Privacy Policy

KeyPath Systems Limited is an AI automation agency based in Auckland, New Zealand. We design and run automation systems for residential real estate agencies, including lead capture and qualification, database reactivation, open-home automation, and AI-assisted conversation and nurture. Contact: [email protected].

We handle personal information in two situations, and our role differs in each:

• Our clients and website visitors. When you deal with us as a client, prospective client or website visitor, we collect and use your information for our own purposes, and we are the agency responsible for it. This policy covers that information.
• Contacts of our client agencies (leads and past clients). When we run automated campaigns for a real estate agency, we handle that agency's contacts' information on the agency's behalf and on its instructions. The agency is responsible for that information and for telling those contacts how it is used. If you are a contact of an agency, please contact that agency about your information.

We take reasonable steps to make sure the personal information we handle is:

• collected only for a genuine and lawful business purpose;
• collected fairly and without being unreasonably intrusive;
• used and shared only for the purpose we collected it for, or as the law otherwise allows;
• kept accurate, up to date and secure;
• kept only for as long as we reasonably need it; and
• available to you for access and correction under the Privacy Act 2020.

When you give us personal information, please:

• only give us someone else's information if you are authorised to do so. This matters especially when an agency gives us its contact database;
• give us only the information that is reasonably needed;
• make sure what you give us is accurate, current and complete;
• tell us promptly if your details change or something you gave us is wrong; and
• contact us promptly if you want to raise a privacy concern, ask for a correction, or think information has been lost, accessed or disclosed by mistake.

From clients and prospective clients

• name, business name and contact details;
• billing and payment information (processed through secure third-party payment providers);
• business information relevant to scoping and delivering our services; and
• communications you send us by email, phone or website live chat.

From contacts of our client agencies

• name, phone number and email address captured through automated interactions;
• property enquiry, timeline and contact preferences;
• conversation content from AI-assisted SMS, email, live chat, social media and phone interactions; and
• open-home registration details and follow-up responses.

Collected automatically from our website

• website usage data (IP address, browser type, pages visited) through cookies and analytics; and
• device and session information used to improve the service.

We collect personal information in everyday business situations, including when:

• you enquire about our services or we prepare a proposal for you;
• we set up your account and onboard you as a client, including receiving your contact database;
• we build, run and monitor automated campaigns for a client agency;
• attendees sign in at an open home through Smart Open Home;
• people reply to or interact with the automated SMS, email, chat, social media or phone systems we run;
• you use our website, forms or live chat;
• we process payments and administer accounts; and
• we handle an enquiry, complaint or legal matter.

Directly from you

Where we can, we collect personal information directly from the person concerned, through enquiries, onboarding, forms, meetings, emails, calls and our website. When we collect your information directly for our own purposes, we take reasonable steps to tell you what the Privacy Act 2020 requires: that we are collecting it, why, who we may share it with, who we are and how to contact us, whether you have to provide it and what happens if you do not, and your rights to access and correct it. This policy is the main way we do that.

Indirectly from others

We also collect personal information indirectly, including:

• from client agencies, when they give us their contact databases and lead lists;
• through the automated systems we run on an agency's behalf, such as open-home sign-ins and AI-assisted conversations; and
• from third-party platform integrations, such as our CRM.

Where we collect personal information about you indirectly for our own purposes, we take reasonable steps to make sure you have been told about the collection, as Information Privacy Principle 3A requires, unless an exception applies. Where we handle information on a client agency's behalf, the agency is responsible for telling its contacts how their information is collected and used, including that their details are used in automated communications run through KeyPath.

We use personal information to:

• deliver, manage and improve the services we provide to our clients;
• communicate with clients about their accounts, services and performance;
• process payments and manage billing;
• run automated communication systems on behalf of our clients;
• send service communications and, where you have opted in, marketing updates; and
• meet our legal obligations.

If you choose not to give us information we reasonably need, we may not be able to respond to your enquiry, provide our services, or set up and run your system effectively.

We run automated communication systems by SMS, email, live chat, social media and phone on behalf of real estate agencies. All automated messages include a way to opt out and identify the sender, as the Unsolicited Electronic Messages Act 2007 requires. The client agency is responsible for ensuring its contacts have agreed to receive these communications or reasonably expect them. Interaction data is stored securely and used only to deliver and improve the service for that agency.

We do not sell personal information. We may share it with:

• the client agency whose contacts' information we handle;
• our service providers (including our CRM, SMS providers, payment processors and hosting providers) who help us deliver the service;
• our professional advisers, including lawyers, accountants and insurers;
• a purchaser or successor in connection with a sale or restructure of our business; and
• legal authorities, where required by law or to protect our rights.

Some of our service providers, including our CRM, AI and hosting providers, store or process information outside New Zealand, including in Australia, the United States and Europe. Where information is sent overseas, we take reasonable steps to ensure it is protected by safeguards comparable to those in the Privacy Act 2020, as Information Privacy Principle 12 requires.

We store personal information securely, using industry-standard encryption and access controls, and take reasonable steps to protect it from misuse, loss, and unauthorised access, change or disclosure.

We keep personal information only as long as we need it to deliver our services and meet our legal obligations. For example, we keep financial records for seven years. We keep automated conversation data for the term of the service agreement plus up to 12 months, unless a client asks us to delete it earlier or the law requires us to keep it longer.

Under the Privacy Act 2020, you can:

• ask for access to the personal information we hold about you; and
• ask us to correct it if it is wrong, incomplete or out of date.

We may ask you to confirm your identity before we respond, and we will answer your request within the timeframes in the Act. You can also opt out of marketing at any time, and make a complaint (see clause 17). To exercise your rights, contact us at [email protected]. Where we handle information on behalf of a client agency, we will direct your request to that agency.

Our website uses cookies and similar technologies to understand how visitors use the site and to improve your experience. You can control cookies through your browser. We may use analytics tools that collect anonymised usage data that does not identify you.

If you believe we have breached your privacy, contact us at [email protected]. Please include your name and contact details, what happened, any relevant dates or messages, and the outcome you are seeking. We will investigate and respond within 20 working days. If you are not satisfied with our response, you can complain to the Office of the Privacy Commissioner at privacy.org.nz or 0800 803 909.

Our website and services are for business clients and are not directed at anyone under 18. We do not knowingly collect personal information from minors, and will delete it promptly if we find we have.

We may update this policy from time to time. The current version is always on our website at keypathsystems.co.nz. We will tell our clients about material changes, in particular any change to overseas processing, how long we keep information, or how we handle their contacts' information.