Privacy Policy

Last updated: September 2026

Welcome to KeyForm, a software-as-a-service platform owned and operated by Keywork Enterprises Limited, New Zealand ("Keywork", "we", "our", or "us"). This Privacy Policy explains how personal information is collected, used, stored, protected, and disclosed when organisations, staff users, and individuals use KeyForm.

KeyForm may hold information relating both to organisations using the platform and to individuals who submit information through forms provided by those organisations.

Information We Collect

  • Account and staff information: Names, email addresses, and information associated with authorised user accounts.
  • Information submitted through KeyForm forms: Personal details, contact information, documents, files, payment-card information, and other information requested by the organisation sending the form.
  • Organisation configuration information: Form templates, staff roles and permissions, secure-link settings, and other platform configuration.
  • Technical and security information: IP addresses, browser and device information, login activity, audit logs, and other security or usage information.

KeyForm does not itself process payments, initiate transactions, or charge payment cards.

How We Use Information

  • To provide, operate, maintain, and support the KeyForm service.
  • To make submissions available to the organisation that requested the information.
  • To manage accounts, authentication, permissions, and security.
  • To send service, submission, security, and support notifications.
  • To maintain audit and security records and investigate suspected misuse or security incidents.
  • To maintain and improve KeyForm.
  • To comply with applicable legal requirements.

Information Collected Through Organisation Forms

Organisations using KeyForm decide what information they request from their clients and the purpose for which that information is collected. When an individual receives a KeyForm secure link, the requesting organisation is responsible for ensuring that it has an appropriate purpose and authority for requesting the information.

Keywork provides the KeyForm platform used to collect that information and make it available to the requesting organisation.

Data Access and Control

Authorised staff of an organisation may access submitted information according to the roles and permissions configured within that organisation's KeyForm account. Authorised users may delete submitted information through KeyForm when it is no longer required. Organisations are responsible for managing their staff access and permissions.

Data Storage and Retention

Submitted information remains available to the organisation that requested it until it is deleted by an authorised user, the organisation's account is closed, or another applicable retention process requires its removal.

Organisations using KeyForm are responsible for determining how long submitted information is required for their business and legal purposes and for deleting information when it is no longer required.

Where information is deleted from the live KeyForm platform, limited technical copies may remain temporarily within backups or security logs in accordance with our technical retention processes.

Data Sharing and Service Providers

Keywork Enterprises Limited does not sell personal information.

We may provide personal information to trusted service providers where reasonably necessary to operate, secure, and support KeyForm, including cloud infrastructure, email-delivery, monitoring, and support providers. These providers may process information only where necessary to provide their services to us and are subject to appropriate security and confidentiality requirements.

We may also disclose information where required or permitted by law.

Security Measures

KeyForm uses technical and organisational safeguards designed to protect information held within the platform, including:

  • Encryption: Data is encrypted in transit and at rest.
  • Access controls: Role-based staff access and permissions are available to organisations.
  • Multi-Factor Authentication (MFA): MFA is available for staff accounts and may be enabled by the organisation.
  • Secure client links: Links can have configurable expiry and become inactive after a form is submitted.
  • Audit logging: KeyForm records relevant account and platform activity for security and accountability purposes.
  • Controlled deletion: Authorised users can delete submitted information when it is no longer required.

No online service can guarantee absolute security, but we take reasonable safeguards appropriate to the nature of the information handled by KeyForm.

Hosting and Overseas Service Providers

KeyForm uses AWS cloud infrastructure and other service providers that may store or process information outside New Zealand, including infrastructure located in Australia. We take reasonable steps to ensure that service providers used by KeyForm maintain appropriate privacy, confidentiality, and security protections.

Access and Correction

Individuals may request access to personal information that Keywork Enterprises Limited holds about them and may request correction of information they believe is inaccurate. Where personal information has been collected through KeyForm on behalf of one of our customer organisations, we may refer the individual to that organisation where appropriate.

Requests can be made using the contact details below.

Privacy Breaches

If Keywork Enterprises Limited becomes aware of a privacy breach affecting KeyForm, we will investigate the incident and take appropriate steps in accordance with the Privacy Act 2020. Where required, this may include notifying affected organisations, affected individuals, and the Office of the Privacy Commissioner.

Legal Compliance

We handle personal information in accordance with New Zealand's Privacy Act 2020 and other applicable privacy obligations. Information may be disclosed where required or permitted by law.

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes to KeyForm, our business practices, or applicable privacy requirements. The current version will be published on the KeyForm website with an updated effective date. Where a change materially affects how personal information is handled, we will take reasonable steps to notify affected users or organisations.

Privacy Officer and Contact Information

For privacy requests or questions about this Privacy Policy, please contact: