Service Facts

This sheet states how the platform operates as at the date above. It forms part of the Agreement. Where a date is given for something to change, that date binds the Supplier. Where no date is given, the statement is a statement of fact and not a commitment.

The contents were verified against the Supplier’s live systems on 14 September 2026, and the entries on backups were re-verified on 12 October 2026, as was the retention of analytics data. This sheet is updated as the position changes, and customers are notified in accordance with Core Terms clause 5.

1. Where Customer Data is stored

The above is the Supplier’s position as at the date of this sheet. No commitment is given here to change it. Where a Customer requires a specific hosting location by a specific date, that may be agreed in the Special Terms of the Order Form.

Transfers of personal data outside the UK and EEA, including to me-central1, are covered by the safeguards set out in the Data Protection Annex.

2. Analytics collected from Visitors

A HypaMap records, for each visit: session start, activity and end; search terms as entered; Points of Interest opened; link clicks; image, video and audio playback; route planning and wayfinding; tour progress; language and view changes; and errors.

Where a Visitor enables location in their browser, the HypaMap additionally records their precise coordinates on each position update, for the duration of that visit.

Each event carries a session identifier generated on page load and not retained thereafter. Google Analytics separately sets its own cookie containing a longer-lived identifier, which is outside the Supplier’s control.

There is no consent banner. As operator of the HypaMap the Customer is the controller, and the Visitor privacy notice and any consent required under the Privacy and Electronic Communications Regulations 2003 are the Customer’s to provide; the Supplier will provide the information reasonably required for that purpose. There is no consent mechanism or per-HypaMap analytics switch in the product at present. The Supplier will disable analytics for a Customer’s HypaMap within 10 Business Days of a written request.

Analytics data is kept in the Supplier’s analytics warehouse for as long as the Agreement continues, including while a HypaMap is on the Basic Plan, and is not deleted automatically after a fixed period. It is deleted under Core Terms clause 14.3 when the Agreement ends. Google Analytics applies its own retention setting to the copy it holds.

Visitors may refuse or withdraw location permission in their browser or in HypaView’s Location Sharing setting, and the location feature may be disabled entirely for a HypaMap on request.

3. Published map media

Images, video, audio and 3D assets in a published HypaMap are served from public storage and may be retrieved by any person holding the link. This is inherent in delivering a public map through a web browser without an application install. Customers should not place content in a HypaMap that is required to remain confidential or unannounced without first agreeing it with the Supplier.

4. Security

Measures in place: encryption in transit and at rest; credentials held in a managed secrets store; least-privilege cloud access with multi-factor authentication on Supplier accounts; keyless deployment credentials; passwordless sign-in for Authorised Users with a four-hour inactivity timeout; organisation-scoped access to HypaFlow and the platform API; automated daily database backups; centralised logging, retained for 30 days and 400 days for audit logs; reproducible builds and automated deployment; and a separate development environment which does not use Customer Data.

Measures not in place: the Supplier holds no security certification — neither Cyber Essentials, ISO 27001 nor SOC 2. The platform has never been independently penetration tested. The Supplier does not operate mandatory second-person code review; its controls are the automated build and consistency checks described above. Automated availability alerting does not cover HypaView or HypaFlow.

Where a Customer requires any of the above by a particular date, that may be agreed in the Special Terms of the Order Form.

The measures are set out in full in the Information Security Schedule, which is provided on request whether or not it is identified in the Order Form.

5. Backups and recovery

Automated daily database backups, encrypted, with the 30 most recent retained. The Supplier’s recovery target is 24 hours for both recovery point and recovery time. Point-in-time recovery is not currently enabled, and no documented restore test has been performed. The database is currently deployed in a single availability zone.

6. Availability

Unless Service Levels are identified in the Order Form, the Supplier gives no availability commitment, as it does not currently hold the monitoring required to evidence one. Support is provided 09:00–17:00 UK time, Monday to Friday, excluding English public holidays.

7. Accessibility

The Supplier designs HypaFlow and the non-3D interface elements of HypaView towards WCAG 2.2 Level AA, recognising that inherently visual 3D content cannot fully conform. No independent accessibility audit has been carried out and no accessibility statement has been published.

Customers subject to the Public Sector Bodies (Websites and Mobile Applications) (No. 2) Accessibility Regulations 2018 — including councils, universities and NHS trusts — are under a legal duty in respect of both. Additional Terms are available which commit the Supplier to a dated audit, a published accessibility statement and an agreed remediation plan.

8. Termination and data export

For 30 days after the Agreement ends, or after a HypaMap moves to the Basic Plan from a Subscription, the Customer may request its content in a common machine-readable format. The Supplier then deletes it within 60 days, save for anonymised data and anything retained as required by law. Deletion is performed as a documented manual procedure and confirmed in writing; database backups are overwritten on their normal cycle rather than selectively purged.

9. Contacts

Data protection: [email protected] · Support: [email protected] · Commercial: [email protected]

HypaMaps Ltd · Company no. 15135809 · 20 Wenlock Road, London N1 7GU