Last Updated: March 31, 2020
Archived versions: www.sheptravel.com/archive
Shep Travel offers a simple way for companies to create a travel policy, guide team bookings on top of consumer travel sites and track expenses as they happen through a lightweight browser extension (as modified from time to time, the “Shep Platform”).
For the purposes of the GDPR, Shep Travel is considered the data controller. This means that we are responsible for deciding how we use the information that we hold. We are a Delaware corporation registered in the United States with an office at Compl.ai Inc. dba Shep, 6908 Larue Belle Cv, Austin, TX 78739.
The GDPR applies to you if you are located in the European Economic Area, the United Kingdom or Switzerland (an “EEA Individual”).
This policy describes the types of information we may collect from you or that you may provide when you access or use the Shep Platform, the Site, the Browser Extension, the other Shep Travel Services or any of the other features, functions, services, and products, including our travel partners’ services and products, and our practices for collecting, using, maintaining, protecting and disclosing that information.
This policy applies to information we collect or may collect:
- In accessing and using the Site and the Browser Extension.
- In registering to use and to create an account for the Shep Platform.
- In accessing and using the Shep Platform and the other Shep Travel Services.
- In searching for flights, hotels, rental cars, and other travel services.
- When you interact with airlines, hotels, rental cars, booking and reservation services, and other travel-related companies in connection with the Shep Platform.
- In e-mail, text and other electronic messages sent through or use of the Site, the Shep Platform, and the other Shep Travel Services.
- When you send any content through the Site, the Shep Platform or any of the other Shep Travel Services.
- Through services provided to us or to you by third-party companies, agents or contractors, including our travel partners.
It does not apply to information collected by:
- Us offline or through any other means, including on any other website operated by Shep Travel or any third party; or
- Any third party, including through any link that may be accessible from or on the Shep Platform, the Site, the Browser Extension or any of the other Shep Travel Services.
Minors under the Age of 18
None of the Shep Travel Services are intended for minors under 18 years of age. No one under age 13 may provide any information on or through the Site, the Shep Platform or the other Shep Travel Services. We do not knowingly collect personal data from children under 13. If you are under 13, do not use or provide any information on or through any of the Shep Travel Services or any of its features or register on the Site, use any of the interactive or public comment features of any of the Shep Travel Services or provide any information about yourself to us, including your name, address, telephone number, e-mail address or any screen name, username you may use or any pictures of you. If we learn we have collected or received personal data from a child under 13 without verification of parental consent, we will delete that information. If you believe that we might have any information from or about a child under 13, please contact us at email@example.com.
Information We Collect About You and How We Collect It
We collect or may collect several types of information from and about users of the Shep Platform, the Site, the Browser Extension and the other Shep Travel Services, including:
- Information by which you may be personally identified, including personal data such as name, birthdate, job function, work telephone number and e-mail address;
- Slack organization details and team identification;
- Your IP Address, including when you create an account;
- Travel booking data on or through the Shep Platform, including the total amount spent on travel, destinations and passenger information;
- Travel search and navigation history on or through the Shep Platform, including all visited URLs;
- Billing information, including the address for billing and billing contact information;
- Information that is about you but individually does not identify you, such as the date and time of visit;
- Usage details and information, including how you communicate with other users of the Site, the Browser Extension, the Shep Platform and the other Shep Travel Services, such as the time, date, sender and your interactions with messages (such as when you open a message);
- Device, internet and mobile information such as the hardware model, operating system version, unique device identifiers, browser type, language, wireless network, and mobile network information (including the mobile phone number);
- Information that you provide by registering, creating accounts or filling in forms or applications on or through the Shep Platform and the other Shep Travel Services, including information provided in connection with registering to access and use the Shep Platform;
- When you report a problem with any of the Shep Travel Services;
- Records and copies of your correspondence (including e-mail addresses), if you contact us; and/or
- Details of transactions you carry out through the Shep Platform, the Site, the Browser Extension and any of the other Shep Travel Services.
We collect this information:
- Directly from you when you provide it to us.
- Automatically as you navigate through or use the Shep Platform, the Site, the Browser Extension or any of the other Shep Travel Services.
- From third parties, such as our customers, business partners and other third parties that provide us or you with certain services, including our travel partners.
Certain transactions may also involve you calling us or our calling you. Please be aware that we may monitor, and in some cases, record such calls for staff training or quality assurance purposes.
We take every reasonable step to limit the volume of your personal data that we process to what is reasonably necessary.
We do not Engage in Automated Decision-making without Human Intervention
We do not use automated decision-making without human intervention, including profiling, in a way that produces legal effects concerning you or otherwise significantly affects you.
Consequences of not providing Personal Data
You are not required to provide all personal data identified in this policy to use our Site or to interact with us offline, but certain functionality will not be available if you do not provide personal data. In addition, if you do not provide the personal data, we may not be able to respond to your requests, provide the Shep Travel Services or access to the Shep Platform, or provide you with marketing that we believe you would find valuable.
The technologies we use for automatic data collection may include:
Do Not Track Policy
Your web browser may offer you a “Do Not Track” option, which allows you to signal to operators of websites and web applications and services (including behavioral advertising services) that you do not wish such operators to track certain of your online activities over time and across different websites. We do not honor any web browser “Do Not Track” signals or other mechanisms that provide you with the ability to exercise choice regarding the collection of personally identifiable information about your online activities over time and across third-party websites or online services. At present, no universally accepted standards exist on how companies should respond to do-not-track signals. In the event a final universally accepted standard is established, we will assess and provide an appropriate response to these signals
Third-party Responsibilities and Services.
We may use or partner with other third-party companies, agents or contractors for various purposes in connection with our business and operations (“Service Providers”), including, travel partners, such as travel management companies, travel agents, online travel agencies, and travel product suppliers, CRM, invoicing and payment processing, support, relationship building, the marketing and growth of our business and the performance of services on our behalf, such as gathering and analyzing information and the provision of services to you. In the course of performing these responsibilities and providing such services, these other companies may have access to your information. We may also share information, including your information, with these Services Providers in order to enable them to perform these responsibilities and to provide these services. These Services Providers may have adopted their own privacy policies, which are not subject to control by Shep Travel. You should always review the policies of these Service Providers to make sure that you are comfortable with the ways in which they collect, use, maintain, protect and disclose your information. We do not list our current Service Providers because they change from time to time. If you would like the names of any of Service Providers, please email us at firstname.lastname@example.org.
The Service Providers may also transmit cookies to your computer or device when you click on ads that appear on or through the Service.
As a convenience to you, we may also provide links to other third-parties from within our Service. If you click on one of these links, you will be redirected to that third-party’s site (via affiliate cookies) and such third party may also transmit cookies to you. We do not have any control over that or how they collect, use, maintain, protect and disclose your information. Please be aware that cookies placed by third parties may continue to track your activities online even after you are no longer using any the Shep Travel Services, and those third parties may not honor “Do Not Track” requests you have set using your web browser.
Shep may receive compensation from these Service Providers and other third parties.
Use of Remarketing with Google Ads, Google Analytics and other Remarking and Analytic Services
We use or may in the future use a variety of remarketing and analytic services including:
You can set preferences for how Google advertises to you using the Google Ad Preferences page, and if you want to, you can opt out of interest-based advertising entirely by cookie settings or permanently using a browser plugin.
DoubleClick: We may use Google Analytics and Google Adwords remarketing codes to log when users view specific pages or take specific actions on a website. This allows us to provide targeted advertising in the future. If you do not wish to receive this type of advertising from us in the future you can opt out using the DoubleClick opt-out page or the Network Advertising Initiative opt-out page.
Google has additional information available about its Remarketing Privacy Guidelines, Policies, and Restrictions on its website.
How We Use Your Information
We use information that we collect about you or that you provide to us, including any personal data:
- To provide the Browser Extension.
- To provide you the Shep Platform and the other Shep Travel Services and the content and the other products and services that you request from us.
- To provide the Site and the content that is on it to you.
- To process and complete transactions, including registration for the use of the Shep Platform and the other Shep Travel Services and send you related information, including the dashboard that provides travel information.
- To provide technical and other support to you.
- To send you promotional communications, such as providing you with information about services, features, surveys, newsletters, offers and events; and providing other news or information about us, our customers and our travel partners.
- To enable Service Providers to perform certain responsibilities and provide certain services in connection with the Shep Travel Services and our business and operations.
- To fulfill any other purpose for which you provide it.
- To provide you with notices about your account.
- To carry out our obligations and enforce our rights arising from any contracts entered into between you and us, including for billing and collection.
- To notify you about changes to the Shep Platform, the Site, the Browser Extension and the other Shep Travel Services.
- To enhance the safety and security of all of the Shep Travel Services.
- To verify your identity and prevent fraud or other unauthorized or illegal activity.
- To enable marketing, remarketing and targeted advertising and similar services from us or Service Providers, including direct and indirect marketing and on-line behavioral advertising regarding our own and third-party products and services that we believe may be of interest to you, including advertisement on third party websites. We do not market to EEA Individuals.
- To perform targeted and other advertising on third party websites.
- In any other way we may describe when you provide the information.
- To provide guidance on travel spending
- To advise/consult on best practices and improvements that could be made by your company to save money or improve policy compliance
- For any other purpose with your consent.
Some of the information that we collect automatically is statistical data and does not include personal data, but we may maintain it or associate it with personal data we collect in other ways or receive from third parties or you provide to us. It helps us to improve the Site, the Browser Extension, the Shep Platform and the other Shep Travel Services, and to deliver a better and more personalized service, including enabling us to:
- Estimate our audience size and better understand usage patterns.
- Store information about your preferences, enabling us to customize the Site according to your individual interests.
- Speed up your searches.
- Recognize you when you return to the Site and the Browser Extension.
- Negotiate on behalf of our customers for better/discounted rates with our travel partners.
Storage and Transfer of Your Information
We may store any data or other information that we collect (personal or otherwise) ourselves or in databases and servers owned and maintained by us, our affiliates, agents or Service Providers. If you access or use the Site, the Browser Extension, the Shep Platform or any of the other Shep Travel Services outside of the United States, information that we collect about you may be transferred to servers inside the United States and maintained indefinitely, which may involve the transfer of information out of countries located in the European Economic Area and other parts of the world unless otherwise prohibited by applicable law or agreed by Shep Travel and you. By allowing Shep Travel to collect information about you, you consent to such transfer and processing of such information without restriction. We may also store some information locally on your computer or other devices. For example, we may store information as local cache so that you can open the Site and view content faster.
Although users from all over the world may access the Site, the Browser Extension, the Shep Platform and the other Shep Travel Services, keep in mind that no matter where you live or where you happen to use our services, you consent to us processing and transferring information in and to the United States and other countries whose data-protection and privacy laws may offer fewer protections than those in your home country.
Disclosure of Your Information
We may disclose aggregated information about our users, and information that does not include any personal data, without restriction.
- To our subsidiaries and affiliates.
- To other users in your organization in connection with the Shep Platform or any of the other Shep Travel Services.
- To other users of the Shep Platform.
- To Service Providers, contractors and other third parties we use to support the Shep Travel Services and our business, including our travel partners.
- To a potential or actual buyer. assignee or other successor (including its related advisors and agents) in the event of a merger, divestiture, restructuring, reorganization, dissolution or other sale or transfer of some or all of Shep Travel’ assets, whether as a going concern or as part of bankruptcy, liquidation or similar proceeding, in which personal data held by Shep Travel about users of the Site is among the assets that may be or are actually transferred.
- To fulfill the purpose for which you provide it.
- For any other purpose disclosed by us when you provide the information.
- With your consent.
We may also disclose your data information:
- To comply with any court order, law or legal process, including to respond to any government or regulatory request.
- To enforce or apply the Terms and other agreements, including for billing and collection purposes.
- If we believe disclosure is necessary or appropriate to protect the rights, property, or safety of Shep Travel, our customers or others.
Choices About How We Use and Disclose Your Personal Data
We strive to provide you with choices regarding the personal data you provide to us. We have created mechanisms to provide you with the following control over your personal data:
- Promotional Offers from Shep Travel. If you do not wish to have your e-mail address/contact information used by Shep Travel to market or otherwise promote our own or third parties’ products or services, you can opt-out through the unsubscribe mechanism at the bottom of the applicable email. This opt out does not apply to information provided to Shep Travel as a result of a service or product purchase, warranty registration, product service experience or other transactions.
We do not control third parties’ collection or use of your information to serve interest-based advertising. You may be able to opt out of receiving personalized advertisements from companies who are members of the Network Advertising Initiative or who subscribe to the Digital Advertising Alliance’s Self-Regulatory Principles for Online Behavioral Advertising. For more information about this practice and to understand your options, please visit: http://www.aboutads.info and http://www.networkadvertising.org/choices/. You may also use TRUSTe’s Preference Manager at http://preferences-mgr.truste.com.
Our Legal Bases for Handling Your Personal Data
GDPR and the laws in some other jurisdictions require companies to tell you about the legal bases that they rely on to use or disclose your personal data. To the extent that those laws apply, we rely on the following legal grounds to process your personal data:
- Performance of a contract: In most cases, we collect and use your personal data and other information to meet our obligations under a contract to which you are a party or pursuant to which we are providing services to you. For example, when you use our Shep Platform or the other Shep Travel Services, we will use your personal data to respond to your requests and to provide you with these services.
- Legitimate interests: We may use your personal data information for our legitimate interests on the grounds that it furthers our legitimate interests in commercial activities (but only to the extent that such interests are overridden by the interests or fundamental rights and freedoms of the affected individuals) including:
- Analyzing and improving the Shep Platform, the other Shep Travel Services and our business
- Providing the services pursuant to our contracts with our clients
- Legal compliance: We may use and disclose personal data in certain ways to comply with our legal obligations under European or Member State law or other applicable law.
- Consent: To the extent required by law, and in certain other cases, we handle personal data on the basis of implied or express consent.
Accessing and Correcting Your Personal Data
You may change, correct or delete any personal data that you have provided to us by emailing us at email@example.com.
For Individuals in the EEA, United Kingdom, and Switzerland: Privacy Shield
Shep Travel is subject to the investigatory and enforcement powers of the U.S. Federal Trade Commission.
In compliance with the Privacy Shield Principles, Shep Travel commits to resolve complaints about your privacy and our collection or use of your personal information transferred to the United States pursuant to Privacy Shield. European Union, UK, and Swiss individuals with Privacy Shield inquiries or complaints should first contact Shep Travel by email at firstname.lastname@example.org
Shep Travel has further committed to refer unresolved privacy complaints under the Privacy Shield Principles to an independent dispute resolution mechanism, the BBB EU PRIVACY SHIELD. If you do not receive timely acknowledgment of your complaint, or if your complaint is not satisfactorily addressed, please visit http://www.bbb.org/EU-privacy-shield/for-eu-consumers for more information and to file a complaint. This service is provided free of charge to you.
If your Privacy Shield complaint cannot be resolved through the above channels, under certain conditions, you may invoke binding arbitration for some residual claims not resolved by other redress mechanisms. See Privacy Shield Annex 1 at https://www.privacyshield.gov/article?id=ANNEX-I-introduction.
Consistent with the Privacy Shield Principles, Shep Travel may transfer personal data to third parties, including transfers from one country to another. We will only disclose an individual’s non-public personal data to third parties under one or more of the following conditions:
- With the individual’s permission to make the disclosure.
- Where required to the extent necessary to meet a legal obligation to which Shep Travel is subject, including a lawful request by public authorities and national security or law enforcement obligations and applicable law, rule, order, or regulation.
- Where reasonably necessary for compliance or regulatory purposes, or for the establishment of legal claims.
- The disclosure is to Service Providers (as described above), to our customers and/or to certain employees in connection with the operation of our business, and as consistent with the purpose for which the personal data was collected. We maintain written contracts with these third parties and require that these third parties provide at least the same level of privacy protection and security as required by the Privacy Shield Principles.
To the extent provided by the Privacy Shield Principles, Shep Travel remains responsible and liable under the Privacy Shield Principles if a third-party that it engages to process personal data on its behalf does so in a manner inconsistent with the Privacy Shield Principles, unless Shep Travel proves that it is not responsible for the matter giving rise to the damage.
Your California Privacy Rights
California Civil Code Section § 1798.83 permits users of the Site that are California residents to request certain information regarding our disclosure of personal data to third parties for their direct marketing purposes. To make such a request, please send an e-mail to email@example.com or write to us at: Compl.ai Inc. dba Shep, 6908 Larue Belle Cv, Austin, TX 78739, USA.
European Privacy Rights for EEA Individuals.
You have the right to ask us not to process your personal data for marketing purposes. We will usually inform you (before collecting your personal data) if we intend to use your personal data for such purposes or if we intend to disclose your personal data to any third party for such purposes. You can exercise your right to prevent such processing by checking certain boxes on the forms we use to collect your personal data. You can also exercise the right by contacting us directly.
If you are an EEA Individual and GDPR applies and we hold your personal data in our capacity as a controller, you may request that we:
- Provide access to and/or a copy of certain personal data (including, in some cases, in portable form);
- Prevent the processing of your personal data for direct-marketing purposes (including any direct marketing processing based on profiling);
- Update personal data that is out of date or incorrect;
- Delete certain personal data which we are holding about you; provided that the personal data is not required by us for (i) compliance with a legal obligation under European or Member State law or other applicable law or (ii) the establishment, exercise or defense of a legal claim;
- Object to our processing of personal data;
- Restrict the way that we process and disclose certain of your information except to the extent that processing is required (i) to comply with a legal obligation under European Member State law or applicable law or (ii) for the establishment, exercise or defense of legal claims;
- Transfer your personal data to a third party to the extent that this is technically feasible; and
- Honor a revocation of your consent for the processing of your personal data (without retroactive effect).
We will consider all requests and provide our response within the time period required by applicable law. Please note, however, that certain information may be exempt from such requests in some circumstances, which may include if we need to keep processing your information for our legitimate interests or to comply with a legal obligation. We may request you provide us with additional information to confirm your identity before responding to your request. You have the right to lodge a complaint with the authorities applicable to your situation, though we invite you to contact us with any concern, as we would be happy to try to resolve it directly. You may also have the right to make a GDPR complaint to the relevant Supervisory Authority. A list of Supervisory Authorities is available here: https://edpb.europa.eu/about-edpb/board/members_en.
If you are an EEA Individual in France, you also have the right to set guidelines for the retention and communication of your personal data after your death.
If you reside in a jurisdiction other than the European Economic Area, you may also have similar rights to the above. Please contact us at firstname.lastname@example.org if you would like to exercise one of these rights, and we will comply with any request to the extent required under applicable law.
You can exercise any of these rights by contacting us at email@example.com or write to us at: Compl.ai Inc. dba Shep, 6908 Larue Belle Cv, Austin, TX 78739.
How Long We Store Your Personal Data
We will only retain your personal data, in a form which permits us to identify you, for as long as necessary to fulfill the purposes we collected it for. We will retain and use your personal data as necessary to satisfy any legal, accounting or reporting requirements, to resolve disputes or to enforce our agreements and rights. To dispose of personal data, we may anonymize it, delete it or take other appropriate steps. Data may persist in copies made for backup and business continuity purposes for additional time.
We understand that the security of your personal data is important. We provide reasonable administrative, technical, and physical security controls to protect your personal data. However, despite our efforts, no security controls are 100% effective. Shep Travel cannot ensure or warrant the security of your personal data. Any transmission of personal information is at your own risk. We are not responsible for circumvention of any privacy settings or security measures contained on the Site or through the Browser Extension.
The safety and security of your data also depends on you. Where you have chosen (or we have given you) a password for access to and use of certain parts of the Site, the Browser Extension, the Shep Platform and/or the other Shep Travel Services, you are responsible for keeping this password confidential. We ask you not to share your password with anyone. We urge you to be careful about giving out information in public areas of any of the Shep Travel Services. The information you share in public areas may be viewed by any other user of the Shep Travel Services.
© Copyright Compl.ai Inc. dba Shep 2020