Where you speak with a Graifox voice assistant, you are speaking with an automated AI system; it tells you so in its first sentence, and it confirms this if you ask. What: the assistant calls you only after you have expressly agreed to be called, on the number and at the moment you gave, or you call the assistant yourself. The conversation is recorded and transcribed. Why: to qualify your interest and to prepare the meeting you may book, in the name of the business on whose behalf we call, or in our own name for our own acquisition. The assistant makes no offers and no commitments; a booking is an invitation to a conversation. Legal basis: your consent to be called; for a conversation you initiated, our or our client's legitimate interest in following it up. How long: the recording and the transcript are held at our speech provider for no longer than ninety (90) days after the conversation; the outcome of the qualification, the briefing and the record of your consent are kept for the term of our agreement with the business concerned, as set out in section 7. Who: our speech AI provider ElevenLabs (United States) and our telephony provider Twilio (United States), both under the EU-US Data Privacy Framework or Standard Contractual Clauses. Your rights: you can end the conversation at any time, ask not to be called again (this takes effect immediately and permanently for your number), withdraw your consent, and exercise the rights in section 8, including erasure of the recording. Where we call on behalf of a client, that client is the controller: we forward your request to the client and carry it out on the client's instruction, including at our providers. You can always write to [email protected].

Data: technical data such as IP address, browser type and pages visited, for the security and functioning of the website. Legal basis: legitimate interest. The website uses functional cookies only.

Directly from you, from your organisation, from public professional sources (such as company websites and professional network profiles) and from business data providers.

Service providers that support our business: hosting, e-mail and productivity tools, payment processing, scheduling, outreach infrastructure and AI providers, each bound by a data processing agreement. For voice conversations: the speech AI provider ElevenLabs (United States) and the telephony provider Twilio (United States). Providers outside the EEA are engaged under an adequacy decision (including the EU-US Data Privacy Framework) or Standard Contractual Clauses. We do not sell personal data. Data may be disclosed where the law requires it.

No longer than necessary for the purposes above. Indicative periods: client contract and billing records seven years (statutory); acquisition correspondence and prospect data up to eighteen months after the last meaningful contact; the suppression register for as long as needed to honour the opt-out; voice recordings and transcripts at our speech provider no longer than ninety (90) days after the conversation; website logs up to twelve months.

Access, rectification, erasure, restriction, objection (at any time against direct marketing) and data portability where applicable. Send your request to [email protected]; we respond within the statutory period of one month, which may be extended where the law allows. We may ask you to identify yourself. You may lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

We use AI tools to draft and handle correspondence, and an AI voice assistant to conduct qualification conversations, under human-defined rules. We do not take decisions based solely on automated processing that produce legal effects or similarly significantly affect you; whether a meeting is booked follows from what you say in the conversation and can always be changed by you.

We protect personal data with technical and organisational measures appropriate to the risk, including encrypted connections, access control and monitoring.

We may update this statement. The current version is on our website and in the client portal.

Privacy Statement, version 2.1, 5 September 2026. T. van der Hoeven Holding B.V., trading as Graifox, Amsterdam, Chamber of Commerce 83214003.