Terms of Service

1. Our Roles and Customer Content

Envoy acts as a controller when it determines why and how personal data is processed, such as information used to administer accounts, operate our business, communicate with customers, and market the Services. Where an Envoy affiliate jointly determines the purposes and means of processing with Envoy, the entities may act as joint controllers.

The Services also allow customers to upload, submit, store, manage, and share data, files, text, images, order information, and other materials ("Customer Content"). For Customer Content, the customer ordinarily acts as the controller and Envoy acts as its processor or service provider. We process Customer Content under the customer's instructions, our agreement with the customer, and applicable law. Questions or requests concerning Customer Content should generally be directed to the customer that provided or controls the information. We will assist customers in responding to applicable requests as required by our agreements and applicable law.

Customers are responsible for ensuring that Customer Content is collected and used lawfully. Envoy does not intentionally request sensitive personal data for its own purposes, although customers may include such information in Customer Content. If you submit Customer Content, you should provide only information that you are authorized to provide.

2. Personal Data We Collect

Depending on how you interact with the Services, we may collect:

• Account and business contact information: name, business email address, telephone number, company, company size, job title, account credentials, system-administrator details, language, region, and account preferences.
• Billing and transaction information: billing and shipping addresses, subscription and order information, payment status, and limited payment-related information. Payment card information may be collected directly by a payment processor acting under its own privacy terms.
• Customer Content: information that customers or their users upload, submit, store, or share through the Services, including product, order, customer, shipping, file-attachment, form-response, and collaboration data.
• Communications and support information: messages, support requests, survey responses, chat content, call information or recordings where permitted by law, and other information you choose to provide when communicating with us.
• Usage, device, and log information: IP address, device and browser type, operating system, device identifiers, pages and features used, links selected, referring URL, approximate location derived from IP address, access and activity logs, timestamps, and diagnostic or performance information.
• Marketing and lead information: business contact and interest information received through forms, events, public sources, resellers, referrals, advertising services, and professional-networking or lead-generation services.

We collect personal data:

• directly from you when you create an account, purchase or use Services, submit a form, or communicate with us;
• from customers, account administrators, employers, authorized users, resellers, integration partners, and other third parties;
• automatically through the Services, cookies, pixels, local storage, logs, and similar technologies; and
• from public and commercially available sources, subject to applicable law.

If information is required to create an account, perform a contract, comply with law, or provide a requested feature, failure to provide it may prevent us from providing some or all of the Services.

3. How We Use Personal Data

We may use personal data to:

• create, authenticate, administer, secure, and support accounts;
• provide, operate, maintain, personalize, and improve the Services;
• process subscriptions, orders, payments, and other transactions;
• enable customer-directed collaboration, sharing, notifications, integrations, and other requested features;
• respond to inquiries, requests, complaints, and support matters;
• send service, security, administrative, and transactional communications;
• send marketing communications where permitted by law and manage marketing preferences;
• measure performance, understand use of the Services, conduct research and analytics, and develop products and features;
• advertise and promote the Services, subject to applicable consent and opt-out requirements;
• protect the Services, customers, users, Envoy, and others; prevent fraud and misuse; and investigate security incidents;
• enforce our contracts, policies, and legal rights; and
• comply with applicable law, legal process, regulatory requirements, and lawful requests.

Envoy does not use Customer Content for its own direct-marketing purposes.

4. Legal Bases for EEA and UK Processing

When the EU General Data Protection Regulation ("EU GDPR") or UK General Data Protection Regulation ("UK GDPR") applies and Envoy acts as a controller, our legal bases may include:

• Contract: processing necessary to enter into or perform a contract with you or provide requested Services;
• Legitimate interests: operating, securing, supporting, improving, and promoting our business and Services, provided those interests are not overridden by your rights and interests;
• Consent: where we ask for and you provide consent, including for certain marketing, analytics, advertising, or cookie activities; and
• Legal obligations and legal claims: complying with law and establishing, exercising, or defending legal rights.

Where Envoy acts as a processor, the customer determines the applicable legal basis for processing Customer Content.

5. How We Disclose Personal Data

Envoy does not sell personal data or disclose personal data to third parties for their own direct-marketing purposes. We may disclose personal data as follows:

• Customers, administrators, and authorized users: account, Customer Content, usage, and collaboration information may be made available to the customer, its account administrators, and users with whom information is shared or made accessible.
• Service providers and subprocessors: vendors and contractors that provide cloud hosting, databases, communications, customer support, billing, payment, security, connectivity, analytics, user-experience, marketing, and other business or technical services. Their access is limited to the services they perform, and we use contractual protections as required by applicable law.
• Payment processors and resellers: payment, billing, subscription, and account information may be disclosed as needed to process a transaction or administer a commercial relationship. Certain payment processors or resellers may act as independent controllers under their own privacy notices.
• Professional advisers and independent contractors: advisers, auditors, insurers, and contractors that require information to provide services to Envoy and are subject to appropriate confidentiality or contractual duties.
• Legal, security, and safety disclosures: government authorities, regulators, courts, law-enforcement bodies, or other parties when we believe disclosure is required by law or legal process, or is reasonably necessary to protect rights, safety, property, the Services, or the public.
• Business transactions: prospective or actual purchasers, investors, financing sources, and advisers in connection with a merger, acquisition, financing, reorganization, bankruptcy, or sale of some or all of our business or assets, subject to appropriate protections.
• At your direction or with your consent: recipients you direct us to share with or authorize to receive information.

We may also disclose information that has been aggregated or de-identified so that it is not reasonably capable of identifying an individual, subject to applicable law.

6. Cookies and Similar Technologies

We use cookies, pixels, local storage, logs, and similar technologies to authenticate users, maintain sessions, remember settings, secure and operate the Services, understand usage, improve performance, and support analytics and advertising. Depending on the Service, these technologies may include:

• Strictly necessary technologies required for authentication, security, load balancing, and core functionality;
• Functional technologies that remember choices, settings, and interface preferences; and
• Analytics and tracking technologies that help us understand visits, sessions, and interactions and improve user experience.

Where required, we obtain consent before using non-essential cookies or similar technologies. You may manage available choices through our cookie-consent tool and your browser settings. Blocking or deleting cookies may affect some features. For details about the technologies currently used, their providers, purposes, and durations, see the Envoy Cookie Table.

7. Your Choices and Rights

Account and marketing choices

You may update certain account information through the Services or contact us for assistance. You may opt out of marketing emails using the unsubscribe link in an email or by contacting privacy@envoyb2b.com. Even after opting out of marketing, you may continue to receive transactional, service, security, and administrative communications.

EEA and UK rights

Subject to applicable law and exceptions, individuals in the European Economic Area ("EEA") and United Kingdom may have the right to:

• request access to and a copy of their personal data;
• request correction of inaccurate or incomplete personal data;
• request deletion of personal data;
• request restriction of processing;
• object to processing based on legitimate interests or for direct marketing;
• receive qualifying personal data in a portable format or request its transfer;
• withdraw consent at any time, without affecting processing performed before withdrawal;
• obtain information about safeguards used for applicable international transfers; and
• complain to a competent data protection authority.

DPF choices

For personal data covered by the Data Privacy Framework Principles, you may opt out of disclosure to a non-agent third party or use for a purpose materially different from the purpose for which the information was originally collected or subsequently authorized. To exercise either choice, email privacy@envoyb2b.com and describe the choice you wish to exercise.

Customer-controlled data

If a request concerns Customer Content controlled by an Envoy customer, please contact that customer. You may also contact us and identify the relevant customer; we will refer the request to the customer and provide assistance as appropriate. We may take reasonable steps to verify identity and authority before processing a request.

8. Data Retention

We retain personal data for as long as reasonably necessary for the purposes described in this Policy, to provide the Services, comply with legal obligations, resolve disputes, enforce agreements, protect against fraud and abuse, and establish or defend legal claims.

When we no longer have a legitimate business or legal need for account-profile data, we generally delete or de-identify it within 180 days after account closure. Some records may be retained for up to seven years after the last relevant communication when reasonably necessary for tax, accounting, contractual, or legal-claim purposes. Information retained solely for direct marketing is generally retained for no more than two years after an individual ceases to be a customer, unless the individual opts out sooner or a different period is required or permitted by law.

Customer Content is retained and deleted in accordance with the applicable customer agreement, customer instructions, backup practices, and legal requirements. Upon termination, customers may request return or deletion of Customer Content as provided in their agreement with Envoy.

9. Data Security

We maintain technical, administrative, and physical safeguards designed to protect personal data against unauthorized access, loss, alteration, disclosure, or misuse. Envoy's security practices are examined through SOC 2 Type II reporting, and the Envoy platform is penetration tested at least annually. No security measure or Internet transmission is completely secure, and we cannot guarantee absolute security.

10. International Transfers and Data Privacy Framework Notice

Envoy is based in the United States. Personal data may be transferred to, accessed from, and stored in the United States and other jurisdictions in which Envoy, its affiliates, customers, or service providers operate. Customer Content is stored in North America or the European Union and is transferred in accordance with customer instructions, contractual commitments, and applicable law. Where required, Envoy uses a recognized transfer mechanism, such as the Data Privacy Framework, an applicable adequacy decision, Standard Contractual Clauses, or another legally recognized safeguard.

EU-U.S. DPF and UK Extension

Appropos, LLC d/b/a Envoy complies with the EU-U.S. Data Privacy Framework ("EU-U.S. DPF") and the UK Extension to the EU-U.S. DPF, as set forth by the U.S. Department of Commerce. Envoy has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. DPF Principles with regard to the processing of non-HR personal data received from the EEA in reliance on the EU-U.S. DPF and from the United Kingdom in reliance on the UK Extension to the EU-U.S. DPF. If there is any conflict between this Policy and the applicable DPF Principles, the DPF Principles govern.

To learn more about the DPF Program and view Envoy's certification, search for "Appropos, LLC" on the Data Privacy Framework List.

Lawful public-authority requests

Envoy may be required to disclose personal data in response to lawful requests by public authorities, including requests made to meet national security or law-enforcement requirements.

Accountability for onward transfers

When Envoy transfers personal data covered by the DPF Principles to a third party acting as an agent, Envoy requires the agent to process the information only for limited and specified purposes and to provide at least the same level of protection required by the DPF Principles. Envoy takes reasonable and appropriate steps to ensure that agents process covered personal data consistently with Envoy's DPF obligations. If Envoy learns that an agent can no longer provide the required level of protection, Envoy will take reasonable and appropriate steps to stop and remediate unauthorized processing. Envoy remains responsible under the DPF Principles if an agent processes covered personal data inconsistently with the DPF Principles, unless Envoy proves that it is not responsible for the event giving rise to the damage.

DPF questions and complaints

Questions or complaints concerning Envoy's handling of personal data under the EU-U.S. DPF or its UK Extension may be submitted to privacy@envoyb2b.com. Envoy will investigate and attempt to resolve DPF-related complaints and will respond within 45 days of receipt.

If Envoy has not addressed a DPF-related complaint to your satisfaction, Envoy has committed to refer unresolved complaints to JAMS, an independent dispute-resolution provider based in the United States. JAMS services are provided to individuals at no cost. Information about submitting a complaint is available through the JAMS Data Privacy Framework Dispute Resolution service.

Under certain conditions described in Annex I of the DPF Principles, an individual may invoke binding arbitration after first giving Envoy an opportunity to resolve the complaint and using the available independent recourse mechanisms. Additional information is available in Annex I of the DPF Principles.

The Federal Trade Commission has jurisdiction over Envoy's compliance with the EU-U.S. DPF and its UK Extension.

11. Children

The Services are not directed to children under 18, and Envoy does not knowingly collect personal data directly from children under 18. If you believe a child has provided personal data to Envoy without appropriate authorization, contact privacy@envoyb2b.com so that we can review and, where appropriate, delete the information.

12. Third-Party Services and Public Areas

The Services may contain links, integrations, widgets, forums, blogs, or other areas operated by third parties or accessible to other users. Information you provide to a third party or make public is governed by the recipient's practices and may be visible or further disclosed by others. This Policy does not govern independent third-party services. Review their privacy notices before providing personal data.

13. Changes to This Policy

We may update this Policy to reflect changes in our Services, practices, or legal obligations. We will update the "Last Updated" date when we make changes. Where required by law, we will provide additional notice of material changes before they take effect, such as by email or through the Services.

14. Contact, Requests, and Complaints

To ask a privacy question, exercise a privacy right, or submit a data-protection complaint, contact:

UK data-protection complaints

Envoy provides the email address above as an electronic means to submit a data-protection complaint. For complaints governed by UK data-protection law, Envoy will acknowledge receipt within 30 days. Without undue delay, Envoy will take appropriate steps to investigate and respond, keep the complainant informed about material progress where appropriate, and communicate the outcome. Individuals may also contact the UK Information Commissioner's Office or another competent data protection authority at any time.

DPF escalation

If Envoy has not satisfactorily resolved a complaint concerning personal data covered by the EU-U.S. DPF or its UK Extension, you may contact JAMS, Envoy's independent dispute-resolution provider, at no cost to you.

15. English Version Controls

Any non-English translation of this Policy is provided for convenience. If a translated version conflicts with the English version, the English version controls to the extent permitted by applicable law.