Legal
Totem Data Processing Addendum
Supplier: Hyperion Labs Ltd
Parties and application
This Data Processing Addendum (DPA) forms part of the agreement between Hyperion Labs Ltd (Supplier) and the organisation that has entered into that agreement with the Supplier (Customer) for the provision of Totem (Agreement). It takes effect when incorporated into the Agreement and does not require a separate signature.
1. Definitions and scope
1.1 "Customer Personal Data" means personal data contained in Customer Data that the Supplier processes on behalf of the Customer in providing the Services.
1.2 "Data Protection Laws" means data-protection and privacy laws applicable to the relevant processing of Customer Personal Data.
1.3 "Services" means Totem and related services and support provided under the Agreement.
1.4 Terms such as controller, processor, personal data, processing, personal data breach and data subject have the meanings given by applicable Data Protection Laws.
1.5 This DPA applies only to Customer Personal Data processed by the Supplier on behalf of the Customer. If this DPA conflicts with the Agreement concerning that processing, this DPA prevails. The Agreement otherwise continues to apply.
2. Roles, instructions and customer responsibilities
2.1 For Customer Personal Data, the Customer is the controller or processor, as applicable, and the Supplier is the processor or subprocessor, as applicable.
2.2 The Supplier shall process Customer Personal Data only:
(a) to provide, secure, support and administer the Services;
(b) in accordance with the Agreement, this DPA, the Customer's use and configuration of the Services and other documented instructions agreed by the Supplier; or
(c) as required by applicable law.
2.3 If applicable law requires processing outside the Customer's instructions, the Supplier shall notify the Customer before processing unless legally prohibited. The Supplier shall inform the Customer if, in its reasonable opinion, an instruction infringes Data Protection Laws and may suspend the affected processing until the parties agree a lawful instruction.
2.4 Instructions outside the scope of the Agreement or the ordinary operation of the Services require the Supplier's prior written agreement and may be subject to additional fees.
2.5 The Customer is solely responsible for:
(a) the lawfulness, fairness, transparency, accuracy, quality and minimisation of Customer Personal Data and its instructions;
(b) providing all required notices and establishing a valid lawful basis, including obtaining any necessary consent;
(c) responding to data subjects and complying with retention obligations applicable to the Customer; and
(d) ensuring that its Authorised Users use the Services lawfully and securely.
2.6 The Customer shall not provide Customer Personal Data that is excessive or unnecessary for the Services. The Customer shall not provide payment-card data, account passwords, special-category data, children's data, passport data or other highly sensitive information unless its processing is lawful, strictly necessary for the Customer's use of a feature intended to process that type of information, and subject to appropriate safeguards.
2.7 Each party acts as an independent controller for personal data it processes for its own account administration, billing, security, fraud prevention and legal compliance.
2.8 The Supplier shall not sell Customer Personal Data or use it to train or fine-tune a general-purpose artificial-intelligence model. The Supplier may generate and use service telemetry and anonymised or aggregated information that does not reasonably identify the Customer, its customers, suppliers or any individual to operate, secure, support, analyse and improve Totem and compile statistics.
3. Confidentiality and personnel
3.1 The Supplier shall ensure that persons authorised to process Customer Personal Data:
(a) are subject to an appropriate duty of confidentiality; and
(b) access Customer Personal Data only where reasonably necessary for their duties.
4. Security
4.1 Taking into account the state of the art, implementation costs, the nature, scope, context and purposes of processing and the risks to individuals, the Supplier shall maintain appropriate technical and organisational measures designed to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.
4.2 Schedule 2 describes the Supplier's current technical and organisational measures. The Supplier may modify those measures without notice, provided that the modification does not materially reduce the overall level of protection for Customer Personal Data.
4.3 No security measure can prevent every security incident. The occurrence of a security incident or Personal Data Breach does not, by itself, establish a breach of this DPA by the Supplier.
5. Personal data breaches
5.1 The Supplier shall notify the Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data. The Supplier is not required to notify the Customer of an unsuccessful attempt or incident that does not constitute a Personal Data Breach.
5.2 The Supplier may provide available information in phases. To the extent reasonably available, the information shall describe:
(a) the nature of the Personal Data Breach;
(b) the categories of affected Customer Personal Data and data subjects;
(c) likely consequences; and
(d) measures taken or proposed to address and mitigate the Personal Data Breach.
5.3 The Supplier shall take reasonable steps to contain, investigate and mitigate the Personal Data Breach. The Customer remains responsible for determining whether and how to notify any regulator, data subject or third party unless applicable law requires the Supplier to notify them directly.
5.4 A notification under this section is not an admission of fault or liability.
5.5 Notifications shall be sent to the Customer's notice email under the Agreement or another security contact notified to the Supplier. The Customer is responsible for keeping that contact information current.
6. Assistance and data-subject rights
6.1 Taking into account the nature of the processing and information available to the Supplier, the Supplier shall provide assistance reasonably required for the Customer to comply with its applicable obligations concerning:
(a) data-subject requests;
(b) security and Personal Data Breach notifications;
(c) data-protection impact assessments and prior consultation with regulators; and
(d) legally binding enquiries from competent regulators.
6.2 The Customer shall first use the controls and information available through the Services. Any further request must be specific, proportionate and limited to Customer Personal Data.
6.3 If the Supplier receives a data-subject request concerning Customer Personal Data, it shall direct the requester to the Customer unless legally prohibited. The Supplier shall not respond substantively except on the Customer's documented instruction or where required by law.
6.4 The Supplier may charge the Customer for assistance under this section at reasonable time-and-materials rates and for associated third-party costs, except to the extent the assistance is required solely because of the Supplier's material breach of this DPA. Where reasonably practicable, the Supplier shall inform the Customer of material expected charges before undertaking non-routine work.
6.5 The Supplier is not required to develop new functionality, alter the Services or incur disproportionate cost to satisfy a request unless required by Data Protection Laws. Any such work remains chargeable to the extent permitted by law.
7. Subprocessors
7.1 The Customer gives the Supplier general written authorisation to appoint subprocessors to process Customer Personal Data for the Services.
7.2 The Supplier shall make its current subprocessor information available electronically or on written request. The Supplier shall give at least 15 days' prior notice of an intended new or replacement subprocessor by email, in-Service notice or another reasonable electronic method.
7.3 The Customer may object within that notice period only on specific and reasonable grounds relating to the protection of Customer Personal Data. The objection must explain those grounds in sufficient detail. If the Customer does not object within the notice period, it is deemed to have authorised the appointment.
7.4 The Supplier shall consider a valid objection in good faith. At the Supplier's option, it may:
(a) not appoint the subprocessor;
(b) take reasonable steps to address the objection;
(c) offer a commercially reasonable alternative, which may be subject to additional fees; or
(d) permit the Customer to terminate only the affected Services by giving written notice before the subprocessor is appointed.
Termination under clause 7.4(d) is the Customer's sole remedy for an unresolved objection. The Supplier shall refund prepaid fees for the terminated period, if any.
7.5 Where an urgent change is reasonably necessary to protect the security or availability of the Services or comply with law, the Supplier may appoint a subprocessor on shorter notice and shall notify the Customer as soon as reasonably practicable.
7.6 The Supplier shall enter into a written agreement with each subprocessor containing data-protection obligations that meet applicable Data Protection Laws. The Supplier remains responsible for the subprocessor's performance of those obligations to the extent required by applicable Data Protection Laws.
8. International transfers
8.1 The Customer authorises the Supplier and its authorised subprocessors to process Customer Personal Data in the countries in which they operate, provided that any restricted transfer is made in accordance with applicable Data Protection Laws.
8.2 Where a legally required transfer mechanism applies, the parties agree that the relevant approved standard contractual clauses, UK addendum, international data transfer agreement or successor mechanism is incorporated into this DPA to the extent necessary. The parties shall provide information reasonably required to complete that mechanism.
8.3 Each party is responsible for transfer obligations applicable to transfers it initiates. The Customer warrants that it may lawfully transfer Customer Personal Data to the Supplier.
9. Return and deletion
9.1 During the term, the Customer shall use available Service functionality to access and export Customer Personal Data.
9.2 On termination of the affected Services, the Customer may instruct the Supplier in writing to return or delete Customer Personal Data. The Customer must provide that instruction within 14 days after termination. If the Customer gives no timely instruction, it instructs the Supplier to delete Customer Personal Data.
9.3 The Supplier may satisfy a return instruction by making Customer Personal Data available through its standard export functionality or in another standard format selected by the Supplier. The Supplier is not required to create a bespoke export or preserve the Customer's preferred layout, formatting or system compatibility. Non-standard assistance is chargeable under clause 6.4.
9.4 Subject to clause 9.2, the Supplier shall delete Customer Personal Data from active systems within 90 days after termination, unless applicable law requires retention. Customer Personal Data in backups may be retained until overwritten or deleted in the ordinary backup cycle, provided it is protected, put beyond ordinary use and not restored except where reasonably necessary for disaster recovery or legal compliance.
9.5 The Supplier is not required to delete:
(a) information it processes as an independent controller;
(b) anonymised or aggregated information that is no longer personal data;
(c) data which applicable law requires it to retain; or
(d) security logs or records retained for the establishment, exercise or defence of legal claims, provided that any continuing processing is limited to that purpose.
9.6 On written request made no more than once, the Supplier shall confirm completion of deletion. The Supplier is not required to provide certificates from subprocessors or permit an audit solely to verify routine deletion unless required by a competent regulator.
10. Information and audits
10.1 The Supplier shall provide information reasonably necessary to demonstrate compliance with this DPA. The Supplier may satisfy this obligation by providing available policies, summaries, certifications, audit reports, responses to a reasonable questionnaire or other relevant documentation.
10.2 The Customer must review the information provided under clause 10.1 before requesting an audit. If that information is reasonably insufficient to demonstrate compliance, the Supplier shall allow an audit relating only to the processing of Customer Personal Data.
10.3 Unless a competent regulator requires otherwise, an audit:
(a) may occur no more than once in any 12-month period;
(b) requires at least 30 days' written notice;
(c) must occur during normal business hours and minimise disruption;
(d) must be conducted remotely where reasonably practicable;
(e) must have a scope, duration and method agreed in advance;
(f) must be conducted by the Customer or an independent auditor that is not a competitor of the Supplier and is bound by confidentiality obligations; and
(g) must not compromise security or expose information relating to another customer.
10.4 An audit does not give the Customer access to source code, vulnerability information, penetration-test materials whose disclosure would create a security risk, data belonging to another customer, privileged material, internal financial information or physical infrastructure not controlled by the Supplier.
10.5 The Customer shall bear all audit costs and reimburse the Supplier for reasonable time and third-party costs incurred in supporting the audit, except where the audit establishes a material breach of this DPA by the Supplier. No audit report may be disclosed to a third party other than a competent regulator or the Customer's professional advisers without the Supplier's prior written consent.
11. Customer claims and indemnity
11.1 The Customer shall promptly notify the Supplier if it becomes aware that its instructions, Customer Personal Data or use of the Services violates Data Protection Laws.
11.2 The Customer shall indemnify the Supplier against third-party claims, liabilities, losses, regulatory fines to the extent lawfully recoverable, reasonable legal fees and other reasonable costs to the extent arising from:
(a) the Customer's breach of this DPA or Data Protection Laws;
(b) the Customer's failure to provide required notices, establish a lawful basis or obtain required consent;
(c) an unlawful or unauthorised instruction given by the Customer; or
(d) Customer Personal Data provided in breach of clause 2.6.
11.3 The indemnity does not apply to the extent the claim or loss was caused by the Supplier's breach of this DPA, negligence, fraud or wilful misconduct.
12. Liability
12.1 The exclusions, limitations and procedures governing liability in the Agreement apply to this DPA. The liability cap in the Agreement is an aggregate cap for the Agreement and this DPA together, not a separate or additional cap.
12.2 The Supplier is not liable to the extent a claim, loss or regulatory action results from:
(a) the Customer's instructions;
(b) Customer Personal Data or the Customer's failure to comply with Data Protection Laws;
(c) the Customer's systems, acts or omissions; or
(d) processing performed by the Customer or a third party outside the Services.
12.3 Nothing in this DPA limits liability that cannot lawfully be limited, restricts the rights of a data subject or regulator, or changes the allocation of responsibility imposed directly by Data Protection Laws.
12.4 A party may not recover more than once for the same loss under the Agreement and this DPA.
13. Term and updates
13.1 This DPA continues for as long as the Supplier processes Customer Personal Data on behalf of the Customer. Clauses intended to survive termination, including clauses concerning confidentiality, return and deletion, audits, indemnity and liability, shall survive.
13.2 The Supplier may update this DPA where reasonably necessary to reflect changes in law, regulatory guidance, the Services, security practices or subprocessors. An update takes effect when published, provided that it does not materially reduce the overall protection of Customer Personal Data or cause the Supplier to breach Data Protection Laws.
13.3 If the Supplier proposes a material reduction in protection that is not required by law, it shall give reasonable prior notice. The Customer's sole remedy is to terminate the affected Services before the change takes effect.
Schedule 1
Processing details
Subject matter
Provision of Totem and related services and support under the Agreement.
Duration
The term of the Agreement and the limited return, deletion, backup and legal-retention periods described in this DPA.
Nature of processing
Collection, receipt, hosting, storage, organisation, retrieval, consultation, analysis, generation, transmission, support, backup, security monitoring, return and deletion.
Purposes
Providing and supporting Totem's itinerary, costing, proposal, communications, CRM, analytics and related functionality; authenticating and supporting Authorised Users; maintaining security, availability and integrity; and complying with documented instructions and applicable law.
Data subjects
Customer employees, officers and contractors; customers, prospective customers and travellers; suppliers, agents, partners and their personnel; and other individuals whose information the Customer submits to the Services.
Personal-data types
Names and identifiers; contact details; account and access information; enquiry, CRM and communications data; travel preferences, itineraries and booking information; supplier and agent information; pricing and transaction-related records; passport, visa, nationality or identification details where lawfully submitted; and technical usage data linked to an individual.
Special-category or sensitive data
Dietary, accessibility, health, religious or other sensitive information only where the Customer lawfully submits it in accordance with clause 2.6.
Processing frequency
Intermittent or continuous, depending on the Customer's use of the Services.
Data sources
The Customer, its Authorised Users, individuals interacting with the Customer and third-party sources used at the Customer's instruction.
Customer rights and obligations
The Customer controls the purposes of processing, may issue lawful documented instructions, may request assistance and audits as limited by this DPA, and may choose return or deletion at the end of the Services.
Schedule 2
Technical and organisational measures
The Supplier applies measures appropriate to the nature and risks of the relevant processing. The precise controls may vary according to the Services, configuration, infrastructure and risk and may include:
Governance and confidentiality
Assigned responsibility for security and privacy, confidentiality obligations for authorised personnel and access limited according to business need.
Identity and access management
Unique user accounts, authentication controls, access permissions and additional controls for privileged administrative access where appropriate.
Encryption
Industry-standard transport encryption for Customer Personal Data in transit and encryption at rest where supported by the relevant hosting or storage infrastructure.
Application and infrastructure security
Logical separation of customer records, controlled production access, secure configuration, dependency and vulnerability management and remediation proportionate to risk.
Development and change management
Controlled deployment, testing and review processes appropriate to the nature and risk of a change.
Logging and monitoring
Logging and monitoring appropriate to the Services, with access restricted to authorised personnel.
Availability and resilience
Use of reputable infrastructure providers, backup and recovery measures appropriate to the Services and measures designed to restore availability following an incident.
Incident response
Processes designed to identify, contain, investigate, mitigate and communicate relevant security incidents.
Subprocessor management
Risk-based assessment, written data-protection terms and oversight appropriate to the subprocessor's services and risk.
Retention and disposal
Retention based on service, security, backup and legal requirements, with controlled deletion when information is no longer required.
Ongoing review
Review and updating of measures where reasonably necessary to address material changes in risk, technology, law or the Services.