Privacy policy

At HypaSpace we take your privacy seriously. This Privacy Policy explains how we collect, use, store and protect any personal data you provide when you visit our website hypaspace.io (“Our Site”), interact with our services, or contact our team. It is written to be readable, not legalistic, and it complies with the UK General Data Protection Regulation (UK GDPR), the EU GDPR where applicable, and the Data Protection Act 2018.

If you have any questions about this policy or about your personal data, please contact us using the details in Part 18.

1. Information about us

Our Site is owned and operated by HypaMaps Ltd, trading as HypaSpace, a private limited company registered in England and Wales (company no. 15135809). Our registered office and primary contact email are set out in Part 18.

HypaMaps Ltd is the Data Controller for the personal data we collect through this Site and our services.

When our clients use our platform, we also handle personal data on their behalf: their staff’s HypaFlow accounts, and what visitors do on their maps. For that data the client is the controller and we act as their processor, under our Data Protection Annex. The client’s own privacy notice explains it, so please contact them first. This Privacy Policy does not cover it.

2. What does this Privacy Policy cover?

This Privacy Policy covers personal data we collect and process when you use Our Site, book a call or request a demo, send us a Join us message or a drone operator application, ask for one of our white papers, sign in to our customer portal, become a client, or otherwise engage with us. It applies whether you interact with HypaSpace as an individual, an employee of a client organisation, or a representative of a partner.

Our Site may contain links to third-party websites, products and services. We are not responsible for the privacy practices of those third parties. We recommend reading their privacy policies before sharing any personal data with them.

3. Your rights

Under UK GDPR, you have the following rights in relation to your personal data:

The right to be informed about our collection and use of your personal data. This Privacy Policy should tell you everything you need to know, but you can always contact us to find out more or to ask any questions using the details in Part 18.
The right of access to the personal data we hold about you. Part 15 tells you how to do this.
The right to rectification if any of your personal data is inaccurate or incomplete.
The right to erasure (“the right to be forgotten”), i.e. the right to ask us to delete or otherwise dispose of any personal data we hold.
The right to restrict (i.e. prevent) the processing of your personal data.
The right to object to us using your personal data for a particular purpose or purposes.
The right to data portability. If you have provided personal data to us directly, we are using it with your consent or for the performance of a contract, and that data is processed using automated means, you can ask us for a copy of that personal data to re-use with another service or business.
Rights relating to automated decision-making and profiling. We do not use your personal data in this way.

For more information about our use of your personal data or to exercise any of your rights, please contact us using the details in Part 18. Further information about your rights can also be obtained from the Information Commissioner’s Office (ICO) at ico.org.uk.

4. What is personal data?

Personal data is defined by the UK GDPR as “any information relating to an identified or identifiable natural person.” In simpler terms, personal data is any information about you that enables you to be identified, either on its own or in combination with other information.

5. What personal data do we collect?

Depending on how you interact with Our Site and our services, we may collect:

Name
Job title and organisation
Business email address
Telephone or mobile number
Postal address (clients only)
Information about your role and interests, including whether you make purchasing decisions
The email addresses of colleagues you invite to a call, and anything you tell us in a booking’s notes
The time of a call you book, and the time zone you chose it in
What you tell us in a Join us message or a drone operator application, such as where you are based, the aircraft you fly, your experience and links to your work
If you ask for one of our white papers, which paper you asked for, your role if you give it, and whether you would like to hear about new ones
If you sign in to our customer portal, the email address you sign in with and your organisation’s name
Your IP address, web browser and operating system, which reach our hosting provider with every visit so that it can deliver Our Site and protect it from attacks

Our Site has no analytics: we do not record which pages you view or where you came from.

We do not knowingly collect or process payment information, special-category personal data (such as health or biometric data), or personal data relating to children through Our Site.

6. How do we use your personal data?

We use the personal data we collect for the following purposes:

Providing Our Site and keeping it secure.
Supplying our products or services to you. Your contact details are required for us to enter into a contract.
Communicating with you. This may include responding to emails or calls from you, following up on demo requests and holding the calls you book.
Considering Join us messages and drone operator applications, and replying to them.
Opening the white papers you ask for, and knowing who reads them.
Giving our clients’ teams access to the guides and videos in our customer portal.
Supplying you with information by email that you have opted in to. You may unsubscribe or opt out at any time using the link provided in any such email.

With your explicit consent and/or where permitted by law, we may also use your personal data for marketing purposes, typically inviting you to events or webinars, or sharing material relevant to your role. You have the right to withdraw consent at any time.

We legally base our processing on one or more of the following: your consent; performance of a contract with you (or steps requested by you to enter a contract); compliance with a legal obligation; or our legitimate interests in operating and improving our business, provided those interests do not override your rights.

7. Booking a call

When you book a call on our Book a call page, we ask for your name, email address, company, job role and mobile number, and whether you are the decision maker. You can also give us the email addresses of colleagues you would like to join, and notes for us. We record the time you pick and the time zone you picked it in.

We use these details to arrange the call, to send the details to you and to anyone you invite, and to prepare for it. We use your mobile number only to reach you if we can’t join the call. We rely on the steps you have asked us to take before any contract, and on our legitimate interest in answering business enquiries. For anyone you invite, we rely on our legitimate interest in arranging the meeting you asked for. We use their address only to put them on the invitation and copy them into the confirmation email, so please let them know before you add them.

Three services handle a booking for us:

Google Workspace (Google Calendar and Google Meet): the call is saved in our team’s shared calendar and in the calendars of the colleagues who will join it, with your details in its description. The call itself takes place on Google Meet. Google provides both to us as part of Google Workspace, under its data processing terms, and does not send invitations on our behalf.
Postmark (ActiveCampaign): sends your confirmation email, copied to anyone you invited, and a copy of the booking to our team. We do not track whether these emails are opened or their links clicked.
Cloudflare: hosts the page and runs the code that makes the booking. Your details pass through it on their way to Google and Postmark. Our booking code does not store or log them.

Google and Postmark may process these details in the United States. Part 11 explains how we protect data that leaves the UK.

The quick picture check on the booking form works entirely in your browser: nothing about how you tap is sent to us. Booking a call sets no cookies, and the page has no tracking.

We keep the calendar event and the booking emails as our record of the call, as set out in Part 12. You can ask us to delete them sooner using the details in Part 18.

8. Join us, drone operator applications and white papers

On our About page you can tell us you would like to join us, and on our Drone operators page you can apply to capture imagery for us. Both forms ask for your name and email address. Join us also asks what interests you and a little about yourself, with an optional link. The operator application also asks where you are based, the aircraft you fly, your experience, a link to your portfolio and, if you like, to footage and a message, and asks you to confirm that you are 18 or over.

When you send either form, Our Site emails it to our team through Postmark, with your address set as the reply-to so that we can answer you directly. Nothing is sent to you automatically: a person will reply. Our Site does not store what you send, and its code does not log it. The email is kept in our team’s Google Workspace mailbox. The quick picture check on both forms works entirely in your browser, like the one on the booking form.

We use these details only to consider your message or application and to reply to you. We rely on the steps you have asked us to take, and on our legitimate interest in finding people to work with. Please do not include health or other special-category information.

Each of our white papers has a page in Resources with a short form that opens it. The form asks for your name, your work email address and your organisation, and, if you like, your role, and you can tick a box to be emailed when we publish a new white paper or article. When you send it, Our Site emails your request to our team through Postmark, in the same way, and sets a cookie called hs_papers so that your browser can open the paper, now and when you come back. That cookie names the papers you have asked for and when it ends; it holds nothing about you, is signed so that it cannot be altered, and lasts 180 days.

We use these details to know who is reading our papers, and we may contact you about your interest in them. We rely on our legitimate interest in understanding and answering interest in our work. We email you about new papers and articles only if you ticked the box (your consent), and you can unsubscribe at any time.

9. Our customer portal

Our clients’ teams can sign in on our Resources page to open the guides and videos that come with our service. Signing in uses your existing HypaFlow account (HypaFlow is our platform):

You enter the email address you use for HypaFlow. Our Site passes it to HypaFlow, which emails you a 6-digit code, through Postmark, if that address has an account. Our Site shows the same message either way, so it cannot be used to find out who our clients are.
You enter the code, and Our Site passes it to HypaFlow to check. HypaFlow stores each code only in a scrambled (hashed) form, and a code works once, for 5 minutes.
When the code is right, Our Site asks HypaFlow once for your organisation’s name, so that it can greet you, and sets a cookie called hs_portal. It holds your email address, that name and when your sign-in ends, and it is signed so that it cannot be altered. It lasts 7 days, and signing out removes it.

Our Site keeps no list of who signs in, and its code does not log what you enter. HypaFlow handles your address and the code as it does whenever you sign in to HypaFlow. It runs on Google Cloud in Qatar, and Part 11 explains how we protect data that leaves the UK. We rely on our legitimate interest in giving our clients’ teams the guides that come with our service.

10. People in our imagery

To build our clients’ maps, we and our capture partners record aerial and ground imagery of their locations (“Our Imagery”). People who were there at the time can sometimes appear in it. We decide how Our Imagery is recorded, used and kept, so we are its controller, as our Data Protection Annex explains. We rely on our legitimate interest in mapping places for our clients.

We do not use Our Imagery to identify anyone. If you believe you can be identified in it, please contact us using the details in Part 18, and tell us the place and roughly when you were there. We will look into it and, where we can, remove or obscure you.

We do not sell your personal data. We share it only with trusted third parties who help us operate the business and only to the extent necessary. This includes:

Hosting and security (Cloudflare): serves Our Site, runs its booking, forms and sign-in code, and handles DNS and protection against attacks.
Email, calendar and video calls (Google Workspace): holds the calls booked on Our Site and hosts them on Google Meet (Part 7), and receives Join us messages, operator applications and white paper requests in our team’s mailbox (Part 8).
Email delivery (Postmark): sends booking confirmations, the team’s copy of each booking and of each form, and HypaFlow’s sign-in codes (Parts 7 to 9).
Our platform (HypaFlow, on Google Cloud): checks sign-ins to our customer portal (Part 9).
Professional advisors: accountants, auditors and legal counsel where required.

Google and Postmark may process personal data in the United States, and HypaFlow runs on Google Cloud in Qatar. Where personal data leaves the UK, we make sure an appropriate transfer mechanism is in place: the UK International Data Transfer Agreement, or the EU Standard Contractual Clauses with the UK Addendum.

12. How long will we keep your personal data?

We will not keep your personal data for longer than is necessary in light of the reason(s) it was collected. Specifically:

Enquiries you email us are retained while we are corresponding with you, plus a short period thereafter (typically 24 months) to maintain a record of the enquiry.
Call bookings (the calendar event and the booking emails) are retained in the same way: while we are in touch, then typically 24 months after our last contact. If you become a client, the client periods below apply.
Join us messages are retained while we are in touch, then typically 12 months after our last contact, so that we can come back to you if the timing is right later.
Drone operator applications are retained while we are in touch, then typically 24 months after our last contact. If you go on to work with us, we keep our records of that work for the periods tax and accounting law require (typically 6 years).
White paper requests are retained while we are in touch, then typically 24 months after our last contact. If you asked to hear about new papers and articles, we keep your email address for that until you unsubscribe.
A sign-in to our customer portal lasts 7 days, or until you sign out. Our Site keeps nothing about it afterwards.
Client records are retained for the duration of the contractual relationship plus the periods required by applicable tax, accounting and regulatory law (typically 6 years).
Marketing subscriptions are retained until you unsubscribe.

13. How can you control your personal data?

In addition to your rights set out in Part 3, when you submit personal data through Our Site you may be given options to restrict our use of it. You can always opt out of marketing communications using the unsubscribe link in any email, or by contacting us directly.

14. Your right to withhold information

You may access Our Site without providing any personal data at all. However, to use certain features (such as booking a call) you will need to provide certain information. We will only request what is reasonably necessary for the relevant purpose.

15. How can you access your personal data?

You have the right to ask for a copy of any of the personal data we hold about you. Under UK GDPR, no fee is payable and we will respond within one month. To make a request, contact us using the details in Part 18 and include “Subject Access Request” in your subject line.

16. How do we use cookies?

Our Site uses no analytics or advertising cookies, and nothing on it tracks you. It uses only what it needs to work:

hs_portal: keeps you signed in to our customer portal (Part 9). It is set only when you sign in, lasts 7 days, and is removed when you sign out.
hs_papers: lets you read the white papers you have asked for (Part 8). It is set only when you ask for one, names those papers and nothing about you, and lasts 180 days.
hs_preview: set only if you enter a password to preview Our Site, or a part of it, before it is public. It lasts 30 days.
Session storage: on pages with a sub-menu, your browser remembers how far you scrolled along it, for that browser tab only. Nothing is sent to us.
Cloudflare: our hosting provider may set a cookie of its own if it needs to check that a visitor is not an automated program.

These are strictly necessary for Our Site to work, so they do not need your consent.

Some pages let you open a client’s live map. It loads from our map platform at 3d.hypamaps.com only when you open it. That map belongs to our client: it may use analytics, and your visit is counted in that client’s statistics, under the client’s own privacy notice.

17. How do we keep your personal data secure?

We take appropriate technical and organisational measures to protect personal data from unauthorised access, disclosure, alteration or destruction. These measures include access controls, encryption in transit, secure hosting, and regular review of our systems. While no internet transmission is completely secure, we treat the security of your data as a priority.

18. How can you contact us?

To exercise any of your rights, make a complaint, or ask any question about this Privacy Policy or how we handle your personal data, please contact us at:

HypaMaps Ltd, trading as HypaSpace
20 Wenlock Road, London N1 7GU
[email protected]

If you are not satisfied with our handling of your personal data, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO): ico.org.uk/make-a-complaint.

19. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in the law, best practice, or how we operate. When we do, we will update the “Last updated” date at the top of this page. We encourage you to review this Privacy Policy periodically so you are aware of how we are protecting your personal data.