Totem is designed for business use by travel companies, tour operators, destination management companies, travel agents and other professional users.

Our customers are responsible for deciding what personal data they upload to Totem, ensuring they have the right to use that data, and reviewing any outputs generated by Totem before relying on or sharing them.

Where our customers upload personal data relating to travellers, agents, suppliers or other third parties, those customers are usually responsible for providing any required privacy notices to those individuals.

Depending on the context, Hyperion Labs may act as either a controller or a processor of personal data.

Where we act as controller

We act as a controller where we decide how and why personal data is used. This may include personal data relating to:

• website visitors;
• users of Totem;
• account administrators;
• billing contacts;
• prospective customers;
• sales and marketing contacts;
• support communications;
• product usage analytics;
• platform security;
• business administration.

Where we act as processor

We act as a processor where we process personal data on behalf of our business customers.

For example, a customer may upload traveller names, travel dates, itinerary details, preferences, booking notes, emails, enquiry details or other travel-related information into Totem.

In those cases, the customer is usually the controller, and Hyperion Labs processes that data on the customer’s behalf under our agreement with that customer, including our Data Processing Addendum.

Our customers are responsible for ensuring that any personal data they provide to Totem is collected, used and shared lawfully.

We may collect and process the following categories of personal data.

Account and user information

This may include:

• name;
• email address;
• company name;
• job title;
• team or workspace details;
• login credentials;
• user role and permissions;
• account settings;
• preferences;
• authentication information.

Customer and billing information

This may include:

• company details;
• billing contact details;
• invoice information;
• payment records;
• subscription details;
• contract details;
• tax or accounting information;
• commercial correspondence.

We may use third-party payment providers to process payments. We do not intentionally store full card details ourselves.

Platform and technical data

When you use Totem, we may collect information about your use of the platform, including:

• pages viewed;
• features used;
• actions taken;
• content created, edited, saved or published;
• timestamps;
• IP address;
• approximate location based on IP address;
• browser type;
• device type;
• operating system;
• referral source;
• performance data;
• error logs;
• diagnostic data;
• security logs;
• usage analytics.

Customer content

Customers and users may upload, generate, store, edit or publish content through Totem, including:

• itinerary drafts;
• travel proposals;
• traveller names;
• travel dates;
• destination information;
• flight details;
• hotel details;
• activity details;
• transfer details;
• supplier details;
• pricing or costing information;
• rooming or group information;
• customer preferences;
• free-text notes;
• emails or copied correspondence;
• images;
• descriptions;
• branding assets;
• other travel-related content.

Customer content may contain personal data depending on what the customer chooses to upload or generate.

Support and communication data

If you contact us, we may process:

• your name;
• email address;
• company name;
• message content;
• attachments;
• call notes;
• meeting notes;
• feedback;
• support requests;
• correspondence history.

Sales and marketing data

If you interact with our sales or marketing activity, we may process:

• name;
• business email address;
• company name;
• role;
• sector;
• country or region;
• demo requests;
• event attendance;
• sales notes;
• marketing preferences;
• email engagement data.

Data from third-party and public sources

Where lawful, we may collect or receive business contact information from:

• public websites;
• company websites;
• professional networks;
• referrals;
• events;
• business partners;
• lead generation providers;
• other publicly available or commercially available sources.

We may collect personal data when:

• you visit our website;
• you create or use a Totem account;
• your company signs up for Totem;
• you upload, generate, edit or publish content in Totem;
• you contact us;
• you request a demo;
• you respond to our sales or marketing communications;
• you attend a meeting, call or event with us;
• you interact with our website, platform or emails;
• a customer uploads information relating to you into Totem;
• a third-party tool, integration or service provides information to us.

We may use personal data to:

• provide, operate, maintain and improve Totem;
• create and manage accounts;
• authenticate users;
• provide access to workspaces and teams;
• generate, edit, format and publish travel itineraries and proposals;
• provide AI-assisted features;
• process and store customer content;
• support collaboration between users;
• provide onboarding, support and customer success;
• respond to enquiries, issues and requests;
• manage subscriptions, billing, payments and contracts;
• communicate with customers, users and prospects;
• monitor platform usage, performance and reliability;
• detect, investigate and fix errors, bugs and technical issues;
• improve, test and develop our website, platform, models, workflows and services;
• analyse product usage and customer needs;
• protect the security and integrity of Totem;
• prevent fraud, misuse, unauthorised access and abuse;
• enforce our terms, agreements and policies;
• comply with legal, regulatory, tax, accounting and reporting obligations;
• manage our business operations;
• carry out internal reporting, forecasting and financial planning;
• send service, product, security, legal and administrative notices;
• send relevant business-to-business marketing communications where permitted by law;
• support financing, investment, restructuring, merger, acquisition, sale or similar business activity.

We may also use personal data for other purposes that are compatible with the purposes described above, where permitted by law.

Totem uses artificial intelligence, automation and related technologies to help users create, improve, structure, summarise, transform and manage travel-related content.

This may include using AI to:

• turn notes, emails, enquiries or briefs into structured itineraries;
• generate hotel, destination, activity and experience descriptions;
• organise travel information into client-facing formats;
• summarise or rewrite content;
• suggest improvements;
• support proposal creation;
• assist with costing, quoting and operational workflows;
• help users work faster and reduce manual work.

To provide these features, content submitted to Totem may be processed by our systems, AI models, infrastructure providers or selected third-party service providers.

We may use customer content, usage data, prompts, outputs, feedback and related technical data to operate, maintain, secure, troubleshoot, evaluate and improve Totem and its features, in each case where permitted by law and our customer agreements.

We do not use customer content to train public AI models unless we have expressly agreed this with the relevant customer or are otherwise permitted to do so by law or contract.

AI-generated outputs may be inaccurate, incomplete, outdated, unsuitable or misleading. Users are responsible for reviewing, verifying and approving outputs before relying on them or sharing them with travellers, agents, suppliers or other third parties.

We may create and use aggregated, anonymised or de-identified data for any lawful business purpose, including to:

• understand usage trends;
• improve Totem;
• develop new features;
• create benchmarks and insights;
• monitor performance;
• support sales, marketing, reporting and fundraising;
• publish or share general product or industry insights.

We will not intentionally use aggregated or anonymised data to identify an individual.

Where we act as a controller, we rely on one or more lawful bases under applicable data protection law.

Contract

We process personal data where necessary to provide Totem, manage accounts, deliver support, process subscriptions, communicate with customers and perform our agreements.

Legitimate interests

We process personal data where necessary for our legitimate interests, provided those interests are not overridden by individual rights and freedoms.

Our legitimate interests may include:

• operating and improving Totem;
• understanding how customers use our product;
• developing new features and services;
• supporting customers;
• securing our systems;
• preventing fraud, misuse and abuse;
• communicating with business contacts;
• carrying out B2B sales and marketing;
• managing customer relationships;
• maintaining records;
• enforcing our legal rights;
• running and growing our business.

Legal obligation

We process personal data where necessary to comply with legal, regulatory, tax, accounting or reporting obligations.

Consent

We rely on consent where required by law, for example for certain cookies or optional marketing communications.

Where we rely on consent, you can withdraw that consent at any time.

We may share personal data where necessary or appropriate for the purposes described in this Privacy Policy.

This may include sharing personal data with:

• cloud hosting providers;
• AI model and infrastructure providers;
• analytics providers;
• error monitoring and logging providers;
• payment processors;
• CRM providers;
• email and communication providers;
• customer support tools;
• authentication providers;
• database, storage and security providers;
• productivity and document tools;
• professional advisers, including lawyers, accountants, auditors and insurers;
• regulators, authorities, courts or law enforcement where required or appropriate;
• investors, prospective investors, lenders, acquirers, buyers, advisers or other transaction parties in connection with financing, investment, restructuring, merger, acquisition, sale of assets or similar business activity;
• other third parties where the customer directs us to share data, integrates Totem with another service, or otherwise authorises the sharing.

We may also share personal data where we believe it is reasonably necessary to protect our rights, property, users, customers, business, systems or others.

We may use third-party service providers and subprocessors to help provide Totem and operate our business.

Where required, we put contractual protections in place with service providers that process personal data on our behalf.

Our service providers may change from time to time as our business and product develop.

Some of our service providers may process personal data outside the United Kingdom, the European Economic Area or the country where the customer or user is located.

Where required, we use appropriate safeguards for international transfers. These may include adequacy decisions, standard contractual clauses, the UK International Data Transfer Agreement, the UK Addendum to the EU standard contractual clauses, or other lawful transfer mechanisms.

We keep personal data for as long as we reasonably consider necessary for the purposes described in this Privacy Policy, including to provide Totem, comply with legal obligations, resolve disputes, enforce agreements, maintain security, prevent misuse and manage our business.

Retention periods vary depending on the nature of the data, the context in which it was collected, our contractual commitments, legal requirements and business needs.

For example:

• account data may be kept while the account is active and for a reasonable period afterwards;
• customer content may be kept while needed to provide the service, maintain backups, support account recovery, resolve disputes or comply with our agreements;
• billing and contract records may be kept for legal, tax, accounting and audit purposes;
• support records may be kept to resolve issues, improve the service and maintain business records;
• technical logs may be kept for security, debugging, fraud prevention and performance monitoring;
• marketing data may be kept until you unsubscribe or we determine it is no longer useful.

Where we act as a processor, retention of customer content may be governed by our agreement with the relevant customer.

We may retain aggregated, anonymised or de-identified data indefinitely.

We use technical and organisational measures designed to protect personal data against unauthorised access, loss, misuse, alteration and disclosure.

These measures may include, where appropriate:

• access controls;
• authentication;
• role-based permissions;
• encryption;
• logging and monitoring;
• secure cloud infrastructure;
• backups;
• internal policies;
• supplier due diligence;
• restrictions on access to customer data.

No method of transmission, storage or processing is completely secure. We cannot guarantee that personal data will always remain secure.

Customers and users are responsible for maintaining the confidentiality of their login credentials and for controlling access to their own systems, devices and accounts.

Customers are responsible for:

• deciding what personal data to upload to Totem;
• ensuring they have a lawful basis for collecting, using and sharing that personal data;
• providing any required privacy notices to travellers, agents, suppliers, employees and other individuals;
• ensuring uploaded data is accurate, relevant and not excessive;
• avoiding unnecessary sensitive personal data;
• configuring user access and permissions appropriately;
• reviewing AI-generated outputs before using or sharing them;
• ensuring travel, pricing, itinerary, supplier and booking information is accurate before sharing it externally;
• obtaining any rights, permissions or licences required for images, descriptions, branding assets or other content they upload or publish through Totem.

We are not responsible for the accuracy, legality or appropriateness of customer content uploaded to Totem by customers or users.

Totem is not designed for unnecessary sensitive personal data.

Customers should not upload sensitive personal data unless it is necessary, lawful and appropriate for the relevant travel-related purpose.

Sensitive personal data may include information about:

• health;
• disabilities or accessibility needs;
• dietary requirements that reveal health, religious or philosophical information;
• passport, visa or identity documents;
• racial or ethnic origin;
• religious beliefs;
• biometric information;
• other special category or highly sensitive information.

Where a customer uploads sensitive personal data, the customer is responsible for ensuring it has a lawful basis and any required conditions for doing so.

We may send business-to-business marketing communications to customers, prospective customers and other business contacts where permitted by law.

You can opt out of marketing emails at any time by:

• using the unsubscribe link in the email; or
• contacting us at hello@totem.travel.

Opting out of marketing does not stop us from sending service-related, legal, billing, security or administrative communications.

We may use cookies and similar technologies on our website and platform.

These may be used to:

• operate the website and platform;
• keep users signed in;
• remember preferences;
• understand website and product usage;
• analyse performance;
• improve Totem;
• support security;
• support sales and marketing activity.

Where required by law, we will ask for consent before placing non-essential cookies.

You can control cookies through your browser settings. Blocking cookies may affect how our website or platform works.

Depending on your location and the circumstances, you may have rights in relation to your personal data.

These may include the right to:

• access your personal data;
• correct inaccurate personal data;
• request deletion of your personal data;
• restrict processing;
• object to certain processing;
• request data portability;
• withdraw consent where processing is based on consent;
• complain to a data protection authority.

These rights are subject to legal conditions, exemptions and limitations.

To exercise your rights, contact us at hello@totem.travel.

If your personal data was provided to Totem by one of our customers, we may refer your request to that customer or require you to contact that customer directly.

Totem may include or interact with third-party websites, services, tools, integrations, images, maps, content, APIs or data sources.

We are not responsible for the privacy practices, security, availability, accuracy or content of third-party websites or services.

Customers and users are responsible for reviewing the terms and privacy policies of third-party services they choose to use with Totem.

Totem may allow users to create, publish, share or send itineraries, proposals, links or other content to third parties.

Customers and users are responsible for deciding what content to publish or share, who to share it with, and whether the content contains personal data or confidential information.

We are not responsible for how recipients use, copy, forward, disclose or otherwise process content that a customer or user chooses to share outside Totem.

If Hyperion Labs is involved in a financing, investment, merger, acquisition, restructuring, sale of assets, insolvency event or similar transaction, personal data may be disclosed to relevant parties as part of that process.

Those parties may include investors, prospective investors, buyers, advisers, lenders, acquirers, administrators or other transaction participants.

Where required by law, we will take appropriate steps to protect personal data in connection with such transactions.

We may disclose personal data where we believe it is necessary or appropriate to:

• comply with applicable law;
• respond to legal process;
• respond to lawful requests from authorities;
• protect our rights, property or business;
• enforce our agreements;
• prevent fraud, abuse or security incidents;
• protect customers, users or others;
• investigate suspected wrongdoing.

Totem is designed for business and professional use. It is not intended for direct use by children.

We do not knowingly collect personal data directly from children.

If you believe a child has provided personal data to us, contact us at hello@totem.travel.

Totem provides AI-assisted tools, but we do not intend to make solely automated decisions that produce legal or similarly significant effects on individuals.

Users are responsible for reviewing and approving AI-generated outputs before relying on them.

If you have concerns about how we handle personal data, contact us first at hello@totem.travel.

You may also have the right to complain to a data protection authority.

In the UK, this is the Information Commissioner’s Office.

We may update this Privacy Policy from time to time.

The updated version will be posted on our website or otherwise made available through Totem. The “Last updated” date at the top of this Privacy Policy shows when it was last changed.

Where required by law, we will provide additional notice of material changes.

Your continued use of Totem after an updated Privacy Policy becomes effective will be treated as acceptance of the updated policy where permitted by law.

This Privacy Policy is provided to explain how we process personal data. It is not intended to create contractual rights or obligations beyond those required by applicable law or agreed in a separate written agreement with us.

If there is a conflict between this Privacy Policy and a separate written agreement between Hyperion Labs and a customer, the written agreement will apply to the extent permitted by law.

For questions, requests or complaints about this Privacy Policy or how we handle personal data, contact: