Privacy Policy.

Welcome to Envoy. The Envoy platform and the website at envoyhq.com are operated by BHCentral BV, a private limited company (besloten vennootschap) incorporated in Belgium, with registered office at Lange Kongostraat 82, 2140 Antwerp, Belgium, company number BE01037.773.997 (“Envoy”, “Company”, “we”, “our”, “us”, or “Parley”). BHCentral BV trades as “Envoy” and previously traded as “Parley”. This Privacy Policy explains how we collect, use, disclose, and protect your personal information. Envoy provides an AI-powered procurement platform that uses autonomous AI agents. This policy applies to information collected when you use our services, visit our website at envoyhq.com, or interact with us in other ways. For the purposes of applicable data protection law, BHCentral BV is the controller of the personal data described in this policy, except where we process personal data on behalf of our Enterprise Customers as described in Section 7.

We collect information from you in various ways when you use our services, including:

2.1 Information You Provide to Us

We collect information you provide directly to us, such as when you create an account, fill out a form, or communicate with us. This information may include:

• Name
• Business email address
• Company or organization name
• Business address
• Country
• Job title or role
• Any other information you choose to provide

2.2 Information We Collect Automatically

We automatically collect certain information about your interactions with our services, including:

• Activity Information: Information about your activity on our services, such as your interactions and communications.
• Device and Usage Information: Information about how you access our services, including your device type, operating system, IP address, unique device identifiers, browser type, and app version. We also collect information about your activity on our services, such as access times, pages viewed, and links clicked.

2.3 Information from Integrated and Third-Party Systems

To provide our services, we integrate with the systems that you or your organization connect to Envoy, such as ERP and other procurement systems, spend management tools, email and internal communication platforms, file repositories. Through these integrations we process business data such as purchase orders and requisitions, supplier and vendor records, contracts, invoices, and spend and transaction data. This data may include personal information relating to your personnel and to the representatives of suppliers and other counterparties (for example names, business contact details, and job titles). Where we process this information on behalf of an Enterprise Customer, that customer is responsible for ensuring there is a lawful basis for the processing and for providing any privacy notices required to the individuals concerned.

We use the information we collect to:

• Provide, maintain, improve, and develop our products and services
• Manage and authenticate accounts
• Send technical notices, security alerts, support messages, and other transactional or relationship messages
• Monitor and analyze trends, usage, and activities in connection with our services
• Detect, investigate, and help prevent security incidents and other malicious, deceptive, fraudulent, or illegal activity
• Comply with our legal and financial obligations
• Create de-identified, anonymized, or aggregated information
• Carry out any other purpose described to you at the time the information was collected
• Operate our AI agents to perform procurement tasks – such as sourcing, supplier negotiation, and vendor management – on your behalf
• Send marketing communications providing the right to opt out at any time

Automated Processing and AI Agents

Envoy uses AI agents and automated processing to perform procurement tasks on behalf of our customers, subject to human oversight and configurable guardrails. We do not use your data or content to train generative AI models without your explicit prior consent.

Our AI agents do not make decisions that produce legal or similarly significant effects for individuals solely by automated means; procurement decisions remain subject to either human oversight or defined by preferences set by you or your organization, and our Enterprise Customers retain control over agent guardrails and approvals. If you believe an automated decision has significantly affected you, you can contact us to request human review of that decision (Article 22 GDPR).

We disclose personal information in the following circumstances:

• With Enterprise Customers on whose behalf we have collected that information
• With vendors who perform work for us, such as cloud hosting, infrastructure, and analytics providers
• With suppliers, vendors, and other counterparties, as necessary to carry out sourcing, negotiation, and procurement activities on your behalf
• If required by law or legal process, including requests by public authorities
• If necessary to protect the rights, property, and safety of Envoy, our users, or others
• With our lawyers and professional advisors where necessary
• In connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business
• With third-party processors who are contractually bound to keep the information confidential and use it only for providing our services
• With your consent or at your direction

Envoy is headquartered in Belgium, and our data, including personal and company data, is hosted in the United States and/or Europe (available in one geography upon request). We ensure appropriate safeguards are in place to protect your data in compliance with applicable data protection laws.

Where we or our sub-processors process personal data outside the European Economic Area (for example, where a service provider operates in the United States), we put in place the appropriate safeguards required by applicable data protection law, such as the European Commission's Standard Contractual Clauses or reliance on an adequacy decision.

You have certain choices regarding your personal information, including:

• Requesting access to, correction of, or deletion of your personal information
• Objecting to or restricting the processing of your personal information
• Withdrawing your consent for us to use your personal information
• The right to object, on grounds relating to your particular situation, to processing based on our legitimate interests (Article 21 GDPR)
• The right to data portability, i.e. to receive the personal data you provided to us in a structured, commonly used, and machine-readable format
• Please note that withdrawing your consent does not affect the lawfulness of any processing we carried out before you withdrew it

To exercise these rights, please contact us at privacy@envoyhq.com. We will respond to your request in accordance with applicable data protection laws.

If you are located in the European Economic Area (“EEA”), the United Kingdom (“UK”), or Switzerland, the following provisions apply:

• Legal Basis for Processing: We process your personal information under the direction of our Enterprise Customers, who determine the lawful basis for processing.
• Where Envoy acts as a controller – for example, in relation to your account, business contact details, website usage, and platform security – we rely on the following legal bases under the GDPR: the performance of a contract or pre-contractual steps (Article 6(1)(b)); our legitimate interests in operating, securing, and improving our services (Article 6(1)(f)); compliance with our legal obligations (Article 6(1)(c)); and, where applicable, your consent (Article 6(1)(a)). Any special category data is processed only where a condition under Article 9 GDPR applies.
• Data Subject Requests: You have the right to access, correct, or delete your personal information, restrict processing, and object to processing. To exercise these rights, contact us at privacy@envoyhq.com, and we will respond directly where we act as controller or, where we process your personal information on behalf of an Enterprise Customer, forward your request to the relevant customer.

We implement strong technological and organizational safeguards to protect your personal data. While no internet transmission is completely secure, we strive to protect your data and ensure it is handled securely. If you have any concerns about your data security, please contact us.

Our safeguards include encryption of data in transit (SSL/TLS) and at rest, access controls, and regular review of our security measures. Where we engage sub-processors to process personal data on our behalf, we put in place data processing agreements requiring them to process personal data only on our documented instructions and in compliance with the GDPR.

We use cookies to enhance your browsing experience and to collect information about how you use our services.

Some cookies are strictly necessary to operate our website, while others help us understand usage and improve our services. Cookies may be session cookies (deleted when you close your browser) or persistent cookies (which remain until they expire or you delete them), and may be set by us or by third parties. Where required by law, we use non-essential cookies only with your consent, which you can manage or withdraw at any time, including through your browser settings.

Our services are intended for business users and are not directed to individuals under 18 years of age. We do not knowingly collect personal data from children. If we become aware that we have inadvertently collected personal data from a child, we will delete that information.

Envoy's platform is designed to process business and procurement data and is not intended to collect or process special category (sensitive) personal data. We do not perform facial recognition or biometric identification. We ask customers not to upload sensitive personal data to the platform, and where any sensitive data is provided, the customer determines the lawful basis for its processing.

We retain personal data only as long as necessary for its lawful purpose. Once data is no longer needed, we securely dispose of it. We determine retention periods based on the duration of our agreement with the relevant Enterprise Customer, the nature and sensitivity of the data, and our legal obligations. Our electronic systems are backed up and archived for a defined period of 90 days, after which the data is permanently deleted.

In some cases we may be required to retain certain information for a longer period to comply with legal, accounting, tax, or reporting obligations, after which it is securely deleted or anonymized.

If you have any questions or feedback, please contact our privacy team at dpo@envoyhq.com or by mail at Envoy, Lange Kongostraat 82, 2140, Antwerp, Belgium. If you are not satisfied with how we handle your personal data, you have the right to file a complaint with a supervisory authority.

We regularly review and update our privacy policy. The latest version is always available on this web page. We keep track of when the policy was last revised.