Policy
Privacy Policy
Last updated: October 11, 2026
This policy explains how WorkGuard handles personal information on workguard.co.nz and in our application at app.workguard.co.nz, including trials and paid company workspaces.
Who handles your information
WorkGuard is operated by WORKGUARD LIMITED, a New Zealand limited company (company number 9459752; NZBN 9429053974402). For privacy questions or requests, contact .
Your employer or organisation manages its company workspace and decides what workplace information to record, who can access it, and which notification recipients to configure. WorkGuard hosts and processes workspace information to provide the service, and handles account administration, support, security, and billing information for its own operations.
Information we collect and where it comes from
- Accounts and invitations: names, email addresses, company details, user roles, account status, time zone preferences, and authentication information. Passwords are stored as salted hashes. Administrators may provide your details when inviting you.
- Workplace records: incident titles and descriptions, dates, locations, reporter and injured-person details, severity, custom form responses, corrective actions, assignments, due dates, uploaded files, and activity history. These records may contain injury or other sensitive personal information entered by you or another person in your organisation.
- Billing: plan, trial and access dates, payment amounts and dates, invoice references, and billing notes. Payments are arranged manually; the application does not collect payment-card details or automatically charge cards.
- Enquiries and support: contact details, company and team-size information, messages, and information you choose to provide when contacting us.
- Technical and delivery records: information processed by our hosting and monitoring services, such as IP addresses, request times, browser information, errors, and email delivery logs. Email logs may include recipient addresses and subject lines.
Providing information directly to WorkGuard is voluntary. Without required account, contact, or record fields, we may be unable to create your account, respond to an enquiry, or save the requested record. Your organisation may have separate workplace reporting requirements.
When recording information about someone else, include only what is necessary for the workplace purpose. Organisations should explain the collection to affected people, including when details are supplied by coworkers, and meet applicable notification obligations. This policy does not replace an organisation's own privacy notices.
How information is used
- To provide company workspaces, authenticate users, and apply access permissions.
- To record incidents, manage actions and evidence, and maintain activity history.
- To send invitations, password resets, incident notifications, action reminders, and billing communications.
- To respond to enquiries, provide support, administer subscriptions, troubleshoot problems, and protect the service.
Who can receive information
Workspace records are available to authorised users according to their roles and the application's access rules. Platform administrators may access records for administration and support. Organisation-configured incident recipients and notification CC recipients may receive record details by email, including an incident title, reporter, location, and date. Action notifications may include the action and incident titles. Recipients' email services process those messages outside the application's access controls.
We use service providers to deliver the service: Microsoft Azure for the application, database, attachment storage, and operational monitoring; Vercel for the public website; and Google/Gmail for email. Website enquiries submitted through our configured contact form are processed by Formspree; enquiries sent by email are processed by our email provider.
We do not sell personal information. Information may also be disclosed where required or permitted by law. Contact us if you need information about a particular disclosure.
Storage, overseas processing, and security
The production database and attachment storage are hosted in Microsoft Azure's Australia East region. Website delivery, email, monitoring, and other provider processing may take place in other countries. Information is therefore not stored exclusively in New Zealand.
The application uses HTTPS, account authentication, role-based access, password hashing, and private attachment storage. These measures reduce risk but cannot guarantee that every security incident will be prevented. Keep your login details private and review your organisation's user access and notification recipients regularly.
Browser storage
The application stores a login token and basic profile information in your browser's local storage to maintain your session. Signing out clears these items. Clearing browser storage may require you to sign in again. Hosting providers may also process technical information needed to deliver and secure the website.
Advertising measurement
Our public website uses the Google Ads tag to measure visits and successful demo or business enquiries associated with our advertising. Google may use cookies and process technical information such as device, browser, page URL, and ad-click identifiers for this measurement. We do not send the contact details or message entered in our enquiry form to Google through this conversion event.
Retention and deletion
Information is retained for the purposes described here, including workplace recordkeeping, account administration, security, and any applicable legal obligations. Trial expiry, subscription expiry, or deactivating a user does not automatically delete workspace records.
Contact your organisation or WorkGuard about deletion or workspace closure. Requests require review, including whether records involve other people or must be retained. Copies may remain in backups and provider systems for their applicable retention periods; deletion from all systems is not necessarily immediate.
Access, correction, and privacy concerns
You can request access to personal information held about you and ask for corrections. For workplace records, contact your organisation first, or contact WorkGuard and we will help identify who should handle the request. We may need to verify your identity before releasing or changing information.
If a requested correction is not made, you can ask for a statement of the correction sought to be attached to the information. You may also request deletion, subject to the recordkeeping and legal considerations above.
Send requests and privacy concerns to . If your concern is not resolved, you can contact the New Zealand Office of the Privacy Commissioner.
Changes to this policy
Updates will be posted on this page with a revised date. Please check it when you need information about our current handling of personal information.