Privacy Policy

This Privacy Policy explains how KeyFiles Limited (KeyFiles, we, us) collects, uses, shares, stores and protects personal information when you use the KeyFiles website at keyfiles.co.nz and related services (the Platform). It forms part of our Terms of Use, and words defined there (such as Buyer, Agent, Lawyer and Report) have the same meaning here.

We are bound by the Privacy Act 2020 (the Act) and its Information Privacy Principles.

This policy also covers people who don't use the Platform but whose information may appear on it — for example, property owners named on a Record of Title, or a lawyer whose email address a Buyer gives us.

KeyFiles Limited, NZBN 9429053765239, 99B Rocking Horse Road, Southshore, Christchurch 8062.

Our Privacy Officer can be contacted at admin@keyfiles.co.nz or 99B Rocking Horse Road, Southshore, Christchurch 8062.

Information you give us

• •Account details: your name, email address, phone number, password (stored only in hashed form by our authentication provider) and the role you register as (Buyer, Agent or Lawyer).
• •Agent details: your agency, and the names, email addresses and phone numbers of any secondary agent you invite to a listing.
• •Lawyer details provided by a Buyer: when a Buyer invites a Lawyer, the Lawyer's name and email address.
• •Listing content and documents: property details, photos and documents uploaded by Agents or sent to us by Report Providers. These may contain personal information about vendors, owners, occupiers or others (for example, owner names on a Record of Title, or comments in a building report).
• •Messages and feedback: support requests, fault reports, feature suggestions and any messages you send us.

Information we collect when you use the Platform

• •Activity on listings: when you view a listing, download a document, buy a Report, add a property to your watchlist, or click to call or email an Agent, we record what you did, which property it related to, and when.
• •Purchase records: what you bought, the amount paid, and any refunds made (including cost-sharing refunds). We do not receive or store your full card number — card details are handled by Stripe.
• •Technical information: your IP address, browser and device type, and similar data, which our hosting, security and email providers process to deliver and protect the Platform (for example, to block malicious traffic). We do not use advertising or third-party analytics cookies.

Information from other people

• •From Agents (listing content and documents, and the details of secondary agents they invite);
• •From Buyers (the details of Lawyers they invite);
• •From Report Providers such as LINZ, councils and building inspectors (the Reports themselves);
• •From Stripe (confirmation of payments and refunds); and
• •From public sources such as LINZ address and parcel data.

Do you have to give us your information? You don't have to, but if you don't give us the information needed to create an account or make a purchase, we won't be able to provide those services to you.

We use personal information to:

• (a)create and manage your account and verify who you are;
• (b)provide the Platform — hosting listings, requesting Reports from Report Providers, delivering documents, and giving Lawyers access when a Buyer asks us to;
• (c)process payments and calculate and pay cost-sharing refunds;
• (d)show Agents who has engaged with their listings (see clause 5.2), so they can follow up with interested Buyers;
• (e)send you service emails — for example, purchase confirmations, access links, report-ready notices, and notices about changes to our terms;
• (f)respond to your questions, complaints and fault reports;
• (g)keep the Platform secure, including detecting fraud, malicious files and misuse, and keeping a tamper-evident record of document access;
• (h)improve the Platform, including using aggregated or de-identified information to understand how it is used;
• (i)send you marketing about KeyFiles, where you have agreed to receive it — you can unsubscribe at any time; and
• (j)comply with our legal obligations and enforce our Terms.

We don't sell your personal information.

Agents. When a Buyer views a listing, downloads a document, buys a Report or clicks to contact an Agent, the Agent(s) responsible for that listing can see that activity together with the Buyer's name, email address and phone number. Agents must use this information only as allowed by our Terms of Use and the law.

Lawyers. When a Buyer invites a Lawyer, we share the Buyer's name and contact details, the property details and the Reports the Buyer has made available.

Report Providers. When a Report is requested, we send the Report Provider the property details and the details needed to fulfil the request (which may include the requesting Agent's name and contact details).

Other users of a listing. Agent names and contact details are shown on listings to Buyers and Lawyers. Documents on a listing (which may contain personal information about vendors or owners) are available to the Agents on that listing and to Buyers and Lawyers who have access to them.

Our service providers. We use trusted providers to run the Platform. They process personal information on our behalf and under contract:

Others. We may also share personal information:

• •where required or allowed by law, including with the police, courts or regulators (such as the Real Estate Authority or the Privacy Commissioner);
• •with our professional advisers (lawyers, accountants, auditors); and
• •with a buyer or successor of our business, who would be bound by this policy.

Our database (including account details, activity records and purchase records) and our property document storage are located in Australia (Sydney). Some other information is processed in the United States and elsewhere by our email, payment and security providers, and our hosting provider's global delivery network (see clause 5.6). Where we disclose personal information to an overseas provider that is not simply storing or processing it on our behalf, we will do so only as allowed by Information Privacy Principle 12 — for example, where the recipient is subject to comparable privacy safeguards or has agreed by contract to protect the information in a way comparable to the Act.

We keep personal information only for as long as we need it for the purposes in section 4 and to meet our legal obligations.

Documents. To protect the integrity of property documents, files uploaded to the Platform are held in locked storage that cannot be altered or deleted for 10 years from upload. This means documents (and any personal information in them) will be retained for that period even if a listing is closed, a document is removed from view, or an account is closed. Access to those documents is restricted to the people entitled to see them.

Account and activity information is kept while your account is open and for 7 years after it is closed, so we can deal with disputes, refunds and legal claims. You can close your account by emailing admin@keyfiles.co.nz. If you do not sign in for 7 years, we will automatically close and delete your account.

Payment records are kept for at least seven years, as required by tax law.

When we no longer need information, we delete it or de-identify it.

We take reasonable steps to protect personal information from loss, unauthorised access, use, change or disclosure. These include encryption in transit and at rest, access controls so that documents are available only to people entitled to them, cryptographic signing of uploaded documents, logging of access, and screening uploaded files and incoming traffic for threats.

No system is completely secure. Please keep your login details and emailed access links private (see the Terms of Use).

If a privacy breach occurs that has caused, or is likely to cause, serious harm, we will notify the Privacy Commissioner and affected people as required by the Act.

We use cookies and browser storage that are necessary for the Platform to work — for example, to keep you signed in and to remember your preferences (such as saved properties).

We do not use advertising or third-party analytics cookies. If that changes, we will update this policy and, where appropriate, ask for your consent first.

You have the right to ask for access to the personal information we hold about you, and to ask us to correct it. Contact our Privacy Officer (clause 2.2). We may need to verify your identity first.

We will respond as soon as reasonably practicable and no later than 20 working days after receiving your request. We won't charge you for making a request.

If we don't agree that information should be corrected — or if it is held in locked document storage and can't be changed (clause 7.2) — you can ask us to attach a statement of the correction you sought, so that it is read with the information.

Information in a Report (for example, a Record of Title or LIM) comes from its Report Provider. If you think it is wrong, you may also need to ask that provider to correct it at the source.

You can unsubscribe from any marketing emails at any time. We will still send you service emails needed to run your account.

If you have a concern about how we have handled your personal information, please contact our Privacy Officer first so we can try to resolve it.

If you are not satisfied with our response, you can complain to the Office of the Privacy Commissioner at privacy.org.nz or 0800 803 909.

We may update this policy from time to time. We will post the updated policy on the Platform with a new “last updated” date and, for material changes, notify registered users by email or on the Platform before the changes take effect.