Privacy Policy

We collect personal information in the following ways:

Information you provide directly:

• Name, email address, and phone number when you book a discovery call via our scheduling tool
• Business name, size, and operational details you share during discovery calls or consultations
• Any information you provide in emails or other correspondence with us

Information collected automatically:

• Website usage data (pages visited, time on site, referral source) via Google Analytics
• Technical data such as IP address, browser type, and device type — collected anonymously
• Cookies set by Google Analytics and Cal.com for session tracking and scheduling functionality

We do not collect sensitive information (as defined by the Privacy Act 2020) unless it is directly relevant to a specific engagement and you have consented to its collection.

We use personal information only for the purposes for which it was collected or a directly related purpose:

• To schedule and manage discovery calls and client meetings
• To deliver consulting services and communicate project progress
• To send relevant follow-up information after enquiries
• To understand how our website is used and improve it
• To comply with our legal and regulatory obligations in New Zealand

We do not use your personal information for unsolicited marketing. If you receive communications from us, it is because you initiated contact or opted in to updates.

We use the following third-party services that may process your personal information. Each operates under their own privacy policy:

• Cal.com — our booking and scheduling tool. When you book a call, your name, email, and any notes you provide are stored by Cal.com. See cal.com/privacy.
• Google Analytics — website analytics. We use Google Analytics with IP anonymisation enabled. See Google’s Privacy Policy.
• Vercel — our website is hosted on Vercel. Server logs may include IP addresses and request metadata. See Vercel’s Privacy Policy.
• AI and automation platforms — Where we deliver AI or automation services to clients, work may involve data being processed through commercial APIs including Anthropic (Claude) and OpenAI. Under their commercial API agreements, client data is not used to train AI models. Data is processed on their secure infrastructure and is subject to their respective privacy policies: see Anthropic’s Privacy Policy and OpenAI’s Privacy Policy.

We do not sell, rent, or share your personal information with any other third parties for their own marketing purposes.

Our website uses cookies — small text files stored on your device — to support analytics and scheduling functionality. Cookies we use include:

• Google Analytics cookies — track website usage anonymously (e.g. _ga, _gid)
• Cal.com cookies — support booking widget functionality

You can disable cookies in your browser settings. Disabling analytics cookies will not affect your ability to use the website. Disabling Cal.com cookies may prevent the booking widget from functioning correctly.

Personal information we hold is stored securely. We take reasonable steps to protect information from loss, misuse, unauthorised access, disclosure, alteration, or destruction. These steps include:

• Using reputable, security-certified third-party platforms (Vercel, Cal.com)
• Limiting access to personal information to personnel who need it to do their job
• Using encrypted communications (HTTPS) for all website traffic

No data transmission over the internet is completely secure. While we take all reasonable steps, we cannot guarantee the absolute security of information transmitted to us.

We retain personal information only for as long as it is needed for the purpose it was collected, or as required by law. Client engagement records are typically retained for seven years in accordance with NZ business record-keeping requirements. Website analytics data is retained in accordance with Google Analytics’ default retention periods. Booking records are retained in accordance with Cal.com’s data policies.

Under the New Zealand Privacy Act 2020, you have the right to:

• Access personal information we hold about you
• Correct personal information we hold about you if it is inaccurate
• Request deletion of personal information where we have no lawful reason to retain it
• Complain to the Office of the Privacy Commissioner if you believe we have not handled your information appropriately

To exercise any of these rights, contact us at info@keystonesystems.co.nz. We will respond within 20 working days as required by the Privacy Act 2020.

If you are not satisfied with our response, you can contact the Office of the Privacy Commissioner at privacy.org.nz.

We may update this Privacy Policy from time to time. When we do, we will update the effective date at the top of this page. If changes are material, we will take reasonable steps to notify affected individuals. Continued use of our website or services after changes are posted constitutes acceptance of the updated policy.