A little clarity
about this website.

Who is responsible?

Clarity Secure Ltd is the data controller for personal information processed in connection with this website. HopVia is our public product brand, not a separate legal entity.

Clarity Secure Ltd is registered in England and Wales, company number 16980283. Registered office: Rasa Sayang, Epping Road, Waltham Abbey, United Kingdom, EN9 2DH.

For privacy enquiries or to exercise your rights, email admin@claritysecure.co.uk or write to our registered office, marking your correspondence “HopVia privacy”.

What this website does

This is a static marketing website about a developing travel idea. The journey stories are illustrations, not live fares, verified timetables or bookable offers. Registration and journey-idea submissions are not open. There are no account, signup or research forms and no marketing-email collection through this website.

Browsing, cookies and local storage

The route animation, replay and journey panels run in your browser. This website does not save those interactions in browser storage, set tracking cookies or use analytics. Images, fonts where present, styles and scripts are served from the website itself. It does not automatically load third-party analytics, advertising, embedded maps or remote fonts.

Following an external link or emailing us involves the service you choose to use. Those services have their own privacy information. Security notifications sent to our support systems do not create a marketing subscription.

Hosting and security information

Our hosting service may process IP addresses, connection and request times, requested pages, browser or device information and technical errors to deliver and protect the website. Disabling registration does not mean that no personal information is processed.

We use OVHcloud infrastructure for hosting. Dedicated website security records contain coarse page categories, response status, timing and broad automated-client classifications. These dedicated records exclude source IP addresses, request bodies, raw URLs and query strings, request headers and user identifiers. Shared hosting, TLS, system and error records may still contain technical connection information, including IP addresses. The dedicated log policy does not describe every record held by the hosting infrastructure.

Monitoring is availability-first and best-effort. Pages may remain available when logging, processing or notifications fail. Some records may be missing, lost under capacity pressure or unavailable earlier than the maximum retention period. Security logs are not a complete record of website activity. We use detection and operational review, not automatic IP blocking. A lack of recent notification evidence or a monitoring failure does not by itself establish that the website is compromised or that it is secure.

Why information is processed

Website delivery relies on our legitimate interests in providing information about HopVia. Proportionate security monitoring relies on our legitimate interests in protecting visitors and services, detecting misuse and investigating technical problems.

For ordinary contact enquiries, we use the details you provide to respond and manage necessary follow-up, relying on our legitimate interests in handling enquiries. We process data-protection rights requests, including proportionate identity checks where needed, to comply with our obligations under UK data-protection law. We also process information where necessary to comply with applicable legal obligations. We do not use this website to collect marketing consent.

Retention and incident evidence

The routine per-site security-log policy is a maximum of 30 days. Eligible closed records are expired through the retention process. Rotation alone does not enforce time-based expiry. A file still being written cannot safely be deleted or truncated by that process: an active-file overrun is reported as degraded monitoring and requires operator review. Records can therefore remain beyond the policy limit while such an overrun is addressed. We do not promise strict active-file expiry or complete capture.

Records needed for an incident investigation or legal obligation may be preserved separately following explicit operator authorisation, with a recorded reason, integrity check and review or retention decision. Ordinary logs are not automatically exempted and incident evidence is not retained indefinitely by default. Shared infrastructure diagnostics have separate operational policies and are not all covered by the dedicated 30-day process.

For ordinary privacy and contact enquiries, our retention policy is 12 calendar months from recorded case closure. The founder is the Clarity Secure Privacy and Retention Owner. Closure is recorded after resolution and outstanding follow-up are complete, not when an email arrives. Reopening cancels the old eligibility date until a genuine reclosure is recorded. Unresolved cases remain under review. The manual process requires a daily due-list and consistency check, weekly exception and audit check, monthly signed founder review, fresh hold and copy checks and explicit per-case disposal approval. The date identifies eligibility for authorised disposal, not a guaranteed date on which every copy disappears.

Privacy enquiries are received at admin@claritysecure.co.uk in a Microsoft 365 user mailbox (UserMailbox). It has no mailbox archive or forwarding configured. Recovery and preservation controls may still apply; these are checked before disposal is approved. Mailbox-wide age-based settings do not implement retention measured from recorded case closure. We do not claim that correspondence is automatically deleted after a fixed period.

We use a restricted-access SharePoint register for minimal case references, closure dates, reviews, holds and disposal decisions, not customer message bodies. Access is limited to authorised personnel, including administrative access. Native version history and Recycle Bin recovery are available; independent backup is not configured. The register does not itself delete correspondence.

Linked attachments, recoverable copies and any backups must be reconciled before disposal is recorded as complete. Moving messages is not deletion, and deleting a live message does not establish that every copy has gone. Recovery copies remain subject to their applicable controls. Incident correspondence, active disputes, legal holds and applicable contractual or statutory obligations require a separately justified retention decision and review. These exceptions override routine disposal; no indefinite exception or guaranteed all-copy deletion date is implied.

Providers and support

OVHcloud provides hosting infrastructure. Microsoft 365 processes email, including privacy correspondence and operational security notifications, and the SharePoint retention register. Our separate support and security-notification workflow uses Zammad hosted on our infrastructure. Zammad does not ingest correspondence from this privacy mailbox; any future manual copy would need to be recorded and reviewed separately. Fasthosts provides this domain’s DNS service. Authorised operators and relevant providers may handle information needed for website delivery, maintenance, security and correspondence.

Our website server is hosted in France. Microsoft 365 reports United Kingdom storage at rest for Exchange Online and SharePoint. These storage locations do not mean that all support, security or diagnostic processing takes place in those countries. Microsoft’s contractual terms permit processing in the United States and other countries where it or its subprocessors operate. For transfers of personal information from the UK covered by its Data Protection Addendum, Microsoft commits to the European Commission’s standard contractual clauses supplemented by the UK International Data Transfer Addendum. Other provider processing is governed by the applicable service and data-protection terms; a UK adequacy regulation may cover a transfer to a recognised country or sector. You can contact admin@claritysecure.co.uk for details of the arrangements relevant to your information and how to obtain a copy of the relevant safeguards.

Your rights and concerns

Under the UK GDPR and Data Protection Act 2018, applicable rights may include access, correction, erasure, restriction, objection and portability, depending on the circumstances. You can object to processing based on legitimate interests. If processing relies on consent, it can be withdrawn; this website does not currently collect signup consent. Contact us using the details above. We may need proportionate information to establish your identity.

You can also complain to the Information Commissioner’s Office, the UK data-protection regulator, through ico.org.uk/make-a-complaint.

Changes to this notice

We will update this notice if our use of personal information changes. Registration, journey submissions, accounts or analytics would require separate consideration and updated privacy information. They remain disabled on this website.