Envoy

What Is Envoy and How Does It Work

Envoy is a US-based workplace experience platform specialising in visitor management, desk booking and room booking. Its visitor management product replaces paper sign-in books with iPad kiosks or browser-based sign-in flows. When a visitor arrives at a workplace, the Envoy kiosk collects their name, email address, phone number, employer, the name of their host employee, and optionally a photograph and a handwritten or digital signature for NDA acceptance. The system notifies the host, logs the visit and stores all captured data on Envoy''s US-based cloud infrastructure. The desk and room booking modules allow employees to reserve workspaces and meeting rooms, with the system processing employee identity and booking preference data.

Data Collected: Photographs, Signatures and Visitor Logs

Envoy''s data collection is unusually broad for a workplace system. Visitor photographs are facial images that, depending on deployment, may be linked to identity records and used for building access purposes, bringing them close to biometric data under Article 4(14) GDPR. Digital signatures are handwriting samples that can uniquely identify individuals. Visitor logs record who entered a building, when and with whom, creating a detailed record of physical presence. NDA acceptance records create a legally sensitive document trail. All of this data belongs to visitors who are not employees of the operator and who may have limited awareness of how their data will be processed or how long it will be retained. This combination of factors places Envoy in the high-risk category.

GDPR Implications and Legal Basis

The GDPR requires a specific legal basis for each category of data processed. For basic sign-in data (name, company, host, timestamp), the operator''s legal basis is typically legitimate interest in building security and visitor management (Article 6(1)(f)), supported by a Legitimate Interest Assessment documenting the proportionality of the processing. For visitor photographs, the legal basis is more contested. Where photos are used solely for a time-limited security badge and deleted on departure, legitimate interest may be defensible. Where photos are retained in a searchable database or used for identification beyond the visit, consent (Article 6(1)(a)) is the appropriate basis, and that consent must be freely given (photos cannot be made a condition of entry). NDA acceptance is covered by contract (Article 6(1)(b)) as between the visitor and the organisation. Employee desk and room booking data is typically processed under contract or legitimate interest.

Visitor data subjects have rights under Articles 15 to 22 GDPR including the right to access, rectification, erasure and restriction of processing. The Article 13 or Article 14 privacy notice obligation applies to visitor data collected at the kiosk. A concise, layered notice at the kiosk is essential. The notice must disclose the controller identity, the data collected, the legal basis, the retention period, the US transfer, and how to exercise rights.

Consent for Photographs and Signage Requirements

For visitor photograph capture, EU DPA guidance generally requires that the consent obtained is genuinely free: the visitor must be able to sign in and access the premises without providing a photo. Making the photo mandatory or presenting it as the only option violates the freely-given consent requirement. The Envoy kiosk should be configured to allow visitors to skip the photo step, and the privacy notice presented at the kiosk must clearly state that the photo is optional. Physical signage at the reception area, in addition to the on-screen notice, is required in most EU jurisdictions to satisfy the transparency obligations of Article 13 for data collected at the point of entry.

International Data Transfers and EU-US DPF

All data processed by Envoy is stored on US infrastructure. Envoy participates in the EU-US Data Privacy Framework (DPF), which provides a transfer mechanism for personal data from the EU to certified US organisations. Operators should verify Envoy''s current DPF certification at the US Department of Commerce DPF list and ensure that the Data Processing Agreement includes Standard Contractual Clauses as a fallback in the event the DPF is invalidated. Given that the DPF has faced legal challenges historically (Schrems I and Schrems II), maintaining SCCs in parallel is prudent. The visitor privacy notice must disclose the US transfer and the mechanism used.

Practical Compliance Steps for High-Risk Deployment

Conduct a DPIA before or at deployment covering the photograph capture, signature collection, visitor log retention and US transfer risks. Execute an Article 28 Data Processing Agreement with Envoy, including Standard Contractual Clauses for US transfers. Configure the kiosk to make photograph capture optional and present a clear Article 13 layered notice at sign-in. Display physical privacy signage at the reception area. Define and configure a data retention period in Envoy that matches your documented retention policy. Maintain a Record of Processing Activities (ROPA) entry for the visitor management processing activity. Implement a process for receiving and responding to visitor data subject access requests. Review Envoy''s DPF certification and SCC compliance annually. For employee desk booking, ensure employee notice satisfies Article 13 and document the retention and deletion policy for booking records.