8.6 include Vercel, PlanetScale, and Resend, whose services involve US processing.

When a transfer requires a legal safeguard, we use the mechanism applicable to that transfer, such as a valid adequacy decision or appropriately executed contractual safeguards. For EEA transfers, this can involve applicable European Commission Standard Contractual Clauses and necessary supplementary protections. For UK transfers, this can involve the UK International Data Transfer Agreement or the UK Addendum to the EU clauses, together with the required assessment. Swiss transfers require the applicable Swiss safeguards and adaptations where relevant.

You can request information about the safeguards and a copy of applicable protections from privacy@somewhere.com; lawful redactions may protect confidential information without preventing you from understanding the safeguards. Merely accepting this policy does not authorize routine restricted transfers.

8. Somewhere Time Tracker — contractors and enrolled application users

8.1 Who this section applies to

Somewhere Time Tracker ("Time Tracker" or "STT") includes a browser extension distributed through the Chrome Web Store and a web application used to record, monitor, and review work hours and related activity for relevant client engagements. The extension is deployed for work use in the company-issued Island browser and requires sign-in using a company-issued account. A user with access to the store listing can also install it in ordinary Chrome, including a personal profile. If the user signs in and activates the extension there, it can record activity in that profile. Recording is therefore not technically restricted to Island.

This section applies to contractors and other designated users whose Time Tracker accounts are enrolled or provisioned, individuals using the browser extension, and authorized Somewhere or client personnel accessing the web application. Time Tracker is mandatory for the contractor roles covered by this section.

An enrolled contractor may have account information, time entries, reminders, or missing-hours records maintained within Time Tracker even if the browser extension has not been installed. Browser activity collection only begins once the extension has been installed, the user has signed in, and the applicable collection notice has been acknowledged.

This section does not apply to ordinary website visitors, unrelated clients, or applicants who are not enrolled in Time Tracker. Visiting Somewhere.com, applying for a position, or receiving recruitment communications does not authorize or result in browser activity monitoring through Time Tracker.

8.2 When the extension records

The Time Tracker browser extension does not begin recording browser activity merely because it is installed. Collection begins after the user signs in using a company-issued account and acknowledges the applicable privacy and collection notice.

Once activated, the extension operates continuously while the browser profile running it remains open and the user is signed in. Contractors may work their agreed hours at different times during the day, so recording is not limited to a fixed daily schedule, an active work timer, or the hours specified under the applicable client engagement. Browser activity may therefore be recorded outside normal working hours, including evenings, weekends, and personal browsing within that profile. This also applies if the extension is activated in a personal Chrome profile.

Users may stop new browser activity collection by signing out of the extension, closing the browser profile running it, or uninstalling the extension. Stopping collection does not automatically delete information previously recorded or transmitted to Time Tracker. These technical controls do not change the mandatory use requirement described in Section 8.1; concerns about that requirement can be raised with your Somewhere representative.

Uninstalling the extension removes its locally stored information from the browser, including any unsent records maintained by the extension.

8.3 What the extension records

• The domain of the website in the foreground tab, such as docs.google.com. A new tab, browser settings page, local file, or other non-website tab is recorded as a blank page.
• Whether the browser running the extension is the foreground application, so time in another application is distinguished from time on a website.
• An active/inactive signal based on whether mouse or keyboard input occurred on the computer within the previous three minutes. A locked screen is treated as inactive; the actual input is not recorded.
• Whether the foreground tab is playing sound, without recording the sound.
• The number of open tabs; timestamps; and time zone.
• A randomly assigned extension-installation identifier and the extension version.

Signals are recorded approximately once per minute and when relevant changes occur, such as a tab switch. When offline, pending records are stored locally and transmitted to Time Tracker when connectivity is restored.

‍

To derive the domain, the extension reads the foreground tab's address on the device and retains only its domain. The full address is not saved or transmitted. The extension does not record page titles, page content, the actual keys pressed, screenshots, audio, or video. It does not run in Incognito windows or record new activity after sign-out or while the browser profile running it is closed.

Browser activity can include information about sites outside Somewhere.com. The extension does not filter out domains relating to health, religion, political views, union membership, or other sensitive topics; these domains may be recorded within the browser profile running the extension, subject to the collection limits above. The limitation to domains reduces the detail recorded but does not make the activity anonymous or eliminate sensitive-data risk.

8.4 What the application and sign-in process store

• Account and engagement settings: name, email, client assignment, hour limit, and reporting/reminder time zone set by Somewhere.
• Time entries: hours, tasks, descriptions, and timestamps for adding, changing, or deleting entries. A deleted entry can remain in the retained audit history, subject to the engagement-level deletion rule in Section 8.8.
• Identity information from a chosen Google or Microsoft sign-in: name and email, plus a Google profile-picture link where provided; or the email used for a one-time code.
• Session and security records: IP address, browser type, necessary sign-in cookie, and authentication sessions.
• Notice records: the confirmation timestamp, notice version, and browser used.
• Operational records: installation identifiers, last extension version, and reminder-email delivery records.

The app obtains some information directly from you, some from your sign-in provider, and some from Somewhere administrators or automatic extension collection. Google and Microsoft may process sign-in information under their own notices as well. The generic social-login examples in Section 2.1 do not expand the Time Tracker sign-in fields listed above.

Additional browser and device information. Time Tracker may access browser and device-related information necessary for its operation, authentication, security, and troubleshooting, including browser type and version, IP address, session information, and relevant technical identifiers.

Time Tracker stores the IP address and time-zone information described above. It does not collect GPS coordinates or other precise location data, and does not use IP addresses to determine a user's country or city.

Time Tracker's browser activity collection is described in Section 8.3. Any additional collection or use of device or location information must be disclosed to affected users and supported by the appropriate permissions and legal requirements before implementation.

8.5 Purposes and prohibited uses

We use Time Tracker information to maintain and verify work-time records for the relevant engagement; automate timesheet recording; display relevant hours and supporting activity; support pay and client billing reviews; monitor activity for performance reviews; send missing-hours reminders; identify shortfalls for the responsible Somewhere team; and carry out historical audits of recorded hours, supporting activity, payments, and who approved them. We also use it to secure accounts, troubleshoot the application, produce internal operational reports limited to these disclosed functions, and meet applicable recordkeeping or legal obligations. How records may affect pay or an engagement, and the human review process, are explained in Section 8.9.

‍

We do not sell Time Tracker information or use or disclose extension activity for advertising, cross-context behavioral advertising, creditworthiness, lending, or a purpose unrelated to the disclosed Time Tracker function. The general website's advertising and analytics provisions do not permit those uses of Time Tracker information.

8.6 Access and service providers

Somewhere limits access to Time Tracker records to authorized personnel with a legitimate operational need. Authorized development contractors can see contractor names and email addresses and use the administrative console to manage profiles, assignments, and account status. They are subject to confidentiality obligations under non-disclosure and contractor agreements. Access to browser activity, time entries, and other records is governed by the person's authorized role and operational need.

The assigned client may access logged hours, tasks, descriptions, and the applicable reporting time zone. Access to recorded browser activity is available only where Somewhere has enabled that functionality for the client.

Client access begins with the relevant contractual engagement and is limited to records from that client's own engagement with the contractor. Where Somewhere enables browser-activity access, the client may see earlier records from that same engagement that were collected before access was enabled. It cannot see activity from before that engagement or from the contractor's work for another client. Access remains subject to the Time Tracker retention and deletion rule in Section 8.8.

Users may view their own logged hours through the extension and may exercise additional access and privacy rights as described in Section 9.

An automatically generated daily shortfall message can identify enrolled people whose logged hours fall below the requirement. It includes name, email, client, and hours and goes to the relevant Somewhere team through the configured workflow. It can include enrolled people who have not yet set up the extension. It is not a browser-activity report for all applicants.

The following providers support the Time Tracker functions described below:

Necessary legal or business-transaction disclosures remain subject to Sections 5 and 7, applicable law, and Chrome Web Store restrictions on extension data. General disclosure wording does not expand the permitted uses of extension activity.

8.7 Roles, lawful basis, and monitoring safeguards

Somewhere determines what activity the extension collects, the purposes for which Somewhere uses the records, and the Time Tracker retention rule in Section 8.8. Somewhere acts as a controller for that processing where applicable law uses that term. Clients can independently decide how to use the records they receive to assess whether a contractor is working the agreed hours and to review performance. A client acts as a controller for the uses it determines and is responsible for the applicable privacy obligations for those uses. Somewhere remains responsible for the processing it controls. Receiving records does not give a client authority to change the extension's collection rules or the deletion period applied by Somewhere.

We process Time Tracker account information, time records, and related operational information to administer contractor engagements, maintain accurate timesheets, support pay and billing reviews and client reporting, review performance and historical approvals as described in Section 8.5, and protect the security and integrity of the application.

Where the EU GDPR or UK GDPR applies, processing must be supported by an appropriate lawful basis. Depending on the specific purpose and circumstances, this may include contractual necessity, legitimate interests, or compliance with a legal obligation, subject to the requirements and limitations of applicable law.

Browser activity monitoring, including activity recorded outside scheduled working hours, is subject to applicable transparency, necessity, proportionality, and data protection requirements. We assess the purposes and scope of such monitoring and apply appropriate safeguards to protect individuals' privacy rights.

Installation, company-account sign-in, and acknowledgment of the Time Tracker privacy notice activate or document the collection process; they do not, by themselves, establish freely given consent under applicable data protection laws. Time Tracker is mandatory for the covered roles. Where consent is legally required for particular processing, it must be obtained separately and meet the applicable requirements; mandatory use does not remove those requirements.

Users may exercise their applicable privacy rights, including the right to object to processing based on legitimate interests, as described in Sections 9 and 10. Additional protections, including requirements relating to sensitive information, workplace monitoring, and worker consultation, apply where required by law.

8.8 Retention and deletion

We retain the relevant client engagement's browser activity and related extension tracking signals described in Section 8.3, timesheets and time entries, and their associated history (including time-entry audit history) during that engagement. We automatically delete those records ten days after the contractor's engagement with that client ends, whether it ends through termination, expiry, or another reason. This period remains subject to any earlier deletion required by applicable law.

For each client engagement, the ten-day rule applies to the browser activity, timesheets and time entries, and associated history held in Time Tracker for that engagement. Payroll, accounting, and payment records are maintained in separate systems and are outside this Time Tracker deletion rule. Their retention is governed by the requirements applicable to those separate records.

We also automatically delete the contractor's Time Tracker account details and sign-in/security logs ten days after the contractor leaves Somewhere entirely.

The deletion process is automated, and an authorized person verifies that deletion has completed. For the engagement records described above, the end of the individual contractor's engagement with the relevant client starts the ten-day period; the client's continuing contract or profile with Somewhere does not extend that period.

We assess requests for access, correction, or deletion in accordance with applicable data protection laws. Where information must be retained to comply with a specific legal obligation, resolve an identified dispute, or establish, exercise, or defend legal claims, retention is limited to the relevant records and the period justified for that purpose. A duty to retain time or payment records does not automatically justify retaining all associated browser activity.

One-time sign-in codes expire after five minutes, and authentication sessions end upon sign-out or removal of access. The expiration of a code or session does not necessarily result in the deletion of related security or audit records. Related security and audit records remain subject to the retention and deletion rules above.

Users may submit privacy requests, including requests for deletion of their personal information, through the contact methods described in Section 9.

8.9 Automated reminders and decisions

Time Tracker automatically generates missing-hours reminders and daily shortfall notifications based on recorded time entries and applicable engagement requirements. These notifications are intended to support accurate timesheet management and identify discrepancies requiring review.

Time Tracker does not independently determine compensation, impose penalties, suspend access, terminate engagements, or make other decisions producing legal or similarly significant effects on individuals.

Authorized Somewhere personnel or the relevant client review Time Tracker information when considering pay or performance concerns. Hours are logged automatically, but shortfalls are reviewed manually. No pay reduction is made without a formal review of the activity and discussion with the contractor before the reduction takes effect. Contractors can provide explanations and evidence, and the reviewer or client can approve corrections and change the proposed outcome. Performance concerns can ultimately lead to termination following review and agreement with the client; Time Tracker does not make that decision automatically.

Contractors can submit amendments or adjustments through the extension and provide communications, explanations, and other evidence during the review before their pay or engagement is affected. They can also raise inaccurate or incomplete records with their designated Somewhere representative and exercise applicable privacy rights under Section 9. An activity signal or shortfall notification is not a complete measure of work or productivity. Review must consider relevant context, including work outside the browser running the extension, offline work, agreed adjustments, and disputed or inaccurate records.

If automated decision-making functionality is introduced in the future, Somewhere will provide any additional disclosures, safeguards, and opportunities for human intervention required by applicable law before implementing such functionality.

8.10 Browser extension transparency and changes

Time Tracker's handling of information received from Google APIs must follow the Google API Services User Data Policy, including Limited Use, as stated in Section 2.1. Its handling of extension user data must separately follow the Chrome Web Store User Data Policy, including Limited Use. Collection must be necessary for the prominently disclosed Time Tracker purpose. The store listing, pre-installation disclosure, in-extension notice, permissions, and this policy must accurately describe the same collection and recipients.

We provide the required affirmative collection disclosure before recording starts. If collection or use changes, we explain the change before it takes effect and obtain a new confirmation or consent where required. We do not collect additional extension information merely because the main website policy allows broader collection.

Questions about monitoring or your engagement may be directed to your Somewhere representative or privacy@somewhere.com. Section 9 provides the request route for all Time Tracker information, including activity and retained history that is not visible in the extension.

9. Privacy requests and general choices

You may contact us from any location to ask about your information or request access, correction, or deletion. Available statutory rights and exceptions depend on the applicable law. Use privacy@somewhere.com, the contact details in Section 14, or the privacy request page at https://somewhere.com/dsar. You do not need to use particular legal language.

Tell us enough to identify the relevant account or relationship and what you are requesting. We use proportionate identity checks where needed for access, correction, or deletion, and use verification information only to handle the request, protect it, and meet applicable obligations. Do not send passwords or full identity documents unless we have specifically arranged a necessary secure verification method. Applicable opt-out requests are handled without identity verification that the law does not permit.

An authorized agent may act where the law allows. We may request evidence of authority and appropriate identity confirmation, subject to applicable exceptions, including recognized opt-out signals and valid legal authority.

We respond within the deadline required by the relevant law and explain any permitted extension, refusal, or retained records. Requests are normally free; any exception or reasonable fee is applied only where the relevant law permits it. Account closure, extension removal, and deletion of an individual time entry are distinct from a request to erase all related personal information.

Where we act solely as a client's processor, we refer the request to the responsible controller or assist it under the applicable arrangement. This does not prevent you from exercising rights against Somewhere for processing Somewhere controls. We do not require an account to make a privacy request.

10. EU/EEA, United Kingdom, and Switzerland

10.1 EU/EEA and UK rights

Where the applicable GDPR applies, you may request access and a copy, correction, erasure, restriction, and portability in the circumstances the law provides. You may withdraw consent for processing based on it. You may object to processing based on legitimate interests because of your particular situation. We stop that processing unless the law allows us to continue, including where we demonstrate overriding compelling grounds or need it for legal claims. You can object to direct marketing at any time, including related profiling; that objection is not subject to a balancing test.

We respond without undue delay and normally within one month. A permitted extension of up to two additional months for complexity or multiple requests is explained within the initial month. Where law permits a specific verification or clarification step to affect the deadline, we explain it rather than imposing a blanket delay.

For the EU GDPR, protections apply against solely automated decisions producing legal or similarly significant effects, subject to the law's limited exceptions and safeguards. Where an exception permits such a decision, the required safeguards can include human intervention, expressing your view, and contesting the outcome. UK law has its own rules for significant automated decisions, including information and applicable opportunities to make representations, obtain human intervention, and contest the decision; we apply the requirements relevant to the processing rather than assuming the EU rules are identical.

You can complain to the supervisory authority in your EEA country of residence, work, or the alleged infringement, or to the UK Information Commissioner's Office (ICO), as applicable. A complaint to Somewhere is not a condition for an EU GDPR complaint or judicial remedy. UK privacy complaints to Somewhere are acknowledged within 30 days and investigated and answered without undue delay; you can also contact the ICO at https://ico.org.uk/make-a-complaint/.

10.2 Switzerland

Where Swiss law applies, you may request information about processing, access, correction, and other remedies such as deletion or restriction in the circumstances the law provides. Applicable rights also cover portability and safeguards for an exclusively automated decision with a legal consequence or significant effect, including human review where required. You may contact the Federal Data Protection and Information Commissioner (FDPIC) at https://www.edoeb.admin.ch/en. Swiss protection is assessed under the Swiss Federal Act on Data Protection, rather than assumed to be identical to the GDPR.

10.3 European contacts and representation

Somewhere's privacy contact is listed in Section 14. 

Appointing a representative or publishing a contact does not transfer Somewhere's own responsibilities. Systematic monitoring can affect both representative and DPO requirements; an exception must be assessed against the actual activity.

11. United States privacy rights and California disclosures

11.1 Scope and rights across the United States

We assess the federal, state, and local privacy and monitoring requirements applicable to our US activities and the people affected. Comprehensive state-law rights depend on residence, statutory thresholds, exemptions, and the processing context. The commercial availability of Somewhere.com throughout the US does not mean every statute applies to every individual or every record.

Where the relevant law applies, rights may include confirming whether we process personal data; knowing the categories, sources, purposes, and recipients; access and a portable copy; correction; deletion; and opting out of sale, targeted advertising or California sharing, and certain profiling used for legally or similarly significant decisions. Additional rights can include the categories or identities of specific third-party recipients; explanations and challenges to relevant profiling; and consent, withdrawal, or limits for sensitive information, as the applicable law provides. We apply stronger prohibitions or minimization duties where a state requires them rather than assuming consent overrides a statutory restriction.

These rights can arise under laws in California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, Virginia, and other applicable jurisdictions. Rights differ by law; this is not a statement that every listed law grants every right described above.

Many state consumer laws exclude some employment or business-context information. California's CCPA/CPRA can cover applicants, employees, independent contractors, and business contacts of a covered business. We assess workforce records under the law that actually applies rather than assuming all contractor information is exempt. Local workplace monitoring notices or acknowledgments may be needed in addition to this public policy.

To make a request or opt out, use Section 9. We honor recognized opt-out preference signals as required by law. Opting out of website advertising does not itself stop operational Time Tracker collection; its controls and applicable objection/consent rights are in Sections 8–10.

We do not unlawfully discriminate or retaliate for exercising privacy rights. A lawful, necessary service limitation or statutory exception is considered separately and explained as required.

11.2 Response times and appeals

For applicable US requests, we generally respond within 45 calendar days, or any shorter deadline required by law. Where a law permits an extension, we provide timely notice explaining it. For California requests to know/access, correct, or delete personal information, we confirm receipt within 10 business days and respond within 45 calendar days; where reasonably necessary and permitted, we may extend the response period by a further 45 calendar days and explain the extension within the initial period. California requests to opt out of sale/sharing or limit sensitive-information use are implemented as soon as feasibly possible and no later than 15 business days after receipt.

If we refuse a request, we explain the reason and available appeal route, subject to lawful limitations. Where an appeal right applies, email privacy@somewhere.com with "Privacy appeal" and the relevant request details. We explain the appeal outcome in writing within the period required by your state and provide the applicable authority's complaint route if the appeal is denied. You may also use our complaint route where a statute does not require an appeal.

11.3 California collection and disclosure categories

The table below organizes the personal information described in Sections 2 and 8 into California categories and identifies the relevant recipient categories. Sources and purposes are described in Sections 2–5 and 8; retention is addressed in Sections 7.1 and 8.8. The information collected depends on your relationship with Somewhere and the services you use. A listed category does not mean that every example within that statutory category is collected from every person.

Sources and purposes are described in Sections 2–4 and 8. Retention criteria are in Sections 7.1 and 8.8. Authorized staff and the exceptional legal/business-transaction recipients described in Section 5 can receive relevant information where lawful.

Time Tracker records are not sold or shared for cross-context behavioral advertising. Where an applicable right to opt out of the sale/sharing of website information or its use for targeted advertising applies, you may submit a request using Section 9 and the relevant website preference controls. We also honor legally recognized opt-out preference signals as described in Section 6. Website advertising choices do not, by themselves, stop Time Tracker recording; its stop controls and applicable objection and consent rights are described in Sections 8–10. 

Sensitive personal information is used for the disclosed purposes and with the additional protections required by applicable law. Where California's right to limit use or disclosure applies, you may request that we limit the relevant use or disclosure to the purposes permitted by that law. Submit the request using the contact methods in Section 9. The availability of that right depends on the information and how it is used; it does not require you to close your account.

We do not knowingly sell or share information of people under 16 for advertising. We do not offer a financial incentive for collecting or selling personal information. 

12. Other regional rights

The US and European sections do not remove protections elsewhere. Where applicable Canadian privacy law applies, collection, use, and disclosure rely on the required consent or a specific permitted exception; access, correction, and withdrawal rights are handled under that law. You may contact the Office of the Privacy Commissioner of Canada or the relevant provincial authority.

Where the Australian Privacy Act 1988 or New Zealand Privacy Act 2020 applies, you can request access and correction and complain about relevant handling of information. Normally raise the concern with Somewhere first, then the Office of the Australian Information Commissioner (https://www.oaic.gov.au/privacy/privacy-complaints) or New Zealand Privacy Commissioner (https://www.privacy.org.nz/your-rights/making-a-complaint-to-the-privacy-commissioner/) as applicable.

Where South Africa's Protection of Personal Information Act applies, you may request access, correction, deletion, or object in the circumstances the law provides, and complain to the Information Regulator at https://inforegulator.org.za/. Applicable local transfer and responsible-party obligations also apply.

Other mandatory local rights remain available. Contact privacy@somewhere.com to identify the request or complaint route relevant to your location. 

13. Children and young people

Our recruitment services and Time Tracker are intended for adults aged 18 and over. We do not knowingly direct them to children or knowingly collect their information for those services. If we learn that a child has provided information without an appropriate lawful arrangement, we investigate and take the required steps, including stopping the relevant use and deleting information where required. Contact privacy@somewhere.com if you believe a child has used them.

Mandatory protections for children and teens, including stricter state rules, continue to apply. A parent accepting a general policy does not automatically authorize workplace monitoring or otherwise override those rules. 

14. Updates and contact details

We update the date at the top when this policy changes and provide additional notice for material changes where appropriate or required. Required consent or extension disclosures are obtained before relevant new collection or processing begins. The policy is reviewed at least annually and sooner when processing or legal requirements change.

Privacy enquiries and requests

Support Shepherd, LLC dba Somewhere

Email: privacy@somewhere.com

Telephone: +1 (214) 699-9033 

Postal address: 3120 Southwest Fwy, Suite 101, PMB 198275, Houston, TX 77098, United States

Privacy request form: https://somewhere.com/dsar

‍

This policy does not restrict non-waivable privacy, employment, consumer, supervisory-authority, or court rights. Any contractual governing-law terms remain subject to applicable mandatory protections.