International Privacy Supplement

1. Application

This Supplement explains how the SiteHeros Privacy Policy applies where an international privacy regime governs the particular processing. Worldwide accessibility of a website does not by itself establish that every national law applies. Good Ground Serves LLC operates SiteHeros from the United States.

When SiteHeros processes information for a customer’s website, that customer ordinarily controls the relevant purposes and notice. Requests about those records should be directed to the customer, with SiteHeros providing assistance under the applicable DPA.

2. European Economic Area and United Kingdom

Where EU or UK data-protection law applies, the Privacy Policy and point-of-collection notice must identify the controller, contact details, processing purposes and legal bases, legitimate interests where relied upon, recipients, transfers, retention criteria, rights, complaint authority and any required representative.

For a natural person entering a service agreement, necessary contractual processing may support account and service administration. For employees or representatives of a corporate client, legitimate interests may be the appropriate basis after assessment; the corporation’s contract does not automatically make every employee’s processing necessary for that person’s own contract.

Legal obligations may support required accounting, tax or legal records. Consent applies to activities requiring a genuine choice, including tracking or marketing where the relevant law requires it. Consent can be withdrawn without affecting prior lawful processing; withdrawal does not necessarily require deletion of records held on another lawful basis.

3. Rights

Applicable rights may include access, correction, erasure, restriction, portability, objection and protection from specified solely automated decisions. Where processing rests on legitimate interests, individuals may object on grounds relating to their situation. Objection to direct marketing must be honored under applicable law.

Individuals may complain to a competent supervisory authority and retain any judicial remedies. The Privacy Rights Request page provides the service channel; no contractual choice of law displaces mandatory rights.

4. Transfers

Information may be accessed or processed outside the individual’s country only with the safeguards required by the applicable law. A United States service location and a supplier’s global operations must be disclosed accurately.

Where applicable, safeguards may include adequacy decisions, an eligible recipient’s verified Data Privacy Framework participation, standard contractual clauses and the UK Addendum or IDTA. We do not claim that SiteHeros itself participates in a Data Privacy Framework or holds a certification without verified enrollment.

Individuals may request information about applicable transfer safeguards at legal@siteheros.com, subject to proportionate protection of confidential and security-sensitive terms. The actual processing locations, recipients and safeguards depend on the service.

5. Switzerland

Where Swiss law applies, the controller, collection purposes, relevant recipients and foreign disclosure information must be supplied as required. Any SCC-based protection must include the required Swiss adaptations. EU or UK coverage must not be assumed to resolve the Swiss analysis automatically.

6. Canada and Quebec

Where Canadian private-sector privacy law applies, processing must satisfy the applicable accountability, consent, purpose, safeguard, access and retention requirements. Federal and provincial coverage depends on the organization and activity, including interprovincial or international commercial processing.

Quebec-specific governance, privacy impact assessment, outsourcing, transfer, incident and individual-rights requirements require separate assessment when there is a relevant nexus. This notice does not claim that the designation of a privacy officer, a Quebec impact assessment or a cross-border assessment has already been completed.

Commercial email and text rules require a separate assessment under Canada’s anti-spam legislation; a privacy notice alone does not establish marketing consent.

7. Brazil

Where the LGPD applies to the processing, the relevant notice must identify purposes, lawful basis, sharing, retention, rights and an appropriate controller contact. Requests may concern confirmation, access, correction, portability, deletion or other statutory rights, subject to the law’s conditions.

Brazilian international-transfer requirements must be assessed independently. EU clauses are not automatically a complete Brazilian transfer mechanism.

8. Australia and New Zealand

Australian coverage depends on the Privacy Act, applicable exceptions and the entity’s connection to Australia; turnover alone does not resolve every exception. Where applicable, the Australian Privacy Principles govern collection, notice, use/disclosure, overseas disclosure, security, access and correction.

New Zealand coverage likewise depends on the actual business and processing nexus. Applicable privacy principles, overseas-disclosure safeguards, access/correction and breach duties must be considered. A domestic United States contract does not remove those obligations.

9. Contact and service-specific information

For privacy requests, questions about applicable processing or transfer safeguards, or information about any required local representative, contact legal@siteheros.com. The Privacy Policy and Privacy Rights Request Notice provide further information. This Supplement does not claim universal worldwide availability or compliance certification.