Legal

Terms of Service

Last updated: 10 May 2026

These Terms of Service govern access to and use of Totem, the AI software product available at totem.travel.

Totem is owned and operated by Hyperion Labs Ltd (“Hyperion Labs”, “we”, “us” or “our”), a private limited company registered in England and Wales with company number 17100790 and registered office at 71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ.

For questions about these Terms, contact us at:

Company
Hyperion Labs Ltd
Product
Totem
Website
totem.travel

1. About Totem

Totem provides AI software for travel companies.

Totem is a software platform only. Totem is not a travel agent, tour operator, destination management company, package organiser, retailer of travel services, supplier, insurer, payment institution or regulated travel provider.

2. These Terms

These Terms apply to your access to and use of:

  • our website;
  • the Totem platform;
  • our software, tools, AI features and workflows;
  • demos, pilots, trials and paid subscriptions;
  • related support, onboarding and business communications;
  • any other services we make available in connection with Totem.

By creating an account, accessing Totem, using Totem, signing an order form, paying an invoice or otherwise agreeing to use our services, you agree to these Terms.

If you use Totem on behalf of a company or other organisation, you confirm that you have authority to bind that organisation. In that case, “Customer” and “you” refer to that organisation.

If you do not have authority to bind that organisation, you must not use Totem and may be personally responsible for any unauthorised use.

If you do not agree to these Terms, you must not use Totem.

3. Business use only

Totem is intended for business and professional use only.

You must not use Totem as a consumer or for personal, household or non-business purposes.

You are responsible for ensuring that your users, employees, contractors, agents and representatives comply with these Terms.

4. Order forms, proposals and subscriptions

Your use of Totem may be subject to an order form, proposal, contract, invoice, online checkout, subscription plan, pilot agreement or other written agreement accepted by us.

That document may set out:

  • the services you are buying;
  • the subscription term;
  • the fees;
  • payment terms;
  • usage limits;
  • modules included;
  • number of users;
  • any trial or pilot period;
  • any special commercial terms.

If there is a conflict between these Terms and an order form or signed written agreement, the order form or signed written agreement will apply only to the extent of the conflict.

Any purchase order, procurement terms, vendor portal terms or other customer standard terms are rejected and will not apply unless we expressly agree to them in a signed written agreement.

No employee, contractor, reseller or representative of Hyperion Labs is authorised to vary these Terms unless the variation is confirmed in a signed written agreement by an authorised representative of Hyperion Labs.

5. Accounts and authorised users

To use Totem, you may need to create an account.

You must ensure that all account information is accurate, complete and kept up to date.

You are responsible for:

  • maintaining the confidentiality of login details;
  • controlling access to your workspace;
  • setting appropriate user roles and permissions;
  • ensuring only authorised users access Totem;
  • all activity that occurs under your account or workspace.

You must notify us promptly if you become aware of any unauthorised access, account compromise or security incident involving Totem.

We may suspend or restrict access if we reasonably believe that an account has been compromised, misused or accessed in breach of these Terms.

6. Customer responsibilities

You are responsible for your use of Totem and for all content, data and instructions provided by you or your users.

You are responsible for:

  • deciding what information to upload to Totem;
  • ensuring you have the right to upload and use that information;
  • ensuring customer, traveller, supplier and agent data is used lawfully;
  • checking all AI-generated outputs before using, sending, publishing or relying on them;
  • verifying all itinerary, pricing, costing, margin, tax, commission, supplier, availability and booking information;
  • ensuring proposals, itineraries, quotes and travel documents are accurate before sharing them externally;
  • complying with all travel, consumer, data protection, advertising, marketing, tax and regulatory obligations that apply to your business;
  • obtaining any licences, consents or permissions needed for images, descriptions, branding assets, supplier content, customer content or third-party materials;
  • ensuring your use of Totem does not breach any contract, law, regulation, third-party terms or third-party rights.

We are not responsible for the accuracy, legality, suitability or commercial consequences of customer content, customer instructions, customer data or customer-approved outputs.

7. AI features and outputs

Totem uses artificial intelligence, automation and related technologies to help users create, improve, structure, summarise, transform and manage travel-related content.

AI-generated outputs may be inaccurate, incomplete, outdated, unsuitable, misleading or inconsistent.

You must review and verify outputs before relying on them or sharing them with travellers, agents, suppliers, customers, colleagues or other third parties.

You are responsible for deciding whether an output is appropriate for your use case.

You must not rely on Totem as a substitute for professional judgement, legal advice, tax advice, accounting advice, immigration advice, medical advice, safety advice, travel regulatory advice or commercial judgement.

Where you enable Totem to send communications, operate third-party systems, update records or take actions on your behalf, you are responsible for ensuring those actions are authorised, accurate and appropriate.

You acknowledge that AI systems may produce the same or similar outputs for different customers and that outputs may not be unique to you.

8. Travel law and customer obligations

You are solely responsible for determining whether your activities are subject to any travel laws, regulations, licensing requirements, bonding requirements, insolvency protection requirements, package travel rules, consumer protection rules or industry rules.

Totem does not sell travel services, arrange travel services, hold traveller money, contract with travellers, provide financial protection, act as organiser or retailer, or accept responsibility for the performance of travel services unless we expressly agree otherwise in a separate signed written agreement.

You remain responsible for the travel services you sell, market, arrange, quote, propose, book or manage.

9. Customer content

“Customer Content” means any content, data, information, text, images, documents, files, prompts, outputs, proposals, itineraries, emails, notes, supplier information, traveller information, pricing information, branding assets or other materials uploaded to, generated in, stored in, processed by or made available through Totem by or on behalf of you.

You retain ownership of your Customer Content.

You grant us a worldwide, non-exclusive, royalty-free licence to host, copy, process, transmit, display, modify, adapt, create derivative works from and use Customer Content as necessary or reasonably useful to:

  • provide Totem;
  • operate, maintain and secure Totem;
  • provide support;
  • troubleshoot issues;
  • monitor performance and reliability;
  • improve and develop Totem and related services;
  • create, test and improve workflows, features, prompts, templates and automation;
  • comply with law;
  • enforce these Terms;
  • perform our obligations to you.

We will not sell your Customer Content.

We will not use your Customer Content to train public AI models unless we have expressly agreed this with you or are otherwise permitted to do so by law or contract.

We may use aggregated, anonymised or de-identified data for any lawful business purpose, including analytics, benchmarking, product improvement, reporting, sales, marketing, fundraising and industry insights, provided we do not intentionally identify you or any individual from that data.

You are responsible for maintaining your own copies and backups of Customer Content. We are not responsible for any loss, deletion, corruption or failure to store Customer Content except to the extent caused by our breach of these Terms and subject to the liability limits in these Terms.

10. Published and shared content

Totem may allow you to create, publish, send, export or share itineraries, proposals, links, PDFs, emails or other content.

You are responsible for:

  • deciding what content to share;
  • deciding who to share it with;
  • ensuring shared content is accurate;
  • ensuring shared content does not contain confidential, personal or sensitive information that should not be shared;
  • obtaining any required consents, rights or licences;
  • complying with applicable marketing, travel and consumer laws.

We are not responsible for how recipients use, copy, forward, disclose or otherwise process content that you choose to share outside Totem.

11. Third-party services and integrations

Totem may integrate with, access or interact with third-party websites, services, tools, APIs, maps, image sources, travel systems, CRMs, email providers, document tools, booking systems, supplier portals, payment providers or AI infrastructure providers.

If you connect Totem to a third-party service, provide third-party credentials, authorise browser automation or instruct Totem to interact with another system, you confirm that you have the right to do so.

You authorise us and Totem to access, use, operate, read from, write to, send information to and take actions within third-party systems to the extent instructed or enabled by you or your users.

You are responsible for:

  • complying with third-party terms;
  • ensuring you have permission to access and use third-party systems;
  • verifying actions taken in third-party systems;
  • maintaining your own third-party accounts;
  • paying any third-party fees;
  • reviewing any third-party privacy, security or contractual terms;
  • ensuring automation or browser-based actions do not breach third-party terms or laws.

We are not responsible for third-party services, including their availability, security, accuracy, performance, content, pricing, changes, outages or errors.

We may suspend or disable integrations where necessary for security, legal, technical or operational reasons.

12. Acceptable use

You must not use Totem to:

  • break the law;
  • infringe third-party rights;
  • upload unlawful, harmful, defamatory, discriminatory, misleading or infringing content;
  • send spam or unlawful marketing;
  • impersonate another person or organisation;
  • mislead travellers, agents, suppliers or customers;
  • create fake reviews, fake claims or deceptive travel content;
  • upload malware or harmful code;
  • interfere with, disrupt or overload Totem;
  • probe, scan or test the vulnerability of Totem without written permission;
  • reverse engineer, decompile or attempt to extract source code from Totem;
  • bypass usage limits or security controls;
  • scrape or copy Totem except as expressly permitted;
  • benchmark Totem or publish performance comparisons without our prior written consent;
  • use Totem, outputs or usage data to build, train, evaluate, improve or support a competing product or model;
  • create datasets from Totem outputs for competitive purposes;
  • share access credentials or allow unauthorised users to access Totem;
  • use Totem to make solely automated decisions with legal or similarly significant effects on individuals without appropriate human review;
  • upload sensitive personal data unless it is necessary, lawful and appropriate for the relevant travel-related purpose.

We may investigate suspected breaches and suspend or terminate access if we reasonably believe you have breached this section.

13. Usage limits and fair use

Your use of Totem may be subject to usage limits, rate limits, storage limits, fair use limits, module limits, user limits or other technical or commercial restrictions.

We may impose, update or enforce reasonable limits to protect Totem, manage infrastructure costs, maintain service quality or prevent misuse.

If your usage materially exceeds reasonable or agreed usage levels, we may require you to reduce usage, upgrade your plan, pay additional fees or agree revised commercial terms.

14. Fees and payment

You must pay all fees set out in the applicable order form, invoice, subscription plan or other agreement.

Unless stated otherwise:

  • fees are exclusive of VAT and other taxes;
  • fees are payable in advance;
  • payment obligations are non-cancellable;
  • fees are non-refundable;
  • subscriptions renew automatically for the renewal period stated in the relevant order form or plan;
  • you are responsible for all taxes, bank fees, payment processing charges and withholding taxes.

We may increase fees for any renewal term by giving notice before the renewal date.

If you do not pay fees when due, we may:

  • charge interest where permitted by law;
  • suspend or restrict access to Totem;
  • stop providing support;
  • terminate your subscription;
  • recover reasonable costs of collection.

You must not withhold, reduce or set off fees unless required by law or agreed by us in writing.

Termination, suspension or non-use of Totem does not relieve you of the obligation to pay fees for the full subscription term, unless we expressly agree otherwise in writing.

15. Trials, pilots and beta features

We may offer trials, pilots, demos, early access features or beta features.

Unless we agree otherwise in writing, these are provided for evaluation only, may be changed or withdrawn at any time, and are provided without any service level commitment.

We may terminate or suspend a trial, pilot or beta feature at any time.

Beta features may be incomplete, unstable or inaccurate. You use them at your own risk.

We have no liability for free, trial, pilot, demo, early access or beta services except to the extent liability cannot lawfully be excluded.

16. Service availability and support

We will use reasonable efforts to provide Totem with reasonable skill and care.

However, we do not guarantee that Totem will be uninterrupted, error-free, secure, always available or compatible with every system or workflow.

We may carry out maintenance, updates, security fixes and changes to Totem from time to time.

Unless an order form says otherwise, support is provided by email at hello@totem.travel during normal UK business hours.

We do not provide any service level agreement, uptime commitment, response time commitment or resolution time commitment unless expressly agreed in a signed written agreement.

17. Changes to Totem

We may update, modify, improve, replace, suspend or discontinue features from time to time.

For paid subscriptions, we will use reasonable efforts to ensure that the service remains substantially similar in overall core functionality during the current subscription term.

We may make changes that reduce, remove or replace functionality where we consider it necessary or appropriate for legal, security, technical, operational, product, commercial or third-party provider reasons.

We may release new features, modules or paid add-ons that are not included in your existing subscription.

18. Intellectual property

We and our licensors own all rights, title and interest in and to Totem, including:

  • software;
  • source code;
  • object code;
  • workflows;
  • AI systems;
  • models;
  • prompts;
  • templates;
  • product design;
  • user interface;
  • documentation;
  • know-how;
  • trade marks;
  • logos;
  • business processes;
  • analytics;
  • improvements;
  • derivative works.

Except for the limited right to use Totem under these Terms, no rights are transferred to you.

You must not copy, modify, distribute, sell, lease, sublicense, reverse engineer or create derivative works from Totem unless expressly permitted by us in writing.

You may use outputs generated through Totem for your internal business purposes and customer-facing travel proposals, subject to these Terms, applicable law and any third-party rights.

Because AI systems may generate similar or identical outputs for different users, you do not receive exclusive rights in generic AI-generated outputs.

All rights not expressly granted to you are reserved by Hyperion Labs.

19. Feedback and product learnings

If you provide feedback, ideas, suggestions, feature requests or recommendations, you grant us a worldwide, perpetual, irrevocable, royalty-free licence to use them without restriction or payment to you.

We are not required to use your feedback.

Nothing in these Terms prevents Hyperion Labs from using general knowledge, experience, ideas, know-how, techniques, workflows, learnings, improvements or non-customer-specific insights gained in the course of providing Totem, provided that Hyperion Labs does not disclose Customer Confidential Information or identify the Customer without permission.

20. Confidentiality

Each party may receive confidential information from the other.

Confidential information includes non-public business, technical, commercial, product, financial, customer, supplier, pricing, security and operational information.

The receiving party must:

  • protect confidential information using reasonable care;
  • use it only for the purposes of the relationship;
  • not disclose it except to employees, contractors, advisers or service providers who need to know it and are subject to confidentiality obligations.

Confidential information does not include information that:

  • is public through no fault of the receiving party;
  • was already known lawfully;
  • is independently developed without using the confidential information;
  • is received lawfully from a third party without confidentiality restrictions;
  • consists of general know-how, experience, learning or non-customer-specific insight retained without deliberate memorisation of the disclosing party’s confidential information.

A party may disclose confidential information where required by law, regulation, court order or authority, provided it gives notice where legally permitted.

21. Data protection and privacy

Our Privacy Policy explains how we collect, use and protect personal data in connection with Totem.

Where we act as a controller, we process personal data in accordance with our Privacy Policy.

Where we process personal data on behalf of a customer as processor, the Data Processing Terms in Schedule 1 apply unless we have signed a separate data processing agreement with you.

You are responsible for ensuring that any personal data you provide to Totem is collected, used and shared lawfully.

You must not upload sensitive personal data unless it is necessary, lawful and appropriate for the relevant travel-related purpose.

22. Security

We use reasonable technical and organisational measures designed to protect Totem and Customer Content.

However, no system is completely secure.

You are responsible for:

  • keeping passwords and credentials secure;
  • using appropriate access controls;
  • managing user permissions;
  • securing your own devices and systems;
  • ensuring your users follow appropriate security practices;
  • promptly notifying us of suspected unauthorised access or security incidents.

We are not responsible for unauthorised access caused by your failure to protect credentials, devices, systems, integrations or user permissions.

23. Intellectual property claims

Unless expressly agreed in a signed written agreement, we do not provide any indemnity for intellectual property claims relating to Totem, AI-generated outputs, third-party services, third-party materials or Customer Content.

If we reasonably believe Totem may infringe third-party rights, or if a claim is made or threatened, we may at our discretion:

  • obtain the right for you to continue using Totem;
  • modify Totem;
  • replace the relevant feature;
  • suspend the relevant feature;
  • terminate the affected service.

This section sets out your sole and exclusive remedies in relation to intellectual property claims involving Totem.

24. Customer indemnity

You will indemnify and hold harmless Hyperion Labs from and against claims, losses, damages, liabilities, costs and expenses arising out of or related to:

  • Customer Content;
  • your use of Totem;
  • your breach of these Terms;
  • your breach of applicable law;
  • your travel services, proposals, bookings, itineraries, quotes or customer communications;
  • your use of AI-generated outputs without appropriate review;
  • your infringement of third-party rights;
  • your use of third-party systems or integrations;
  • personal data you upload or instruct us to process;
  • disputes between you and your customers, travellers, agents, suppliers or partners;
  • any allegation that your use of Totem breached travel, consumer, data protection, advertising, marketing, tax or regulatory obligations.

This indemnity is not subject to the liability cap in Section 26 to the fullest extent permitted by law.

25. Disclaimers

Totem is provided on an “as is” and “as available” basis.

To the fullest extent permitted by law, we disclaim all warranties, representations and conditions, whether express, implied, statutory or otherwise, including any implied warranties of merchantability, fitness for a particular purpose, title and non-infringement.

We do not warrant that:

  • Totem will meet your requirements;
  • Totem will be uninterrupted, secure or error-free;
  • outputs will be accurate, complete or reliable;
  • travel information will be up to date;
  • third-party services will remain available;
  • bugs or errors will be corrected;
  • Totem will increase revenue, conversion, profit, market share or business performance;
  • Totem will identify every error, inconsistency, missing item, risk or issue in your workflows.

You are responsible for your own business decisions and for reviewing all outputs before use.

26. Limitation of liability

Nothing in these Terms limits or excludes liability for:

  • death or personal injury caused by negligence;
  • fraud or fraudulent misrepresentation;
  • any liability that cannot lawfully be limited or excluded.

Subject to the above, we will not be liable for:

  • loss of profits;
  • loss of revenue;
  • loss of sales;
  • loss of business;
  • loss of anticipated savings;
  • loss of goodwill;
  • loss of reputation;
  • loss or corruption of data;
  • business interruption;
  • travel disruption;
  • supplier failure;
  • customer claims arising from your travel services;
  • loss arising from inaccurate, incomplete, outdated, unsuitable or misleading outputs;
  • loss arising from third-party services, integrations, systems, APIs or providers;
  • indirect, special, incidental, punitive or consequential loss.

Subject to the above, our total aggregate liability arising out of or in connection with these Terms, Totem or any related services will not exceed the greater of:

  • the fees actually paid by you to us for Totem in the 12 months before the event giving rise to the claim; or
  • £100.

For free, trial, pilot, demo, early access or beta services, our total aggregate liability will not exceed £100.

The liability cap applies whether the claim arises in contract, tort, negligence, breach of statutory duty, misrepresentation, restitution or otherwise.

The liability cap does not limit your obligation to pay fees, your indemnity obligations, your confidentiality obligations, your data protection obligations, your infringement of our intellectual property rights or your breach of acceptable use restrictions, to the fullest extent permitted by law.

27. Suspension

We may suspend or restrict access to Totem immediately if:

  • you fail to pay fees when due;
  • you breach these Terms;
  • your use creates a security, legal, regulatory, reputational, financial or operational risk;
  • your account appears compromised;
  • we are required to do so by law or a third-party provider;
  • you use Totem in a way that may harm us, our customers, our systems or third parties;
  • we reasonably believe suspension is necessary to protect Totem or Hyperion Labs.

Where reasonable, we will give notice and an opportunity to resolve the issue.

We are not liable for losses arising from suspension or restriction of access where we act in accordance with this section.

Fees remain payable during any suspension caused by you or your users.

28. Term and termination

These Terms apply for as long as you access or use Totem.

Either party may terminate a subscription at the end of the applicable subscription term by giving notice in accordance with the relevant order form or subscription plan.

Either party may terminate immediately if the other party materially breaches these Terms and fails to remedy the breach within 30 days of written notice.

We may terminate immediately if:

  • you fail to pay fees;
  • you breach acceptable use rules;
  • you infringe our intellectual property rights;
  • your use creates legal, security, reputational, financial or operational risk;
  • we are required to do so by law;
  • you become insolvent or cease trading.

Early termination by you does not release you from paying fees due for the full then-current subscription term, unless we expressly agree otherwise in writing.

29. Effect of termination

On termination:

  • your right to use Totem ends;
  • you must stop using Totem;
  • unpaid fees become immediately due;
  • we may delete or disable access to your workspace and Customer Content after a reasonable period;
  • we may retain data where required for legal, accounting, security, backup, dispute resolution or compliance purposes;
  • provisions intended to survive termination will continue.

You are responsible for exporting any Customer Content you need before termination.

We are not required to provide access to Customer Content after termination unless we agree otherwise in writing.

30. Publicity

Unless the applicable order form expressly says otherwise, you grant us the right to identify you as a Totem customer using your company name, trade marks and logo in our website, pitch materials, customer lists, investor materials and marketing materials.

We will not publish a detailed case study about you without your consent.

You may request that we stop future public use of your name or logo by emailing hello@totem.travel. Any withdrawal will apply prospectively only and will not require us to recall, remove or amend materials already produced, published, distributed or shared.

31. Changes to these Terms

We may update these Terms from time to time.

The updated version will be posted on our website or otherwise made available through Totem.

If we make material changes, we will provide notice where required by law or where reasonably practicable.

Your continued use of Totem after updated Terms become effective means you accept the updated Terms.

If you do not agree to the updated Terms, you must stop using Totem.

32. Force majeure

We will not be liable for delay or failure to perform caused by events beyond our reasonable control, including:

  • internet or hosting failures;
  • cloud provider outages;
  • third-party service failures;
  • cyberattacks;
  • strikes;
  • labour disputes;
  • power failures;
  • natural disasters;
  • war;
  • terrorism;
  • civil unrest;
  • epidemics or pandemics;
  • government action;
  • changes in law;
  • supplier failures.

33. Assignment

You may not assign, transfer or subcontract your rights or obligations under these Terms without our prior written consent.

We may assign, transfer or subcontract our rights or obligations to an affiliate, successor, acquirer, investor, purchaser or other party involved in a merger, acquisition, restructuring, financing, sale of assets or similar transaction.

34. Notices

We may give notices by email, through Totem, through our website or by other reasonable means.

Notices to us must be sent to hello@totem.travel unless we specify another address.

You are responsible for keeping your contact details up to date.

35. No partnership or agency

These Terms do not create a partnership, joint venture, employment relationship, franchise, fiduciary relationship or agency relationship between you and us.

Neither party has authority to bind the other unless expressly agreed in writing.

36. Entire agreement

These Terms, together with any applicable order form, invoice, proposal, signed agreement, Privacy Policy and Data Processing Terms, form the entire agreement between you and us regarding Totem.

They replace all prior discussions, proposals, representations and agreements relating to Totem.

You acknowledge that you have not relied on any statement, promise, representation, assurance or warranty that is not expressly set out in these Terms or a signed written agreement.

37. Severability

If any part of these Terms is found to be invalid, unlawful or unenforceable, the rest of the Terms will continue in effect.

The invalid, unlawful or unenforceable part will be modified to the minimum extent necessary to make it valid, lawful and enforceable, or treated as deleted if modification is not possible.

38. Third-party rights

Except as expressly stated, these Terms do not give rights to any person who is not a party to them.

The Contracts (Rights of Third Parties) Act 1999 does not apply to these Terms.

39. Governing law and jurisdiction

These Terms are governed by the laws of England and Wales.

The courts of England and Wales have exclusive jurisdiction over any dispute arising out of or in connection with these Terms, Totem or any related services.

Schedule 1

Data Processing Terms

1. Scope

These Data Processing Terms apply where Hyperion Labs processes personal data on behalf of the Customer as processor in connection with Totem.

If we have signed a separate data processing agreement with you, that separate agreement will apply instead of this Schedule to the extent of any conflict.

2. Roles

For Customer Personal Data, the Customer is the controller and Hyperion Labs is the processor, unless otherwise agreed in writing.

For account data, billing data, sales data, support data, usage analytics, security logs and business administration data that we process for our own purposes, Hyperion Labs may act as controller in accordance with our Privacy Policy.

3. Customer Personal Data

“Customer Personal Data” means personal data contained in Customer Content that we process on behalf of the Customer through Totem.

This may include personal data relating to:

  • travellers;
  • customers;
  • prospective customers;
  • agents;
  • suppliers;
  • employees;
  • contractors;
  • users;
  • other individuals whose data is uploaded to or processed through Totem.

The categories of personal data may include:

  • names;
  • contact details;
  • company details;
  • travel dates;
  • itinerary details;
  • booking notes;
  • preferences;
  • dietary requirements;
  • accessibility information;
  • passport, visa or identity details where uploaded;
  • supplier details;
  • pricing or costing details;
  • emails or copied correspondence;
  • free-text notes;
  • other travel-related information.

4. Processing details

The subject matter of processing is the provision of Totem and related services.

The duration of processing is the term of the Customer’s use of Totem and any further period required for deletion, backup, legal, compliance or dispute purposes.

The nature and purpose of processing includes:

  • hosting;
  • storage;
  • retrieval;
  • organisation;
  • structuring;
  • analysis;
  • generation;
  • editing;
  • formatting;
  • transmission;
  • support;
  • troubleshooting;
  • security monitoring;
  • product improvement;
  • AI-assisted processing;
  • other processing necessary to provide Totem.

5. Customer obligations

The Customer must ensure that:

  • it has a lawful basis for processing Customer Personal Data;
  • it has provided all required privacy notices;
  • it has obtained all required consents where needed;
  • its instructions to us comply with applicable data protection law;
  • Customer Personal Data is accurate, relevant and not excessive;
  • sensitive personal data is only uploaded where necessary, lawful and appropriate;
  • users are authorised to access the relevant personal data;
  • it responds to data subject requests where required.

6. Processor obligations

We will:

  • process Customer Personal Data only on documented instructions from the Customer, including these Terms, the applicable order form and the Customer’s use of Totem;
  • ensure persons authorised to process Customer Personal Data are subject to confidentiality obligations;
  • implement appropriate technical and organisational security measures;
  • assist the Customer, taking into account the nature of processing, with data subject rights requests where reasonably possible;
  • assist the Customer with security, breach notification, data protection impact assessment and consultation obligations where reasonably required and taking into account the nature of processing;
  • notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data;
  • delete or return Customer Personal Data after the end of the services, unless retention is required by law or permitted by these Terms;
  • make available information reasonably necessary to demonstrate compliance with these Data Processing Terms.

7. Subprocessors

The Customer gives us general authorisation to use subprocessors to provide Totem and operate our business.

Subprocessors may include providers of:

  • cloud hosting;
  • storage;
  • AI models and infrastructure;
  • analytics;
  • logging;
  • error monitoring;
  • email;
  • authentication;
  • customer support;
  • payment processing;
  • CRM;
  • database services;
  • security tools;
  • productivity tools.

We may appoint, replace or remove subprocessors from time to time.

Where required by applicable data protection law, we will give notice of material subprocessor changes. If the Customer objects on reasonable data protection grounds, the Customer must notify us promptly. The Customer’s sole remedy if the objection cannot be resolved is to stop using the affected part of Totem.

We will take reasonable steps to ensure subprocessors are subject to appropriate contractual obligations.

We remain responsible for the performance of our subprocessors as required by applicable data protection law.

8. International transfers

Customer Personal Data may be processed outside the United Kingdom or European Economic Area.

Where required, we will use appropriate safeguards for international transfers, which may include adequacy decisions, standard contractual clauses, the UK International Data Transfer Agreement, the UK Addendum or other lawful transfer mechanisms.

9. Security measures

We will maintain reasonable technical and organisational measures designed to protect Customer Personal Data, which may include:

  • access controls;
  • authentication;
  • role-based permissions;
  • encryption where appropriate;
  • logging and monitoring;
  • secure cloud infrastructure;
  • backups;
  • supplier due diligence;
  • restrictions on access to customer data;
  • internal policies and procedures.

The Customer is responsible for configuring access controls and user permissions within its own workspace.

10. Personal data breaches

If we become aware of a personal data breach affecting Customer Personal Data, we will notify the Customer without undue delay.

We will provide information reasonably available to us to help the Customer meet its legal obligations.

Our notification of a personal data breach is not an admission of fault or liability.

11. Data subject requests

If we receive a request from an individual relating to Customer Personal Data, we may refer the request to the Customer unless legally required to respond ourselves.

The Customer is responsible for responding to data subject requests where it is the controller.

12. Audits

Upon reasonable written request, we will provide information reasonably necessary to demonstrate compliance with these Data Processing Terms.

Before requesting any audit, the Customer must first use information we make available, such as security summaries, policies, questionnaire responses or other compliance materials.

Any audit must be:

  • remote-first unless we agree otherwise;
  • limited to information relevant to the services provided to the Customer;
  • carried out during normal UK business hours;
  • subject to at least 30 days’ prior written notice unless shorter notice is legally required;
  • limited to once per year unless required by law or following a confirmed material personal data breach affecting Customer Personal Data;
  • conducted in a way that does not compromise the security, confidentiality, availability or data of Hyperion Labs, Totem or other customers.

The Customer and its auditors must not access source code, internal systems, other customer data, commercially sensitive information, privileged information or information that would create a security risk.

The Customer will bear its own audit costs and our reasonable costs of assisting with any audit, unless prohibited by law.

13. Deletion and return

Following termination of the services, we will delete or return Customer Personal Data in accordance with these Terms, the applicable order form or our standard data retention practices.

We may retain copies where required or permitted for legal, compliance, backup, security, dispute resolution or legitimate business purposes.

14. Liability

Each party’s liability under these Data Processing Terms is subject to the limitations and exclusions of liability in the main Terms of Service, unless prohibited by applicable law.

Schedule 2

Acceptable Use Policy

You must not use Totem to:

  • violate any law or regulation;
  • infringe intellectual property, privacy, confidentiality or other rights;
  • process personal data without appropriate rights, notices or lawful basis;
  • upload unnecessary sensitive personal data;
  • generate or distribute unlawful, deceptive, harmful or misleading content;
  • misrepresent travel services, pricing, availability or supplier terms;
  • send spam or unlawful marketing;
  • impersonate any person or organisation;
  • upload malware or harmful code;
  • interfere with the operation of Totem;
  • attempt to gain unauthorised access to Totem or related systems;
  • reverse engineer or copy Totem;
  • benchmark Totem or publish comparisons without our prior written consent;
  • use Totem, outputs or usage data to build, train, evaluate, improve or support a competing product or model;
  • create datasets from Totem outputs for competitive purposes;
  • exceed usage limits;
  • bypass security or access controls;
  • use Totem for high-risk decisions without appropriate human review.

We may investigate suspected breaches and suspend or terminate access where appropriate.

Mailing list

Sign up for our newsletter

Occasional notes on Totem—new capabilities, launches, and how operators are using AI in the workflow.