Privacy Policy

CamKey Systems Pty Ltd
ABN 65 664 529 819 | ACN 664 529 819
102/276 Pitt St, Sydney NSW 2000, Australia

Effective date: 14 October 2026

1. About this policy

CamKey Systems Pty Ltd (CamKey, we, us, our) makes a QR smart lock for hotels, serviced apartments and short-stay rentals. Guests receive a QR code by email, SMS or WhatsApp and use it to unlock their door, with no app needed.

This Privacy Policy explains how we handle personal information. It covers:

• visitors to our website at https://camkey.org (the Website);
• people who contact us, including through our enquiry form, “Talk to Sales” and “Investor Enquiry” options;
• our business customers and their staff, suppliers, investors and other business contacts; and
• in section 12, how we handle guest and lock data on behalf of the hotels and accommodation providers who use our products.

We handle personal information in line with the Australian Privacy Principles (APPs) in the Privacy Act 1988 (Cth) (Privacy Act).

“Personal information” means information or an opinion about an identified individual, or an individual who is reasonably identifiable.

2. What personal information we collect

The information we collect depends on how you deal with us.

Enquiries and contact. When you complete our enquiry form, choose “Talk to Sales” or “Investor Enquiry”, or email or call us, we collect:

• your name;
• your email address;
• your phone number;
• your message and anything else you choose to tell us (for example, your organisation, your role, the property or properties you manage, or your investment interest); and
• records of our communications with you.

Website use. When you visit the Website, some information is collected automatically by our website host and service providers. This may include your IP address, browser and device type, the pages you view, the date and time of your visit, and the referring website. We use Google Analytics, which also collects information about how you use the Website (see section 4 and our Cookie Policy).

Business customers and partners. If you or your organisation buy from us, supply to us or work with us, we may collect your name, job title, business contact details, and information needed to manage the relationship, such as billing and contract details.

Investors. If you make an investor enquiry, we may collect information about you and your investment interest. If you go on to invest, we may collect other information required by law, such as identity details.

Job applicants. If you apply to work with us, we collect the information in your application, such as your CV and referee details.

Sensitive information. We do not intend to collect sensitive information (such as health information or information about racial or ethnic origin) through the Website. Please do not include sensitive information in messages to us. If we need sensitive information for a particular purpose, we will only collect it with your consent or where the law allows.

3. How we collect personal information

We collect personal information:

• directly from you, for example when you fill in our enquiry form, email or call us, meet us at an event, or deal with us as a customer, supplier or investor;
• automatically, through our Website host, cookies and similar technologies, when you use the Website; and
• from third parties, such as your employer or colleagues (if they refer you to us), our hotel and accommodation clients (see section 12), our service providers, and publicly available sources such as business websites and professional networking sites.

If we receive personal information that we did not ask for, we will check whether we could have collected it lawfully. If we could not, we will destroy or de-identify it where it is lawful and reasonable to do so.

4. Cookies and analytics

The Website uses cookies and similar technologies. Some are needed for the Website to work. Others, set by Google Analytics, help us understand how visitors use the Website so we can improve it. We do not currently use advertising or marketing cookies.

For details, including how to manage cookies, see our Cookie Policy at https://camkey.org/cookie-policy.

5. Why we collect, use and hold personal information

We collect, use and hold personal information to:

• respond to your enquiries and requests, including sales and investor enquiries;
• provide product information, quotes, demonstrations and proposals;
• supply, install, support and improve our products and services;
• manage our relationships with customers, suppliers, partners and investors;
• run, secure and improve the Website;
• send you marketing communications, where permitted (see section 8);
• assess job applications;
• manage our business, including accounting, record keeping, audit and insurance;
• protect our rights and the security of our systems; and
• comply with our legal obligations and assist law enforcement and regulators where required.

We may also use your information for other purposes that you would reasonably expect, or that are permitted or required by law.

If you do not give us information. You do not have to give us your personal information. If you do not, we may not be able to respond to your enquiry or deal with you. Where it is lawful and practicable, you may deal with us anonymously or using a pseudonym, for example when asking a general question.

6. Who we disclose personal information to

We may disclose personal information to:

• service providers who help us run our business, such as our website host (Webflow), font provider (Google Fonts), analytics provider (Google Analytics), email and productivity providers, IT and cloud hosting providers, messaging providers that deliver QR codes by email, SMS or WhatsApp, and professional advisers such as lawyers and accountants;
• our hotel and accommodation clients, where relevant to the services we provide to them;
• installers, contractors and partners who help us deliver our products;
• potential investors, purchasers or financiers, in connection with a proposed investment in, sale of, or financing of our business (subject to confidentiality obligations); and
• government agencies, regulators, courts and law enforcement, where required or authorised by law.

We do not sell personal information.

We require our service providers to handle personal information only for the purpose of providing their services to us and to protect it appropriately.

7. Overseas disclosure

Some of our service providers store or process information outside Australia.

In particular, our Website is hosted by Webflow, Inc., which is based in the United States. Information submitted through our enquiry form, and information collected automatically when you visit the Website, is stored by Webflow and its sub-processors, which may be located in the United States and other countries. When the Website loads fonts from Google Fonts, your browser connects to Google’s servers, which may be located outside Australia, and your IP address is disclosed to Google for that purpose. Google Analytics information is also processed by Google, including in the United States.

Other service providers may be located in the United States and other countries where our service providers operate.

Before we disclose personal information overseas, we take reasonable steps to ensure the recipient handles it consistently with the APPs, for example through contractual terms or by relying on the recipient’s own privacy commitments, unless an exception under the Privacy Act applies.

8. Marketing and how to opt out

We may use your contact details to send you information about our products, services, news and events, where you have agreed to this or where the law otherwise allows. We comply with the Spam Act 2003 (Cth) when we send commercial electronic messages.

You can opt out of marketing at any time by:

• using the “unsubscribe” link in our emails;
• replying “STOP” to our SMS messages, where this option is offered; or
• emailing us at privacy@camkey.org.

We will process your request as soon as practicable. Even if you opt out of marketing, we may still send you messages about an existing enquiry, contract or relationship.

9. How we hold and protect personal information

We hold personal information in electronic form using our own systems and those of our service providers, and in some cases in paper form.

We take reasonable steps to protect personal information from misuse, interference and loss, and from unauthorised access, change or disclosure. We use reasonable technical and organisational measures to do this, such as access controls and encrypted connections (HTTPS).

No method of transmission over the internet or of electronic storage is completely secure, so we cannot guarantee the security of information.

We keep personal information only for as long as we need it for the purposes described in this policy, or as required by law. When we no longer need it, we take reasonable steps to destroy or de-identify it.

Data breaches. If we become aware of a data breach that is likely to result in serious harm to you, we will assess it and, where required, notify you and the Office of the Australian Information Commissioner (OAIC) under the Notifiable Data Breaches scheme.

10. Accessing and correcting your personal information

You can ask to access the personal information we hold about you, or ask us to correct it if you think it is inaccurate, out of date, incomplete, irrelevant or misleading.

To make a request, contact our Privacy Officer (see section 13). We may need to confirm your identity before we act on your request.

We will respond within a reasonable period, usually within 30 days. We do not charge for making a request or for correcting information. We may charge a reasonable fee to cover the cost of providing access, and we will tell you about any fee in advance.

If we refuse your request, we will tell you why in writing (unless it would be unreasonable to do so) and how you can complain. If we refuse to correct information, you can ask us to attach a statement to it noting that you believe it is inaccurate, out of date, incomplete, irrelevant or misleading.

11. Complaints

If you have a concern or complaint about how we have handled your personal information, please contact our Privacy Officer (see section 13) and give us details of your concern.

We will acknowledge your complaint, investigate it, and respond to you in writing within a reasonable time, usually within 30 days.

If you are not satisfied with our response, you can complain to the OAIC:

• Website: https://www.oaic.gov.au
• Phone: 1300 363 992
• Post: GPO Box 5288, Sydney NSW 2001

12. Guest and lock data we handle for our hotel and accommodation clients

Our hotel, serviced apartment and short-stay rental clients (Operators) use our products to issue QR codes that let their guests unlock doors.

To deliver this service, we may handle personal information about guests and Operator staff on behalf of the Operator. Depending on how the Operator sets up the service, this may include:

• guest name and contact details (such as email address and mobile number) used to send the QR code by email, SMS or WhatsApp;
• booking details, such as the property, room or unit, and check-in and check-out dates and times;
• the QR code and the access permissions linked to it; and
• lock event records, such as when a code was issued, used or rejected, and which lock was used.

Data stored in the lock. Each CamKey lock stores the following guest details locally in the lock itself: guest name, booking number, preferred language and check-in date. These details are kept in the lock for 6 months and then deleted. A copy of guest data is also kept in the CamKey data centre for 6 months and then deleted.

When we handle this information:

• we act as a service provider to the Operator. The Operator decides what guest information is collected and how it is used, and is responsible to its guests for how their personal information is handled, including giving guests any required privacy notice;
• we use the information only to provide, support, secure and improve the service for the Operator, in accordance with our agreement with the Operator, or as required by law;
• we do not use guest information to market our own products to guests; and
• we use the messaging providers needed to deliver QR codes, including email and SMS delivery providers and WhatsApp (operated by Meta Platforms). These providers may process information outside Australia.

If you are a guest, please read the privacy policy of the hotel or accommodation provider you are staying with. If you want to access or correct your information, or make a complaint, please contact that provider first. If you contact us, we will refer your request to the relevant Operator and help them respond where appropriate.

13. Contact us

For privacy questions, requests or complaints, please contact:

Privacy Officer: Wayne Kevill
CamKey Systems Pty Ltd
Email: privacy@camkey.org
Phone: 0423 713 442 (+61 423 713 442)
Post: 102/276 Pitt St, Sydney NSW 2000, Australia

14. Changes to this policy

We may update this Privacy Policy from time to time. The updated version will be published on the Website with a new effective date. Please check this page regularly.

This policy was last updated on 14 October 2026.